Cybersecurity

Watching North Korea’s Internet Connectivity Go Up and Down Via Twitter

One thing I enjoy about following Dyn Research (formerly Renesys) on Twitter is that they provide quite interesting graphics and charts about Internet outages. They've been tracking North Korea's Internet access quite closely over the past week and their tweets have been quite enlightening. Back on December 22, for instance, DynResearch tweeted a chart showing a 9-hour, 31-minute outage... more

Thoughts on IPv6 Security, Take Two

A few months ago, I made a post about IPv6 security. I've caught some flak for saying that IPv6 isn't a security issue. I still stand by this position. This is not to say that you should ignore security considerations when deploying IPv6. All I claim is that deploying IPv6 in and of itself does not make an organization any more or less secure. This point was made by Dr. Joe St. Sauver, of the University of Oregon... more

NSA, Prism and Internet Exchange Points in Canada

As the operator of the registry for the .CA top-level domain and the domain name system (DNS) infrastructure that supports it, I am uncomfortable, though not surprised, with the knowledge that a government is monitoring the activities of Internet users. And while recent reports about the National Security Agency's top-secret PRISM program actively monitoring Internet users in the United States and (by default) citizens of other countries - Canada included - are on the front page of newspapers around the world, Internet surveillance is not exactly new. more

Overcoming Cloud Storage Security Concerns: 7 Key Steps

According to a 2013 TwinStrata survey, 46 percent of organizations use cloud storage services and 38 percent plan to adopt this technology in the near future. Cloud storage capacity demands are increasing 40 to 60 percent year-over-year, while storage density lags behind at 20 percent. The result? More data, growing demands for space and increasing security concerns. How do enterprises overcome cloud storage security challenges? more

The Coming Cybersecurity Regulatory Revolution

Cybersecurity regulation will take its place alongside environmental regulation, health and safety regulation and financial regulation as a major federal activity. What is not yet clear is what form the regulations will take. FISMA controls, performance standards, consensus standards and industry-specific consortia standards are all possible regulatory approaches. What is not likely is an extended continuation of the current situation in which federal authorities have only limited, informal oversight of private sector cyberdefenses (or lack thereof). more

Cryptominers Infected 10x More Organizations Than Ransomware in 2018

A new security report reveals cryptominers infected ten times more organizations than ransomware in 2018, but only one in five IT security professionals were aware their company's networks had been infected by mining malware. more

Cyberwar vs No Cyberwar

I was browsing CircleID the other day and came across Bruce Schneier's article on cyberwar. Schneier's article, and the crux of his point, is that the term cyber war and the threat of cyber warfare has been greatly exaggerated. The real problem in cyberspace is not the threat of cyber warfare wherein a foreign government, or possibly non-state actor, conducts a cyber attack on another nation. more

ICANN’s Last Call for Whois Comments

From "Last Call for Whois Comments", a recent opinion piece by eWeek's Security Center Editor Larry Seltzer: "It's not a good sign when the criminals and the lawyers are on the same side of an issue; there may be no good solution to the problems of Whois service rules. Who would have imagined that so much business and so much abuse would center around Internet domain names? Certainly not the designers of the system, including those of the Whois service, which reports on ownership and some other data on domain names... more

Why DNS Is Broken, Part 1: Trust

So this Internet thing, as we discussed in our last article, is broken. I promised to detail some of the specific things that are broken. Implicit trust is the Achilles heel of the Internet... All of the communication between the resolver and the DNS server is in plain text that can be easily seen and changed while in transit, further, the resolver completely trusts the answer that was returned... more

The Missing Link in Dotless Domains

Well more than a year ago, ICANN's Security and Stability Advisory Committee published SSAC 053, its paper on single-label domain names - now referred to in the community as "dotless" domains - advising against their use. In a robust comment period, the community weighed in on the utility and safety of dotless domains, with some in favor and some opposed. To address the matter, ICANN has commissioned further study of the issue with an eye toward resolving the issue for new gTLD applicants. more

Emerging Markets Tech Watch 2012

2011 has been a significant year for the technology sector globally. Information technology is touching more people in more ways than ever before. Developed markets will be considering a 2012 in which business innovation, competitiveness, and service differentiation are built on ubiquitous broadband, cloud computing, smarter mobile computing, and an increasing plethora of Internet-connected devices. By contrast, securing the technology future for developing markets demands that attention be placed on more fundamental issues. more

VeriSign-ICANN Proposed Settlement Discussed in Vancouver

Unfortunately I cannot be in Vancouver for the conference. I write this from Cape Town, venue of last years fall ICANN. I want to disclose a couple of things upfront. Those who know me will know I am nothing if not strongly independent in my views. However disclosure helps those of a more suspicious mind know my associations and if they choose to, take them into account in interpreting my opinions. ...I am somewhat disappointed by the reaction to the proposed settlement. I feel that most of the discussion fails to take into account the actual conditions under which the settlement has been negotiated. more

The Public Interest and the Root: Why the Next Round Demands a Public Law Approach to DNS Governance

As ICANN prepares to expand the domain name space, calls grow for a public-law framework to govern the DNS root, ensuring global equity, transparency, and accountability in managing the Internet's core infrastructure. more

A Closer Look at Postponing of the Root Zone KSK Rollover Decision

On Sept. 27, Internet Corporation for Assigned Names and Numbers (ICANN) announced that the first root zone Key Signing Key (KSK) rollover - originally scheduled to take place on Oct. 11 - will be postponed. Although this was certainly a difficult decision, we fully agree that erring on the side of caution is the best approach to take. In this blog post, I want to explain some of the involvement Verisign has had in KSK rollover preparations, as well as some of the recently available research opportunities which generated data that we shared with ICANN related to this decision. more

New gTLDs: Floodgates for Spammers?

Ever since I heard of the new generic Top-Level Domains (gTLDs), I wondered whether they would be prone to abuse. For example, Microsoft might want to register www.microsoft.microsoft, or Sony might want to register www.sony. But isn't this opening up the floodgates for spammers to register their own domains and squat on them? Why couldn't a spammer register www.cit.ibank? They could then send phishing messages and fool people into clicking very legitimate looking domains. But I don't think this will be a problem. more