Collaborate Disseminate
The NSA has another contractor who stole classified documents. It’s a weird story: "But more than a month later, the authorities cannot say with certainty whether Mr. Martin leaked the information, passed them on to a third party or whether he simply downloaded them." So maybe a potential leaker. Or a spy. Or just a document collector. My guess is… Continue reading NSA Contractor Arrested for Stealing Classified Information
This article on US/China cooperation and competition in cyberspace is an interesting lens through which to examine security policy…. Continue reading US and China in Cyberspace
Interesting research from Sasha Romanosky at RAND: Abstract: In 2013, the US President signed an executive order designed to help secure the nation’s critical infrastructure from cyberattacks. As part of that order, he directed the National Institute for Standards and Technology (NIST) to develop a framework that would become an authoritative source for information security best practices. Because adoption of… Continue reading The Cost of Cyberattacks Is Less than You Might Think
Both are worth reading…. Continue reading Two Good Essays on the NSA’s "Upstream" Data Collection under Section 702
The National Security Agency is lying to us. We know that because of data stolen from an NSA server was dumped on the Internet. The agency is hoarding information about security vulnerabilities in the products you use, because it wants to use it to hack others’ computers. Those vulnerabilities aren’t being reported, and aren’t getting fixed, making your computers and… Continue reading The NSA Is Hoarding Vulnerabilities
Good article. And I was interviewed on WGBH on the topic…. Continue reading More on Voting Machine Security
The Open Technology Institute of the New America Foundation has released a policy paper on the vulnerabilities equities process: "Bugs in the System: A Primer on the Software Vulnerability Ecosystem and its Policy Implications." Their policy recommendations: Minimize participation in the vulnerability black market. Establish strong, clear procedures for disclosure when it discovers and acquires vulnerability. Establish rules for government… Continue reading More on the Vulnerabilities Equities Process
Last week, President Obama issued a policy directive (PPD-41) on cyber-incident response coordination. The FBI is in charge, which is no surprise. Actually, there’s not much surprising in the document. I suppose it’s important to formalize this stuff, but I think it’s what happens now. News article. Brief analysis. The FBI’s perspective…. Continue reading New Presidential Directive on Incident Response
Russia has attacked the US in cyberspace in an attempt to influence our national election, many experts have concluded. We need to take this national security threat seriously and both respond and defend, despite the partisan nature of this particular attack. There is virtually no debate about that, either from the technical experts who analyzed the attack last month or… Continue reading Hacking the Vote
Disaster stories involving the Internet of Things are all the rage. They feature cars (both driven and driverless), the power grid, dams, and tunnel ventilation systems. A particularly vivid and realistic one, near-future fiction published last month in New York Magazine, described a cyberattack on New York that involved hacking of cars, the water system, hospitals, elevators, and the power… Continue reading Real-World Security and the Internet of Things