Security

Noteworthy

 IPv6 represents new territory for most Internet stakeholders, and its rollout will introduce some unique security challenges.

Security / Recently Commented

The Other Side of Security

The Denver edition of Security BSides took place a few weeks ago in a garage turned art gallery on the far end of Denver's emerging Santa Fe Arts District, right on the border between historic working-class neighborhoods and a rambling wasteland of building supply warehouses. ... The presentation I enjoyed most was "Top 10 Ways IT is Enabling Cybercrime," presented by Daniel J. Molina from Kaspersky Labs. He described how quickly threats are evolving, how many new threats are appearing every day, and explained that the targets aren't always who you'd expect. more»

Bruce Schneier: The Threat of Cyberwar Grossly Exaggerated

Security expert Bruce Schneier in a blog post today writes: "It's about who is in charge of cyber security, and how much control the government will exert over civilian networks. And by beating the drums of war, the military is coming out on top. ... General Keith Alexander, the current commander of the U.S. Cyber Command, hypes it every chance he gets. This isn't just rhetoric of a few over-eager government officials and headline writers; the entire national debate on cyberwar is plagued with exaggerations and hyperbole." more»

Domain Transfers… Domain Hijacking… Make Your Voice Heard

ICANN's Generic Names Supporting Organisation (GNSO) has formed a working group to consider changes to the domain transfer process to enhance security and reduce hijacking. The working group consists of registrars, aftermarket players, domainers and other members of the ICANN Community. The group published its preliminary recommendations at the ICANN meeting in Brussels two weeks ago and the 20-day comment period has just begun. more»

A Bigger Boat: Application Security Outgrows Capacity for CIOs

There is a classic scene in the movie, "Jaws," when Roy Scheider gets a look at the size of the shark circling his fishing vessel and says, "We're going to need a bigger boat." The same case can be made for CIOs dealing today with application security. Hackers from all over the world are circling business and government like great whites looking for vulnerabilities in Internet-facing applications. The growth of applications is great for doing business but they have become chum in the water for predators. more»

Tackling Cyber Security: Should We Trust the Libertarians? Part 2

A couple of months ago, I wrote a post posing the question of whether or not more government regulation is required in order to secure the Internet. On the one hand, anonymity is viewed in the west as a forum for freedom of speech. The anonymity of the Internet allows dissidents to speak up against unpopular governments. However, the anonymity afforded by the Internet is not so much by design as it is byproduct of its original designers not seeing how widespread it would eventually become. more»

Terrorism, New gTLDs, DAG4, and ICANN's Continued US and Western Centric Bias

Those who have been involved in the ICANN process as long as I have naturally become accustomed to ICANN controversies at all levels. But the latest is a "wrong" of international ramifications. The four (4) versions of the Guidebook for the new generic Top-Level Domains (gTLDs) have been hundreds of pages long with a lot of The Good, The Bad, and to some, The Ugly. However, something new has appeared in the 4th and latest version called DAG4 can be called: "The Disturbing". more»

Three Reasons Why It Makes Sense to Deploy DNSSEC Now

As many of you may know, today .ORG announced that all of its 8.5 million domains are now able to be fully DNSSEC signed - the largest set of domain names in the world so far that has access to this key security upgrade. .. The widespread publicity that the Kaminsky bug got around the world vindicated a decision made in several companies to invest time, effort and money into deploying DNSSEC. The community was split on the value of the DNSSEC effort -- many thought the deployment was quixotic, while a few others thought it was appropriate. more»

DNSSEC Becomes a Reality Today at ICANN Brussels

Attendees at the public ICANN meeting in Brussels today heard from over two dozen companies that have implemented or are planning to support DNSSEC, the next-generation standard protocol for secured domain names. It is clearer than ever before that DNSSEC is becoming a reality. more»

Domain Registrars Warned by Law Enforcement Agencies, Demanding Better Enforcement

Kevin Murphy reporting in The Register: International police have called for stricter rules on domain name registration, to help them track down online crooks, warning the industry that if it does not self-regulate, governments could legislate. The changes, which are still under discussion, would place more onerous requirements on ICANN-accredited domain name registrars, and would likely lead to an increase in the price of domains. more»

Australian Government Proposes ISPs Force Customers to Use Antivirus and Firewall

Josh Taylor reporting in ZDNet.com.au: Committee chair Belinda Neal said in her introduction to the 262-page report titled "Hackers, Fraudsters and Botnets: Tackling the Problem of Cyber Crime" that due to the exponential growth of malware and other forms of cybercrime in recent years, "the expectation that end users should or can bear the sole responsibility for their own personal online security is no longer a tenable proposition"... more»

VPN Security Flaw Makes IP Address of Users Using IPv6 Easily Traceable

Duncan Geere reporting in Wired: "Since the slow introduction of internet monitoring systems around the world began, more and more people have attempted to preserve their privacy by signing up for VPN services like the Pirate Bay's Ipredator and Pirate Party offering Relakks. But it turns out that there's a gaping security flaw in these services that allows individual users to be identified..." more»

Top Level Domains and a Signed Root

With DNSSEC for the root zone going into production in a couple of weeks, it is now possible for Top Level Domain (TLD) managers to submit their Delegation Signer (DS) information to IANA. But what does this really mean for a TLD? In this post we're going to try to sort that out. more»

BP and Incident Response: How Well Do Oil and Security Mix?

BP and the Oil Industry are taking a lot of heat these days - much of it rightly so. Moving beyond the drama and evaluating the overall response of BP and others reinforces much of what is taught in incident response training and preparation... by showing the outcomes when one does not respond well. This is probably the most important incident that the responders involved will deal with in their professional lives. For those of us working to protect Internet Infrastructure and resources there are useful lessons as we consider what is happening in the Gulf of Mexico and their response effort. more»

New Cyber Security Bill Could Increase Power of President and DHS

Introduced by ranking Senate members of the Homeland Security and Governmental Affairs Committee, the Protecting Cyberspace as a National Asset Act of 2010, S.3480 is intended to create an Office of Cyber Policy in the executive branch of the government, confirmed by the Senate and ultimately reporting to the president. Senators Joe Lieberman, Blanche Lincoln and Tom Carper introduced the bill publicly on June 10, and a critical part of the bill is that critical infrastructure networks such as electricity grids, financial systems and telecommunications networks need to cooperate with the Office of Cyber Policy. more»

Today Marks a Giant Step Towards DNSSEC Deployment

The global deployment of Domain Name System Security Extensions (DNSSEC) is charging ahead. With ICANN 38 Brussels just around the corner, DNSSEC deployment will inevitably be the hot topic of discussion over the next few days. Case in point, today, ICANN hosted the first production key ceremony at a secure facility in Culpepper, Va. where the first cryptographic digital key was used to secure the Internet root zone. The ceremony's goal was simple: for the global Internet community to trust that the procedures involved with DNSSEC are executed correctly and that the private key materials are stored securely. more»