Cybersecurity

  • CybersecuritySWAMP: Improving software assurance activities

    The Software Assurance Market Place, or SWAMP, is an online, open-source, collaborative research environment that allows software developers and researchers to test their software for security weaknesses, improve tools by testing against a wide range of software packages, and interact and exchange best practices to improve software assurance tools and techniques.

  • TerrorismISIS’s appeal to Islamist recruits grows as al Qaeda seen as stale, tired, and ineffectual

    Advances by militant groups like the Islamic State of Iraq and Syria (ISIS) in the midst of turmoil in the Arab world, while al-Qaeda’s aging leaders remain relatively silent, have led would-be terrorists and Islamic scholars to question al-Qaeda’s influence on global Jihad and its would-be fighters. Within the social circles of potential militant recruits, al-Qaeda is increasingly seen as stale, tired, and ineffectual.

  • GridThe smart grid offers convenience, but it also makes cyberattacks more likely

    Recent efforts to modernize the electric grid have increased communication between utilities and consumers, enhanced reliability, and created more opportunities for green energy producers; but it has also elevated the risk of cyberattacks. Proposed smart grids rely on technology that has created millions of new access points; and though more access points within the grid allows renewable energy generators to supply utilities, they also present opportunities for hackers to breach the system.

  • TerrorismCanadian “sha’hid” used by ISIS in Jihadi recruitment video

    The Islamic State in Iraq and Syria’s (ISIS) strategy to use English-speaking Westerns and social media to recruit militants is unprecedented. ISIS has used World Cup hashtags on Twitterand Facebookto spread propaganda and generate death threats. The group’s adoption of new media could be seen as a move better to compete with rival militant groups. One of the more popular YouTube ISI video featuring a Canadian of was killed in an attack on a Syrian military airport.

  • Cyberattack insuranceDemand for cyberattack insurance grows, but challenges remain

    The surge in cyberattacks against the private sector and critical infrastructure has led to a growth in demand for cyber insurance; yet most insurers are unable properly to assess their clients’ cyber risk, let alone issue the appropriate pricing for their cyber coverage.Insurers which traditionally handle risks like weather disasters and fires, are now rushing to gain expertise in cyber technology.On average, a $1 million cyber coverage could cost $20,000 to $25,000.

  • Digital forensicsCloud computing poses technical challenges for digital crime-fighters

    The ultimate in distributed computing, cloud computing is revolutionizing how digital data is stored, processed, and transmitted. It enables convenient, on-demand network access to a shared pool of configurable computing resources, including servers, storage, and applications. The characteristics that make this new technology so attractive also create challenges for forensic investigators who must track down evidence in the ever-changing, elastic, on-demand, self-provisioning cloud computing environments.

  • China syndromeChinese government hackers collected information on U.S. security clearance applicants

    Chinese government hackers last March broke into the computer networks of the U.S. Office of Personnel Management, the agency which keeps the personal information of all federal employees. The hackers targeted the information of tens of thousands of employees who had applied for top-secret security clearances. Experts note that the hacking of OPM files containing information about federal employees applying for security clearance is especially disturbing since federal employees applying for security clearances enter their most personal information.

  • CybersecurityPennsylvania cybersecurity group takes down international criminal network

    Over the past month, a coalition of cybersecurity forces in Pittsburgh, Pennsylvania made of regional FBI officers and members of Carnegie Mellon University’s CERT cyberteam, took down the Gameover Zeus cyber theft network, which had employed data ransom and theft schemes. The criminal group was able to snatch funds up to seven figures from owners’ bank accounts.

  • CybercrimeLeaked documents reveal law enforcement hacking methods

    Through the sourcing of a leaked documents cache from the Italian firm Hacking Team, members of the University of Toronto’s Citizen Lab have revealed the methods of law-enforcement hackers. While much of Snowden’s revelations concerned broad international surveillance, documents from Hacking Team reveal more specific methods such as the actual techniques for tapping phones and computers to operate as eavesdropping devices.

  • CybersecuritySyrian Electronic Army’s attack on Reuters makes a mockery of cyber-security (again)

    By Bill Buchanan

    One big security issue that has arisen lately concerns control of news media. National boundaries have become blurred on the Internet, and the control any nation can have over information dissemination has been eroded — on news Web sites but especially on open platforms such as Twitter and Facebook. One lesson from all the attacks on open platforms is that a focus of any attempted hack will be a spear phishing e-mail. Tricking users into entering their details may be simple, but it can be very serious. For example the Reuters site, which was attacked by the Syrian Electronic Army (SEA), a pro-Assad group of “hacktivists,” integrates more than thirty third-party/advertising network agencies into its content. A breach on any of these could compromise the agency’s whole infrastructure.

  • Information securityDHS receives top FISMA score for the second year in a row

    DHS has received the top score in the annual Federal Information Security Management Act (FISMA), making it the only agency to achieve a score of ninety-nine two years in a row. The act, passed in 2002, requires the Office of Management and Budget to report on federal agencies’ implementation of set processes designed to secure federal IT infrastructures.Analysts credit the achievement to DHS’ Office of Inspector General’s (OIG) push for continuous monitoring of IT systems and standards. The OIG uses commercial vulnerability scanning tools and open source management software to form a system that routinely scans the agency’s networks for compliance with FISMA metrics.

  • CybersecurityIs Facelock the password alternative we’ve been waiting for?

    By Philip Branch

    One of the problems with using passwords to prove identity is that passwords that are easy to remember are also easy for an attacker to guess, and vice versa. Nevertheless, passwords are cheap to implement and well understood, so despite the mounting evidence that they are often not very secure, until something better comes along they are likely to remain the main mechanism for proving identity. But maybe something better has come along. Researchers propose a new system based on the psychology of face recognition called Facelock. But how does it stack up against existing authentication systems? The idea certainly sounds interesting and the technical challenges in implementing such a system do not seem great. But there are difficult questions regarding cost, selection and security of images that need to be answered before it becomes a practical alternative to passwords.

  • CybersecurityResearch identifies Android security weaknesses caused by performance design

    Researchers have identified a weakness in one of Android’s security features. Their research, titled Abusing Performance Optimization Weaknesses to Bypass ASLR, identifies an Android performance feature that weakens a software protection called Address Space Layout Randomization (ASLR), leaving software components vulnerable to attacks that bypass the protection. The work is aimed at helping security practitioners identify and understand the future direction of such attacks.

  • Storage security“Marked ghost imaging” offers enhanced security for data storage, transmission

    Ghost imaging” sounds like the spooky stuff of frivolous fiction, but it is an established technique for reconstructing hi-res images of objects partly obscured by clouds or smoke. Now researchers are applying the same idea in reverse to securing stored or shared electronic data. Their work establishes “marked ghost imaging” technology as a new type of multi-layer verification protocol for data storage or transmission.

  • CybersecurityShortage of cybersecurity professionals a risk to U.S. national security

    The nationwide shortage of cybersecurity professionals — particularly for positions within the federal government — creates risks for national and homeland security, according to a new RAND study. Demand for trained cybersecurity professionals who work to protect organizations from cybercrime is high nationwide, but the shortage is particularly severe in the federal government, which does not offer salaries as high as the private sector.