Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Author

 Rafal Los, Managing Director, Solutions Research and Development, Optiv

Profile of Rafal Los

Managing Director, Solutions Research and Development, Optiv
News & Commentary Posts: 1

Rafal Los brings a blend of pragmatism and thought leadership in his approach to enterprise information security. As managing director, solutions research and development at Optiv, Los helps organizations build mature, defensible and operationally efficient security programs. Leveraging over 15 years of technical, consulting and management skills his team researches, develops and delivers program strategy frameworks, maturity models, and provides operational guidance from across industry verticals and varying maturity levels.Los previously worked at Acccuvant. Prior to that, he served as principal, strategic security services at HP Enterprise Security Services. Los developed a methodology for refocusing enterprise security programs through an assessment and threat-centric approach, directly aligning security to business value. While there, he developed new services-based offerings from concept through prototype and launch stages, and spearheaded a cross-business task team to develop new use cases for products and service offerings within the existing portfolio. Previously at HP, Los served several diverse roles including security strategist in enterprise security products where he advised customers on implementing practical solutions. He also wrote and maintained the top blog in HP Software, "Following the White Rabbit." Prior to HP, Los held various positions at GE Energy, EnterEdge Technology and Envestnet PMC.Los is an advocate for focus on sound security fundamentals and for the principles of "proportional, common sense security." He has been contributor to open standards and various organizations such as the Open Web Application Security Project (OWASP) and the Cloud Security Alliance. He has served as a speaker at conferences such as Black Hat, ISSA International, InfoSec World and many others. In addition, he maintains a regular column in SecurityWeek and contributes to other community forums. Los received his bachelor's degree in computer information systems from Concordia University.

The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13453
PUBLISHED: 2019-07-17
Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().
CVE-2019-4211
PUBLISHED: 2019-07-17
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159131.
CVE-2019-4430
PUBLISHED: 2019-07-17
IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162887.
CVE-2018-1921
PUBLISHED: 2019-07-17
IBM Campaign 9.1.0, 9.1.2, 10.1, and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152857.
CVE-2018-2021
PUBLISHED: 2019-07-17
IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155345.