Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //

Compliance

News & Commentary
5 Tips on How to Build a Strong Security Metrics Framework
Joshua Goldfarb, Independent ConsultantCommentary
The carpentry maxim "measure twice, cut once" underscores the importance of timely, accurate, and regular metrics to inform security leaders' risk decisions.
By Joshua Goldfarb Independent Consultant, 1/10/2020
Comment0 comments  |  Read  |  Post a Comment
Client-Side JavaScript Risks & the CCPA
Ido Safruti, Co-founder & CTO, PerimeterXCommentary
How California's new privacy law increases the liability for securing Web-facing user data, and what enterprises can do to mitigate their risk.
By Ido Safruti Co-founder & CTO, PerimeterX, 1/6/2020
Comment0 comments  |  Read  |  Post a Comment
CCPA Kickoff: What Businesses Need to Know
Kelly Sheridan, Staff Editor, Dark ReadingNews
The California Consumer Privacy Act is in full effect, prompting organizations to think about how they'll remain compliant.
By Kelly Sheridan Staff Editor, Dark Reading, 1/2/2020
Comment0 comments  |  Read  |  Post a Comment
'Honoring' CCPA's Binding Principles Nationally Won't Be Easy
Dr. Salvatore Stolfo, Founder & CTO, Allure SecurityCommentary
Even companies with the reach, capital, and innovative capacity of Microsoft or Google will struggle to adhere to the tenets of California's new consumer privacy law.
By Dr. Salvatore Stolfo Founder & CTO, Allure Security, 12/26/2019
Comment1 Comment  |  Read  |  Post a Comment
Ambiguity Around CCPA Will Lead to a Slow Start in 2020
Anurag Kahol, CTO, BitglassCommentary
But longer term, compliance to California's new privacy law represents an opportunity for companies to increase customer trust and market share.
By Anurag Kahol CTO, Bitglass, 12/20/2019
Comment0 comments  |  Read  |  Post a Comment
Privacy Requirements & Penalties Grow, Causing Firms to Struggle
Robert Lemos, Contributing WriterNews
Between Europe's and California's privacy laws, companies have a complex landscape to navigate in 2020. Even data-mature industries, such as financial services, see problems ahead.
By Robert Lemos Contributing Writer, 12/19/2019
Comment0 comments  |  Read  |  Post a Comment
Talking to the Board about Cybersecurity
Bill Ruckelshaus, CFO, ExtraHopCommentary
A chief financial officer shares five winning strategies for an effective board-level conversation about right-sizing risk.
By Bill Ruckelshaus CFO, ExtraHop, 12/17/2019
Comment0 comments  |  Read  |  Post a Comment
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLCCommentary
Assessments can be used against your company in court proceedings. Here's how to mitigate this potential risk.
By Beth Burgin Waller Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC, 12/5/2019
Comment2 comments  |  Read  |  Post a Comment
Employee Privacy in a Mobile Workplace
Michael J. Covington, Vice President of Product Strategy at WanderaCommentary
Why businesses need guidelines for managing their employees' personal information -- without compromising on security.
By Michael J. Covington Vice President of Product Strategy at Wandera, 11/20/2019
Comment0 comments  |  Read  |  Post a Comment
Americans Fed Up with Lack of Data Privacy
Robert Lemos, Contributing WriterNews
Eight out of every 10 US adults are worried over their inability to control how data about them is used, a new Pew Research survey shows.
By Robert Lemos Contributing Writer, 11/18/2019
Comment1 Comment  |  Read  |  Post a Comment
Companies Increasingly Fail Interim Security Test, But Gap Narrows
Robert Lemos, Contributing WriterNews
Stability of PCI DSS helps companies cope and create more mature security programs, but some parts of the Payment Card Industry's Data Secure Standard continue to cause headaches.
By Robert Lemos Contributing Writer, 11/12/2019
Comment0 comments  |  Read  |  Post a Comment
To Prove Cybersecurity's Worth, Create a Cyber Balance Sheet
Andrew Morrison, Principal, Cyber Risk Services, at DeloitteCommentary
How tying and measuring security investments to business impacts can elevate executives' understanding and commitment to cyber-risk reduction.
By Andrew Morrison Principal, Cyber Risk Services, at Deloitte, 11/7/2019
Comment0 comments  |  Read  |  Post a Comment
Microsoft Tools Focus on Insider Risk, Data Protection at Ignite 2019
Kelly Sheridan, Staff Editor, Dark ReadingNews
New tools and updates aimed at addressing ongoing challenges with insider threats and sensitive data classification.
By Kelly Sheridan Staff Editor, Dark Reading, 11/4/2019
Comment1 Comment  |  Read  |  Post a Comment
Hacking Phones: How Law Enforcement Is Saving Privacy
Matthew Rosenquist, Cybersecurity StrategistCommentary
It's no longer true that society must choose to either weaken everybody's privacy or let criminals run rampant.
By Matthew Rosenquist Cybersecurity Strategist, 10/30/2019
Comment1 Comment  |  Read  |  Post a Comment
Cybersecurity Trumps Political, Reputational Concerns for Companies
Robert Lemos, Contributing WriterNews
The average company has seen its risk increase, with cybersecurity topping the list of business threats, followed by damage to reputation and financial risks, a report finds.
By Robert Lemos Contributing Writer, 10/29/2019
Comment0 comments  |  Read  |  Post a Comment
4 Security Lessons Federal IT Pros Can Teach the Private Sector
Greg Kushto, Vice President of Sales Engineering at Force 3Commentary
With a little research and basic planning, small companies can make big strides against the cybersecurity threats they face. Here's how.
By Greg Kushto Vice President of Sales Engineering at Force 3, 10/25/2019
Comment2 comments  |  Read  |  Post a Comment
IoTopia Framework Aims to Bring Security to Device Manufacturers
Kelly Sheridan, Staff Editor, Dark ReadingNews
GlobalPlatform launches an initiative to help companies secure connected devices and services across markets.
By Kelly Sheridan Staff Editor, Dark Reading, 10/23/2019
Comment0 comments  |  Read  |  Post a Comment
Planning a Zero-Trust Initiative? Here's How to Prioritize
James Carder, CISO & VP, LogRhythm Labs, LogRhythm, Inc.Commentary
If you start by focusing on users, data, access, and managed devices, you will make major strides toward achieving better security.
By James Carder CISO & VP, LogRhythm Labs, LogRhythm, Inc., 10/23/2019
Comment0 comments  |  Read  |  Post a Comment
Trend Micro Buys Cloud Conformity to Fight Cloud Competition
Dark Reading Staff, Quick Hits
The cloud security posture management startup was acquired for a reported $70 million.
By Dark Reading Staff , 10/21/2019
Comment0 comments  |  Read  |  Post a Comment
Data Privacy Protections for the Most Vulnerable Children
Dimitri Sirota, Founder & CEO of BigIDCommentary
The business case for why companies that respect the privacy of individuals, and especially minors, will have a strong competitive advantage.
By Dimitri Sirota Founder & CEO of BigID, 10/17/2019
Comment2 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5397
PUBLISHED: 2020-01-17
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not incl...
CVE-2019-17635
PUBLISHED: 2020-01-17
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version and the heap dump is reopened in Memory Analyzer. The user must chose to reopen an already parsed heap dump with an untrusted inde...
CVE-2019-19339
PUBLISHED: 2020-01-17
It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between, virtual to physical memory address translations in CPU's local cache and system software's Paging structure entries...
CVE-2007-6070
PUBLISHED: 2020-01-17
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-1382. Reason: This candidate is a reservation duplicate of CVE-2008-1382. Notes: All CVE users should reference CVE-2008-1382 instead of this candidate. All references and descriptions in this candidate have been removed to prevent ...
CVE-2019-17634
PUBLISHED: 2020-01-17
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could...