Security Standards for the Internet of (Insecure) Things?

Everything you can think of and many things you have never dreamed of are being manufactured with little Linux operating systems and wireless Internet connections. Or in simpler terms, a brain, storage, and communications ability. This is the Internet of Things (IoT).  Lots and lots of “smart” devices talking to each other and phoning home to some data collection or dissemination point.  If only the people who are designing these devices, ...

Continue Reading →
0

Don’t Make Yourself A Target

Many social network sites make it too easy to overshare personal information.  An innocent post to Twitter or Facebook, or pictures uploaded to SnapChat or Instagram can help a criminal target you.  Online posts that identify your location, your travel and vacation plans, your employer, your home, and your personal possessions can be used by criminals to plan an crime.  Kidnapping ...

Continue Reading →
0

US-CERT Releases More About Grizzly Steppe

US-CERT just released more information about the Grizzly Steppe cybercrime group who has been fingered for hacking the DNC and US voter registration databases.  The short  report, titled Enhanced Analysis of GRIZZLY STEPPE Activity, makes interesting reading, especially if you are interested in finding out more about state-sponsored political espionage.  See pages 4-7 for the main story.

The Grizzly Steppe group is certainly ...

Continue Reading →
0

The Problem With Biometric Authentication

NIST is working on new authentication standards, and there are some surprising changes coming out of this effort.  One of the issues that NIST is dealing with is the use of biometrics for authentication.  But there are problems with biometrics.  Here they are from the NIST Special Publication 800-63b.  Emphasis is mine.

“5.2.3. Use of Biometrics

For a variety of reasons, this ...

Continue Reading →
0

FTC Sues D-Link Over Poor Security

We have complained in this blog about the plethora of Internet connected IoT devices that are being sold without anything approaching meaningful security to an unsuspecting public. A notable exploitation of IoT devices was behind the Mirai botnet, which shut down significant parts of the Internet for a couple of days.

But other disasters await, for instance, the easy access of web cams from the Internet ...

Continue Reading →
0

Beyond the Kill Chain – Active Defense

I have been working my way through a Cybrary course titled ” Incident Response and Advanced Forensics.”  In it I came across the following slide, and what interested me was how it juxtaposed the Lockheed-Martin Cyber Kill Chain against a lower row of defensive tactics.  The last option, hidden beneath the instructor’s image, is “Destroy.”

Where did this intriguing six ...

Continue Reading →
0

The Best Defense

Is a good offense?  If you or your company has been a victim of cyber-crime, I am sure you have had fantasies about back-hacking the perpetrators back to the stone age.  Or having some sort of magic button phone app that would do the same thing.

Currently, the bad guys are running the offense, 24/7/365.  The good guys are limited to defense only.  There is ...

Continue Reading →
0

New European Regulations Could Affect Your Business.

On May 25 2018, new regulations will go into effect in the European Union called the General Data Protection Regulation (GDPR).  If you are doing business in Europe, this will affect your business.  If your website collects personal information and other data from European site visitors or customers, this will affect your business.

The Europeans take personal privacy, especially online privacy, much more ...

Continue Reading →
0

The Russians Are Coming! Or Are They?

The United States recently accused the Russian government of trying to influence US elections last November, and has expelled 35 Russian diplomatic officials and closed two Russian diplomatic facilities, one in New York City, and the other in Maryland, near Washington DC.

The Russians are denying any direct involvement, of course, and are laying the blame on Russian cyber-criminal groups.    But we have discussed ...

Continue Reading →
0

U.S. House Supports Encryption

The House Judiciary Committee’s Encryption Working Group has released a report that comes out in favor of strong encryption, and opposed to the daft notion of creating encryption  “backdoors” for law enforcement and government to use.  As we have expressed in this blog previously, the concept that the secret backdoor keys could somehow be kept securely, when nothing else seems to be able to be kept secret, is the main fatal ...

Continue Reading →
0
Page 2 of 6 12345...»