• National cyber complex to open next to Ben-Gurion University of the Negev campus

    A new national cyber complex called CyberSpark will open at the Advanced Technology Park (ATP) which is located next to Ben Gurion University of the Negev. Fortune 500 companies Lockheed Martin and IBM announced they would invest in CyberSpark R&D facilities, joining other cybersecurity leaders Deutsche Telekom, EMC, RSA, and many startups. The 15-building ATP is the only type of complex of its kind in the world that includes Fortune 500 companies and cyber-incubators, academic researchers, and educational facilities as well as national government and security agencies. The CyberSpark will also include a high school geared toward science and technology.

  • Gaza-based Palestinian hackers compromise Israeli defense ministry computer

    Hackers broke into a computer at the Israeli Ministry of Defense through an e-mail attachment tainted with malicious software. The attachment looked as if it had been sent by the country’s internal security service, the Shin Bet. it was likely that Palestinians were behind the cyberattack, saying that the more recent attacks were similar to cyberattacks against Israeli computers more than a year ago. Those attacks originated in the Hamas-controlled Gaza Strip. The attackers used an e-mail attachment to infect the computers with Xtreme RAT malware, which is a remote access Trojan. The malware allows hackers complete control of an infected machine. They can steal information, load additional malicious software onto the network, or use the invaded computer as a base of operations from which to conduct reconnaissance and attempt to gain deeper access into the network.

  • Cal Poly unveils ambitious cybersecurity educational initiative

    Cal Poly, with a grant from the Northrop Grumman Foundation, has established a Cybersecurity Center, opened a new cyber lab, and is developing a cybersecurity curriculum with an ambitious set of goals in mind: educating thousands of students in cybersecurity awareness and readiness; producing experts in cyber technologies and systems, including many professionals who will serve the military and defense industry; and graduating cyber innovators who are prepared for advanced study and applied research in emerging cyber issues.

  • Botwall: New Web security solution uses real-time polymorphism to ward off attacks

    Malware has long used polymorphism — that is, rewriting its code — every time a new machine was infected in order easily to evade antivirus detection systems. Shape Security says its new product, the ShapeShifter, is reversing this advantage which malware has so far enjoyed: the new product uses polymorphic code as a new foundational tool for Web site defense. The patent-pending technology implements real-time polymorphism, or dynamically changing code, on any Web site, to remove the static elements that botnets and malware depend on for their attacks.

  • Many VSATs operated with no security, leaving them vulnerable to hacking

    Very-small-aperture terminals, or VSATs, are used by the oil and gas industry, utilities, financial firms, and news media to transmit information, often sensitive, from remote locations to headquarters. There are more than 2.9 million VSATs in operation around the world, with about two-thirds based in the United States. New security report says that at least 10,500 VSATs are operated with minimal or no security, and are wide open to being hacked.

  • House approves $447 for Cyber Command

    The House of Representatives approved a fiscal 2014 stop-gap budget last Monday (it approved to full spending bill on Wednesday), which allocates $447 million to the Defense Department’s Cyber Command. This is more than twice the $191 million budget for Cyber Command in 2013.

  • Healthcare industry to conduct cyberattack drill in March

    The American health care industry, in partnership with the federal government, will in March conduct simulated cyberattacks targeting industry networks and resources in an effort to test the industry’s vulnerability to cyberattacks. This will be the first time insurers, hospitals, pharmaceutical manufacturers, and HHS will run coordinated drills. Healthcare is one of seventeen critical infrastructure sectors which, if attacked, could have damaging consequences for the country.

  • Estimating the best time to launch a cyberattack

    Of the many tricks used by the world’s greatest military strategists, one usually works well — taking the enemy by surprise. It is an approach that goes back to the horse that brought down Troy. But surprise can only be achieved if you get the timing right. Timing which, researchers at the University of Michigan argue, can be calculated using a mathematical model — at least in the case of cyber-wars. “The question of timing is analogous to the question of when to use a double agent to mislead the enemy, where it may be worth waiting for an important event but waiting too long may mean the double agent has been discovered,” the researchers say.

  • Palo Alto Networks acquires Morta Security

    Palo Alto Networks has acquired Morta Security, a Silicon Valley-based cybersecurity company operating in stealth mode since 2012. Financial terms of the acquisition were not disclosed. Palo Alto Networks says that the acquisition of Morta Security further strengthens its position as a provider of next-generation enterprise security.Palo Alto Network says that most organizations still rely on legacy point technologies that address only specific types of attacks, or phases of the attack. Because of the singular nature of these technologies, they are ill-equipped to detect and prevent today’s advanced cyberattacks.The company says that to address these challenges, a new approach is required.

  • Bringing anthropological insights to bear on cybersecurity

    Michael Polanyi (1891-1976), in his book Personal Knowledge, rejected the British Empiricists’ notion that experience can be reduced to sense data, and Alan Turing’s assertion that human minds are reducible to collections of rules. Rather, Polanyi said, it is tacit awareness — he later called it the “structure of tacit knowing”— which connects us, albeit fallibly, with reality. It provides us with the context within which our words and actions have meaning. Princeton’s anthropologist Clifford Geertz (1926-2006), in his The Interpretation of Cultures, built on Polanyi’s argument to say that the task of ethnography is thus to discover and interpret the secondary, or underlying (Polnayi would say “tacit”) meanings of social behavior — the “deep structure” of culture and social life. Cybersecurity experts at Kansas State University, in a 3-year, $700,000 project, take an anthropological approach to cybersecurity: they are examining the unspoken knowledge shared by cybersecurity analysts as a way to develop new automated tools that help analysts strengthen their cyberdefenses.

  • FireEye acquires Mandiant in a deal worth about $1 billion

    The combination of the two companies creates one of the cybersecurity industry leading vendor. The combined competencies of the two companies would allow them to find and stop attacks at every stage of the attack life cycle. “The reason for this deal is that we now live in a world of constant compromise. When you know you will be compromised, you can’t just continue trying to keep the bad guys out; you also need to investigate every compromise, figure out what happened, prevent it from ever happening again and clean up the mess,” says one analyst.

  • NIST invites comment on RFP to support cybersecurity center of excellence

    The National Cybersecurity Center of Excellence (NCCoE) is inviting comments on a Partial Draft Request for Proposals (RFP) for a contractor to operate a Federally Funded Research and Development Center (FFRDC) to support the mission of the NCCoE. The FFRDC will be the first solely dedicated to enhancing the security of the nation’s information systems.

  • BGU researchers identify critical vulnerability Samsung's Galaxy S4

    Security researchers at Ben Gurion University of the Negev’s (BGU) Cyber Security Labs have identified a critical vulnerability in highly secure Samsung mobile devices which are based on the Knox architecture. Samsung Knox, which is currently undergoing the U.S. Department of Defense approval review process, features the most advanced security-driven infrastructure for mobile phones. The breach, researchers believe, enables easy interception of data communications between the secure container and the external world including file transfers, emails and browser activity.

  • U.S. Air Force plans to add 1,000 new cybersecurity personnel

    Budget cuts notwithstanding, the U.S. Air Force plans to add 1,000 new personnel between 2014 and 2016 as part of its cybersecurity units. The 24th Air Force at Joint Base San Antonio-Lackland, Texas is home to the U.S. Air Force cyber command. With a budget of about $1 billion and a staff of roughly 400 military and civilian personnel, the command oversees about 6,000 cyber defense personnel throughout the Air Force.

  • NERC’s critical infrastructure protection standards ambiguous, unclear: analysts

    In January 2008, to counter cybersecurity threats to critical infrastructure assets such as bulk electricity supply (BES), North American Electric Reliability Corp.’s (NERC) launched its Critical Infrastructure Protection (CIP) standards for BES cybersecurity. The NERC-CIP is marked by uncertainties and ambiguous language, raising concerns in the industry and among industry observers as companies try to enforce the standards. “Industry now screams for a defined control set with very specific requirements that don’t permit subjective and ambiguous interpretations,” comments one analyst.