Cybersecurity

Achieving a Cyber-Reliant Infrastructure

Don't worry about the bad guys turning out the lights. Worry about everything they're stealing while the lights are still on. The theft of intellectual property ranging from Hollywood films to defense secrets is underway by cyber-criminals of various stripes. Maintaining control over intellectual property may be the single most important challenge to American economic security. Implementing a cyber-reliant infrastructure is a national challenge which crosses the traditional boundaries between economic sectors and between public and private domains. more

Navigating the “Pentest” World

The demand for penetration testing and security assessment services worldwide has been growing year-on-year. Driven largely by Governance, Risk, and Compliance (GRC) concerns, plus an evolving pressure to be observed taking information security and customer privacy seriously, most CIO/CSO/CISO's can expect to conduct regular "pentests" as a means of validating their organizations or product's security. more

The World of the Subdomain

A web domain name is the foundational piece of internet property allowing its owner (registrant) to construct and host an associated website. On a domain, the owner is also able to construct whatever subdomains they wish -- a process that is technically achieved via the configuration of records on the authoritative domain name system (DNS) server. more

Remembering the Good Times

The most effective early email-borne viruses didn't need botnets. They didn't change your computer settings, or steal your login credentials. And they somehow convinced regular users to help them spread. The first warnings about the Good Times virus began to appear in November of 1994, and by December the warnings were seen all over as people did what the warning said, and forwarded it to all their friends. There was another outbreak the following March... more

Yahoo’s 1 Billion Accounts Hacked is a Chilling Warning: Start Doing Things Differently or Die

Today, this is how easily "TRUST" by your users/customers can be shattered, your revenues devastated, your share value plunged into the abyss, and your business destroyed. Furthermore, conventional thinking belongs only in university libraries, not in board rooms. It is time to seriously consider other innovative Out-Of-The-Box Solutions and doing things differently, or start writing your business obituary. more

A Sophisticated Online Counterfeit Ring

Online fakes can be a lucrative business and difficult to crack down on, due to the ease and low-cost of setting up multiple virtual storefronts and the ability to obfuscate an operation's identity. A federal lawsuit filed on March 1, 2010 by Polo Ralph Lauren and VF Corp. illustrates these points and highlights many of the intricacies of an online counterfeit ring. more

Aged Security Flaw Renews Open/Closed-Source Debate

The recent announcement of a 13-year old security flaw found in an Open Source security library has renewed the debate between open source and closed source software. The library, crypt_blowfish, allows for fast two-way password encryption. The flaw introduces the potential for passwords to be easily compromised and affects PHP and a number of Linux distributions that include the crypt_blowfish library. more

Cyber Security: A Duty to Care?

Yesterday, in my post on three new threats in one day, I posed the question whether it was necessary to develop regulations that would set a minimum standard on cyber security for devices that connect to the Internet. I'm having second thoughts here, which I'll explain in this post, but also try to look at a way forward and ask you to engage. more

Increasing the Strength of the Zone Signing Key for the Root Zone, Part 2

A few months ago I published a blog post about Verisign's plans to increase the strength of the Zone Signing Key (ZSK) for the root zone. I'm pleased to provide this update that we have started the process to pre-publish a 2048-bit ZSK in the root zone for the first time on Sept. 20. Following that, we will publish root zones with the larger key on Oct. 1, 2016. more

Facebook Security Vulnerability Allowed Attackers to Steal User Access Tokens Affecting 50 Million

Facebook alerted users today that its engineering team on Tuesday had discovered a security issue affecting almost 50 million accounts. more

US Policy Container: Depoliticizing the Global Internet

One of fastest growing trends of electronic communications is digital identity. The simplest way of establishing digital identity is to get a domain name and create a web site and email accounts. While this might have been a fairly complex undertaking some ten years ago, today it is a trivial matter. So trivial in fact that spammers and phishers can ply their trade with very low costs of entry. These low cost of entry have made the Internet a commodity business as traffic is handled in the aggregate and competitive pricing has made being an ISP a difficult business model. It also has created aggressive growth and adoption curves. The Internet is also the lowest common denominator... more

Businesses Beware: Cybersecurity Awareness Varies Based on Job Function

Businesses should consider bumping phishing as an urgent concern in their cybersecurity agendas. To those still unacquainted, "phishing" refers to the use of fake emails, messages, and websites that fool users into giving up access to accounts and information or into installing malware through attachments. It has become quite rampant over recent years. Attackers are using the method as a primary means to breach defenses, and with good reason: they work. more

Cryptographic Catastrophe Theory

Technologists and law enforcement have been arguing about cryptography policy for about 30 years now. People talk past each other, with each side concluding the other side are unreasonable jerks because of some fundamental incompatible assumptions between two conceptual worlds in collision. In the physical world, bank branches have marble columns and granite counters and mahogany woodwork to show the world that they are rich and stable. more

Why the Fukushima Analogy Was Apt

A few days ago, CAUCE published a blog post entitled "Epsilon Interactive breach the Fukushima of the Email Industry" on our site, and the always-excellent CircleID. A small coterie of commenters was upset by the hyperbolic nature of the headline. Fair enough, an analogy usually has a high degree of probability that it will fail, and clearly, no one has died as a result of the release of what appears to be tens of millions of people's names and email addresses. But, the two situations are analogous in many other ways, and here's why. more

DNS Insecurity

The Internet as we know it and use it today -- is broken, badly broken. Yes broken so much so that we are really crazy to have any expectations of privacy or security. Yes, really. The Internet was conceived as somewhat of a utopian environment, one where we all keep our doors, windows and cars unlocked and we trust all the people and machines out there to "do the right thing...". more