Leaders from China, U.S. Meet, Agree to Rally Against Cyber Threats

In an attempt to clear the cybersecurity air, the United States and the People’s Republic of China agreed Monday to work in tandem to prevent future cyber threats. Meeting at the Pentagon, Defense Secretary Leon Panetta and General Liang Guanglie, China’s Minister of National Defense, insisted the two nations should be seen as equals and according to Guanglie, “build a new state-to-state relationship that’s not a stereotype of two major powers predestined for conflict.”

PHP Group Set to Release Another Patch for CVE-2012-1823 Flaw

The PHP Group on Tuesday is planning to release another new version of the scripting language that’s designed to address, again, the remotely exploitable flaw that came to light last week. That bug, which requires no authentication, was supposed to have been fixed in new releases pushed out on May 3, but they didn’t completely address the problem.

There’s a serious weakness in certain versions of Apple OS X that causes the operating system to store users’ login credentials for the FileVault encrypted storage in plaintext. The bug, which is found in older versions of FileVault present on OS X Lion 10.7.3 systems, enables anyone with admin access to the machine to get the login password for the FileVault system. The flaw also can be exploited when a machine is in FireWire disk mode and accessible to another computer.

This post is the fourth in a 5-part series on Application Security, or “AppSec”. The series will define the components of a sound AppSec program, delineate the growing threats to software, weigh the costs of a data breach, and outline the CISO’s responsibility in managing software security risk. Taken together, they are a primer on AppSec best practices that will help organizations build the business case for further investment in this critical IT security discipline.By Fergal Glynn, VeracodeAs we have examined in this series, the information security practice called Application Security (or “AppSec”) seeks to protect all of the software that runs a business. It has three distinct objectives:1) Measurable reduction of risk from existing applications2) Prevention of introduction of new risks3) Ensuring compliance with regulatory mandates

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.