Cybersecurity

No Virginia, You Have No Duty to Secure Your WiFi Access Point

Every now and again a report flies across the network about the police breaking down someone's door and attempting to arrest the home owner for bad things online - assuming that whatever happened from that person's Internet connection is their fault. Now there are lots of problems with this - lots of problems. But one of the big ones is that anyone can access an open access point... more

Institutionalizing Consumer Trust and Public Interest at ICANN

For an organization where people argue for hours over arcane minutiae, it's remarkable that virtually everyone agrees that ICANN should serve the "global public interest" and build "consumer trust" in the Internet. Although it's only three pages long, ICANN's Affirmation of Commitments (AoC) cites "public interest" five times and "consumer trust" eight times. So at the ICANN meeting today in Cartagena, Colombia, a group of participants explored ways to "institutionalize" these concepts within the organization. more

Mitigating the Increasing Risks of an Insecure Internet of Things

The emergence and proliferation of Internet of Things (IoT) devices on industrial, enterprise, and home networks brings with it unprecedented risk. The potential magnitude of this risk was made concrete in October 2016, when insecure Internet-connected cameras launched a distributed denial of service (DDoS) attack on Dyn, a provider of DNS service for many large online service providers (e.g., Twitter, Reddit). Although this incident caused large-scale disruption, it is noteworthy that the attack involved only a few hundred thousand endpoints... more

The Story of Conficker and the Industry Response

On November 2, 2009, Microsoft released its seventh edition of the Security and Intelligence Report (SIR). The SIR provides an in-depth perspective on the changing threat landscape including software vulnerability disclosures and exploits, malicious software (malware), and potentially unwanted software. Using data derived from hundreds of millions of Windows computers, and some of the busiest online services on the Internet, this report also provides a detailed analysis of the threat landscape and the changing face of threats and countermeasures and includes updated data on privacy and breach notifications. The following is an excerpt from the SIR, pp 29-32, about the Conficker worm and the industry response that showed an incredible amount of collaboration across vendors. more

Registration Patterns of Deceptive Domains

A key requirement for a bad actor wanting to launch a brand attack is the registration of a carefully chosen domain name. The most convincing infringements frequently use a domain name that's deceptively similar to that of the official site of the target brand. This allows a variety of attacks to be executed, including phishing attacks... more

If You Build It, They Will Come.

Only two years after signing the DNS root zone, the powerful lure of a secure global infrastructure for data distribution is starting to reveal itself. It is illustrated clearly by two proposed technical standardizations that seek to leverage secure DNS. To some degree these developments highlight the strength of DNS institutions and how they might fill gaps elsewhere in the Internet's governance. But an increasing reliance upon and concentration of power in the DNS also makes getting its global governance correct even more important. more

Household Botnet Infections

Pinning down the number of infected computers is really, really hard. I'd go as far as saying it's practically impossible to calculate, let alone observe. Still, that's not going to stop people from attempting to guess or extrapolate from their own observations. Over the years I've heard "reliable" numbers ranging from 10% through to 60% -- and I don't trust any of them. There's a whole gaggle of reasons why the numbers being thrown out to the public are inaccurate and should ideally be interpreted with a lot of skepticism by any right-minded folks. more

Don’t Make Us Treat Our Customers Like Criminals!

Crime, fraud, scams etc., they're all very bad things. They're also not going to go away anytime soon. As a domain name registrar and hosting provider we're constantly "at risk", as we sell a lot of services that are both cost-effective and also give criminals the tools they need to attack 3rd parties. Again, this isn't exactly news. We've always taken a very pro-active approach to dealing with criminal activity and network abuse... But recently I've been losing sleep. more

Schneier: Lasting IoT Security Will Only Happen if Governments Start Introducing Stiff Penalties

Without regulation, there is little hope companies will implement proper security protection measures for IoT devices, said author and security expert Bruce Schneier, during a panel discussion at the Aspen Cyber Summit. more

New Report on “State of DNSSEC Deployment 2016” Shows Continued Growth

Did you know that over 50% of .CZ domains are now signed with DNS Security Extensions (DNSSEC)? Or that over 2.5 million .NL domains and almost 1 million .BR domains are now DNSSEC-signed? Were you aware that around 80% of DNS clients are now requesting DNSSEC signatures in their DNS queries? And did you know that over 100,000 email domains are using DNSSEC and DANE to enable secure email between servers? more

Brands Should Not Ignore the Security Benefits of New gTLDs

If one thing has become clear from recent commentary on ICANN's new top-level domain program, it's that there's a dramatic lack of understanding about some of the benefits of owning your own TLD - especially as it relates to security. Many brand owners - especially those with luxury brands - could realize immediate benefits from reduced counterfeiting and greater brand trust with a "dot Brand." more

CircleID’s Top 10 Posts of 2018

It is once again time for our annual review of posts that received the most attention on CircleID during the past year. Congratulations to all the 2018 participants for sharing their thoughts and making a difference in the industry. more

Centralizing the Net, Monetizing DNS, Getting Trendy?

In a Red Herring Conference held last week in California, Mitch Ratcliffe's offers an analytical overview of an interview held with Stratton Scalovs, VerisSign's CEO..."He then goes on to say that we need to move the complexity back into the center of the Net! He says the edge can't be so complex. Get David Isenberg in here! Ross Mayfield, sitting in front of me, laughs out loud. I am dumbfounded. According to VeriSign, the Net should not be open to any type of application, only applications that rely on single providers of services, like VeriSign. This is troglodyte talk." more

Project Title: Adopt-an-Haitian-Internet-Technician-or-Facility

I circulated this, and its precursors, notes about the necessity for diesel to keep the generators powering Boutilliers Hill NAP on the Hatian-Dominican Republic Border from failing, earlier this month on the North American Operators Group (NANOG) mailing list. Efforts by former ICANN people, in public service and in the private sector, were critical to bringing the continuity of the surviving infrastructure to the attention of the White House, the Department of State, and the Southern Command. more

Proactive Cybersecurity: What Small Businesses Can Actually Do

In the business world, there are two main paths a company can take with cybersecurity -- the reactive and the proactive approach. The problem with a purely reactive attitude is that it can easily put companies in constant firefighting mode. And for small companies with limited resources, this can turn out to be an increasingly uncomfortable place to be in.
With that in mind, experts today suggest proactive cybersecurity by monitoring suspicious activity and identifying risks before they turn into full-blown attacks. more