Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
California's New Privacy Law Gives GDPR-Compliant Orgs Little to Fear
Newest First  |  Oldest First  |  Threaded View
ebyjeeby
100%
0%
ebyjeeby,
User Rank: Strategist
7/9/2018 | 2:55:19 PM
Re: The oligarchs
Why? In a few words, it costs money that they otherwise would not have to spend.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
7/6/2018 | 11:37:07 AM
Re: The oligarchs
@jenshadus:

> First, if a company doesn't want to be sued because their databases breached, why don't they use encryption.  Even if it slows things down, the data is secured.


While I tend to agree with you, I can point out that perhaps the most common counterargument lies precisely in the lack of business agility that you point out -- which can be particularly problematic when regulatory compliance dictates certain levels of accessibility (as in, for example, certain cases with HIPAA).

But, like I said, I tend to agree with you. It seems that the pendulum could stand to swing a bit more towards security when we are talking about this context of encryption.
jenshadus
50%
50%
jenshadus,
User Rank: Strategist
7/5/2018 | 9:15:46 AM
The oligarchs
There is a lot I do not understand about all this.  First, if a company doesn't want to be sued because their databases breached, why don't they use encryption.  Even if it slows things down, the data is secured.  Or...instead of keeping everything in one database, why not have the active database of a few days and push the older data into an encrypted database.  Second,  I those against this law, which for once I think CA has the right idea, the only ones upset by this are those who might be using the data illegally to start with...the FB, AWS, Google, Yahoo, and other social media.  Companies that collect data from consumers thought emarts provide two options: sign up and have the company keep personal data, or sign in a guest, and I hope they don't keep the data for long.  That would be a breach of trust.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22953
PUBLISHED: 2021-09-23
A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team"
CVE-2021-22016
PUBLISHED: 2021-09-23
The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this issue to execute malicious scripts by tricking a victim into clicking a malicious link.
CVE-2021-22017
PUBLISHED: 2021-09-23
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
CVE-2021-22018
PUBLISHED: 2021-09-23
The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with network access to port 9087 on vCenter Server may exploit this issue to delete non critical files.
CVE-2021-22019
PUBLISHED: 2021-09-23
The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition.