Database Security
Authentication
Privacy
Compliance
Careers & People
Identity & Access Management
Threat Intelligence
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
VENOM Zero-Day May Affect Thousands Of Cloud, Virtualization Products
Taking A Security Program From Zero To Hero
10 Security Questions To Ask A Cloud Service Provider
Healthcare Data Breaches From Cyberattacks, Criminals Eclipse Employee Error For The First Time
Beginning Of The End For Patch Tuesday
News & Commentary
Polish Security Firm Discloses Unpatched Security Flaws in Google App Engine
Jai Vijayan, Freelance writerNews
Google was given enough time to respond researcher says.
By Jai Vijayan Freelance writer, 5/15/2015
Comment0 comments  |  Read  |  Post a Comment
Drinking from the Malware Fire Hose
John Bambenek , Senior Threat Researcher, Fidelis Cybersecurity
Take a staged approach to processing malware in bulk so that scarce and time-limited resources can be prioritized for only those threats that truly require them.
By John Bambenek Senior Threat Researcher, Fidelis Cybersecurity, 5/15/2015
Comment0 comments  |  Read  |  Post a Comment
The Cybercrime Carnival in Brazil: Loose Cyberlaws Make for Loose Cybercriminals
Limor S Kessem, Sr. Cybersecurity Evangelist, IBM SecurityCommentary
Brazil loses over $8 billion a year to Internet crime, making it the second-largest cybercrime generator in the world.
By Limor S Kessem Sr. Cybersecurity Evangelist, IBM Security, 5/15/2015
Comment2 comments  |  Read  |  Post a Comment
Experts' Opinions Mixed On VENOM Vulnerability
Sara Peters, Senior Editor at Dark ReadingNews
Some say the virtualization vuln could be worse than Heartbleed, while others advise to patch, but don't panic.
By Sara Peters Senior Editor at Dark Reading, 5/14/2015
Comment2 comments  |  Read  |  Post a Comment
When Encrypted Communication Is Not Good Enough
Lysa Myers, Security Researcher, ESETCommentary
For the vast majority of conversations -- on paper, by phone or computer -- encryption is a perfectly adequate form of protection. Unless, of course, a life or livelihood is at stake.
By Lysa Myers Security Researcher, ESET, 5/14/2015
Comment3 comments  |  Read  |  Post a Comment
Cloud Security Alliance, Waverley Labs Collaborate On Open-Source Software-Defined Perimeter Spec
Jai Vijayan, Freelance writerNews
SDPs offer enterprises an alternative to traditional perimeter tools for protecting network assets, says CSA, Waverley
By Jai Vijayan Freelance writer, 5/13/2015
Comment0 comments  |  Read  |  Post a Comment
Teaming Up to Educate and Enable Better Defense Against Phishing
Rees Johnson, Sr. VP and GM the Content Security Business Unit, Intel Security
Companies need to both educate their employees and implement prevention technology.
By Rees Johnson Sr. VP and GM the Content Security Business Unit, Intel Security, 5/13/2015
Comment4 comments  |  Read  |  Post a Comment
Oil & Gas Firms Hit By Cyberattacks That Forgo Malware
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
New spin on the 'Nigerian scam' scams crude oil buyers out of money with bait-and-switch.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 5/13/2015
Comment0 comments  |  Read  |  Post a Comment
Taking A Security Program From Zero To Hero
Joshua Goldfarb, VP & CTO - Americas, FireEye.Commentary
Breaking the enigma of InfoSec into smaller bites is a proven method for building up an organization’s security capabilities. Here are six steps to get you started.
By Joshua Goldfarb VP & CTO - Americas, FireEye., 5/13/2015
Comment2 comments  |  Read  |  Post a Comment
Microsoft Edge Browser Gets Security Boost
Kelly Sheridan, Associate Editor, InformationWeekNews
The new Windows 10 browser, Microsoft Edge, is fortified with security measures to keep users safe.
By Kelly Sheridan Associate Editor, InformationWeek, 5/13/2015
Comment4 comments  |  Read  |  Post a Comment
VENOM Zero-Day May Affect Thousands Of Cloud, Virtualization Products
Sara Peters, Senior Editor at Dark ReadingNews
Critical vulnerability in the open-source QEMU hypervisor lets attackers break out of a virtual machine, execute code on a host machine and access all the other VMs on the host.
By Sara Peters Senior Editor at Dark Reading, 5/13/2015
Comment6 comments  |  Read  |  Post a Comment
Verizon 2015 Data Breach Cover Puzzler Solved: Defending Champs Win
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
The 2015 DBIR Cover Challenge is as highly anticipated by some as the DBIR report itself.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 5/12/2015
Comment0 comments  |  Read  |  Post a Comment
Vulnerability Disclosure Deja Vu: Prosecute Crime Not Research
Katie Moussouris, Chief Policy Officer, HackerOneCommentary
There is a lesson to be learned from a locksmith living 150 years ago: Attackers and criminals are the only parties who benefit when security researchers fear the consequences for reporting issues.
By Katie Moussouris Chief Policy Officer, HackerOne, 5/12/2015
Comment9 comments  |  Read  |  Post a Comment
First Example Of SAP Breach Surfaces
Ericka Chickowski, Contributing Writer, Dark ReadingNews
USIS attack in 2013 stealing background check information about government personnel with classified clearance came by way of an SAP exploit.
By Ericka Chickowski Contributing Writer, Dark Reading, 5/12/2015
Comment0 comments  |  Read  |  Post a Comment
Protecting The Data Lifecycle From Network To Cloud
Gerry Grealish, CMO, PerspecsysCommentary
Enterprises are pushing more sensitive and regulated data into the public cloud than ever before. But the journey carries many new risks.
By Gerry Grealish CMO, Perspecsys, 5/12/2015
Comment0 comments  |  Read  |  Post a Comment
10 Security Questions To Ask A Cloud Service Provider
Ericka Chickowski, Contributing Writer, Dark Reading
Help the business assess the risks of cloud services with these handy questions.
By Ericka Chickowski Contributing Writer, Dark Reading, 5/12/2015
Comment2 comments  |  Read  |  Post a Comment
What Does China-Russia 'No Hack' Pact Mean For US?
Sara Peters, Senior Editor at Dark ReadingNews
It could be an Internet governance issue or a response to the U.S. DoD's new cyber strategy, but one thing is certain: it doesn't really mean China and Russia aren't spying on one another anymore.
By Sara Peters Senior Editor at Dark Reading, 5/11/2015
Comment2 comments  |  Read  |  Post a Comment
Women In Security Speak Out On Why There Are Still So Few Of Them
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
They're now CISOs, security officials in DHS and the NSA, researchers, and key players in security -- but women remain a mere 10% of the industry population.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 5/11/2015
Comment7 comments  |  Read  |  Post a Comment
PHP Hash Comparison Weakness A Threat To Websites, Researcher Says
Jai Vijayan, Freelance writerNews
Flaw could allow attackers to compromise user accounts, WhiteHat Security's Robert Hansen -- aka "RSnake" -- says in new finding on 'Magic Hash' vulnerability.
By Jai Vijayan Freelance writer, 5/9/2015
Comment2 comments  |  Read  |  Post a Comment
Beginning Of The End For Patch Tuesday
Sara Peters, Senior Editor at Dark ReadingNews
Starting with Windows 10, Microsoft will introduce Windows Update for Business, issuing patches as they're available, instead of once a month.
By Sara Peters Senior Editor at Dark Reading, 5/7/2015
Comment6 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
Decline in detected malware attacks in organisations coincides perfectly with weekends.
SANs Survey Reveals Organizations Lack Control Over Mobile Workspaces
CoroNet Launches Solution to Protect from Eavesdropping, Data Interception and Remote Manipulation of Devices on WiFi and Cellular Networks
Digital Guardian Acquires Savant Protection
Videology and White Ops Unveil Partnership to Combat Bot Traffic and Non-Human Activity Across Campaigns, Devices
Absolute Survey Shows Millennials Represent Greatest Risk to Corporate Data
Bitdefender Rolls Out New Technology for Virtualized Infrastructure Security
LiveEnsure Launches FourSure, a Peer-to-Peer Trust App
More Products & Releases
PR Newswire
Vulnerability Disclosure Deja Vu: Prosecute Crime Not Research
Katie Moussouris, Chief Policy Officer, HackerOne,  5/12/2015
Women In Security Speak Out On Why There Are Still So Few Of Them
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/11/2015
VENOM Zero-Day May Affect Thousands Of Cloud, Virtualization Products
Sara Peters, Senior Editor at Dark Reading,  5/13/2015
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Teaming Up to Educate and Enable Better Defense Against Phishing
Companies need to both educate their employees and implement prevention technology. Read >>
Partner Perspectives
What's This?
Drinking from the Malware Fire Hose
Take a staged approach to processing malware in bulk so that scarce and time-limited resources can be prioritized for only those threats that truly require them. Read >>
Cartoon
Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.
White Papers
Current Issue
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0717
Published: 2015-05-16
Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.

CVE-2015-0723
Published: 2015-05-16
The wireless web-authentication subsystem on Cisco Wireless LAN Controller (WLC) devices 7.5.x and 7.6.x before 7.6.120 allows remote attackers to cause a denial of service (process crash and device restart) via a crafted value, aka Bug ID CSCum03269.

CVE-2015-0726
Published: 2015-05-16
The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters, aka Bug IDs CSCum65159 and ...

CVE-2015-0729
Published: 2015-05-16
Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server Solution Engine (ACSE) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a file-inclusion attack, aka Bug ID CSCuu11005.

CVE-2015-0730
Published: 2015-05-16
The SMB module in Cisco Wide Area Application Services (WAAS) 6.0(1) allows remote attackers to cause a denial of service (module reload) via an invalid field in a Negotiate Protocol request, aka Bug ID CSCuo75645.

10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Flash Poll
Video
Slideshows
Twitter Feed