Cybersecurity

Leading a Horse to Water

It is one thing to bring broadband internet to the masses, but how do we make them drink from the fountain of knowledge? One of the challenges, of course, is that the industry has not yet sold turn-key applications that capture the imaginations of the unconnected. Surprising as it seems, email, Facebook, file swapping and web surfing have not yet attracted 100% of the population. Are there some applications that might lend themselves to a toll-free model in order to reach the rest of the market? more

Government Hacking: Proposed Law in the Netherlands

In 2012 I wrote a blog on CircleID called State hacking: Do's and don'ts, pros and cons. In this post I give some thoughts to the concept of a government "hacking back" at criminals. The reason for this was an announcement by the Dutch government that it contemplated law along these lines. The proposed law is now here: the Act Computer Criminality III. more

Who Is Responsible for Your Application’s Security?

The dividing line between developers and IT operations used to be distinct. Developers were responsible for adding new features securely, but it was IT operations who had responsibility for infrastructure and network security. For the most part, developers didn't have to think too much about the wider security context. With the advent of the cloud, and of devops, things changed radically. more

5th ITAC OECD Newsletter: Internet Governance, WSIS+10, IoT, Cybersecurity, Trust, Standards…

Today the Internet Technical Advisory Committee (ITAC) to the OECD published the fifth edition of its newsletter. The ITAC was created in 2009 following the OECD's Seoul Ministerial with the objective to provide Internet technical and policy expertise to the work of the OECD on Internet-related issues. This informal group is coordinated by the Internet Society and currently counts 28 members active in domains such as open Internet/Web standards development, interconnection, IP addressing, security or privacy. more

11 Information Economy Policy Reversals Coming to a Marketplace Near You!

In the wake of the election, sweeping policy shifts in the information economy are set to accelerate. Expect fast-tracked FCC reforms, Starlink subsidies, and AI-driven oversight to redefine media, tech, and regulatory landscapes. From relaxed antitrust to intensified media control, these eleven reversals signal a move toward deregulation and Chicago School libertarianism, with lasting impacts on U.S. markets and governance. more

2023 Routing Security Summit Starts July 17 - Participate Virtually

Interested in learning more about routing security? How it can affect your connectivity supply chain? What are best practices for enterprises and organizations? What is the role of CSIRTs in securing routing? What are governments doing now, and planning to do in the future around routing security? more

Spam from Mobile Networks? Who Woulda Thought…

Mobile networks aren't usually thought of as sources of spam, but a quick look at some of the resources that track spam reveals they actually are. This is counter intuitive at first glance because when most people think of mobile they think of smartphones, and those aren't known to be sources of spam (at least not yet). What's really going on is PCs connected to mobile networks with air cards, or tethered with a smartphone where it's permissible, are the culprits more

Akamai: DDoS Attacks Increased 71 Percent in Q3 2016 as Compared to Q3 2015

Akamai releases its Third Quarter, 2016 State of the Internet / Security Report, providing analysis of the current cloud security and threat landscape, including insight into two record setting DDoS attacks caused by the Mirai botnet. more

Governing the Invisible: AI Risks in Telecom Infrastructure Outpace Global Legal Frameworks

As AI systems take on critical roles in telecommunications, global regulatory frameworks remain outdated and fragmented, leaving essential infrastructure vulnerable to novel risks that current laws on cybersecurity and data protection fail to address. more

Some Thought on the Paper: Practical Challenge-Response for DNS

Because the speed of DNS is so important to the performance of any connection on the 'net, a lot of thought goes into making DNS servers fast, including optimized software that can respond to queries in milliseconds, and connecting DNS servers to the 'net through high bandwidth links. To set the stage for massive DDoS attacks based in the DNS system, add a third point: DNS responses tend to be much larger than DNS queries. more

Security, Backdoors and Control

Encryption is a way to keep private information private in the digital world. But there are government actors, particularly here in the US, that want access to our private data. The NSA has been snooping our data for years. Backdoors have been snuck into router encryption code to make it easier to break. Today at M³AAWG we had a keynote from Kim Zetter, talking about Stuxnet and how it spread well outside the control of the people who created it. more

Blocking Shodan

The Internet is chock full of really helpful people and autonomous systems that silently probe, test, and evaluate your corporate defenses every second of every minute of every hour of every day. If those helpful souls and systems aren't probing your network, then they're diligently recording and cataloguing everything they've found so others can quickly enumerate your online business or list systems like yours that are similarly vulnerable to some kind of attack or other. more

Canada Launching DNSSEC Test-Bed for Country’s .CA Domain

The Canadian Internet Registration Authority (CIRA) for the .ca country code Top-Level Domain yesterday announced the launch of a test-bed initiative for DNSSEC. CIRA’s Chief Information Officer, Norm Ritchie who made the official announcement at the SecTor security conference in Toronto, says it began the process of implementing DNSSEC in early 2009 and the implementation date is set for 2010. So far, over 15 Top-Level Domains have already deployed DNSSEC including dot-gov and dot-org. more

One Year Later: Lessons Learned from the Target Breach

As the autumn leaves fall from naked trees to be trampled or encased in the winter snow, it reminds us of another year quickly gone by. Yet, for organisations that were breached and publicly scrutinised for their security lapses, it's been a long and arduous year. It was about this time last year that the news broke of Target's mega breach. Every news outlet was following the story and drip feeding readers with details, speculation and "expert opinion" on what happened, why it happened and who did it. more

Time to Start Calling Facebook “The Dark Empire” and Regulate It Accordingly

It appears people, governments, regulators and legislators worldwide may have forgotten Facebook's complicit involvement with Cambridge Analytica (CA). It is possible that new priorities such as the Covid-19 pandemic in 2020 may have pre-occupied them, and rightly so. But an unprecedented data breach in 2019 unfolded this weekend, bringing a recurring nightmare of the past back into today's reality. more