• NERC’s critical infrastructure protection standards ambiguous, unclear: analysts

    In January 2008, to counter cybersecurity threats to critical infrastructure assets such as bulk electricity supply (BES), North American Electric Reliability Corp.’s (NERC) launched its Critical Infrastructure Protection (CIP) standards for BES cybersecurity. The NERC-CIP is marked by uncertainties and ambiguous language, raising concerns in the industry and among industry observers as companies try to enforce the standards. “Industry now screams for a defined control set with very specific requirements that don’t permit subjective and ambiguous interpretations,” comments one analyst.

  • 2014 Cybersecurity Forum to focus on Trusted Computing

    The 2014 Cybersecurity Innovation Forum, to be held 28-30 January 2014, at the Baltimore Convention Center in Baltimore, Maryland, will focus on the existing threat landscape and provide presentations and keynotes on current and emerging practices, technologies and standards to protect the nation’s infrastructure, citizens and economic interests from cyberattack.

  • Lawmaker wants to know how cyber-safe vehicles are

    Senator Ed Markey (D-Massachusetts) has asked twenty automobile manufacturers to submit details of their plans to prevent vehicles from wireless hacking attempts, as well as plans to prevent violations of driver privacy. Markey wants automobile manufacturers to apply computer-industry security processes and technology — including anti-virus software, incident logging, incident-response planning, software vulnerability patching, and third-party penetrating testing — to mass produced vehicles.

  • Cybersecurity giants adapt to changing cyberthreat landscape

    McAfee and Symantec, the two technology giants of traditional firewall and antivirus protection software, are shifting their attention to focus more on cybersecurity challenges. A rapidly changing landscape for computer networks, in which data is transmitted and stored via mobile devices and cloud computing, has created demand for products and services that can secure information against state-sponsored or organized cyber terrorism.

  • DHS announces expansion of cyber student volunteer initiative

    DHS the other day announced the launch of the 2014 Secretary’s Honors Program (SHP) Cyber Student Volunteer Initiative for college students. Through the program, more than 100 unpaid student volunteer assignments will be available to support DHS’ cyber mission at local DHS field offices in over sixty locations across the country.

  • Cold War to cyber war, here’s how weapon exports are controlled

    It was reported last week that the U.K. government is pushing for new restrictions on software — in particular, on tools that would prevent surveillance by the state. This was the focus of negotiations to incorporate cyber security technologies into the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies. Wassenaar was born of the Cold War in 1996. The idea was to inhibit the Soviets (and Chinese) by preventing the export of military equipment and the technology that could be used to make, maintain or defeat that equipment. The push to include cybersecurity in Wassenaar negotiations is unlikely to be effective but will reassure nervous politicians and officials.

  • Cybersecurity isn’t all about doom and gloom

    Much is made in the press of the devastating effects that weak cybersecurity is having on the economy in the United Kingdom and globally. The threat is compounded by a significant skills shortage. The U.K. government thinks the problem is so severe that it has identified cybersecurity as a Tier 1 national security threat and invested 860 million pounds to defend the country’s digital shores. What all this means is that there is money to be made from cybersecurity and small businesses should not fear it but embrace it. The business opportunities are boundless in cybersecurity. One area that is promising in this sense is the move towards smart cities. As the infrastructure around us, such as traffic lights and utilities becomes more regularly controlled via computers, market opportunities emerge

  • New Silicon Valley focus on cybersecurity

    The last time Silicon Valley focused on cybersecurity was in the 1990s. That focus saw the emergence of two giants: McAfee and Symantec. The two companies remain the most recognizable household names, thanks to their traditional firewall and anti-virus products. Now they find the arena which they thought was their own encroached from two sides. On one side there are tech giants like Hewlett-Packard and Cisco Systems, which see new revenue opportunity in cybersecurity. On the other side there is a rush of start-ups backed by large investments of venture capital.

  • Cyberweapons to defend electricity's perimeter

    Cyber war, cyber terror, and cyber crime target all manner of operations and, by design, cannot be detected until they have already done their damage. Nobody is immune to such attacks, and particularly target-rich environments include government bodies and critical power industries such as bulk electricity supply (BES). Hackers and cyberdefenders clash just outside of, at, or inside an organization’s electronic security perimeter (ESP). To counter such threats, a bulk electricity solution — North American Electric Reliability Corp.’s (NERC) Critical Infrastructure Protection (CIP) standards regarding BES cybersecurity — was launched in January 2008 through Federal Energy Regulatory Commission (FERC) oversight. How effective is the use of cyberweapons in protecting electricity’s perimeter?

  • Protecting cars from hackers

    A U.S. senator has asked twenty automobile manufacturers how each plans to stave off wireless hacking attempts on the computer systems of the vehicle they manufacture, and also how they protect driver privacy. The questions by Senator Ed Markey (D-Massachusetts) indicate that he will demand that carmakers apply computer-industry security processes, including implementation of anti-virus software, incident logging, incident-response planning, software vulnerability patching, and third-party penetration testing — the last of which would stage real hacker attacks on mass-production vehicles.

  • NIST's cybersecurity framework for infrastructure

    Company which are managing critical infrastructure in the United States and disregard the Preliminary Cybersecurity Framework, issued by the National Institute of Standards and Technology (NIST) in late October, do so at their own peril. The framework is now in its final comment stage and due to be released in mid-February. It lays out a set of comprehensive but voluntary cybersecurity practices.

  • EU issues new manual for defending ICS against cyberattacks

    ENISA, the EU’s cybersecurity agency, has issued a new manual for better mitigating attacks on Industrial Control Systems (ICS). ICS support vital industrial processes primarily in the area of critical information infrastructure such as the energy and chemical transportation industries, where sufficient knowledge is often lacking. As ICS are now often connected to Internet platforms, additional security preparations must be taken. ENISA says that the new guide provides the necessary key considerations for a team charged with ICS Computer Emergency Response Capabilities (ICS-CERC).

  • Federal IT spending to exceed $11 billion by 2018

    A new report from Delteks, contracted spending on cybersecurity will continue to grow from nearly $9 billion in FY2013 to $11.4 billion in FY2018, driven by multiple initiatives aimed at improving the overall cybersecurity posture of federal agencies. Persistent threats, complex and evolving policy issues, and changing technologies highlight ongoing cyber-workforce shortages to drive investments despite constrained federal IT funding.

  • Cybersecurity Manhattan Project needed

    On a daily basis, cyberattacks successfully steal U.S. intellectual property and military weapons plans, disrupt banking systems operations, and gain access to personal information which is supposed to be secure. The question: What it will take to harness America’s resources to push the country into developing effective national cyberdefense capabilities? Should it take another 9/11? Experts say that the whole must be greater than the sum of its parts. Power grid cyberattack exercises, increased cyberwarrior staffing at U.S. Cybercom, and the authorization of preemptive cyberattacks by Presidential Policy Directive 20 are individually good steps. But where is the whole? The unifying call to action? The United States may not be able to have another Manhattan Project, but it should be able to develop a Manhattan Project mentality, one which is orchestrated and executed by the U.S. cybersecurity czar or perhaps the DHS.

  • NSA planted sleeper malware in 50,000 computer networks

    The NSA has planted 50,000 sleeper malware packages – in effect, digital sleeper agents – in more than 50,000 computer networks around the world. The agents, controlled by the NSA’s Tailored Access Operations (TAO) unit, can be activated on command to harvest information of cause disruption. To plant the digital agents, the NSA employed methods typically used by Internet scammers and fraudsters.