Cybersecurity

Data Breaches Reported During 2016 Exposed Over 4.2 Billion Records

2016 broke the previous all-time high, set back in 2013, for the number of records exposed from reported data breaches. more

Facebook, Privacy, and Cryptography

There has long been pressure from governments to provide back doors in encryption systems. Of course, if the endpoints are insecure it doesn't matter much if the transmission is encrypted; indeed, a few years ago, I and some colleagues even suggested lawful hacking as an alternative. Crucially, we said that this should be done by taking advantage of existing security holes rather than be creating new ones. more

A Look Inside the European Response to Spam

Last week the European Network and Information Security Agency (ENISA), which assists the European Commission and its member states with network and information security issues, published its third Anti-Spam Measures Survey. The survey provides insight into how network operators in Europe are responding to the continued onslaught of email spam. more

Internet Society Activities at EuroDIG 2016: Trust, Collaborative Security, Zero Rating and More…

Over the next two days (9-10 June), the European Dialogue on Internet Governance (EuroDIG) takes place in Brussels, Belgium. With a theme of "Embracing the digital (r)evolution", EuroDIG has a full agenda and Internet Society staff will be participating in many aspects of the programme. For us, a primary focus will be at 11:30 CEST (UTC+2) on Thursday, June 9, when our President and CEO Kathy Brown opens the first Plenary with a keynote speech. more

Malware Reach Is Expanding, Ransomware on the Rise

We live in an online age, one where malware infections have become commonplace. Some might say this is the price of doing business online. News headlines report damaging attacks on well-known brands with depressing regularity. Consumer confidence suffers as customers look to organizations to sort out the issue, secure their transactions and fix the problem. more

Usenet, Authentication, and Engineering (or: Early Design Decisions for Usenet)

A Twitter thread on trolls brought up mention of trolls on Usenet. The reason they were so hard to deal with, even then, has some lessons for today; besides, the history is interesting. (Aside: this is, I think, the first longish thing I've ever written about any of the early design decisions for Usenet. I should note that this is entirely my writing, and memory can play many tricks across nearly 40 years.) more

Watch LIVE: Edward Snowden at HOPE-X Today at 2:00pm EDT (18:00 UTC)

Whether you view Edward Snowden as a criminal or a hero, or somewhere in between, you cannot dispute that his revelations about pervasive surveillance have changed the discussions about the Internet on both technology and policy levels. If you are interested in hearing what Edward Snowden has to say himself, he is scheduled to speak today, Saturday, July 19, 2014, at 2:00pm US EDT at the HOPE-X conference in New York City. more

The Importance of IPRC in Asia Pacific

I believe and strongly support Internet Principle and Right Coalition (IPRC) Charter is an important edition of document supplementing the principles and rights of individual internet users in any developing and least developed country. Especially in Asia Pacific region where the need and use of such document is immense, as there is a gap in recognition and awareness of rights of internet users. more

Call for “ISP Point of Contact” Database for Neutrality “Event” Concerns

When I initiated NNSquad (Network Neutrality Squad), one of my primary concerns was that many seemingly reportable "events" that can occur on the Internet -- and that might seem on their face to be network neutrality "violations" -- might actually be caused by innocent technical issues related to ISP operations, testing anomalies, or misinterpretation of test or otherwise observed data. Analysis of these situations -- which may invoke security and privacy concerns -- can be quite complex, and without a reasonably complete picture of events can also be considerably problematic... more

Equifax Announces Comprehensive Consumer Settlement for the 2017 Data Breach

Equifax has announced a comprehensive resolution for its 2017 cybersecurity incident that includes a fund of up to $425 consumer fund. more

DDoS Attacks on US Banks This Week Peaked at 60 Gbps

Distributed denial-of-service (DDoS) attacks that targeted U.S. financial institutions this week have reached 60 Gbps, according to researchers from DDoS mitigation provider Arbor Networks. more

Today’s CISOs Are Contending With Oft-Changing Disclosure Standards

When it comes to breach disclosures, today's chief information security officers (CISOs) are struggling with an especially turbulent regulatory environment. Security teams are understaffed, and systems are more extensive, making them harder to monitor and defend, while threats are becoming more sophisticated, more frequent, and more varied. It's at precisely this difficult juncture that regulations and enforcement are rapidly changing, leaving CISOs feeling like they are running up the down escalator. more

Hiding in Plain Sight: Post-Breach

The majority of network breaches begin and end with the installation of malware upon a vulnerable device. For the rest, once that initial malware beachhead has been achieved, the story is only just beginning. The breach disclosures that make the news are often confusing as they're frequently compiled from third-hand reports, opinions and technical assumptions. More often than not, they include a discussion about the malware - how advanced it was, etc. - and whether any 0-day vulnerabilities were likely used by the mysterious attacker. more

Closing in on the Google Hackers

Joseph Menn has an article on CNN.com wherein the crux of the story is that US experts are closing in on the hackers that broke into Google last month. It is believed by some that the Chinese government sponsored these hackers. China, naturally, denied involvement. My own take is that tools today are sophisticated enough such that you don't necessarily need state sponsorship in order to launch a cyber attack. more

Phishers Expand Number of Top Level Domains Abused, Policy Changes Found Effective in Prevention

The new Global Phishing Survey released by the Anti-Phishing Working Group (APWG) this month reveals that phishing gangs are concentrating their efforts within specific top level domains (TLDs), but also that anti-phishing policies and mitigation programs by domain name registrars and registries can have a significant and positive effect. The number of TLDs abused by phishers for their attacks expanded 7 percent from 145 in H2/2007 to 155 in H1/2008. The proportion of Internet-protocol (IP) number-based phishing sites decreased 35 percent in that same period, declining from 18 percent in the second half of 2007 to 13 percent in the first half of 2008. more