Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

News & Commentary
Success Enablers or Silent Killers?
Douglas Ferguson, Founder & CTO, Pharos SecurityCommentary
These five success enablers will help CISOs report, measure, and demonstrate ROI to the C-suite.
By Douglas Ferguson Founder & CTO, Pharos Security, 12/6/2019
Comment0 comments  |  Read  |  Post a Comment
Password-Cracking Teams Up in CrackQ Release
Robert Lemos, Contributing WriterNews
The open source platform aims to make password-cracking more manageable and efficient for red teams.
By Robert Lemos Contributing Writer, 12/4/2019
Comment0 comments  |  Read  |  Post a Comment
What's in a Botnet? Researchers Spy on Geost Operators
Kelly Sheridan, Staff Editor, Dark ReadingNews
The investigation of a major Android banking botnet yields insights about how cybercriminals structure and run an illicit business.
By Kelly Sheridan Staff Editor, Dark Reading, 12/4/2019
Comment0 comments  |  Read  |  Post a Comment
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, OktaCommentary
Underestimating the security changes that need to accompany a shift to the cloud could be fatal to a business. Here's why.
By Diya Jolly Chief Product Officer, Okta, 12/4/2019
Comment1 Comment  |  Read  |  Post a Comment
Microsoft Issues Advisory for Windows Hello for Business
Kelly Sheridan, Staff Editor, Dark ReadingQuick Hits
An issue exists in Windows Hello for Business when public keys persist after a device is removed from Active Directory, if the AD exists, Microsoft reports.
By Kelly Sheridan Staff Editor, Dark Reading, 12/4/2019
Comment0 comments  |  Read  |  Post a Comment
Leveraging the Cloud for Cyber Intelligence
Paul Kurtz, Co-Founder and Executive Chairman of TruSTARCommentary
How fusing output datasets and sharing information can create a real-time understanding of suspicious activity across your enterprise.
By Paul Kurtz Co-Founder and Executive Chairman of TruSTAR, 12/3/2019
Comment0 comments  |  Read  |  Post a Comment
DHS to Require Federal Agencies to Set Vulnerability Disclosure Policies
Robert Lemos, Contributing WriterNews
The Cybersecurity and Infrastructure Security Agency (CISA) publishes a draft document mandating a vulnerability disclosure policy and a strategy for handling reports of security weaknesses.
By Robert Lemos Contributing Writer, 12/2/2019
Comment0 comments  |  Read  |  Post a Comment
3 Modern Myths of Threat Intelligence
Anton Chuvakin, Head of Security Solution Strategy, ChronicleCommentary
More intelligence does not lead to more security. Here's why.
By Anton Chuvakin Head of Security Solution Strategy, Chronicle, 12/2/2019
Comment0 comments  |  Read  |  Post a Comment
An Alarming Number of Software Teams Are Missing Cybersecurity Expertise
Robert Lemos, Contributing WriterNews
The overwhelming majority of developers worry about security and consider it important, yet many lack a dedicated cybersecurity leader.
By Robert Lemos Contributing Writer, 11/26/2019
Comment0 comments  |  Read  |  Post a Comment
The 'Department of No': Why CISOs Need to Cultivate a Middle Way
Malcolm Harkins, Chief Security & Trust OfficerCommentary
A chief information security officer's job inherently involves conflict, but a go-along-to-get-along approach carries its own vulnerabilities and risks.
By Malcolm Harkins Chief Security & Trust Officer, 11/21/2019
Comment0 comments  |  Read  |  Post a Comment
Patch 'Easily Exploitable' Oracle EBS Flaws ASAP: Onapsis
Robert Lemos, Contributing WriterNews
Organizations that have not yet applied a pair of months-old critical patches from Oracle for E-Business Suite are at risk of attacks on their financial systems, the application security firm says.
By Robert Lemos Contributing Writer, 11/20/2019
Comment0 comments  |  Read  |  Post a Comment
Google Cloud Update Gives Users Greater Data Control
Dark Reading Staff, Quick Hits
External Key Manager and Key Access Justification are intended to give organizations greater visibility into requests for data access.
By Dark Reading Staff , 11/20/2019
Comment0 comments  |  Read  |  Post a Comment
TPM-Fail: What It Means & What to Do About It
Ari Singer, CTO at TrustPhiCommentary
Trusted Platform Modules are well-suited to a wide range of applications, but for the strongest security, architect them into "defense-in-depth" designs.
By Ari Singer CTO at TrustPhi, 11/19/2019
Comment1 Comment  |  Read  |  Post a Comment
Most Companies Lag Behind '1-10-60' Benchmark for Breach Response
Robert Lemos, Contributing WriterNews
Average company needs 162 hours to detect, triage, and contain a breach, according to a new CrowdStrike survey.
By Robert Lemos Contributing Writer, 11/19/2019
Comment0 comments  |  Read  |  Post a Comment
A Security Strategy That Centers on Humans, Not Bugs
Andrea Little Limbago, Chief Social Scientist, VirtruCommentary
The industry's fixation on complex exploits has come at the expense of making fundamentals easy and intuitive for end users.
By Andrea Little Limbago Chief Social Scientist, Virtru, 11/19/2019
Comment0 comments  |  Read  |  Post a Comment
Windows Hello for Business Opens Door to New Attack Vectors
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers exploring Windows Hello for Business found an Active Directory backdoor and other attack vectors that could lead to privilege escalation.
By Kelly Sheridan Staff Editor, Dark Reading, 11/18/2019
Comment0 comments  |  Read  |  Post a Comment
Human Nature vs. AI: A False Dichotomy?
John McClurg, Sr. VP & CISO, BlackBerryCommentary
How the helping hand of artificial intelligence allows security teams to remain human while protecting themselves from their own humanity being used against them.
By John McClurg Sr. VP & CISO, BlackBerry, 11/18/2019
Comment1 Comment  |  Read  |  Post a Comment
Attacks on Healthcare Jump 60% in 2019 - So Far
Robert Lemos, Contributing WriterNews
Well-known Trojans Emotet and Trickbot are cybercriminals' favorite weapons in their campaigns.
By Robert Lemos Contributing Writer, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
5 Cybersecurity CISO Priorities for the Future
Paul Shomo, Cybersecurity AnalystCommentary
Seven chief information security officers share their pain points and two-year spending plans.
By Paul Shomo Cybersecurity Analyst, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
8 Backup & Recovery Questions to Ask Yourself
Sara Peters, Senior Editor at Dark Reading
Don't wait until after a disaster, DDoS, or ransomware attack to learn just how good your backups really are.
By Sara Peters Senior Editor at Dark Reading, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16772
PUBLISHED: 2019-12-07
The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.to...
CVE-2019-9464
PUBLISHED: 2019-12-06
In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warning indicating an app accessed the user's location. This could dissolve the trust in the platform's permission system, with no additional execution privileges need...
CVE-2019-2220
PUBLISHED: 2019-12-06
In checkOperation of AppOpsService.java, there is a possible bypass of user interaction requirements due to mishandling application suspend. This could lead to local information disclosure no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVers...
CVE-2019-2221
PUBLISHED: 2019-12-06
In hasActivityInVisibleTask of WindowProcessController.java there�s a possible bypass of user interaction requirements due to incorrect handling of top activities in INITIALIZING state. This could lead to local escalation of privilege with no additional execution privileges need...
CVE-2019-2222
PUBLISHED: 2019-12-06
n ihevcd_parse_slice_data of ihevcd_parse_slice.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android...