Friday, April 27, 2018

You would expect to find CyberWar anywhere you find a shooting war.
Syria Is Now ‘The Most Aggressive Electronic Warfare Environment On The Planet,’ SOCOM Says
General Raymond Thomas, the commander of U.S. Special Operations Command (USSOCOM), revealed that Syria has become the frontline of electronic warfare and U.S. planes are being disabled.
… While Thomas did not say which country is responsible for the attacks, Russian jamming and electronic warfare capabilities in Syria have long been noticed. Earlier this month, reports surfaced that Russian jamming was affecting small U.S. surveillance drones.
Those efforts were, according to NBC News, not affecting larger armed drones like the MQ-1 Predator or the MQ-9 Reaper.
… It’s not clear what exactly Thomas meant by “disabling,” but Lori Moe Buckhout, a former Army colonel and expert on electronic warfare, told Breaking Defense that the attacks could possibly have targeted a EC-130’s Position, Navigation and Timing (PNT) or communications.
That would force the pilots to use traditional methods of navigation like maps and line of sight, which could make flying the aircraft more difficult.
… Syria has proven to become, as STRATFOR notes, “the ultimate testing ground” for the Russian military.
“Moscow’s forces employed new sea- and air-launched land-attack cruise missiles, deployed new types of air defense systems and battlefield drones, and extensively relied on next-generation electronic warfare systems,” a report from the geopolitical intelligence platform said.

I would like the SEC to mandate a comparison between costs of the breach and costs that could have prevented the breach. I doubt we’ll ever see that.
Larry Dignan reports:
Equifax’s first quarter earnings report highlighted expenses due to its September 2017 data breach and how the spending is shifting more toward IT and security.
In its first quarter earnings report, Equifax outlined that it spent $45.7 million for the three months ended March 31 on IT and data security. The company has been staffing up to bring on expertise to shore up its security.
Read more on ZDNet.

Get ready for November.
… Election hacking has a broad set of definitions, but you can boil it down to one central concept: manipulation of the voting process in favor of a candidate or political party.
… Despite the many examples of electoral interference around the globe, election hacking boils down to just three major, coverall categories. Why? Because together, these three categories form a cohesive strategy for election hacking.
1. Manipulate the Voters Before the Election
2. Manipulate the Votes and Machines
3. Manipulate the Infrastructure

More for Mom & Dad than the corporate environment, but I would recommend sharing this with employees.
Reports of tech support scams rocket, earning handsome returns for fraudsters
A typical technical support scam works like this:
1. A user receives a phone call, claiming to come from an operating system vendor or ISP claiming that a security problem has been found on the user’s computer.
One trick fraudster may use to gain a less technically savvy user’s confidence by tricking them into looking for error messages in Windows Event Viewer’s logs.
In fact, such entries are completely harmless and should not be considered evidence of a malware infection.

Gosh Jeff, physical security was last week’s topic. Try to keep up!
Amazon is now selling home security services, including installations and no monthly fees
… Amazon has quietly launched a portal offering home security services — which include all the equipment you would need and in-person visits from Amazon consultants to advise and install the kit. The packages are being sold in five price tiers, at a flat fee — no monthly service contracts, a significant disruption of how many home security services are sold today.

This week is Cryptography…
A few thoughts on Ray Ozzie’s “Clear” Proposal
.. In this post I’m going to sketch a few thoughts about Ozzie’s proposal, and about the debate in general. Since this is a cryptography blog, I’m mainly going to stick to the technical, and avoid the policy details (which are substantial).

As much for my Architecture class as my Computer Security class.
… The disaster at TSB should serve as a big wake up call. The very short version is that a UK bank, TSB, which had been merged into and then many years later was spun out of Lloyds Bank, was bought by the Spanish bank Banco Sabadell in 2015. Lloyds had continued to run the TSB systems and was to transfer them over to Sabadell over the weekend. It’s turned out to be an epic failure, and it’s not clear if and when this can be straightened out.
It is bad enough that bank IT problem had been so severe and protracted a major newspaper, The Guardian, created a live blog for it that has now been running for two days.
The more serious issue is the fact that customers still can’t access online accounts and even more disconcerting, are sometimes being allowed into other people’s accounts, says there are massive problems with data integrity.
… Even worse, the fact that this situation has persisted strongly suggests that Lloyds went ahead with the migration without allowing for a rollback. If true, this is a colossal failure, particularly in combination with the other probable planning failure, that of not remotely adequate debugging (while there was a pilot, it is inconceivable that it could have been deemed to be a success if the testing had been adequate).

Something to research: Does this track with the decline in PC sales?
Microsoft Tops Amazon In Q1 Cloud Revenue, $6.0 Billion To $5.44 Billion; IBM Third at $4.2 Billion
Despite posting excellent first-quarter cloud-revenue growth of 49% to $5.44 billion, Amazon actually lost ground in its efforts to overtake Microsoft as the world's leading enterprise-cloud provider as Satya Nadella's company reported its commercial-cloud revenue jumped 58% to $6.0 billion.

No comments: