Cybersecurity

Comcast’s Impressive System for Notifying Infected Users

Pretty much as long as there've been computers, one of the biggest challenges has been user education. How do you create software smart enough to inform a user when they're about to do something potentially disastrous - or, worse, when something disastrous has been done to them? As one of the world's largest access providers, Comcast has put a ton of thought into developing a notification system for their users. The solution Comcast developed involves, in effect, hijacking HTTP requests... more

Making IDN gTLDs Attractive and Safe

The primary focus of this article is to illustrate that the Applicant Guidebook is not supplying sufficient protection mechanisms, and creates too high financial barrier for those who are interested in applying for multiple Top-Level Domains (TLDs) that are translations/transliterations of each other and/or of an existing generic Top-Level Domains (tt-gTLDs). more

Foreign Hackers Attack Canadian Government

An unprecedented cyberattack on the Canadian government also targeted Defence Research and Development Canada, making it the third key department compromised by hackers, CBC News has learned. ... While there is no definitive proof, of course, that China was behind these attacks, there is a lot of circumstantial evidence that points in that direction. China (allegedly) has a long history of engaging in espionage activities in order to gain access to information. In the United States, this is sometimes referred to as cyber warfare, but I think that cyber espionage is a better choice of terms. more

Collecting Cybercrime Data: Can Signal Spam Be a Piece of the Puzzle?

The gathering of coherent data on cybercrime is a problem most countries haven't found a solution for. So far. In 2011 it is a well known fact that spam, cybercrime and botnets are all interrelated. The French database Signal Spam may be a significant part of the solution to gather, analyse and distribute data on spam, phishing, cybercrimes and botnets, but also be a forum in which commercial mass e-mail senders and ISPs can work on trust. more

Are We at the Dawn of a New Cold War?

Over the past say six months there are trends and events on and around the Internet that made me come up with this bizarre sounding question. Still it may actually make sense if we look at some facts. I'll be honest up front. This is a contribution that is not totally thought over and more a compilation of ideas and impressions gathered over the past weeks and months. Still, it could well serve as the beginning of a discussion on giving the recent events a place. There's nothing better than a provocative question in that case! Let's start here. more

The Dark Internet

I consult on communication issues for Neustar, an Internet infrastructure company. As most CircleIDers know, Neustar works behind the scenes to ensure the smooth operation of many critical systems like DNS, .us and .biz, local number portability and digital rights management. One of the cool things about working for them is the chance to attend the events they sponsor. Last week Neustar held a security briefing for senior federal IT personnel focused on Cybersecurity and Domain Name System Security Extensions (DNSSEC)... more

2010 Domain Name Year in Review - Oh, What A Year It Was!

Many of us were expecting radical changes in 2010 to the domain name market. There definitely were some of those -- just not the ones I expected. From the seizure of domains names by the US Government to ICANN's removal of restrictions on Registry/Registrar cross-ownership, 2010 was a year full of surprises. In this post, I've compiled what I think were the biggest domain name stories in 2010. more

NIST Cancels FISMA Continuous Monitoring Document’s 2nd Public Draft

NIST has released a revised FIMSA Implementation Schedule that omits a previously planned Second Public Draft of SP 800-137: Information Security Continuous Monitoring for Federal Information Systems and Organizations. Instead, NIST plans to proceed directly to a Final Public Draft, now expected in May 2011. more

Where Every Phisher Knows Your Name

Spear phishing is the unholy love child of email spam and social engineering. It refers to when a message is specifically crafted, using either public or previously stolen information, to fool the recipient into believing that it's legitimate. This personalization is usually fairly general, like mentioning the recipient's employer (easily gleaned from their domain name.) Sometimes they address you by name. Much scarier is when they use more deeply personal information stolen from one of your contacts... more

CircleID’s Top 10 Posts for 2010

Looking back at 2010, here is the list of top ten most popular news, blogs, and industry news on CircleID in 2010 based on the overall readership of the posts (total views as of Jan 1, 2011). Congratulations to all the participants whose posts reached top readership and best wishes to the entire community for 2011. Happy New Year! more