Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //

Compliance

News & Commentary
7 Considerations Before Adopting Security Standards
Steve Zurier, Contributing Writer
Here's what to think through as you prepare your organization for standards compliance.
By Steve Zurier Contributing Writer, 10/8/2019
Comment0 comments  |  Read  |  Post a Comment
10 Steps to Assess SOC Maturity in SMBs
Andrew Houshian, Associate Director of SOC and Attestation Services at A-LIGNCommentary
Facing a system and organization controls audit doesn't have to be stressful for small and midsize businesses if they follow these guidelines.
By Andrew Houshian Associate Director of SOC and Attestation Services at A-LIGN, 10/7/2019
Comment0 comments  |  Read  |  Post a Comment
How FISMA Requirements Relate to Firmware Security
John Loucaides, Vice President, R&D, EclypsiumCommentary
Federal guidelines can help all organizations pragmatically and meaningfully improve their firmware security.
By John Loucaides Vice President, R&D, Eclypsium, 10/3/2019
Comment0 comments  |  Read  |  Post a Comment
How to Define & Prioritize Risk Management Goals
Kelly Sheridan, Staff Editor, Dark ReadingNews
As risk management programs differ from business to business, these factors remain constant.
By Kelly Sheridan Staff Editor, Dark Reading, 9/24/2019
Comment1 Comment  |  Read  |  Post a Comment
How Network Logging Mitigates Legal Risk
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLCCommentary
Logging that is turned on, captured, and preserved immediately after a cyber event is proof positive that personal data didn't fall into the hands of a cybercriminal.
By Beth Burgin Waller Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC, 9/23/2019
Comment1 Comment  |  Read  |  Post a Comment
How Intel Unlocks the Powerful Potential of Diversity in Cybersecurity
Jim Gordon, GM, Ecosystem Strategy & Business Development, Intel Platform Security DivisionCommentary
Sparking cultural shifts within an organization -- and throughout an entire industry -- can feel like a monumental task, but the juice is well worth the squeeze.
By Jim Gordon GM, Ecosystem Strategy & Business Development, Intel Platform Security Division, 9/17/2019
Comment0 comments  |  Read  |  Post a Comment
6 Questions to Ask Once Youve Learned of a Breach
Steve Zurier, Contributing Writer
With GDPR enacted and the California Consumer Privacy Act on the near horizon, companies have to sharpen up their responses. Start by asking these six questions.
By Steve Zurier Contributing Writer, 9/13/2019
Comment1 Comment  |  Read  |  Post a Comment
Proposed Browser Security Guidelines Would Mean More Work for IT Teams
Chris Hickman, Chief Security Officer at KeyfactorCommentary
CA/Browser Forum wants SSL certificates to expire after a year. Many businesses that rely on them aren't equipped to cope.
By Chris Hickman Chief Security Officer at Keyfactor, 9/11/2019
Comment0 comments  |  Read  |  Post a Comment
It's Not Healthy to Confuse Compliance with Security
Todd Weller, Chief Strategy Officer at Bandura CyberCommentary
Healthcare organizations should be alarmed by the frequency and severity of cyberattacks. Don't assume you're safe from them just because you're compliant with regulations.
By Todd Weller Chief Strategy Officer at Bandura Cyber, 9/5/2019
Comment5 comments  |  Read  |  Post a Comment
Rising Fines Will Push Breach Costs Much Higher
Robert Lemos, Contributing WriterNews
The cost of breaches will rise by two-thirds over the next five years, exceeding an estimated $5 trillion in 2024, primarily driven by higher fines as more jurisdictions punish companies for lax security.
By Robert Lemos Contributing Writer, 9/4/2019
Comment0 comments  |  Read  |  Post a Comment
SafeGuard Cyber Adds Security, Compliance Capabilities for WeChat
Dark Reading Staff, Quick Hits
A lack of visibility into the app could expose business users to compliance risks and security threats, the company says.
By Dark Reading Staff , 8/22/2019
Comment0 comments  |  Read  |  Post a Comment
'Phoning Home': Your Latest Data Exfiltration Headache
Jeff Costlow, CISO, ExtraHopCommentary
Companies phone enterprise customer data home securely and for a variety of perfectly legitimate and useful reasons. The problems stem from insufficient disclosure.
By Jeff Costlow CISO, ExtraHop, 8/21/2019
Comment0 comments  |  Read  |  Post a Comment
Compliance Training? What Compliance Training?
Beyond the Edge, Dark Reading
Employees can run ... but they can't hide. Or can they?
By Beyond the Edge Dark Reading, 8/19/2019
Comment0 comments  |  Read  |  Post a Comment
Security Pros, Congress Reps Talk National Cybersecurity at DEF CON
Kelly Sheridan, Staff Editor, Dark ReadingNews
Cybersecurity and government leaders discussed why Congress is unprepared for a major cyberattack and how the two parties can collaborate.
By Kelly Sheridan Staff Editor, Dark Reading, 8/12/2019
Comment0 comments  |  Read  |  Post a Comment
It's (Still) the Password, Stupid!
Sam Bocetta, Security AnalystCommentary
The best way to protect your identity in cyberspace is the simplest: Use a variety of strong passwords, and never, ever, use "123456" no matter how easy it is to type.
By Sam Bocetta Security Analyst, 8/9/2019
Comment3 comments  |  Read  |  Post a Comment
Yes, FaceApp Really Could Be Sending Your Data to Russia
Marc Rogers, Executive Director of Cybersecurity, OktaCommentary
FaceApp has an unprecedented level of access to data from 150 million users. What could its endgame be? We unpack three potential risks.
By Marc Rogers Executive Director of Cybersecurity, Okta, 8/8/2019
Comment0 comments  |  Read  |  Post a Comment
Cisco Pays $8.6M in First False Claims Suit for Vulnerabilities in Security Product
Robert Lemos, Contributing WriterNews
A security consultant reported vulnerabilities in Cisco's Video Surveillance Manager in 2009 but the company ignored the issues and fired the consultant.
By Robert Lemos Contributing Writer, 8/1/2019
Comment0 comments  |  Read  |  Post a Comment
Companies' 'Anonymized' Data May Violate GDPR, Privacy Regs
Robert Lemos, Contributing WriterNews
New study found that any database containing 15 pieces of demographic data could be used to identify individuals.
By Robert Lemos Contributing Writer, 7/26/2019
Comment3 comments  |  Read  |  Post a Comment
Answer These 9 Questions to Determine if Your Data Is Safe
Chad Cragle, Information Security Officer at FormAssemblyCommentary
Data protection regulations are only going to grow tighter. Make sure you're keeping the customer's best interests in mind.
By Chad Cragle Information Security Officer at FormAssembly, 7/25/2019
Comment9 comments  |  Read  |  Post a Comment
6 Actions That Made GDPR Real in 2019
Steve Zurier, Contributing Writer
In the wake of recent fines levied against British Airways, Marriott, and Facebook, companies are starting to take data privacy and security more seriously.
By Steve Zurier Contributing Writer, 7/22/2019
Comment1 Comment  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17593
PUBLISHED: 2019-10-14
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
CVE-2019-17594
PUBLISHED: 2019-10-14
There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVE-2019-17595
PUBLISHED: 2019-10-14
There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVE-2019-14823
PUBLISHED: 2019-10-14
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to...
CVE-2019-17592
PUBLISHED: 2019-10-14
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.