SecurityWeek

For many reasons you’ve heard and read about, security is a very difficult space. Prioritizing is an unenviable job many security professionals must do every day – do you go live with a product on time, or do you hold it to fix that security bug which could cause a catastrophic failure? The answer is nuanced, as we all know well, and while I think we all would love it if we never had to answer that question, it’s a...

Attackers typically use one of three common techniques to compromise SAP systems at the application layer: pivoting, portal attacks, and database warehousing, according to researchers from application security firm Onapsis.

A new report from Enterprise Strategy Group found that many enterprises feel breach prevention and detection is more difficult today than two years ago.

Researchers at Proofpoint recently identified a clever attack campaign involving CareerBuilder.com.

A widening scandal over claims Germany helped the US spy on European targets triggered tensions in Angela Merkel's coalition Tuesday, which analysts said could potentially prove dangerous for the "untouchable" chancellor.

Microsoft announced on Monday at its first-ever Ignite Conference the launch of a new on-premises user behavior and advanced threat analytics solution.

In security, whether to build or buy a given solution is one of the oldest questions. I was most recently reminded of this question a few weeks ago. Despite all my years on the operational side, I am unable answer the “build or buy” question. Not because I don’t understand how technology is procured, deployed, and operated in an enterprise, but rather because the question makes no sense. Sound like a radical statement? Allow me to elaborate.

Researchers at Cisco’s Talos Security Intelligence and Research Group have conducted an in-depth analysis of Rombertik, a sophisticated piece of malware designed to steal sensitive information from infected devices. In an effort to ensure that their creation cannot be analyzed, the malware authors have included some clever mechanisms.

Officials at Sally Beauty Holdings are investigating a possible data breach involving payment cards used at some of its stores in the United States.

Network Administrators Are Not Just the Protectors of the Organization – They Are Also the Most Valuable Targets

Infrastructure-as-a-service can provide an attractive option for businesses, but approaching security wrong can come with a cost all its own.

Researchers have identified several ways to bypass Password Alert, an anti-phishing extension for Chrome launched last week by Google. The search giant has started patching some of the issues, but it’s having a hard time keeping up with researchers.

Rapid7, a Boston, Mass.-based provider of security analytics software and services, announced on Monday that it has acquired application security testing company NT OBJECTives (NTO).

EllisLab reported on Friday that one of its servers was breached on March 24. The company is advising users to change their passwords following the incident.

PayPal’s Partner Program website (paypal-marketing.com) was plagued by a vulnerability that could have been exploited for remote code execution.

Researchers have come across a new version of the Dyre banking malware that leverages a clever yet simple technique to evade sandboxes and prevent analysis.

The German intelligence service BND, which is accused of helping the United States spy on EU leaders and companies, had actually "deleted 12,000 requests" targeting European officials, according to Saturday's edition of the Der Spiegel weekly.

MySQL, Oracle’s relational database management system, is plagued by a vulnerability that can be exploited to downgrade SSL/TLS connections, according to researchers at Duo Security.

A researcher has identified two arbitrary code execution vulnerabilities in industrial control and automation software products developed by Opto 22. The vendor has released updates to resolve the flaws.

The Internet Corporation for Assigned Names and Numbers (ICANN) announced on Thursday the completion of the first phase of its investigation into the impact of a vulnerability affecting two of the organization’s generic top-level domain (gTLD) portals.