As enterprises move their applications and data to the cloud, executives increasingly face the task of balancing the benefits of productivity gains against significant concerns about compliance and security.Security in the cloud is not the same as security in the corporate data center. Different rules and thinking apply when securing an infrastructure over which one has no real physical control.+ Also on Network World: The tricky, personal politics of cloud security +
When leveraging cloud services, enterprises need to evaluate several key factors, including:To read this article in full or to leave a comment, please click here
What’s the best way to avoid Android malware? Downloading all your apps from the Google Play store -- where software is vetted – is perhaps the best advice. But that doesn’t mean Google Play is perfect.Security researchers do find new Android malware lurking on Google’s official app store. That’s because hackers are coming up with sneaky ways to infiltrate the platform, despite the vetting processes that protect it."Eventually, every wall can be breached," said Daniel Padon, a researcher at mobile security provider Check Point.To be sure, most Android users will probably never encounter malware on the Google Play store. Last year, the amount of malicious software that reached the platform amounted to only 0.16 percent of all apps, according to a new report from Google.To read this article in full or to leave a comment, please click here
If you aren’t using two-factor authentication to protect your Apple ID and iCloud account, you really should do it today. Hackers who claim to have millions of stolen iCloud credentials are demanding Apple pay a ransom or they’ll release them—and ZDNet obtained a sample set of credentials and determined they’re real.But guess what? Using two-factor authentication should protect you completely. It’s easy to set up, so take a minute and do it now.To read this article in full or to leave a comment, please click here
Google is considering a harsh punishment for repeated incidents in which Symantec or its certificate resellers improperly issued SSL certificates. A proposed plan is to force the company to replace all of its customers’ certificates and to stop recognizing the extended validation (EV) status of those that have it.According to a Netcraft survey from 2015, Symantec is responsible for about one in every three SSL certificates used on the web, making it the largest commercial certificate issuer in the world. As a result of acquisitions over the years the company now controls the root certificates of several formerly standalone certificate authorities including VeriSign, GeoTrust, Thawte and RapidSSL.To read this article in full or to leave a comment, please click here
Canary’s initial foray into the networked home security camera space was very impressive – my colleague David Newman touted its high security settings in the wake of revelations about the general insecurity of these types of devices. The Canary camera was also somewhat large – a cylindrical tower that took up some significant space on your desk, cabinet or shelf.The latest camera the company sent me is the Canary Flex, a much smaller unit meant to be more flexible (hence the name) in terms of placement, but also in power options. Like the Arlo Pro camera, the Canary Flex is powered by an internal battery (it’s charged via USB cable and power adapter). This means you can move the Flex to a location inside or outside your home where there’s no power outlet. The Flex comes with wall mounting screws and a 360-degree magnetic stand so you can position the camera in different spots. Additional accessories, such as a plant mount or twist mount (pictured below), offer even more location choices.To read this article in full or to leave a comment, please click here
Canary’s initial foray into the networked home security camera space was very impressive – my colleague David Newman touted its high security settings in the wake of revelations about the general insecurity of these types of devices. The Canary camera was also somewhat large – a cylindrical tower that took up some significant space on your desk, cabinet or shelf.The latest camera the company sent me is the Canary Flex, a much smaller unit meant to be more flexible (hence the name) in terms of placement, but also in power options. Like the Arlo Pro camera, the Canary Flex is powered by an internal battery (it’s charged via USB cable and power adapter). This means you can move the Flex to a location inside or outside your home where there’s no power outlet. The Flex comes with wall mounting screws and a 360-degree magnetic stand so you can position the camera in different spots. Additional accessories, such as a plant mount or twist mount (pictured below), offer even more location choices.To read this article in full or to leave a comment, please click here
Canary’s initial foray into the networked home security camera space was very impressive – my colleague David Newman touted its high security settings in the wake of revelations about the general insecurity of these types of devices. The Canary camera was also somewhat large – a cylindrical tower that took up some significant space on your desk, cabinet or shelf.The latest camera the company sent me is the Canary Flex, a much smaller unit meant to be more flexible (hence the name) in terms of placement, but also in power options. Like the Arlo Pro camera, the Canary Flex is powered by an internal battery (it’s charged via USB cable and power adapter). This means you can move the Flex to a location inside or outside your home where there’s no power outlet. The Flex comes with wall mounting screws and a 360-degree magnetic stand so you can position the camera in different spots. Additional accessories, such as a plant mount or twist mount (pictured below), offer even more location choices.To read this article in full, please click here
The price of a single Bitcoin passed that of an ounce of gold for the first time this month, and scammers were quick to get in on the action with Ponzi schemes and phishing sites spread via social media.Victims are lured in with fake Bitcoin wallets, fake Bitcoin search services, fake surveys about Bitcoin, too-good-to-be-true money making offers, and classic pyramid scams now dressed up with Bitcoins, according to a report released this week."The same characteristics that make Bitcoin attractive to people who want to make money distributing ransomware make it attractive to scammers," said Philip Tully, senior data scientist at security vendor ZeroFox, which published the report.To read this article in full or to leave a comment, please click here
BOSTON -- Blockchain can help secure medical devices and improve patient privacy, but the key is proper implementation, according to a top security pro at Partners Healthcare.The downsides would include mistrust of the technology because of blockchain’s potential performance problems, and its association with ransomware and use as payment for illegal items on the Dark Web, Partners’ Deputy CISO Esmond Kane told the SecureWorld audience this week in Boston.On the other hand, the decentralized, encrypted public ledger could have a wealth of applications in healthcare, Kane says. These include streamlining the resolution of insurance claims, management of internet of things medical devices and providing granular privacy settings for personal medical data.To read this article in full or to leave a comment, please click here
Deception tools have been growing in popularity over the past several years, but customers need to ensure they are using the technology to its fullest potential. The concept behind deception is fairly simple to understand: Security teams deploy a fake target that is monitored closely, which hackers will attack. Once the target is breached, the security team is alerted to the threat. In my experience, the use of deception technology is relatively low compared to the amount of time, energy and money invested in traditional intrusion prevention systems. Part of the challenge of deception is that maintaining things such as decoys, breadcrumbs and honeypots can be difficult in environments that are always changing. However, networks are becoming more agile through the use of software, making deception technology more agile and easier to use. To read this article in full or to leave a comment, please click here
FBI director James Comey has suggested that an international agreement between governments could ease fears about IT products with government-mandated backdoors, but privacy advocates are doubtful.Speaking on Thursday, Comey suggested that the U.S. might work with other countries on a “framework” for creating legal access to encrypted tech devices.“I could imagine a community of nations committed to the rule of law developing a set of norms, a framework, for when government access is appropriate,” he said on Thursday.Comey made his comments at the University of Texas at Austin, when trying to address a key concern facing U.S. tech firms in the encryption debate: the fear that providing government access to their products might dampen their business abroad.To read this article in full or to leave a comment, please click here
A group of hackers threatening to wipe data from Apple devices attached to millions of iCloud accounts didn't obtain whatever log-in credentials they have through a breach of the company's services, Apple said."There have not been any breaches in any of Apple's systems including iCloud and Apple ID," an Apple representative said in an emailed statement. "The alleged list of email addresses and passwords appears to have been obtained from previously compromised third-party services."A group calling itself the Turkish Crime Family claims to have login credentials for more than 750 million icloud.com, me.com and mac.com email addresses, and the group says more than 250 million of those credentials provide access to iCloud accounts that don't have two-factor authentication turned on.To read this article in full or to leave a comment, please click here
This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.In a recent Network World article Jon Oltsik noted that Incident Response (IR) automation is becoming a very hot topic in the info security world. Oltsik called out multiple factors driving demand for IR automation and orchestration, including the manual nature of IR work, the cyber skills shortage and the difficulty of coordinating activity between SecOps and DevOps.To read this article in full or to leave a comment, please click here
The U.S. CIA has had tools to infect Apple Mac computers by connecting malicious Thunderbolt Ethernet adapters to them since 2012, according to new documents purported to be from the agency and published by WikiLeaks.One of the documents, dated Nov. 29, 2012, is a manual from the CIA's Information Operations Center on the use of a technology codenamed Sonic Screwdriver. It is described as "a mechanism for executing code on peripheral devices while a Mac laptop or desktop is booting."Sonic Screwdriver allows the CIA to modify the firmware of an Apple Thunderbolt-to-Ethernet adapter so that it forces a Macbook to boot from an USB stick or DVD disc even when its boot options are password protected.To read this article in full or to leave a comment, please click here
The U.S. CIA has had tools to infect Apple Mac computers by connecting malicious Thunderbolt Ethernet adapters to them since 2012, according to new documents purported to be from the agency and published by WikiLeaks.
One of the documents, dated Nov. 29, 2012, is a manual from the CIA's Information Operations Center on the use of a technology codenamed Sonic Screwdriver. It is described as "a mechanism for executing code on peripheral devices while a Mac laptop or desktop is booting."
Sonic Screwdriver allows the CIA to modify the firmware of an Apple Thunderbolt-to-Ethernet adapter so that it forces a Macbook to boot from an USB stick or DVD disc even when its boot options are password protected.To read this article in full or to leave a comment, please click here
The U.S. Senate has voted to kill broadband provider privacy regulations prohibiting them from selling customers' web-browsing histories and other data without their permission.The Senate's 50-48 vote Thursday on a resolution of disapproval would roll back Federal Communications Commission rules requiring broadband providers to receive opt-in customer permission to share sensitive personal information, including web-browsing history, geolocation, and financial details with third parties. The FCC approved the regulations just five months ago.To read this article in full or to leave a comment, please click here
Steven Bay, a former defense contractor, knows a thing or two about insider threats. For a brief period, he was the boss of Edward Snowden, the famous leaker who stole sensitive files from the U.S. National Security Agency.
Recalling the day he learned Snowden had been behind the NSA leaks back in June 2013, Bay said he received texts about the breaking news while in a leadership meeting at a church. The first text said "Sorry man, looks like your worst nightmare came true."To read this article in full or to leave a comment, please click here
Earlier this month, the notorious info leaker WikiLeaks published a batch of documents from the CIA detailing how the CIA has developed several tools to crack, break into or infect all kinds of devices—from PCs to Smart TVs—even if they are not connected to the internet. At the time, WikiLeaks leader Julian Assange promised that the site would work with the affected tech companies to give them exclusive access to the technical details of those exploits and would not go public with the exploits and back doors. However, it wasn't until this week that WikiLeaks got in contact with the listed tech companies, such as Microsoft, Apple and Google, according to Motherboard, the tech site run by Vice. Citing unnamed sources familiar with the matter, Motherboard said WikiLeaks has made demands on the initial contact with firms but didn't share any of the alleged CIA codes. To read this article in full or to leave a comment, please click here
The Federal Trade Commission this week issued a warning about the irritating and illegal “Can you hear me now?” robocall scam making the rounds on phones across the country.
The FTC says it has received hundreds of complaints on the calls which could end up being part of a scam to get your money.
+More on Network World: U.S. Marshals warn against dual phone scams+
The Better Business Bureau described the scam earlier this year: “By replying ‘yes,’ ‘sure,’ or other agreeable response, the scammer records the call and uses that sound bite to authorize unwanted charges to the scammers benefit. “It seems like an innocent question, but it can cause undue financial burdens and stress. The scam caller may already have your financial information, which is how they authorize a payment and, if you dispute a charge, the scammer has doctored the recording to make it seems as though you agreed to it.”To read this article in full or to leave a comment, please click here
Cisco Senior Security Researcher Brad Antoniewicz often gets asked whether those who take people’s computers hostage with ransomware actually hold up their end of the bargain and decrypt files when victims pay by bitcoin.
“They’re in it to make money…Good customer service is important to these people,” he said, and not at all tongue in cheek, during his lunchtime address on the opening day of SecureWorld Boston this week.
Antoniewicz, sporting a RUN DNS t-shirt reflecting his position with the Cisco Umbrella (formerly OpenDNS) team, dove into the topic of ransomware variants like Cerber as part of a broader talk on “An Anatomy of an Attack” and the elaborate ecosystem behind cyberattacks. To read this article in full or to leave a comment, please click here