• Enhancing Privacy Protections for Android Applications

    From navigation to remote banking, mobile device users rely on a variety of applications to streamline daily tasks, communicate, and dramatically increase productivity. While exceedingly useful, the ecosystem of third-party applications utilizes a number of sensors – microphones, GPS, pedometers, cameras – and user interactions to collect data used to enable functionality. Troves of sensitive personal data about users are accessible to these applications and as defense and commercial mobile device users become increasingly reliant on the technology, there are growing concerns around the challenge this creates for preserving user privacy.

  • Assessing Cyber Risk from External Information

    There is a vision for the future of assessing cybersecurity: The goal is a system of cyber metrics that are transparent, auditable, practical, scalable and widely agreed upon. To that end, it is useful—indeed, imperative—to evaluate various approaches to cyber risk quantification with the aim of informing the development of a public standard for measuring cybersecurity.

  • Wobbly” Tracing App “Failed” Clinical Safety and Cybersecurity Tests

    The government’s coronavirus contact tracing app has so far failed the tests needed to be included in the NHS app library, HSJ understands. Jasmine Rapson writes in HJS that the app is being trialed on the Isle of Wight this week, ahead of a national rollout later this month. Senior NHS sources told HSJ it had thus far failed all of the tests required for inclusion in the app library, including cyber security, performance and clinical safety. There are also concerns at high levels about how users’ privacy will be protected once they log that they have coronavirus symptoms, and become “traceable,” and how this information will be used. Senior figures told HSJ that it had been hard to assess the app because the government was “going about it in a kind of a ham-fisted way. They haven’t got clear versions, so it’s been impossible to get fixed code base from them for NHS Digital to test. They keep changing it all over the place.” HSJ’s source described the app as “a bit wobbly.”

  • Predicting and Countering Cyberttacks

    The U.K Defense and Security Accelerator (DASA) announce nearly £1m to further develop technology that predicts and counters cyber-attacks. “This work will develop, adapt and merge the novel approaches explored in Phase 1 of the competition, to proactively defend deployed U.K. military systems and networks from the rapidly growing threat of offensive cyber action from aggressive adversaries,” DASA said.

  • Cyber Operations against Medical Facilities During Peacetime

    In the face of the coronavirus pandemic, governments around the world have tried to compensate for insufficient hospital beds and intensive care units by nationalizing private medical facilities and relying on military ships and improvised evac hospitals. Adina Ponta writes that at a time when overcrowded medical and testing facilities struggle with shortages in supplies and a huge influx of patients, hacker groups have exploited their inattention to cybersecurity.

  • New Privacy Threat Combines Device Identification with Biometric Information

    A new study by computer scientists has revealed a new privacy threat from devices such as smartphones, smart doorbells and voice assistants that allows cyber attackers to access and combine device identification and biometric information.

  • The COVIDSafe App Was Just One Contact Tracing Option. These Alternatives Guarantee More Privacy

    Since its release on Sunday, experts and members of the public alike have raised privacy concerns with the Australian federal government’s COVIDSafe mobile app. Many Australians have said that they worried about “the security of personal information collected” by the app. In its coronavirus response, the government has a golden opportunity to build public trust. There are other ways to build a digital contact tracing system, some of which would arguably raise fewer doubts about data security than the app.

  • The Department of Defense Should Not Wage Cyber War Against Criminal Hackers During the Coronavirus Crisis

    Politicians and pundits in the United States have frequently described the challenge of controlling the COVID pandemic with the language of waging war. Erica D. Borghard writes that given this terminology, it can be tempting to look to the Department of Defense (DOD) to solve problems it was not meant to address. While nefarious actors in cyberspace are seeking to capitalize on scared and vulnerable individuals during the pandemic for criminal gain and national strategic objectives, “any efforts to leverage DOD capabilities in combating these efforts must distinguish between nation-state and criminal activity,” she writes.

  • Studying Ideologically Motivated Cyberattacks

    A John Jay College of Criminal Justice project on cyberterrorism is one of 13 selected by the Department of Homeland Security as part of the National Counterterrorism Innovation, Technology, and Education (NCITE) Center, a new DHS Center of Excellence. The John Jay project will study and aggregate ideologically motivated cyberattacks and will create a new, unique dataset – the Cyber-Extremist Crime Database (Cyber-ECDB) – which will track ideologically motivated cyberattacks against U.S. targets from 1998 to present.

  • Senate Intel Releases Report on Intel Community Assessment of Russian Interference

    On Tuesday, Senate Select Committee on Intelligence released a new report, the fourth and penultimate volume in the Committee’s bipartisan Russia investigation. The latest installment examines the sources, tradecraft, and analytic work behind the 2017 Intelligence Community Assessment (ICA) that determined Russia conducted an unprecedented, multi-faceted campaign to interfere with the 2016 U.S. presidential election. “One of the ICA’s most important conclusions was that Russia’s aggressive interference efforts should be considered ‘the new normal,’” said Senator Richard Burr (R-North Carolina), the committee’s chairman.

  • Bolstering Cybersecurity for Systems Linking Solar Power to Grid

    DOE has awarded researchers $3.6 million to advance technologies that integrate solar power systems to the national power grid. “As U.S. energy policy shifts toward more diverse sources, particularly solar, the Energy Department understands the critical importance of protecting these systems and technologies,” said Alan Mantooth, U Arkansas Professor of electrical engineering and principal investigator for the project.

  • Strengthening Mobile Device Email Security and Privacy

    Large and small organizations alike now rely heavily on mobile devices like smartphones or tablets to enable their workers, customers and management to connect and collaborate, even when some or all of them are working remotely. But device users may prioritize convenience over strong security, accidently share sensitive information with unintended audiences, or use their corporate- or government-owned devices in contexts in which sensitive business information should not be shared.

  • Cybersecurity Requires International Cooperation, Trust

    Most experts agree that state-sponsored hackers in Russia are trying to use the internet to infiltrate the U.S. electrical grid and sabotage elections. And yet internet security teams in the U.S. and Europe actively seek to cooperate with their Russian counterparts, setting aside some of their differences and focusing on the issues where they can establish mutual trust.

  • Huawei and the Third Offset

    In order to effectively mitigate the security risks posed by Huawei, the U.S. Department of Defense needs to fund and integrate cutting-edge technologies from the private sector. Offset strategies are intended to counterbalance an adversary’s military advantages by developing asymmetric technological strengths.

  • Saving the IoT from Botnets

    The advent of the Internet of Thing, essentially smart devices with connectivity to the internet has wrought many benefits, but with it comes the problem of how to cope with third party users with malicious or criminal intent.