The Facebook Breach: Some Lessons for the Internet

Last week Facebook found itself at the heart of a security breach that put at risk the personal information of millions of users of the social network.

On September 28, news broke that an attacker exploited a technical vulnerability in Facebook’s code that would allow them to log into about 50 million people’s accounts.

While Facebook was quick to address the exploit and fix it, they say they don’t know if anyone’s accounts actually were breached.

This breach follows the Cambridge Analytica scandal earlier this year that resulted in the serious mishandling of the data of millions of people who use Facebook.

Both of these events illustrate that we cannot be complacent about data security. Companies that hold personal and sensitive data need to be extra vigilant about protecting their users’ data.

Yet even the most vigilant are also vulnerable. Even a single security bug can affect millions of users, as we can see.

There are a few things we can learn from this that applies to the other security conversations: Doing security well is notoriously hard, and persistent attackers will find bugs to exploit, in this case a combination of three apparently unrelated ones on the Facebook platform.

This Continue reading

Microsoft Ignite Lacks Azure Pizzazz

Some in attendance at the computing giant's Ignite event thought that Azure innovation was lacking and that Google was a stronger long-term rival to AWS.

IPv6 Security Considerations

When rolling out a new protocol such as IPv6, it is useful to consider the changes to security posture, particularly the network’s attack surface. While protocol security discussions are widely available, there is often not “one place” where you can go to get information about potential attacks, references to research about those attacks, potential counters, and operational challenges. In the case of IPv6, however, there is “one place” you can find all this information: draft-ietf-opsec-v6. This document is designed to provide information to operators about IPv6 security based on solid operational experience—and it is a must read if you have either deployed IPv6 or are thinking about deploying IPv6.

The draft is broken up into four broad sections; the first is the longest, addressing generic security considerations. The first consideration is whether operators should use Provider Independent (PI) or Provider Assigned (PA) address space. One of the dangers with a large address space is the sheer size of the potential routing table in the Default Free Zone (DFZ). If every network operator opted for an IPv6 /32, the potential size of the DFZ routing table is 2.4 billion routing entries. If you thought converging on about 800,000 routes is Continue reading

AT&T Contributes Its Cell Site White Box Router Spec to the Open Compute Project

This white box reference design is available to any hardware maker to use as a guide to build cell site gateway routers. And they can be paired with disaggregated software.

Verizon Fires Up First Residential 5G Fixed Wireless Markets  

Verizon is touting the fact that it is the first operator globally to deploy 5G, even though the service is based upon the company’s own 5G TF standard.

Cisco sets $2.3B deal for unified access, multi-factor authentication security firm Duo

Cisco said today it had closed the $2.35 billion deal it made for network identity, authentication security company Duo.According to Cisco, Duo’s zero-trust security model authorizes secure connections to all applications based on the trustworthiness of users and devices. Duo’s cloud-delivered technology lets IT professionals set and enforce risk-based, adaptive access policies and get enhanced visibility into users’ devices and activities. As more devices come onto the network remotely this issue takes on more importance.“Outdated devices are particularly vulnerable to being compromised, which can easily spiral into a full-blown, major breach,” wrote Richard Archdeacon, Duo Advisory CISO about a recent Duo study on remote access security. “Organizations don’t necessarily need to block individuals from using their personal devices, but they do need to re-shape their security models to fit these evolving working practices. … If you don’t know what’s connecting to the network, how can you protect data from being compromised?"To read this article in full, please click here

Cisco sets $2.3B deal for unified access, multi-factor authentication security firm Duo

Cisco said today it had closed the $2.35 billion deal it made for network identity, authentication security company Duo.According to Cisco, Duo’s zero trust security model authorizes secure connections to all applications based on the trustworthiness of users and devices. Duo’s cloud-delivered technology lets IT professionals set and enforce risk-based, adaptive access policies and get enhanced visibility into users’ devices and activities.  As more devices come onto the network remotely this issue takes on more importance.“Outdated devices are particularly vulnerable to being compromised, which can easily spiral into a full-blown, major breach,” wrote Richard Archdeacon, Duo Advisory CISO about a recent Duo study on remote access security.   “Organizations don’t necessarily need to block individuals from using their personal devices, but they do need to re-shape their security models to fit these evolving working practices…If you don’t know what’s connecting to the network, how can you protect data from being compromised? “To read this article in full, please click here

Cisco sets $2.3B deal for unified access, multi-factor authentication security firm Duo

Cisco said today it had closed the $2.35 billion deal it made for network identity, authentication security company Duo.According to Cisco, Duo’s zero trust security model authorizes secure connections to all applications based on the trustworthiness of users and devices. Duo’s cloud-delivered technology lets IT professionals set and enforce risk-based, adaptive access policies and get enhanced visibility into users’ devices and activities.  As more devices come onto the network remotely this issue takes on more importance.“Outdated devices are particularly vulnerable to being compromised, which can easily spiral into a full-blown, major breach,” wrote Richard Archdeacon, Duo Advisory CISO about a recent Duo study on remote access security.   “Organizations don’t necessarily need to block individuals from using their personal devices, but they do need to re-shape their security models to fit these evolving working practices…If you don’t know what’s connecting to the network, how can you protect data from being compromised? “To read this article in full, please click here

Oracle Top Cloud Exec Thomas Kurian Resigns

Kurian's resignation comes less than a month after he announced that he was taking “extended time off” from Oracle.

Free to code

This week at the Cloudflare Internet Summit I have the honour of sitting down and talking with Sophie Wilson. She designed the very first ARM processor instruction set in the mid-1980s and was part of the small team that built the foundations for the mobile world we live in: if you are reading this on a mobile device, like a phone or tablet, it almost certainly has an ARM processor in it.

But, despite the amazing success of ARM, it’s not the processor that I think of when I think of Sophie Wilson. It’s the BBC Micro, the first computer I ever owned. And it’s the computer on which Wilson and others created ARM despite it having just an 8-bit 6502 processor and 32k of RAM.

Luckily, I still own that machine and recently plugged it into a TV set and turned it on to make sure it was still working 36 years on (you can read about that one time blue smoke came out of it and my repair). I wanted to experience once more the machine Sophie Wilson helped to design. One vital component of that machine was BBC BASIC, stored in a ROM chip on Continue reading

Worth Reading: The Ecology of Web Browsing Engines

Early in my career when I worked at agencies and later at Microsoft on Edge, I heard the same lament over and over: “Argh, why doesn’t Edge just run on Blink? Then I would have access to ALL THE APIs I want to use and would only have to test in one browser!” Let me be clear: an Internet that runs only on Chrome’s engine, Blink, and its offspring, is not the paradise we like to imagine it to be. —Rachel Nabors @css-tricks

WebAssembly on Cloudflare Workers

We just announced ten major new products and initiatives over Crypto Week and Birthday Week, but our work is never finished. We're continuously upgrading our existing products with new functionality.

Today, we're extending Cloudflare Workers with support for WebAssembly. All Workers customers can now augment their applications with WASM at no additional cost.

What is WebAssembly?

WebAssembly -- often abbreviated as "WASM" -- is a technology that extends the web platform to support compiled languages like C, C++, Rust, Go, and more. These languages can be compiled to a special WASM binary format and then loaded in a browser.

WASM code is securely sandboxed, just like JavaScript. But, because it is based on compiled lower-level languages, it can be much faster for certain kinds of resource-intensive tasks where JavaScript is not a good fit. In addition to performance benefits, WASM allows you to reuse existing code written in languages other than JavaScript.

What are Workers?

For those that don't know: Cloudflare Workers lets you deploy "serverless" JavaScript code directly to our 153-and-growing datacenters. Your Worker handles your site's HTTP traffic directly at the location closest to your end user, allowing you to achieve lower latency and reduce serving costs. Continue reading

5 reasons eSignatures are the must-have tool you don’t think about

Many companies boast about going entirely digital, but continue to work with mountains of documents. Don't be that company.The bulk of said documents are normally those that require signatures, like contracts, tax forms, reimbursement sheets, and — well, the list is seemingly endless, which also means that the work allocated to creating and organizing them also never stops. A simple solution? Electronic signatures or eSignatures.Having the same legal weight as handwritten signatures, eSignatures could revolutionize the way you do business, and could potentially pave the way for more profit and innovation. And using a renowned tool like HelloSign can help ease your journey in the transition.To read this article in full, please click here

Gender Equality: A Mouse Click Away

This post reflects arguments made in a joint background paper published by the Internet Society and the Association for Progressive Communications (APC) ahead of the G20 Women’s Group (W20) Summit in Argentina 1-3 October.

In our digital age, Internet literacy has become essential for, if not synonymous with, being employable in many fields. Information and communications technologies (ICTs) fuel business growth and countries’ economic development. They open new channels to communicate across great distances, as well as to organise people, raise awareness and spur activism.

But such promise can deepen existing inequalities offline if these technologies cannot be accessed and enjoyed by all.

Today, many women and girls are getting left behind in digital development. While in low- and middle-income countries, the gap between women’s use and that of men is 26%, in least developed countries (LDCs), women are 33% less likely than men to use the Internet.

In some cases, women simply don’t have access to the Internet, or it’s too expensive. In others, they have limited access with pre-paid services. There are also cultural factors that stop women from using the Internet or even owning a computer or a mobile phone.

This points to deeper issues. Globally, women Continue reading

Drone defense — powered by IoT — is now a thing

The Internet of Things (IoT) didn’t just create smart houses and enable predictive analytics for industrial applications. It’s also creating a wide variety of new business opportunities and spawning new threats and challenges. Sometimes, all those things happen at once.At least, that’s my takeaway from a new partnership between AT&T and Dedrone, a drone detection technology startup based in San Francisco. (De-drone, get it?)Using IoT sensor data to detect drone threats According an AT&T spokesperson, “AT&T and Dedrone are teaming up to deploy IoT sensor technology to protect against malicious drones. Powered exclusively by AT&T, and using sensor data like radio frequency, visual, and radar, Dedrone detects and classifies approaching drones, pinpointing their locations and triggering alarms to alert security.”To read this article in full, please click here

802.11ax preview: Access points and routers that support new Wi-Fi protocol on tap

The latest update to the Wi-Fi protocol standard, 802.11ax, has been designed to transmit data even faster, to better negotiate bandwidth among several computers and other devices connected to a network, and to more reliably deliver high-bandwidth applications to them, such as streaming video, than the protocol standard it succeeds, 802.11ac.To take advantage of these gains, client and networking devices need to have hardware that supports the new protocol, of course. Many network device makers have announced 802.11ax products to come. They’ve also filed 802.11ax devices with the FCC for licensing, which reveal more technical information about them.To read this article in full, please click here

802.11ax preview: Access points and routers that support the Wi-Fi 6 protocol on tap

The latest update to the Wi-Fi protocol standard, 802.11ax, has been designed to transmit data even faster, to better negotiate bandwidth among several computers and other devices connected to a network, and to more reliably deliver high-bandwidth applications to them, such as streaming video, than the protocol standard it succeeds, 802.11ac.To take advantage of these gains, client and networking devices need to have hardware that supports the new protocol, of course. Many network device makers have announced 802.11ax products to come. They’ve also filed 802.11ax devices with the FCC for licensing, which reveal more technical information about them.To read this article in full, please click here

802.11ax preview: Access points and routers that support new Wi-Fi protocol on tap

The latest update to the Wi-Fi protocol standard, 802.11ax, has been designed to transmit data even faster, to better negotiate bandwidth among several computers and other devices connected to a network, and to more reliably deliver high-bandwidth applications to them, such as streaming video, than the protocol standard it succeeds, 802.11ac.To take advantage of these gains, client and networking devices need to have hardware that supports the new protocol, of course. Many network device makers have announced 802.11ax products to come. They’ve also filed 802.11ax devices with the FCC for licensing, which reveal more technical information about them.To read this article in full, please click here

802.11ax preview: Access points and routers that support the Wi-Fi 6 protocol on tap

The latest update to the Wi-Fi protocol standard, 802.11ax, has been designed to transmit data even faster, to better negotiate bandwidth among several computers and other devices connected to a network, and to more reliably deliver high-bandwidth applications to them, such as streaming video, than the protocol standard it succeeds, 802.11ac.To take advantage of these gains, client and networking devices need to have hardware that supports the new protocol, of course. Many network device makers have announced 802.11ax products to come. They’ve also filed 802.11ax devices with the FCC for licensing, which reveal more technical information about them.To read this article in full, please click here

The Week in Internet News: Social Media Networks Sign onto Fake News Code

Fake news code: Google and several operators of social networks have signed a code of conduct to combat fake news, CNet reports. The code of conduct, pushed by the European Union, stipulates that they must work to disrupt advertising revenues of accounts and websites that spread disinformation. The code also requires that the websites empower people to report disinformation and access other news sources.

Government news vs. fake news: Indonesia’s communications ministry plans to hold weekly briefings to highlight examples of “hoax” news reports, Time.com reports. The briefs will also focus on digital literacy as the country moves toward a presidential election next year. The government also plans to have a 70-member content management team to determine fake news.

Fake news as cancer: Lots of news about fake news this week. The billionaire owner of the Los Angeles Times as called fake news the “cancer of our time,” CNBC.com says. Meanwhile, cancer still exists. Patrick Soon-Shiong blamed social media for the spread of fake news.

Too little regulation? California’s recently passed Internet of Things security bill may be “too little, too late,” says an opinion piece on Diginomica.com. “No one seems to believe that SB-327 will completely Continue reading