National Intelligence office wants to perfect the art of security deception

Sometimes a great offense is much better than a stout defense, especially when it comes to protecting enterprise assets.This week the advanced technology developers from the Intelligence Advance Research Projects Activity (IARPA) office put out a Request For Information about how to best develop better denial and deception technologies – such as honeypots or deception servers for example -- that would bolster cyber security.To read this article in full or to leave a comment, please click here

How the Internet is like the Verrazano Bridge

No, the Internet has not become a series of bridges; it remains a series of tubes.The Internet is like the Verrazano Bridge in that there are moves afoot – ill-advised moves -- to change how each entity is represented through the written word.In the case of the Internet, the influential Associated Press and its indefatigable style disciples have already decreed that the word Internet should no longer be capitalized. Many news organizations and journalists are meekly complying by demoting the Internet to the internet. As you can see, I am refusing to fall in line.Meanwhile, in New York City, nitpicky petitioners are demanding that the Verrazano Bridge – North America’s longest such span – be renamed the Verrazzano Bridge. OK, fine, renaming may be oversating the case; they’re actually demanding the addition of a second “z” in Verrazano, despite the fact that it’s been spelled with only one since the bridge opened in 1964.To read this article in full or to leave a comment, please click here

How the Internet is like the Verrazano Bridge

No, the Internet has not become a series of bridges; it remains a series of tubes.The Internet is like the Verrazano Bridge in that there are moves afoot – ill-advised moves -- to change how each entity is represented through the written word.In the case of the Internet, the influential Associated Press and its indefatigable style disciples have already decreed that the word Internet should no longer be capitalized. Many news organizations and journalists are meekly complying by demoting the Internet to the internet. As you can see, I am refusing to fall in line.Meanwhile, in New York City, nitpicky petitioners are demanding that the Verrazano Bridge – North America’s longest such span – be renamed the Verrazzano Bridge. OK, fine, renaming may be oversating the case; they’re actually demanding the addition of a second “z” in Verrazano, despite the fact that it’s been spelled with only one since the bridge opened in 1964.To read this article in full or to leave a comment, please click here

Reading List: 060916

A few of the papers, RFCs, and drafts I’m reading this week, along with a short description of each.

A Survey of Worldwide Censorship Techniques
draft-hall-censorship-tech-03

Censorship is a large problem on the Internet—but it’s often difficult to find any good description of the various ways censors can both find and block “offending” content. This draft is a short, readable overview of the various techniques actually seen in the wild, along with pointers to research about the techniques themselves, and instances where they’ve been used in the real world.

IPv6 Extension Headers and Packet Drops
draft-gont-v6ops-ipv6-ehs-in-real-world

One of the interesting features of IPv6 is its support for extension headers, which are variable length bits of information—metadata about the packet, for instance—that can be attached to a packet and processed by either the receiving host or forwarding devices along the way. Extension headers are useful, in that they allow IPv6 to be easily extended on the fly, rather than forcing the protocol designer to create a set of metadata “in stone.” Extension headers, however, are also controversial; how should an ASIC designer decide which ones to support in hardware, and how should extension headers that cannot be handled in hardware Continue reading

Communications of the Bolek Trojan

A few weeks ago CERT Polska released a short blog post introducing a new malware family now known as Bolek. PhishMe and Dr.Web have since added some additional insight into the family. Browsing through a memory dump of the malware, a Webinjects section sticks out. Webinjects usually imply banking malware, so it seems Bolek picks […]

Hackers could have changed Facebook Messenger chat logs

Here's a Facebook hack straight from the pages of the novel 1984: A way to rewrite the record of the past."Who controls the past controls the future: who controls the present controls the past," went the ruling party's slogan in George Orwell's dystopian novel.Security researchers have found a way to control the past, by altering Facebook's logs of online chats conducted through its website and Messenger App.Such modified logs could be used to control the future, the researchers suggest, by using them to commit fraud, to falsify evidence in legal investigations, or to introduce malware onto a PC or phone.Roman Zaikin of Check Point Software Technologies discovered a flaw in Facebook's chat system that made it possible for an attacker to modify or remove any sent message, photo, file or link in a conversation they were part of.To read this article in full or to leave a comment, please click here

Hackers could have changed Facebook Messenger chat logs

Here's a Facebook hack straight from the pages of the novel 1984: A way to rewrite the record of the past."Who controls the past controls the future: who controls the present controls the past," went the ruling party's slogan in George Orwell's dystopian novel.Security researchers have found a way to control the past, by altering Facebook's logs of online chats conducted through its website and Messenger App.Such modified logs could be used to control the future, the researchers suggest, by using them to commit fraud, to falsify evidence in legal investigations, or to introduce malware onto a PC or phone.Roman Zaikin of Check Point Software Technologies discovered a flaw in Facebook's chat system that made it possible for an attacker to modify or remove any sent message, photo, file or link in a conversation they were part of.To read this article in full or to leave a comment, please click here

6 ways video can boost your business

According to a recent Aberdeen report, marketers who use video see much faster revenue growth (49 percent) than those who do not. However, video has become more than just a marketing tool. With their capability to visually explain and demonstrate things and concepts, videos can help businesses not only showcase their products and services, attracting new customers, but they can help companies attract new employees and even make workers more productive.Here are six cases where video can be beneficial.1. Explaining your value proposition/what you do Why tell people what you do when you can show them?To read this article in full or to leave a comment, please click here

Open Forum Track at DockerCon 2016 Includes Curated and Open BoF Sessions and Panels!

Ready for another new addition to DockerCon this year?

The Open Forum track is brand new to this year’s conference agenda! This room is our unique version of hybrid Birds-of-a-Feather sessions and interactive panel discussions. The goal is for a highly interactive conversational room around some guided topics. Be sure to stop in at some point during the conference and let us know what you think!

Continue reading

Ghost story blogger has kind words for Comcast

It's not every day I come across positive sentiments about Comcast, so I thought I'd share this example that I stumbled upon in a local blog focused on, of all things, ghost stories. Author Liz Sower writes realistic but fictional accounts of the paranormal at "Ghosts in the Burbs," and she caught my eye with this recent headline: Xfinity vs. Verizon. I thought for sure she was going to dive into haunted DSL or eerie broadband experiences.To read this article in full or to leave a comment, please click here

Ghost story blogger has kinds words for Comcast

It's not every day I come across positive sentiments about Comcast, so I thought I'd share this example that I stumbled upon in a local blog focused on, of all things, ghost stories.Author Liz Sower writes realistic but fictional accounts of the paranormal at "Ghosts in the Burbs," and she caught my eye with this recent headline: Xfinity vs. Verizon. I thought for sure she was going to dive into haunted DSL or eerie broadband experiences.To read this article in full or to leave a comment, please click here

Ghost story blogger has kinds words for Comcast

It's not every day I come across positive sentiments about Comcast, so I thought I'd share this example that I stumbled upon in a local blog focused on, of all things, ghost stories.Author Liz Sower writes realistic but fictional accounts of the paranormal at "Ghosts in the Burbs," and she caught my eye with this recent headline: Xfinity vs. Verizon. I thought for sure she was going to dive into haunted DSL or eerie broadband experiences.To read this article in full or to leave a comment, please click here

Worth Reading: Big data and big trouble

Deluged with an unprecedented amount of information available for analysis, companies in just about every industry are discovering increasingly sophisticated ways to make market observations, predictions and evaluations. Big Data can help companies make decisions ranging from which candidates to hire to which consumers should receive a special promotional offer. As a powerful tool for social good, Big Data can bring new opportunities for advancement to underserved populations, increase productivity and make markets more efficient. MarketWatch

LinkedInTwitterGoogle+Facebook

The post Worth Reading: Big data and big trouble appeared first on 'net work.

When you isolate your industrial control systems don’t forget about DNS

Many organizations that run industrial control systems strive to isolate them from the Internet, but sometimes forget to disallow Domain Name System (DNS) traffic, which provides a stealthy way for malware to exfiltrate data.Sometimes referred to as supervisory control and data acquisition (SCADA) systems, industrial control systems (ICS) are notoriously insecure. Not only is their firmware full of flaws, but the communication protocols many of them use lack authentication or encryption.Since most ICS systems are typically meant to last over a decade once deployed, they're not easily replaceable without considerable costs. As such, ICS operators tend to focus on securing the perimeter around control systems instead of patching the devices themselves, which is not always possible. This is done by isolating ICS environments from corporate networks and the larger Internet, an action sometimes referred to as airgapping.To read this article in full or to leave a comment, please click here

When you isolate your industrial control systems don’t forget about DNS

Many organizations that run industrial control systems strive to isolate them from the Internet, but sometimes forget to disallow Domain Name System (DNS) traffic, which provides a stealthy way for malware to exfiltrate data.Sometimes referred to as supervisory control and data acquisition (SCADA) systems, industrial control systems (ICS) are notoriously insecure. Not only is their firmware full of flaws, but the communication protocols many of them use lack authentication or encryption.Since most ICS systems are typically meant to last over a decade once deployed, they're not easily replaceable without considerable costs. As such, ICS operators tend to focus on securing the perimeter around control systems instead of patching the devices themselves, which is not always possible. This is done by isolating ICS environments from corporate networks and the larger Internet, an action sometimes referred to as airgapping.To read this article in full or to leave a comment, please click here

Endpoint detection and response: What’s important?

My colleagues Doug Cahill, Kyle Prigmore and I recently completed a research project on next-generation endpoint security. We determined that there are actually two distinct product categories within next-generation endpoint security: advanced prevention and advanced detection and response (EDR). While most firms seem to be gravitating toward advanced prevention, massive enterprise organizations tend to move in the opposite direction by evaluating, testing and deploying EDR products. Why? These organizations have large cybersecurity teams with lots of experience, so they are willing to dedicate resources toward more complex projects.Furthermore, many of these enterprise organizations are already investing in security analytics by collecting, processing and analyzing data from numerous disparate sources (i.e., network forensics, events/logs, threat intelligence, etc.). Endpoint forensic data is a natural extension of these cybersecurity analytics efforts. To read this article in full or to leave a comment, please click here

Endpoint detection and response: What’s important?

My colleagues Doug Cahill, Kyle Prigmore and I recently completed a research project on next-generation endpoint security. We determined that there are actually two distinct product categories within next-generation endpoint security: advanced prevention and advanced detection and response (EDR). While most firms seem to be gravitating toward advanced prevention, massive enterprise organizations tend to move in the opposite direction by evaluating, testing and deploying EDR products. Why? These organizations have large cybersecurity teams with lots of experience, so they are willing to dedicate resources toward more complex projects.Furthermore, many of these enterprise organizations are already investing in security analytics by collecting, processing and analyzing data from numerous disparate sources (i.e., network forensics, events/logs, threat intelligence, etc.). Endpoint forensic data is a natural extension of these cybersecurity analytics efforts. To read this article in full or to leave a comment, please click here

1 … 2,945 2,946 2,947 2,948 2,949 … 3,882