Security

Noteworthy

 IPv6 represents new territory for most Internet stakeholders, and its rollout will introduce some unique security challenges.

Blogs

DDOS Attackers - Who and Why?

Bruce Schneier's recent blog post, "Someone is Learning How to Take Down the Internet", reported that the incidence of DDOS attacks is on the rise. And by this he means that these attacks are on the rise both in the number of attacks and the intensity of each attack. A similar observation was made in the Versign DDOS Trends report for the second quarter of 2015, reporting that DDOS attacks are becoming more sophisticated and persistent in the second quarter of 2016. more»

Does Apple's Cloud Key Vault Answer the Key Escrow Question?

In a recent talk at Black Hat, Apple's head of security engineering (Ivan Krstić) described many security mechanisms in iOS. One in particular stood out: Apple's Cloud Key Vault, the way that Apple protects cryptographic keys stored in iCloud. A number of people have criticized Apple for this design, saying that they have effectively conceded the "Going Dark" encryption debate to the FBI. They didn't, and what they did was done for very valid business reasons -- but they're taking a serious risk... more»

Internet Access: A Chokepoint for Development

In the 1980's internet connectivity meant allowing general public to communicate and share knowledge and expertise with each other instantly and where it was not possible otherwise. Take the story of Anatoly Klyosov, connecting Russia to the western world for the first time in 1982, as an example. A bio-chemist who was not allowed to leave the soviet territory for security reasons. The internet enabled him to participate in meetings with his counterparts at Harvard University, University of Stockholm and beyond. more»

China's QUESS and Quantum Communications

In mid-August China launched "QUESS" (Quantum Experiments at Space Scale), a new type of satellite that it hopes will be capable of "quantum communications" which is supposed to be hack-proof, through the use of "quantum entanglement". This allows the operator to ensure that no one else is listening to your communications by reliably distributing keys that are then used for encryption in order to be absolutely sure that there is no one in the middle intercepting that information. more»

Security Against Election Hacking - Part 2: Cyberoffense Is Not the Best Cyberdefense!

State and county election officials across the country employ thousands of computers in election administration, most of them are connected (from time to time) to the internet (or exchange data cartridges with machines that are connected). In my previous post I explained how we must audit elections independently of the computers, so we can trust the results even if the computers are hacked. more»

Security Against Election Hacking - Part 1: Software Independence

There's been a lot of discussion of whether the November 2016 U.S. election can be hacked. Should the U.S. Government designate all the states' and counties' election computers as "critical cyber infrastructure" and prioritize the "cyberdefense" of these systems? Will it make any difference to activate those buzzwords with less than 3 months until the election? First, let me explain what can and can't be hacked. Election administrators use computers in (at least) three ways... more»

Video: Interview with Jari Arkko at IETF 96 in Berlin

Would you like to understand the major highlights of the 96th meeting of the Internet Engineering Task Force (IETF) last month in Berlin? What were some of the main topics and accomplishments? How many people were there? What else went on? If so, you can watch a short video interview I did below with IETF Chair Jari Arkko. more»

NTP is Still a Security Risk

The Network Time Protocol (NTP) has been in the news a number of times over the past couple of years because of attacks on the protocol, vulnerabilities in the daemon, and the use of NTP in DDoS attacks. In each case, the developers of NTP have responded quickly with fixes or recommendations for remediating these attacks. Additionally, the development team has continued to look ahead and has worked to enhance the security of NTP. Unfortunately, that has not translated to an improved security picture for NTP. more»

Internet: Quo Vadis (Where are you going?)

Articles, blogs, and meetings about the internet of the future are filled with happy, positive words like "global", "uniform", and "open". The future internet is described in ways that seem as if taken from a late 1960's Utopian sci-fi novel: the internet is seen as overcoming petty rivalries between countries, dissolving social rank, equalizing wealth, and bringing universal justice. If that future is to be believed, the only obstacle standing between us and an Arcadian world of peace and harmony is that the internet does not yet reach everyone... more»

Final Day to Give Input on "Future of the Internet" Survey

Today, June 26, is the final day that you can help the Internet Society with its "Future of the Internet" survey. It takes about 20-25 minutes and will help my colleagues at the Internet Society develop a number of scenarios about the possible future of the Internet. These scenarios can help all of us in talking to policy makers, leaders, media and the general user population about the choices we have before us for the future of the Internet. more»

The Value of Openness for Building Tomorrow's Digital Economy - Reflections on the OECD Ministerial

Yesterday marked the last day of the OECD Ministerial Meeting on the Digital Economy, but also the culmination of a week where the need for an open and trusted Internet has been the main message from all stakeholders. Back in 2008, the OECD was one of the first intergovernmental organizations to open its discussions to the wider Internet community. more»

ICANN 56 in Helsinki - Schedule of DNSSEC Activities

The ICANN 56 meeting takes place in Helsinki, Finland, from June 27-30 and while it is a smaller "policy forum" style of meeting, there will still be some activities related to DNSSEC, DANE and DNS security in general. DNSSEC Workshop The DNSSEC Workshop will take place on the morning of Monday, 27 June 2016. All times are Eastern European Summer Time (EEST), which is UTC+3. more»

Which Direction Will the Internet Go? Take Our Survey and Help Us Explore the Forces at Work

In the past seven years, the number of people online has essentially doubled, from 1.7 billion in 2009 to about 3.4 billion today. New and innovative services have also emerged and people and companies around the world are using the Internet in ways barely imagined at the turn of the decade. Looking ahead to the next five to seven years, there are many forces at work that could have a significant impact on the Internet. more»

Who Is Responsible for Your Application's Security?

The dividing line between developers and IT operations used to be distinct. Developers were responsible for adding new features securely, but it was IT operations who had responsibility for infrastructure and network security. For the most part, developers didn't have to think too much about the wider security context. With the advent of the cloud, and of devops, things changed radically. more»

Ethical Hacking: Turning The Tables to Boost Cyber Security

Hacking remains a huge problem for businesses. As noted by MarketWatch, more than 175 data breaches have already happened this year, and in 2015 approximately 105 million adults in the United States had their personal information stolen. For companies, the stakes are huge: Compromised systems not only damage the bottom line but can severely impact public opinion. more»

News Briefs

Cybersecurity Regime for Satellites and other Space Assets Urgently Required, Warn Researchers

Yahoo to Confirm Massive Data Breach, Several Hundred Million Users Exposed

UK's National Cyber Security Centre Reveals Plans to Scale Up DNS Filtering

Schneier: "Someone Is Learning How to Take down the Internet"

U.S. Justice Department Forms Group to Study National Security Threats of IoT

New York’s Department of Financial Services Issues Cybersecurity Proposal

White House Appoints Retired Air Force General as First Cyber Security Chief

China Taking Steps to Show it is Responsive to Foreign Concerns on Cybersecurity

Singapore Plans to Cut Off Internet Access for Government Agencies

ICANN Gets an In-House Physical Security Operations Professional

Russian Central Bank Announces Mandatory Cyber-Security Regulations for Domestic Banks

Clothing Retailer Eddie Bauer Confirms Point-Of-Sale Malware, All US, Canadian Stores Infected

Massive Cyberattack Aimed at Flooding .Gov Email Inboxes With Subscription Requests

Chinese Cloud Vendors Benefitting from Home-Field Advantage While Expanding Globally

Code Released by 'Shadow Brokers' Raises Alarming Concerns on Whether NSA Was Hacked

Australia's First Online Census Halted Due to Multiple DDoS Attacks

Reports Provide Details on 'Project Sauron' Malware, Highly Advanced, Remained Hidden for 5 Years

Kazakhstan Using Malware Against Journalists, Political Activists, Lawyers

FBI Withheld Warning Democratic National Committee of Suspected Russian Role in Hack

Nigerian Scammer, Ringleader of International Criminal Network Arrested

Most Viewed

Most Commented

Taking Back the DNS

Fake Bank Site, Fake Registrar

When Registrars Look the Other Way, Drug-Dealers Get Paid

Who Is Blocking WHOIS? Part 2

Not a Guessing Game

Verisign Updates – Sponsor

Verisign Releases Q2 2016 DDoS Trends Report - Layer 7 DDoS Attacks a Growing Trend

Verisign today released its Q2 2016 DDoS Trends Report providing a unique view into online distributed denial of service (DDoS) attack trends from mitigations enacted on behalf of customers of Verisign DDoS Protection Services, and research conducted by Verisign iDefense Security Intelligence Services. ›››

Verisign Named to the Online Trust Alliance's 2016 Honor Roll

Verisign is pleased to announce that it has qualified for the Online Trust Alliance's (OTA) 2016 Honor Roll for showing a commitment to best practices in security, privacy and consumer protection. ›››

Verisign Q1 2016 DDoS Trends: Attack Activity Increases 111 Percent Year Over Year

Verisign today released its Q1 2016 DDoS Trends Report, which provides a unique view into online distributed denial of service (DDoS) attack trends from mitigations enacted on behalf of customers of Verisign DDoS Protection Services and research conducted by Verisign iDefense Security Intelligence Services. ›››

Resilient Cybersecurity: Dealing with On-Premise, Cloud-Based and Hybrid Security Complexities

Having a tightly integrated security framework is more critical than ever as cyber-attacks grow and enterprises employ a variety of on-premise and cloud-based computing services to deliver applications. ›››

Verisign Releases Q4 2015 DDoS Trends - DDoS Attack Activity Increasing by 85% Year Over Year

Verisign has just released its Q4 2015 DDoS Trends Report, which provides a unique view into online distributed denial of service (DDoS) attack trends from mitigations enacted on behalf of customers of Verisign DDoS Protection Services and research conducted by Verisign iDefense Security Intelligence Services. ›››

The Framework for Resilient Cybersecurity (Webinar)

A shift in security architecture is needed, to an open platform where devices and services from different vendors can share, and act, on threat intelligence information, all in concert and in the proper context. Join Ramakant Pandrangi, Vice President of Technology, and learn how to assist with designing a resilient security ecosystem by maximizing an API-centric approach. ›››

Verisign Mitigates More Attack Activity in Q3 2015 Than Any Other Quarter During Last Two Years

As part of our efforts to support National Cyber Security Awareness Month by sharing the latest cybersecurity research, Verisign released its Q3 2015 DDoS Trends Report, which represents a unique view into attack trends unfolding online for the previous quarter. ›››

Industry Updates

Participants – Random Selection