Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/16/2018
12:06 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Doh!!! The 10 Most Overlooked Security Tasks

Here's a list of gotchas that often slip past overburdened security pros.
Previous
1 of 11
Next

Image Source: Shutterstock via VGStockstudio

Image Source: Shutterstock via VGStockstudio

Security pros are under siege. Just in the last weeks we discovered major vulnerabilities in basic hardware chips, dubbed Meltdown and Spectre. Hacking from nation-states continues unabated, prompting fears that it will deter our ability to have safe elections later this year. And now, even the basics can go wrong as was displayed last week when the power went out at the 2018 Consumer Electronics Show in Las Vegas.

There’s big money on the line. Ponemon estimated the average cost of a breach in 2017 at $3.62 million, but the cost to a company can be much more than financial. Damage to the brand and public perception is often hard to judge.

And then there’s security holes you may not have thought about – or seem so obvious that you considered them handled years ago – like making sure the company has a back-up generator on hand for its data center.   

In interviews with three security experts, we developed a list of 10 gotchas that may not lock the organization down for good, but will go a long way to making sure you can sleep at night. They range from being ever more vigilant about phishing emails and DNS calls to taking more care about deleting accounts when an employee leaves. The latter can be a real headache because merely deleting a user from Active Directory doesn’t cut it any more.

To develop the list we spoke to John Pescatore, director of emerging security trends at the SANS Institute; Christos Dimitriadis, head of security for Greece’s INTRALOT Group; and Stephen Cobb, senior security researcher at ESET. 

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
MariaColeman
50%
50%
MariaColeman,
User Rank: Apprentice
1/23/2018 | 11:47:26 AM
Interesting
Interesting opinion as for me) 
edwardmyers
50%
50%
edwardmyers,
User Rank: Apprentice
5/24/2018 | 3:33:20 AM
Re: Interesting
Understandably, many corporations sense crushed with the burden of overlaying all components of IT safety. So what are the safety responsibilities that need to be prioritized with the aid of companies to make certain that they may be secure? Assignment Writer UK
LauraLeeCircadence
100%
0%
LauraLeeCircadence,
User Rank: Author
1/24/2018 | 12:50:57 PM
One more to consider

This is a strong list that includes technical controls, as well as human actions, to help reduce the attack surface. #11 would be seeking out ongoing professional development and practice opportunities in interactive environments. The traditional security trainings that exist at industry conferences or week-long seminars are no longer enough to prepare our cyber pros. Practicing defensive and offensive techniques – in real-world scenarios with your own tools and team members – is key to keeping yourself sharp and up to date on emerging threats.

 

 

 

AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14540
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-16332
PUBLISHED: 2019-09-15
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
CVE-2019-16333
PUBLISHED: 2019-09-15
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
CVE-2019-16334
PUBLISHED: 2019-09-15
In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636.
CVE-2019-16335
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.