Friday, August 29, 2014

It has been a few years (Okay, decades) since I worked the “Russian Problem” but this seems very familiar. Think of this as a military strategy and ask yourself how significant sanctions can be.
Ukraine: Vladimir Putin's military action reveals a wider plan
Alarm is growing in Kiev and the West over Russia's role in eastern Ukraine. But what is Russian President Vladimir Putin trying to achieve? [Annexation of the Ukraine. Bob]
The indications are clear that Russia is being more confident and less discreet about the presence of its troops and equipment in eastern Ukraine.
As well as sightings of Russian tanks, and reports of Russian paratroopers not only captured by Ukraine but also killed "while carrying out their duties", statements by separatist leaders have changed too.
After months of calling for assistance from Russia, separatist leaders now say that they can "do without outside help".
All this could indicate that Russian planners felt the military situation of Russian-backed separatists was severe enough to need more direct assistance.
Equally, it could be that Russia is simply less concerned at this stage about discretion and deniability.

(Related) Is retaliation for sanctions an act of war? Perhaps JPMorgan should conduct their “routine checks” more frequently?
JPMorgan Hack Said to Span Months Via Multiple Flaws
Hackers burrowed into the databanks of JPMorgan Chase & Co. (JPM) and deftly dodged one of the world’s largest arrays of sophisticated detection systems for months.
The attack, an outline of which was provided by two people familiar with the firm’s investigation, started in June at the digital equivalent of JPMorgan’s front door, an overlooked flaw in one of the bank’s websites. From there, it quickly developed into any security team’s worst nightmare.
The hackers unleashed malicious programs that had been designed specifically to penetrate JPMorgan’s corporate network. Using these sophisticated tools, the intruders reached deep into the bank’s infrastructure, silently siphoning off gigabytes of information, including customer-account data -- uninterrupted until mid-August.
Only then did a JPMorgan team conducting a routine scan trigger an alarm. They discovered a breach, now being traced and evaluated, which investigators believe originated in Russia.
Evidence of advanced planning and the access to elaborate resources, as well as information provided by the FBI, led some members of the bank’s security team to tell outside consultants that they believed the hackers had been aided by the hidden hand of the Russ ian government, possibly as retribution for U.S.- imposed sanctions.

A case study for my Computer Security students.
Report Examines Unanswered Questions Around Target Attack
Cybersecurity startup Aorato has published a report around the data breach suffered in 2013 by Target, which investigates some of the techniques used by the attackers to gain access to the company's networks.
based on publicly available information, Aorato has reviewed the steps taken by the attackers, from the HVAC (heating, ventilation, and air conditioning) contractor breach up to the theft of sensitive information from the retailer's networks.
The report.
… Researchers highlight the fact that in such credit card-oriented attacks, cybercriminals don't invest too much in infrastructure and automation. As in the case of Target, many operations are carried out manually with the aid of various tools; the only automated tasks are performed by the piece of malware used in the attack. In this particular attack, unlike many other APT attacks, the cybercrooks had not created a command and control (C&C) infrastructure, and instead operated everything manually from within the network.

This should be part of your security budget calculation.
2014 Cost of Data Breach: Global Analysis
by Sabrina I. Pacifici on Aug 28, 2014
News release: “Throughout the world, companies are finding that data breaches have become as common as a cold but far more expensive to treat. With the exception of Germany, companies had to spend more on their investigations, notification and response when their sensitive and confidential information was lost or stolen. As revealed in the 2014 Cost of Data Breach Study: Global Analysis, sponsored by IBM, the average cost to a company was $3.5 million in US dollars and 15 percent more than what it cost last year. Will these costs continue to escalate? Are there preventive measures and controls that will make a company more resilient and effective in reducing the costs? Nine years of research about data breaches has made us smarter about solutions. Critical to controlling costs is keeping customers from leaving. The research reveals that reputation and the loss of customer loyalty does the most damage to the bottom line. In the aftermath of a breach, companies find they must spend heavily to regain their brand image and acquire new customers. Our report also shows that certain industries, such as pharmaceutical companies, financial services and healthcare, experience a high customer turnover. In the aftermath of a data breach, these companies need to be especially focused on the concerns of their customers. As a preventive measure, companies should consider having an incident response and crisis management plan in place. Efficient response to the breach and containment of the damage has been shown to reduce the cost of breach significantly. Other measures include having a CISO in charge and involving the company’s business continuity management team in dealing with the breach. In most countries, the primary root cause of the data breach is a malicious insider or criminal attack. It is also the most costly. In this year’s study, we asked companies represented in this research what worries them most about security incidents, what investments they are making in security and the existence of a security strategy.”

As long as your “Thing” only monitors your vitals, you are safe from hackers. If your pacemaker is connected to the Internet, hackers could turn you off.
Doctors and nurses need to take their Internet of Things pills
THE INTERNET OF THINGS (IoT) has the potential to reshape a number of industries, none more so than the healthcare sector.
According to the results of a recent survey we ran, questioning IT professionals on their attitudes to the IoT, healthcare is the biggest potential market for connected devices and technology. Fifty-four percent of readers said that tools like heart-rate monitors were a top benefit of the Internet of Things.
The results show a clear interest among users in how their health, and healthcare in general can be improved by the IoT. This is reflected in recent research, which has indicated that remote patient monitoring is predicted to save an average of $12,000 per patient in the US and significantly reduce hospital-acquired diseases, a figure likely to be achievable in the UK and across Europe too.

Reasonable? Doesn't leave me warm and fuzzy.
The Foreign Intelligence Surveillance Court declassified an opinion today which, although highly redacted, illuminates the way at least one Judge is interpreting his mandate to protect the First Amendment activities of Americans who the FBI seeks to investigate under USA PATRIOT Act Section 215, codified at 50 USC 1861.
Essentially, the question the judge, John D. Bates, confronts is when are international terrorism investigations involving Americans based “solely upon activities protected by the first amendment to the Constitution.” Judge Bates concludes that so long as a international terrorism investigation is premised on some unprotected activity, the FBI can nevertheless investigate law-abiding US persons.

Worthy of a quick read.
The pace of technological change and rise of social media “may make it inevitable” that UK privacy laws need to be revised and updated, the country’s most senior judge has said.
In a speech at the Hong Kong Foreign Correspondents’ Club (9-page / 157KB PDF), Supreme Court president Lord Neuberger said that “astonishing developments” in technology had created “enormous challenges for people involved in the law and people involved in the media”.

Is Apple reserving the right to sell your data to their Apps only?
Kevin Rawlinson reports:
Apple has tightened its privacy rules relating to health apps ahead of next month’s product launch, which is expected to see the unveiling of an updated iPhone and could include new wearable technology.
The technology firm has told developers that their apps, which would use Apple’s “HealthKit” platform on the forthcoming products, must not sell any personal data they gather to advertisers. The move could stave off concerns users might have around privacy as Apple seeks to move into the health data business.
Read more on The Guardian.

I suppose this could work with any online document, but flagging changes to policies is a worthwhile start.
– is a free service that allows you to track changes made to online documents that affect your privacy or your personal information, like Privacy Policies, Terms and Conditions or User Agreements. Pick the websites you’re interested in, and the site will notify you when an update has been made and show you exactly what has changed.

Soon, drones will be armed to shoot down competitor's drones. At minimum, they will have cameras for real time updating of Google maps.
Google reveals the drones that will battle Amazon for control of our skies
… The hope is to one day use these drones for delivering goods to our homes. And if this all sounds familiar, it's because Amazon is doing the same with its Prime Air delivery drones, also in the development phase.

Cars can be drones too.
Terence P. Jeffrey reports:
The National Highway Traffic Safety Administration, part of the Department of Transportation, published last week an ” advanced notice of proposed rulemaking on “vehicle-to-vehicle communications.”
What NHTSA is proposing could begin a transformation in the American transportation system that makes our lives better and freer — or gives government more power over where we go and when.
Read more on CNS News.

Apparently this was not elementary.
Judge Posner Solves Sherlock Holmes Copyright Case
by Sabrina I. Pacifici on Aug 28, 2014
Rita Yoon, McDermott Will & Emery: “The original character of the famous detective Sherlock Holmes, along with his sidekick, Dr. John H. Watson, are no longer subject to copyright protection. In an opinion by Judge Richard A. Posner, the U.S. Court of Appeals for the Seventh Circuit held that copyright protection in these century-old literary characters cannot be extended simply by changing their features in later stories. When the original story expires, the characters covered by the expired copyright are “fair game” for follow-on authors. Klinger v. Conan Doyle Estate, Ltd., Case No. 14-1128 (7th Cir., Jun. 16, 2014) (Posner, J.).”

Curious. Does each lawyer add these to their Kindle or does the firm's librarian keep all the copies?
Free Federal Rules books from LII and CALI
by Sabrina I. Pacifici on Aug 28, 2014
Via Sarah Glassmeyer, Center for Computer-Assisted Legal Instruction: “The 2015 versions of the Federal Rules of Evidence, Criminal Procedure and Civil Procedure are now available. These books are powered by the Legal Information Institute at Cornell University Law School and distributed by the Center for Computer-Assisted Legal Instruction’s eLangdell Press. The books come in .epub format, which is compatible with iPads, Nooks, Android devices and basically everything but kindles. These editions of the books include:
  • The complete rules as of December 1, 2014 (for the 2015 edition).
  • All notes of the Advisory Committee following each rule.
  • Internal links to rules referenced within the rules.
  • External links to the LII website’s version of the US Code.
And yes, all totally free. You are more than welcome to download as many copies as you’d like and add to digital collections. Here are the direct links to the books:
While you are at the eLangdell Press bookstore, you may want to take a look at the growing collection of primary law (including the Federal Rules of Bankruptcy Procedure) and Appellate Procedure and legal classics available, as well as our open law school casebooks.”

For the Computer Security lab.
Netflix Releases Internally Developed Security Tools
Netflix has released two applications used by the company's security team to monitor the Web for potential threats.
… Two of the security-related applications used by Netflix's security team are Scumblr and Sketchy, which the company released on Monday as open source.
Scumblr, a Web app developed in Ruby on Rails, enables users to search the Internet for content of interest. Its built-in plugins are designed for searches on seven popular websites, including Google, Facebook and Twitter. However, new plugins can easily be created for manual or automatic searches on other sites, the company said.
… Sketchy … is capable of saving HTML, capturing screenshots and scraping text, all of which can be stored locally or in the cloud (AWS S3 bucket).
Scumblr, Sketchy and Workflowable are available on Netflix's page on GitHub.

Skyfence Launches Free Cloud App Usage Visibility Tool
Cloud-based applications can be highly useful for an organization, but monitoring them could prove challenging for IT departments. According to Skyfence, enterprise IT teams can use Skyfence Cloud Discovery to monitor Software-as-a-Service (SaaS) applications and services, and determine, based on risk information generated by the tool, which of them could pose a security threat.
Skyfence Cloud Discovery, which is part of the Skyfence Cloud Gateway product suite, can be downloaded for free and used to generate an unlimited number of reports.

Well, I find it amusing.
Pinging The Whole Internet
The image included in the tweet above shows what happens when you ping “all devices on the Internet.” Or at least the devices that answered when a company called Shodan, which bills itself as the “world’s first search engine for internet-connected devices,” attempted the feat.
There are no real surprises in terms of hot-spots but it is, nonetheless, a beautiful visualization of how we are all connected to each other by this series of tubes we call the Internet.

For my students. What can you make better?
The Coolest Cooler breaks Kickstarter records
A beachside drinks and food cooler for the digital generation is now officially the most successful Kickstarter campaign of all time, raising an incredible US$10.36mil (RM32.63mil) in pledges, and the campaign is yet to close.
… What makes the Coolest Cooler so cool? After all, the concept of the cooler predates the refrigerator.
Its creator, Ryan Grepper, will point to the fact that it's a cooler for the 21st century so as well as insulating perishables from the elements, it has an integrated battery-powered blender for smoothies and cocktails, a water-resistant Bluetooth speaker, a built-in chopping board, a USB charger for keeping smartphones powered up and chunky tires for easy rolling over the sand.

No comments: