Cybersecurity

Institutionalizing Consumer Trust and Public Interest at ICANN

For an organization where people argue for hours over arcane minutiae, it's remarkable that virtually everyone agrees that ICANN should serve the "global public interest" and build "consumer trust" in the Internet. Although it's only three pages long, ICANN's Affirmation of Commitments (AoC) cites "public interest" five times and "consumer trust" eight times. So at the ICANN meeting today in Cartagena, Colombia, a group of participants explored ways to "institutionalize" these concepts within the organization. more

Fixing the Internet Might Break It Worse Than It’s Broken Now

Willis Alan Ramsey, who wrote "Muskrat Love," recorded one and only one studio album. The cognoscenti of country think it's a gem, an all time top ten. There's an apocryphal story that when Ramsey was pushed to make another record he allegedly retorted, "What's wrong with the first one?" We who use the Internet every day risk losing sight of what a miracle it is, and the openness that keeps it so miraculous... We also lose sight of the fact that even as the Internet's miracles occur, it's almost always broken or malfunctioning or threatening or worse in many places along the line. more

Coordinating Attack Response at Internet Scale

How do we help coordinate responses to attacks against Internet infrastructure and users? Internet technology has to scale or it won't survive for long as the network of networks grows ever larger. But it's not just the technology, it's also the people, processes and organisations involved in developing, operating and evolving the Internet that need ways to scale up to the challenges that a growing global network can create. more

FBI, Department of Homeland Security Issue Warning About a North Korean Trojan Malware Variant

The US Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) this week issued a malware analysis report on Trojan malware variants linked to the North Korean government. more

Brands Should Not Ignore the Security Benefits of New gTLDs

If one thing has become clear from recent commentary on ICANN's new top-level domain program, it's that there's a dramatic lack of understanding about some of the benefits of owning your own TLD - especially as it relates to security. Many brand owners - especially those with luxury brands - could realize immediate benefits from reduced counterfeiting and greater brand trust with a "dot Brand." more

Project GhostNet: Canada (and Google) Save the World from Cyber-Spying - Again!

While most people I know are at either VoiceCon or CTIA this week, this one is worth staying home for. Also, I'm sure all the Skype followers are focused today on the news about working with the iPhone -- and that IS a big story. However -- for very different reasons -- I'm sure you'll find this one of interest too. This was a front page story in today's Globe and Mail, and no doubt many other Canadian dailies... more

Phishing Registrar Accounts: eNom is First Target

Criminals are now looking to use established domain names, via phishing targeted at domain registrars. This is possibly related to ICANN finally moving to stop the black hat registrars of the world. According to the first report on the matter sent yesterday to Registrar Operations (reg-ops) mailing list, the attacks seem to be run by gang of child pornography spammers. more

World Notices That Verisign Said Three Months Ago That They Had a Security Breach Two Years Ago

The trade press is abuzz today with reports about a security breach at Verisign. While a security breach at the company that runs .COM, .NET, and does the mechanical parts of managing the DNS root is interesting, this shouldn't be news, at least, not now. Since Verisign is a public company, they file a financial report called a 10-Q with the SEC every quarter. According to the SEC's web site, Verisign filed their 10-Q for June through September 2011 on October 28th. more

Project Title: Adopt-an-Haitian-Internet-Technician-or-Facility

I circulated this, and its precursors, notes about the necessity for diesel to keep the generators powering Boutilliers Hill NAP on the Hatian-Dominican Republic Border from failing, earlier this month on the North American Operators Group (NANOG) mailing list. Efforts by former ICANN people, in public service and in the private sector, were critical to bringing the continuity of the surviving infrastructure to the attention of the White House, the Department of State, and the Southern Command. more

Phish or Fair?

It shouldn't be a big surprise to hear that phishing is a big problem for banks. Criminals send email pretending to be a bank, and set up web sites that look a lot like a bank. One reason that phishing is possible is that e-mail has no built in security, so that if a mail message comes in purporting to be from, say, [email protected], there's no easy way to tell whether the message is really from bankofamerica.com, or from a crook. more

Facts & Tips for Consumers About the Epsilon Breach

There has been a lot of talk, blogging, tweeting and press reportage about the Epsilon breach, but little in the way of concrete information to consumers as to where they stand, if their personal information (PII) such as their name and email address has been lost to criminals. The CAUCE Board of Directors have developed the following FAQ that provides facts and guidance for those affected by the breach. more

U.S. Schools Targeted in Ransomware Attacks: White House Responds

In response to increasing ransomware attacks targeting U.S. educational institutions, the White House convened an inaugural cybersecurity summit this Tuesday. The malicious cyber onslaughts have led to the online leakage of confidential student data, ranging from medical files to reports on sexual assaults. more

Biden’s National Cybersecurity Strategy Suggests Increased Website Security, Customer Protection

Phishing attacks have been rising over the past couple of years. Reports show that there was a 345 percent increase in phishing attacks between 2020 and 2021. In 2022, the number of advanced phishing attacks rose by 356 percent. Behind these alarming numbers, however, is an even uglier picture of digital fraud: a difficult-to-quantify prevalence of fake or spoof websites. more

The Sysadmin’s Guide to Securing Your SaaS Apps

As an admin, app security should be a top priority - but SaaS apps represent a difficult challenge in that regard. How can you protect your business from their risks, while enjoying all their rewards? Within the average enterprise, there are 508 unique cloud applications in use. That number's overwhelming enough on its own without considering that 88% of those applications aren't enterprise ready, or the fact that one in five cloud applications has data sharing as a core functionality. more

EU’s Cyber Security Agency Identifying Five Areas as Critical IT Security

The EU's 'cyber security' Agency ENISA (The European Network and Information Security Agency) has launched a new report concluding that the EU should focus its future IT security research on five areas: cloud computing, real-time detection and diagnosis systems, future wireless networks, sensor networks, and supply chain integrity. more