Cybersecurity

At the Start of the NL IGF

At the annual Dutch "delegation" dinner at the Internet Governance Forum (IGF) in Vilnius, Lithuania, I voiced that it may be a good idea to start a Dutch IGF. This followed a discussion in which we discussed the possibilities of involving more people and organisations from the Netherlands in Internet governance. The, now, Ministry of Economic Affairs, Agriculture and Innovation followed this thought and made it possible for the ECP/EPN foundation to start the NL IGF. more

Canada’s Electronic Spy Agency Makes Its Malware Analysis Tool Public

Canada's Communications Security Establishment (CSE) which rarely discloses detail of its activities has taken the "unprecedented step" of releasing one of its own cyber defense tools to the public, in a bid to help companies and organizations better defend their computers and networks against malicious threats. more

A Cynic’s View of 2015 Security Predictions - Part 3

A number of security predictions have been doing the rounds over the last few weeks, so I decided to put pen to paper and write a list of my own. However, I have a quite a few predictions so I have listed them over several blog posts. After all, I didn't want to bombard you with too much information in one go! Part three examines the threats associated with data breaches. more

On the Success of Malware

There's often a lot of discussion about whether a piece of malware is advanced or not. To a large extent these discussions can be categorized as academic nitpicking because, at the end of the day, the malware's sophistication only needs to be at the level for which it is required to perform -- no more, no less. Perhaps the "advanced" malware label should more precisely be reattributed as "feature rich" instead. more

Unintended Benefits of Trump’s Twitter Tantrum

Four years ago, progressive intergovernmental organizations like the European Union became increasingly concerned about the proliferation of hate speech on social media. They adopted legal mechanisms for removing Twitter accounts like Donald Trump's. The provisions were directed at Facebook, Twitter, and YouTube. In June of 2016, a "deconstruction" of these mechanisms was presented to one of the principal global industry standards bodies with a proposal to develop new protocols to rapidly remove such accounts. more

BYOD Woes and Worries

Like the scene of a movie in which a biblical character holds back the mighty sea and is about to release the tide against his foes, BYOD has become a force of nature poised to flood those charged with keeping corporate systems secure. Despite years of practice hardening systems and enforcing policies that restrict what can and can't be done within the corporate network, businesses are under increasing (if not insurmountable) pressure to allow a diversifying number of personal devices to connect to their networks and be used for business operations. more

Beyond Domains: What Did We Really Learn in 2009?

The beginning of every year is a time for introspection, an appraisal of the year that was, and planning for the year to come. It is also a time to follow tradition and to recap the biggest news of the year. But by now, I am guessing that we have all read our fair share about the people and events who have impacted the last 12 months... if we take a larger vantage point (than our own relatively small domain name industry), these lessons from 2009 -- in my view -- could teach us all and most importantly, really shape the year ahead. more

Why Passwords Have Never Been Weaker and Crackers Have Never Been Stronger

The past few weeks, I've been on this security kick particularly when it comes to encryption. I'm developing my own app in my spare time. So I'm trying a whole bunch of things, no doubt making plenty of mistakes in the process. Luckily, the data I am protecting is only quasi-valuable so I can afford to take a hit due to my own conscious incompetence. Anyhow, I ran across this article on Ars Technica yesterday entitled "Why Passwords have never been weaker - and crackers have never been stronger." It's a long article and it will take you a while to read it, but here is my summary. more

Some Hackers Earning Over 16 Times That of Full-Time Software Engineers in Their Home Country

A report from one of the largest documented surveys conducted on the ethical hacking community reveals some hackers are earning over 16 times that of full-time software engineers in their home country. more

Helping Haiti: The Email Community Response

It is inconceivable that anyone within viewing distance of a television or computer screen this week doesn't know about the disaster in Haiti. As of this writing, 50,000 bodies have been collected from the streets of Port-au-Prince. Millions of people, a number our brains simply aren't equipped to deal with, are now homeless. Help is needed now, and will be, for a very long time. more

Web Encryption - It’s Not Just for E-Commerce, Anymore

Last week, I re-tweeted Cloudflare's announcement that they are providing universal SSL for their customers. I believe the announcement is a valuable one for the state of the open Internet for a couple of reasons: First, there is the obvious -- they are doubling the number of websites on the Internet that support encrypted connections. And, hopefully, that will prompt even more sites/hosting providers/CDNs to get serious about supporting encryption, too. Web encryption -- it's not just for e-commerce, anymore. more

April 8 2014: A World Less Secure

Not long after the message that Microsoft will stop updating Windows XP from 8 April onwards, after extending it beyond the regular life cycle for over a year already, came the soothing message that malware will be monitored for another year. That may be good news to some, but the fact remains that this is not the same as patching. Remaining on XP leads to a vulnerable state of the desktop, lap top and any other machine running on XP; vulnerable to potential hacks, cyber crimes, becoming part of a botnet, etc. more

Building a Secure Global Network

Recently, the DNS has come under an extensive attack. The so-called "DNSpionage" campaigns have brought to light the myriad methods used to infiltrate networks. These attacks employed phishing, system hopping via key exfiltration, and software zero day exploits, illustrating that many secure networks may not be fully protected. more

Phishing 2020: A Concentrated Dose of Badness

How much phishing is there? Where is it occurring, and why? How can it be reduced? I and my colleagues at Interisle Consulting have just published a new study called Phishing Landscape 2020, designed to answer those questions. We assembled a deep set of data from four different, respected threat intelligence providers and enriched it with additional DNS data and investigation. The result is a look at phishing attacks that occurred in May through July 2020. more

Usenet, Authentication, and Engineering (or: Early Design Decisions for Usenet)

A Twitter thread on trolls brought up mention of trolls on Usenet. The reason they were so hard to deal with, even then, has some lessons for today; besides, the history is interesting. (Aside: this is, I think, the first longish thing I've ever written about any of the early design decisions for Usenet. I should note that this is entirely my writing, and memory can play many tricks across nearly 40 years.) more