Cybersecurity

Sponsored
by

Blogs

Encryption, Our Last Line of Defense

Encryption is fundamental to our daily life. Practically everything we do online makes use of encryption is some form. Access to our financial transactions, health records, government services, and exchanged private messages are all protected by strong encryption. Encryption is the process of changing the information in such a way as to make it unreadable by anyone except for those possessing special knowledge (usually referred to as a "key"), which allows them to change the information back to its original, readable form. more

Fake Apps Are a Real Problem

In the short ten years that they've been around, mobile apps have grown to become a staple of modern digital life. With more than five million apps currently available for download in the major app stores, and with over 2,000 new apps being uploaded every day, mobile apps are big business. Fifty-eight percent of shoppers consistently browse e-commerce apps and 49% of all website traffic now comes directly from mobile app users. All this browsing directly translates into spending. more

What to Make of the Inaugural NetThing 2019

The last Australian Internet Governance Forum (auIGF) was held in October 2016 before the annual event was cancelled as part of an auDA review. Three years on and the auIGF replacement – NetThing – was held in Sydney on 28 October 2019, though I was surprised to see that this Australian Internet event no longer had an associated .au domain name, instead choosing to go with NetThing.info. more

IGF2019 Observation: Compare Chancellor Merkel's Digital Sovereignty with Chinese and U.S. Version

The 2019 UN IGF is right now being held in Berlin and entering the last day. There has been a wide range of exciting discussions. It is a huge step forward that this year's IGF has been able to bring a plethora of topics together under a framework of thinking after the efforts done by the UN Secretary-General António Guterres' High-Level Panel on Digital Cooperation (The Age of Digital Interdependence) and by German scholars' engagement with all the stakeholders... more

Recognizing Lessons Learned From the First DNSSEC Key Rollover, a Year Later

A year ago, under the leadership of the Internet Corporation for Assigned Names and Numbers (ICANN), the internet naming community completed the first-ever rollover of the cryptographic key that plays a critical role in securing internet traffic worldwide. The ultimate success of that endeavor was due in large part to outreach efforts by ICANN and Verisign which, when coupled with the tireless efforts of the global internet measurement community, ensured that this significant event did not disrupt internet name resolution functions for billions of end users. more

Advancing Cyberstability: Protect the Public Internet Core and Improve Cyber Hygiene

The Paris Peace Forum (PPF), established by the French president Emanual Macron, was picked by the Global Commission for Stability in Cyberspace (GCSC) to launch its final report "Advancing Cyberstability" for good reasons: The Internet isn't just a purely technical issue with some political implications anymore. On the eve of the 2020s, the management of cyberspace is a global problem, a matter of international security, a question of war or peace. more

Cybersecurity Standards Practices as Cyber Threats

One of the most embarrassing and pernicious realities in the world of cybersecurity is the stark reality that some industry cybersecurity standards practices are themselves cyber threats. How so? Most industry and intergovernmental standards bodies serve as means for assembling the constantly evolving collective knowledge of participant experts and package the resulting specifications and best practices as freely available online documents to a vast, diverse universe of users. more

More Privacy for Domain Registrants – Heightened Risk for Internet Users

A recent exchange on CircleID highlighted a critical need for data to inform the debate on the impact of ICANN's post-GDPR WHOIS policy that resulted in the redaction of domain name registrant contact data. A bit of background: in my original post, I made the point that domain name abuse had increased post-GDPR. A reader who works with a registrar (according to his bio) commented: "Can you back up that statement with data? Our abuse desk has actually seen a reduction in abuse complaints." more

Doing Our Part for a Safer, Stronger DNS

Public Interest Registry is the industry leader of DNS Anti-Abuse efforts on the Internet. Since our inception, we have worked to empower people and organizations that use the Internet to make the world a better place. Whether a .ORG is the foundation of an individual voice, a global non-profit, or any organization that is part of the mission-driven .ORG community, we are proud to have earned the trust of so many dedicated users. more

Part 2: Let's Have an Honest Conversation About Huawei

In the first section of this piece, I argued that the anti-Huawei litany only makes sense when one realizes that it is the Chinese state, not a global telecommunication equipment manufacturer based in China, is the target of this attack. China, in this view, is an integrated monolith, and any Chinese firm can be ordered to do the government's will without any legal, political, or economic checks and balances. more

Blasphemy: The U.S. Problem Is Huawei's Security Is Too Good

Everyone knows the $100B/year U.S. security apparatus taps almost the entire Internet. Friendly governments help from Australia to Canada to France. Companies like AT&T, Ericsson, Verizon, and Nokia obviously cooperate. The NSA assumes that China is attempting to do the same and that Huawei, as a Chinese company, will provide assistance. The evidence suggests otherwise. Huawei is the primary opponent of U.S. security. more

Crypto Back Doors Are Still a Bad Idea

In the always interesting Lawfare blog, former FBI counsel Jim Baker in a piece called Rethinking Encryption reiterates his take on the encryption debates. There's a certain amount that makes me want to bang my head against the wall... But it's worth reading to remind us of what the other side is thinking, even with a lot of motivated reasoning that makes him conclude that Congress can pass some laws and the going dark problem will be solved. more

Cybercriminals Benefitting from Stalled Privacy/Proxy Policy

We've seen alarmingly BIG increases in multiple abusive behaviors – like phishing, hacking and malware – that often leverage the domain name system (DNS) and privacy/proxy services. Cybercriminals capitalize on gaps in DNS security measures, and ICANN is holding the door open for them by failing to implement their privacy/proxy policy. If you are ever targeted, you are not alone. more

Lessons From an E-Voting Debacle

There has been a significant focus over the past two years on the vulnerability and cyber threat risks faced for voting systems at the local level. That focus has typically been on State and local jurisdictions like cities, counties and towns, and resulted in the creation of the DHS Elections Infrastructure Information Sharing and Analysis Center (ISAC) to assist. However, there are other local governance entities at significant risk as well. more

Let's Have an Honest Conversation About Huawei

On May 29, I attended an AEI event on "International economics and securing next-generation 5G wireless networks," with Ambassador Robert Strayer, who heads the U.S. State Department's CIP team. But the focus of the talk was not really on 5G security, international trade or 5G development. In fact, there was no constructive agenda at all. The talk was an extended attack on China and the Chinese-based telecommunications vendor Huawei – another episode in an ongoing U.S. government campaign to shut Huawei and other Chinese firms out of the U.S. market, and to convince every other country in the world to do the same. more

News Briefs

Microsoft Announces Plans to Adopt DoH in Windows

Cybersecurity Workforce Needs to Grow 145% to Close Skills Gap Worldwide, Says New Study

Leading Domain Registries and Registrars Release Joint Document on Addressing 'DNS Abuse'

EU Member States Release Report on Coordinated Risk Assessment on Cybersecurity in 5G Networks

More Than 500 Schools in the U.S. Hit by Ransomware in 2019, Says Report

27 Countries Issue Joint Statement on 'Advancing Responsible State Behavior in Cyberspace'

Cyber Risk Now on Top of Corporate Risk Agendas, Cyber Insurance Expanding

The Insecurity of the IoT is Only Getting More Profound, Says Principal Researcher at F-Secure

Phishing Attacks Targeting Executives Now Top Cybersecurity Insurance Claims, Says AIG

There's a Full-On War for Cybersecurity Talent, CEOs Forking Millions to Fill Roles

Close to 200K Phishing Domains Discovered in a 5-Month Span, 66% Targetted Consumers, Akamai Reports

A Seattle Woman Charged With Capital One Data Theft Affecting 106 Million People

A 60% Rise Reported on Malware Designed to Harvest Consumers' Digital Data, aka Password Stealers

Equifax Announces Comprehensive Consumer Settlement for the 2017 Data Breach

Majority of Popular Mobile-Only VPNs Are Run by Chinese Nationals or Located in China

Mozilla Named "Internet Villain" for Supporting DNS-Over-HTTPS by a UK ISP Association

Florida Cities Are Paying Hundreds of Thousands of Dollars in Ransom to Get Their Data Back

Demand for Cybersecurity Workers in the United States Has Nearly Doubled Since 2013

United States Steps Up Digital Incursions Into Russia's Electric Power Grid, According to NYT

Notorious Hacker Group XENOTIME Expands Its Targeting Beyond Oil and Gas to Electric Utility Sector

Most Viewed

Most Commented

Taking Back the DNS

Fake Bank Site, Fake Registrar

When Registrars Look the Other Way, Drug-Dealers Get Paid

Who Is Blocking WHOIS? Part 2

ICANN Complaint System Easily Gamed

Verisign Updates – Sponsor

Q2 2018 DDoS Trends Report: 52 Percent of Attacks Employed Multiple Attack Types

Verisign just released its Q2 2018 DDoS Trends Report, which represents a unique view into the attack trends unfolding online, through observations and insights derived from distributed denial of service (DDoS) attack mitigations enacted on behalf of customers of Verisign DDoS Protection Services. more

Operational Update Regarding the KSK Rollover for Administrators of Recursive Name Servers

Currently scheduled for October 11, 2018, the Internet Corporation for Assigned Names and Numbers (ICANN) plans to change the cryptographic key that helps to secure the internet's Domain Name System (DNS) by performing a Root Zone Domain Name System Security Extensions (DNSSEC) key signing key (KSK) rollover. more

Q1 2018 DDoS Trends Report: 58 Percent of Attacks Employed Multiple Attack Types

Verisign has released its Q1 2018 DDoS Trends Report, which represents a unique view into the attack trends unfolding online, through observations and insights derived from distributed denial of service (DDoS) attack mitigations enacted on behalf of Verisign DDoS Protection Services, and security research conducted by Verisign Security Services. more

DNS-Based Threats: Cache Poisoning

As DNS attacks grow in frequency and impact, organizations can no longer afford to overlook DNS security as part of their overall defense-in-depth strategy. As with IT security in general, no single tactic can address the entire DNS threat landscape or secure the complete DNS ecosystem. more

Q4 2017 DDoS Trends Report: Financial Sector Experienced 40 Percent of Attacks

Verisign has released its Q4 2017 DDoS Trends Report, which represents a unique view into the attack trends unfolding online, through observations and insights derived from distributed denial of service (DDoS) attack mitigations enacted on behalf of Verisign DDoS Protection Services and security research conducted by Verisign Security Services. more

DNS-Based Threats: DNS Reflection and Amplification Attacks

Cybercriminals recognize the value of DNS availability and look for ways to compromise DNS uptime and the DNS servers that support it. As such, DNS becomes an important point of security enforcement and a potential point in the Cyber Kill Chain for many cyber-attacks. more

Verisign Named to the Online Trust Alliance's 2017 Audit and Honor Roll

Verisign has qualified for the Online Trust Alliance's (OTA) 2017 Honor Roll for showing a commitment to best practices in security, privacy and consumer protection. This is the fifth consecutive year that Verisign has received this honor. more

Industry Updates

How Can Domain Intelligence Analysis Help in Vetting Third-Party Providers

Using Threat Intelligence Feeds to Prevent Orcus RAT Infections

Billtrust Breach: Can Threat Intelligence Platforms Help with Ransomware Prevention?

Post NordVPN Data Exposure: Using Domain Threat Intelligence to Prevent MitM Attacks

InterMed Breach: How Threat Intelligence Sources Help Maintain Domain Integrity

BriansClub & PoS Malware Attacks: How Threat Intelligence Solutions Help Prevent Payment Card Theft

How Reverse WHOIS Search Can Help Protect Against MegaCortex and Other Ransomware

The Web.com Data Breach: A Quick Investigation with Domain Reputation Lookup

Do Security Service Providers Need Their Own Data Scientists?

SOAR Versus SIEM: The Fundamental Differences

Being Cybersecure Is Not Enough, Become Cyber-Resilient Instead

Is Your Organization Mature Enough for Security Orchestration, Automation, and Response?

Can Security Analytics Combat Digital Fraud with IP and Domain Name Monitoring?

Afilias Endorses Global Commission on the Stability of Cyberspace Final Report at Paris Peace Forum

Moving from the Castle-and-Moat to the Zero-Trust Model

Participants – Random Selection