Cybersecurity

Officially Compromised Privacy

The essence of information privacy is control over disclosure. Whoever is responsible for the information is supposed to be able to decide who sees it. If a society values privacy, it needs to ensure that there are reasonable protections possible against disclosure to those not authorized by the information's owner. In the online world, an essential technical component for this assurance is encryption. If the encryption that is deployed permits disclosure to those who were not authorized by the information's owner, there should be serious concern about the degree of privacy that is meaningfully possible. more

GCIG Releases Final Report, ‘One Internet’

Monika Ermert reporting in the IP Watch: "On the eve of the third internet-related Ministerial Meeting of the Organisation for Economic Development and Cooperation (OECD) starting tomorrow in Cancun, Mexico, the Global Commission on Internet Governance (GCIG) published a think report on 'One Internet.' Calling for a new 'social compact' for the internet, the 140-page report that was fed by 50 research studies has a number of well-known recommendations, some surprisingly technical and some interesting ones." more

DNSSEC Becomes a Reality Today at ICANN Brussels

Attendees at the public ICANN meeting in Brussels today heard from over two dozen companies that have implemented or are planning to support DNSSEC, the next-generation standard protocol for secured domain names. It is clearer than ever before that DNSSEC is becoming a reality. more

ICANN Makes Urgent Call for Full Deployment of Domain Name System Security Extensions (DNSSEC)

In light of increasing reports of malicious activity targeting the DNS infrastructure, ICANN is calling for the full deployment of the Domain Name System Security Extensions (DNSSEC) across all unsecured domain names. more

Cyber Terrorism Is a Real Threat, and for the First Time Both Russia and the US Acknowledge It

Eugene Kaspersky, CEO and co-founder of Internet security giant Kaspersky Lab said last week that "terrorists could build a botnet that could bring down the entire Internet structure". Mr. Kaspersky ended his speech with the statement that "a global cyber police force, and global cooperation between law enforcement agencies and governments is needed". This goes very much in accordance with some of the conclusions in the Cyberspace Policy Review more

ICANN Begins Public DNSSEC Test Plan for the Root Zone

The deployment of Domain Name System Security Extensions (DNSSEC) for the root zone got an official start today with its public signing for the first time. DNSSEC for the root zone is a joint effort between ICANN and VeriSign, with support from the U.S. Department of Commerce to improve security of the Internet's naming infrastructure. Kim Davies, ICANN's Manager of Root Zone Services, says: "What happened today was the deliberately un-validatable root zone started being published on l.root-servers.net. It is anticipated this will be rolled out across the other root servers over the coming months. This phase is designed to identify any issues with the larger DNS response sizes associated with DNSSEC data." more

The Hack Will Be a Costly Affair for Optus

More and more information is becoming available about the breach of Optus (Australia's second-largest telco). It looks like the hacker is more of an amateur than a professional criminal or a "state actor." This makes the hack even more worrisome. It looks as though Optus didn't have its security house in order. This makes the issue all the more painful for the company. It will dent its reputation, and customers could become somewhat wary about dealing with the company. more

Schneier: Lasting IoT Security Will Only Happen if Governments Start Introducing Stiff Penalties

Without regulation, there is little hope companies will implement proper security protection measures for IoT devices, said author and security expert Bruce Schneier, during a panel discussion at the Aspen Cyber Summit. more

Majority of Popular Mobile-Only VPNs Are Run by Chinese Nationals or Located in China

While the current VPN market appears to be filled with numerous products by various companies, recent research that took a closer look into the market revealed very unexpected results. more

Averting the Internet Meltdown

A call to action went out: a small, California-based organization called People for Internet Responsibility (PFIR) posted an announcement for an urgent conference - "Preventing the Internet Meltdown." The meltdown that PFIR envisioned was not an impending technical malfunction or enemy attack. Instead, conference organizers foresaw "risks of imminent disruption" to the Internet that would come from an unlikely sector: government officials and bureaucrats working on the unglamorous-sounding problems of Internet Governance. more

Web Server Botnets and Server Farms as Attack Platforms

Are file inclusion vulnerabilitiess equivalent to remote code execution? Are servers (both Linux and Windows) now the lower hanging fruit rather than desktop systems? In the February edition of the Virus Bulletin magazine, we (Kfir Damari, Noam Rathaus and Gadi Evron (me) of Beyond Security) wrote an article on cross platform web server malware and their massive use as botnets, spam bots and generally as attack platforms. Web security papers deal mostly with secure coding and application security. In this paper we describe how these are taken to the next level with live attacks and operational problems service providers deal with daily. more

The Internet as Weapon

One of the most striking and enduring dichotomies in the conceptualization of electronic communication networks is summed up in the phrase "the Internet as weapon." With each passing day, it seems that the strident divergence plays in the press -- the latest being Tim's lament about his "web" vision being somehow perverted. The irony is that the three challenges he identified would have been better met if he had instead pursued a career at the Little Theatre of Geneva and let SGML proceed to be implemented on OSI internets rather than refactoring it as HTML to run on DARPA internets. more

IGF Best Practice Forums, an Opportunity to Bring Your Experience to the Policy Debate

In the run-up to the 14th Internet Governance Forum in Berlin, Germany, 25 to 29 November, different groups are discussing best practices pertaining to specific internet governance policy questions. These groups are open and thrive on your input and experiences. Their findings will be presented at the IGF and published shortly after. The IGF Best Practice Forums intend to inform internet governance policy debates by drawing on the immense and diverse range of experience and expertise... more

Designing Secure Networks with Cisco Technology, Part 3

In this multipart series I will be presenting some of the leading industry-standard best practices for enterprise network security using Cisco technologies. Each article in the series will cover a different aspect of security technologies and designs and how each can be deployed in the enterprise to provide the best security posture at the lowest possible budgetary and administrative cost. In Part 2 of this series I discussed security risks and vulnerability. In this article we begin to focus on the role Cisco network and security technologies play in ensuring the safety and security of network data. more

NTIA Issues RFC, Asks for Input on Dealing With Botnets and DDoS Attacks

NTIA issued a Request for Comments today asking for broad input from "all interested stakeholders, including private industry, academia, civil society, and other security experts," on actions against botnets and distributed attacks. more