Category: cybersecurity

Auto Added by WPeMatico

NIST Is Updating Its Cybersecurity Framework

Posted on By infossl
cybersecurity, national security policy, nist, Security technology, Uncategorized

NIST is planning a significant update of its Cybersecurity Framework. At this point, it’s asking for feedback and comments to its concept paper. Do the proposed changes reflect the current cybersecurity landscape (standards, risks, and technologies)? Are the proposed changes sufficient and appropriate? Are there other elements that should be considered under each area? Do … Read More “NIST Is Updating Its Cybersecurity Framework” »

US Cyber Command Operations During the 2022 Midterm Elections

Posted on By infossl
cyberattack, cybersecurity, hacking, national security policy, Security technology, Uncategorized, voting

The head of both US Cyber Command and the NSA, Gen. Paul Nakasone, broadly discussed that first organization’s offensive cyber operations during the runup to the 2022 midterm elections. He didn’t name names, of course: We did conduct operations persistently to make sure that our foreign adversaries couldn’t utilize infrastructure to impact us,” said Nakasone. … Read More “US Cyber Command Operations During the 2022 Midterm Elections” »

Breaking the Zeppelin Ransomware Encryption Scheme

Posted on By infossl
cryptanalysis, cybersecurity, encryption, ransomware, Security technology, Uncategorized

Brian Krebs writes about how the Zeppelin ransomware encryption scheme was broken: The researchers said their break came when they understood that while Zeppelin used three different types of encryption keys to encrypt files, they could undo the whole scheme by factoring or computing just one of them: An ephemeral RSA-512 public key that is … Read More “Breaking the Zeppelin Ransomware Encryption Scheme” »

Failures in Twitter’s Two-Factor Authentication System

Posted on By infossl
authentication, cybersecurity, passwords, Security technology, sms, twitter, two-factor authentication, Uncategorized, vulnerabilities

Twitter is having intermittent problems with its two-factor authentication system: Not all users are having problems receiving SMS authentication codes, and those who rely on an authenticator app or physical authentication token to secure their Twitter account may not have reason to test the mechanism. But users have been self-reporting issues on Twitter since the … Read More “Failures in Twitter’s Two-Factor Authentication System” »

The Conviction of Uber’s Chief Security Officer

Posted on By infossl
courts, cover-ups, cyberattack, cybersecurity, data breaches, data protection, Security technology, uber, Uncategorized

I have been meaning to write about Joe Sullivan, Uber’s former Chief Security Officer. He was convicted of crimes related to covering up a cyberattack against Uber. It’s a complicated case, and I’m not convinced that he deserved a guilty ruling or that it’s a good thing for the industry. I may still write something, … Read More “The Conviction of Uber’s Chief Security Officer” »

October Is Cybersecurity Awareness Month

Posted on By infossl
cybersecurity, history of security, security education, Security technology, Uncategorized

For the past nineteen years, October has been Cybersecurity Awareness Month here in the US, and that event that has always been part advice and part ridicule. I tend to fall on the apathy end of the spectrum; I don’t think I’ve ever mentioned it before. But the memes can be funny. Here’s a decent … Read More “October Is Cybersecurity Awareness Month” »

New Report on IoT Security

Posted on By infossl
cybersecurity, Internet of Things, reports, security engineering, Security technology, Uncategorized

The Atlantic Council has published a report on securing the Internet of Things: “Security in the Billions: Toward a Multinational Strategy to Better Secure the IoT Ecosystem.” The report examines the regulatory approaches taken by four countries—the US, the UK, Australia, and Singapore—to secure home, medical, and networking/telecommunications devices. The report recommends that regulators should … Read More “New Report on IoT Security” »

USB “Rubber Ducky” Attack Tool

Posted on By infossl
cyberattack, cybersecurity, hacking, Security technology, Uncategorized, usb

The USB Rubber Ducky is getting better and better. Already, previous versions of the Rubber Ducky could carry out attacks like creating a fake Windows pop-up box to harvest a user’s login credentials or causing Chrome to send all saved passwords to an attacker’s webserver. But these attacks had to be carefully crafted for specific … Read More “USB “Rubber Ducky” Attack Tool” »

Securing Open-Source Software

Posted on By infossl
cybersecurity, infrastructure, open source, Security technology, Uncategorized

Good essay arguing that open-source software is a critical national-security asset and needs to be treated as such: Open source is at least as important to the economy, public services, and national security as proprietary code, but it lacks the same standards and safeguards. It bears the qualities of a public good and is as … Read More “Securing Open-Source Software” »

Apple’s Lockdown Mode

Posted on By infossl
apple, cybersecurity, ios, Security technology, Uncategorized, usability, vulnerabilities

I haven’t written about Apple’s Lockdown Mode yet, mostly because I haven’t delved into the details. This is how Apple describes it: Lockdown Mode offers an extreme, optional level of security for the very few users who, because of who they are or what they do, may be personally targeted by some of the most … Read More “Apple’s Lockdown Mode” »