Category Archives: Internet Security
Drones must be constantly connected to the internet to give Feds real-time location data new US govt proposal – The Register
Drone enthusiasts are up in arms over rules proposed by the US Federal Aviation Administration (FAA) that would require their flying gizmos to provide real-time location data to the government via an internet connection.
The requirement, for drones weighing 0.55lb (0.25kg) or more, would ground an estimated 80 per cent of gadgets in the United States, and many would never be able to fly again because they couldnt be retrofitted with the necessary equipment, say drone owners. Those that did buy new drones would need to buy a monthly data plan for their flying machines: something that would likely cost $35 or more a month, given extortionate US mobile rates.
There are also additional costs of running what would need to be new location databases of drones, which the FAA expects will be run by private companies but doesnt exist yet, which drones owners would have to pay for through subscriptions. The cost of all this is prohibitive, for little real benefit, they argue.
If a device loses internet connectivity while flying, and can't send its real-time info, it must land. It may be possible to pair a drone control unit with, say, a smartphone or a gateway with fixed-lined internet connectivity, so that the drone can relay its data to the Feds via these nodes. However, that's not much use if you're out in the middle of nowhere, or if you wander into a wireless not-spot.
Nearly 35,000 public comments have been received by the FAA, with the comment period closing later today. The vast majority of the comments are critical and most make the same broad point: that the rules are too strict, too costly and are unnecessary.
The worlds largest drone maker, DJI, is among those fighting the rule change, unsurprisingly enough. The manufacturer argues that while it agrees that every drone should have its own unique ID, the FAA proposal is complex, expensive and intrusive.
It would also undermine the industry own remote ID solution that doesnt require a real-time data connection but utilizes the same radio signals used to control drones to broadcast ID information. It also flags that the proposed solution has privacy implications: people would be able to track months of someones previous drone usage.
Everyone understands why cars need license plates: drivers have to be accountable, DJI argues. But what if instead of just a license plate, your car was also legally required to be connected via the internet to a privately run car-tracking service that charged you an annual fee of about 20 per cent of your cars value, and stored six months of your driving data for government scrutiny? Would you think the government had gone too far?
For its part, the FAA says it is following recommendations put to it by a special committee called the Remote ID Aviation Rulemaking Committee (ARC). The ARC recommended the FAA adopt an industry standard for data transmission, which may need to be created, to ensure unmanned aircraft equipment and public safety receivers are interoperable, the FAA notes in its rules. It later states: The FAA agrees that requiring the broadcasting of messages directly from the unmanned aircraft and the transmission of messages over the internet is an appropriate approach because it provides a more complete picture of unmanned aircraft in the airspace of the United States.
It rejects the drone industrys standard where radio rather than cellular data is used to broadcast IDs because, it argues, public safety officials may not be able to equip with receivers for all possible direct broadcast technologies. Under the radio plan, officials would use a receiver to pick up the radio signals but would need to physically be in the area. Under its current plan, those government officials could sit in offices thousands of miles away (or in the field) and watch drone traffic through their browsers.
But, DJI and others argue, the FAA has actually ignored its own ARC team and similar teams across the globe by insisting that the cellular solution is the only one that can be allowed: all recommendations up to this point have argued that both radio or cellular approaches are acceptable.
ARC produced a final report that did not recommend mandatory internet-based services, says DJI. Rather, the consensus recommendation was for drones flying under existing FAA rules to perform Remote ID via a radio broadcast, with network solutions an optional alternative. Moreover it notes: Aviation officials in Europe, who also weigh the aviation safety and terrorism risks of drones, agree with that assessment.
And it says that while it is not an easy task to balance all the interests involved in protecting innovation while addressing security and safety concerns, by pushing the cellular-network approach the FAA had disregarded without sufficient explanation the radio solution.
A similar length critique of the FAAs plan has been posted by drone enthusiast organization the Pilot Institute. It has been encouraging its members to write to the FAA pointing out concerns, and they have seemingly obliged.
The FAAs proposal for Remote ID will dramatically change how and where people can fly their drones if its implemented, a blog post on the Pilot Institutes website reads. It will eliminate a large portion of the FPV market, potentially permanently ground older drones, prevent people from flying their drones in numerous places, destroy privacy, and increase the cost to own and operate drones. Right now, we have the opportunity to leave a comment to the FAA and hopefully get it changed.
It rejects numerous parts of the FAAs plan, noting as well that significant parts of the US do not have cellular coverage and so drones would be effectively banned from those areas.
And while many imagine the issue of drones to be people spying on neighbors, or disrupting airports by flying into flight paths, the Pilot Institute tells a different story: of drone owners being attacked and abused by members of the public while doing nothing wrong and, in one case, while looking for a missing dog. It also warns that under the FAA plan where the location of the pilot is also made public, it would give thieves a way to target drone pilots with expensive equipment and mug them.
It breaks down the cost of the proposed approach: $2.50 a month for the data connection; $35+ a month for a data plan; $75 a year registration fee - meaning that before even taking to the skies, a drone operator would have to pay at least $500 a year. Per drone. Most enthusiasts have several.
As to what is driving the FAAs approach, it appears to be focused intently on the biggest and most publicized problem of drones: flying into commercial airspace. The FAA rules make repeat and length mentions of the various global disruption to airline traffic that drones or rather supposed sightings of have caused in recent years, particularly at Gatwick in London. But also Dubai, Dublin, and Frankfurt.
In October 2018, the FAA gave itself permission to shoot down any drone it wants in response to the airport disruptions. It is also concerned that Americans love of guns and weapons will cause them to do idiotic things to drones, emailing drone owners last year to remind them that it is illegal to operate a drone with a dangerous weapon attached.
While those fears are real and understandable, the Pilot Institute points out that if someone does want to cause disruption, all they would have to do it disable the very functions that the FAA is insisting on to go unnoticed. Instead, the rules are punishing the most responsible drone flyers in an effort to target the least responsible.
And, as one drone hobbyist that we choose at random from the 34,000+ comments noted: Model aviation is the natural precursor to careers in aviation, including commercial pilots and engineers and more jobs which the US desperately needs to fill. Model aviation supports a $1 billion hobby industry responsible for thousands of existing US jobs. We simply cannot afford to further harm the model aviation hobby with overly burdensome requirements.
Sponsored: Quit your addiction to storage
Go here to read the rest:
Drones must be constantly connected to the internet to give Feds real-time location data new US govt proposal - The Register
State of the Internet / Security: Financial Services – Hostile Takeover Attempts – BankInfoSecurity.com
Please fill out the following fields:
CountryUnited StatesCanadaIndiaAfghanistanAlbaniaAlgeriaAmerican SamoaAndorraAngolaAnguillaAntarcticaAntigua and BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBoliviaBosnia and HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean Trty.Brunei DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCape VerdeCayman IslandsCentral African RepublicChadChileChinaChristmas IslandCocos (Keeling) IslandsColombiaComorosCongoCook IslandsCosta RicaCote D'IvoireCroatiaCubaCyprusCzech RepublicDenmarkDjiboutiDominicaDominican RepublicEast TimorEcuadorEgyptEl SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland Islands (Malvinas)Faroe IslandsFijiFinlandFranceFrance, MetropolitanFrench GuianaFrench PolynesiaFrench Southern TerritoriesGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuineaGuinea-BissauGuyanaHaitiHondurasHong KongHungaryIcelandIndonesiaIran (Islamic Republic of)IraqIrelandIsraelItalyJamaicaJapanJordanKazakhstanKenyaKiribatiKoreaKorea (Democratic)KuwaitKyrgystanLaosLatviaLebanonLesothoLiberiaLibyaLiechtensteinLithuaniaLuxembourgMacauMacedoniaMadagascarMalawiMalaysiaMaldivesMaliMaltaMarshall IslandsMartiniqueMauritaniaMauritiusMayotteMexicoMicronesiaMoldovaMonacoMongoliaMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNetherlands AntillesNeutral ZoneNew CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk IslandNorthern Mariana IslandsNorwayOmanPakistanPalauPanamaPapua New GuineaParaguayPeruPhilippinesPitcairnPolandPortugalPuerto RicoQatarReunionRomaniaRussian FederationRwandaSaint HelenaSaint Kitts and NevisSaint LuciaSaint Pierre and MiquelonSaint Vincent and the GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSlovakiaSloveniaSolomon IslandsSomaliaSouth AfricaSpainSri LankaSudanSurinameSvalbard and Jan MayenSwazilandSwedenSwitzerlandSyrian Arab RepublicTaiwanTajikistanTanzaniaThailandTogoTokelauTongaTrinidad and TobagoTunisiaTurkeyTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited Arab EmiratesUnited KingdomUruguayUS Minor Outlying IslandsUzbekistanVanuatuVatican City StateVenezuelaViet NamVirgin Islands (British)Virgin Islands (US)Wallis and FutunaWestern SaharaYemenYugoslaviaZaireZambiaZimbabwe
Title Level Attorney / General Counsel / Counsel AVP Board of Director C Level - Other CCO CEO / President CFO Chairperson CIO CISO / CSO COO CRO CTO Director EVP / SVP / FVP Head Healthcare Professional Manager / Supervisor Partner VP --Other Title Level--
Job Function Anti-Money Laundering (AML) Audit BSA Business Continuity/Disaster Recovery Business Development Cashier / Customer Service / Administrative Clinical Healthcare Professional Compliance Compliance / BSA Data Management Debit/Credit Card/Electronic Banking eCommerce / eBusiness Executive Management Finance / Accounting Founder / Owner Fraud HR / Training Information Security Information Technology Legal Lending Loss Prevention Marketing Network / Systems / Web Operations Others Policies / Procedures Product Management Project Regulatory Affairs Risk Management Sales Security / Privacy Vendor Management --Other Job Function--
Subscription Preferences:
Banking
Risk Management
Data Breach
Careers
Subscribe
Originally posted here:
State of the Internet / Security: Financial Services - Hostile Takeover Attempts - BankInfoSecurity.com
Zyxel storage, firewall, VPN, security boxes have a give-anyone-on-the-internet-root hole: Patch right now – The Register
Zyxel's network storage boxes, business VPN gateways, firewalls, and, er, security scanners can be remotely hijacked by any miscreant, due to a devastating security hole in the firmware.
The devices' weblogin.cgi program fails to sanitize user input, allowing anyone who can reach one of these vulnerable machines, over the network or across the internet, can silently inject and execute arbitrary commands as a root superuser with no authentication required. That would be a total compromise. It's a 10 out of 10 in terms of severity.
As its name suggests, weblogin.cgi is part of the built-in web-based user interface provided by the firmware, and the commands can be injected via GET or POST HTTP requests.
If a miscreant can't directly connect to a vulnerable Zyxel device, "there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable device," noted Carnegie Mellon's CERT Coordination Center in its advisory on the matter.
"For example, simply visiting a website can result in the compromise of any Zyxel device that is reachable from the client system."
Here's the affected equipment, which will need patching:
Fixes can be fetched and installed from Zyxel's website. Meanwhile, the NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2 models are no longer supported, and thus no patches are available, but are still vulnerable. The security bug (CVE-2020-9054) is trivial to exploit, unfortunately.
"Command injection within a login page is about as bad as it gets and the lack of any cross-site request forgery token makes this vulnerability particularly dangerous," Craig Young, a researcher with security house Tripwire, told The Register earlier today. "JavaScript running in the browser is enough to identify and exploit vulnerable devices on the network."
Speaking of bad, exploit code is already on sale for $20,000 in underground forums, and the patched firmware is delivered via unencryped FTP, which can be meddled with by network eavesdroppers.
"Be cautious when updating firmware on affected devices, as the Zyxel firmware upgrade process both uses an insecure channel (FTP) for retrieving updates, and the firmware files are only verified by checksum rather than cryptographic signature," CERT-CC warned.
"For these reasons, any attacker that has control of DNS or IP routing may be able to cause a malicious firmware to be installed on a Zyxel device."
If you can't patch your Zyxel device, bin it especially if it's facing the internet.
Sponsored: Quit your addiction to storage
Continued here:
Zyxel storage, firewall, VPN, security boxes have a give-anyone-on-the-internet-root hole: Patch right now - The Register
Internet Security Market Report Growth, Analysis, Applications, forecast to 2024 & Focusing on top key Companies like Symantec Co, IBM, Hewlett…
Internet Security Market research Report is an inestimable supply of perceptive information for business strategists. This Internet Security Market study provides comprehensive data which enlarge the understanding, scope and application of this report.
A specific study of competitive landscape of the global Internet Security Market has alloted, providing insights into the corporate profiles, financial standing, recent developments, mergers and acquisitions, and therefore the SWOT analysis. This analysis report will provides a transparent program to readers concern regarding the general market situation to further choose on this market projects.
The Internet Security Market report profiles the successive companies, which includes: Symantec Co, IBM, Hewlett Packard, Microsoft, Cisco System , Intel, Trend Micro, SonicWall, Check Point
Get Sample Copy of this Report @ https://www.reportsintellect.com/sample-request/626744
This report studies the global Internet Security Market status and forecast, categorizes the global Internet Security Market size (value & volume), revenue (Million USD), product price by manufacturers, type, application, and region. Internet Security Market Report by Material, Application and Geography with Global Forecast to 2024 is an connoisseur and far-reaching research provide details related to worlds major provincial economic situations, Concentrating on the principle districts (North America, South America Europe, and Asia-Pacific) and the crucial nations (United States, Germany, United Kingdom, Japan, South Korea, and China).
Market Segment by Type, coversHardwareSoftware ServiceMarket Segment by Applications, can be divided intoFinancial InstitutionRetailGovernmentDefense Aerospace & IntelligenceTelecommunications & ITManufacturingEducationOthers
Market Segment by Regions, regional analysis coversNorth AmericaEuropeAsia-PacificSouth AmericaMiddle East and Africa
Table of Contents
Global Internet Security Market Size, Status and Forecast 20241 Market Overview2 Manufacturers Profiles3 Global Internet Security Sales, Revenue, Market Share andCompetitionby Manufacturer4 Global Internet Security Market Analysis by Various Regions5 North America Internet Security by Countries6 Europe Internet Security by Countries7 Asia-Pacific Internet Security by Countries8 South America Internet Security by Countries9 Middle East and Africas Internet Security by Countries10 Global Internet Security Market Segment by Types11 Global Internet Security Market Segment by Applications12 Internet Security Market Forecast13 Sales Channel, Distributors, Traders and Dealers14 Research Findings and Conclusion15 Appendix
Get a Good Amount of Discount @ https://www.reportsintellect.com/discount-request/626744
Overview of the chapters analysing the global Internet Security Market in detail:
Reasons why you should buy this report
About Us:-Reports Intellect is your one-stop solution for everything associated with marketing research and market intelligence. We tend to perceive importance of market intelligence and its need in todays competitive world.
Our exhausting team works hard to fetchthe foremostauthentic research reports backed with impeccable data figures that guarantee outstanding resultsanytimefor you.
So, whetheritsthe newestreport from the researchers or a custom requirement, our team is hereto assistyouwithin theabsolute bestway.
Contact Us:
Sales@reportsintellect.comPH + 1-706-996-2486US Address:225 Peachtree Street NE,Suite 400,Atlanta, GA 30303
See original here:
Internet Security Market Report Growth, Analysis, Applications, forecast to 2024 & Focusing on top key Companies like Symantec Co, IBM, Hewlett...
How to prepare your business and employees for the coronavirus – Komando
The coronavirus outbreak continues to make its way across the globe and health officials are urging Americans to be vigilant and prepare for the possibility of more cases. Currently, the numbers of infected in the U.S. are few, but the situation is fluid. Calm, proactive behavior is the key to staying healthy.
Still, people across America have questions about what to do if the virus reaches their communities. With so much misinformation online, it can be tough to determine the best course of action. Tap or click to learn more about coronavirus fake news.
This is especially true for business owners and employees, who might be concerned about working in the midst of an outbreak. How do you prepare? And what does the spread of the virus mean for your business, your data and your family? Read our guide to see what tools can keep you informed and keep your digital life and business going strong.
Americans are famous for our work ethics, and many of us would rather arm ourselves with caffeine and DayQuil before heading into the office than take a sick day. But when a community disease outbreak occurs, this practice becomes a dangerous health risk to others.
Employers and employees alike should always stay home if theyve got a fever regardless of which illness theyre afflicted with. If youre experiencing symptoms, it means youre likely contagious and can spread the illness to your coworkers.
One sick worker staying home is less impactful to your business than an entire sick workforce. Advise your employees to be mindful of their health, to wash their hands frequently and to cough into their elbows.
The Center for Disease Control and Prevention also recommends businesses cross-train employees to perform other job functions. This can help keep operations going when youre short-staffed.
One of the best ways to do this is via process mapping. This means preparing detailed written guidelines and instructions for employees that would allow them to act in multiple roles at your business.
For example, if you work in publication, you could process-map the copy editing process so a writer could potentially act in the role with no issues.
Process mapping can be done informally, or you can gain certifications that will make the practice more regimented. If youre informally mapping your business processes, collaborate with your team and create shared documents everyone can access.
For a more formal certification, check out this process mapping resource from Business Enterprise Mapping and see if it fits the needs of your business.
The internet is rife with misinformation surrounding the novel coronavirus, and bad actors ranging from government-sponsored trolls to conspiracy theorists are banking on paranoia to generate clicks and profits. If you see an online claim that seems either too good or too bad to be true, it probably is.
There are several fake news stories surrounding the origins of the disease that do not line up with the established facts (or objective reality, for that matter). Be skeptical about the stories circulated by your friends on places like Facebook especially if disease numbers increase over time.
If youre looking for an accurate, up-to-date way to track the spread of the illness, tap or click here to check out this map from John Hopkins University and access more detailed information.
Depending on your industry, it may be worth implementing work from home options for certain employees. Jobs with a heavy emphasis on digital work can easily transition to a home environment. And with help from the right video conferencing and security tools, it can even feel like an ordinary day at the office.
So what tools are right for a work from home setup? Youll want to look into cloud-based solutions for documents and data. Software suites like G Suite or Office 365 give you access to word processors, spreadsheets and slideshows. You can even use these programs to collaborate and share projects between employees.
G Suite is a business-oriented version of Google Drive, which includes popular cloud-based productivity software like Google Docs, Sheets and Slides. Signing up for G Suite also gives you and your employees access to cloud storage and device management for just $6 per user per month. There is also a 14-day free trial.
Users each receive a custom Gmail address to sign into that can be accessed anywhere. All employees need to do is download the Gmail app to gain access to their work emails.
This account is secured through Google, and administrators can set up features like 2FA to protect essential documents and data. Tap or click here to learn more about 2FA.
Tap Get Started in the upper right-hand corner to get G Suite for your business and fill out your contact information. If your business has specific needs youd like to address, click Contact Sales to speak with a Google representative.
Office 365 is Microsofts cloud-based productivity suite. Its an upgraded version of the Microsoft Office suite were all familiar with, and it includes several features that make remote work more productive remote access, teleconferencing and live document collaboration.
Users can access Office 365 via Microsoft accounts created by the administrator who sets up the software. The service is $8.25 per user per month for the basic package and $10 per user per month for the upgraded package that includes custom email domains and teleconferencing.
Visit the site page to choose which business account you want to activate, then follow the onscreen instructions to set up Office 365.
Next up, youll want your employees to have secure access to their files and accounts without putting the companys data at risk. Your employees home internet security might not be as robust as your business, so its a good idea to lock down your apps and system before anyone accesses them remotely.
To protect your data, youll need security options like a VPN and password manager. This makes employee logins more secure and prevents any unauthorized traffic from piggybacking on your employees connections. Tap or click here to find out why VPNs are so important to set up.
Look for VPNs that are strong on privacy, avoid tracking your data and let you browse anonymously. It should also be fast and capable of handling the digital side of your business.
To set up a VPN on Windows, click thestart button(Windows iconat the bottom of your screen on the left). Go toSettingsthen chooseNetwork & Internet, followedby VPNfrom the menu on the left.
Click Add a VPN Connection, then open the drop-down arrow where it saysVPN Providerand select Windows. Type in whatever name you want for your connection.
Next, type in the server name or address your VPN provided. If your VPN gives you a specific VPN type to use, choose that one; otherwise, selectAutomaticand let Windows 10 choose for you.
Look for User Name and PasswordunderType of Sign-In Info. Type in a user name and password youll remember, then selectSave to complete the setup.
To set up a VPN on a Mac, many software designers provide simple apps that will automatically set things up for you. But if youre asked to set up manually, openSystem Preferencesby tapping the apple in the upper left corner of your screen, then selectSystem Preferences and click Network.
Select the+ symbolon the lower-left corner, tap the drop-down menu and selectVPN. Youll then be prompted to add the server name or address your VPN provider gave you. Save changes to complete the setup.
If youre looking for a trustworthy VPN, our sponsor, ExpressVPN, takes a different approach to getting started. All you need to do is download an app and log in with your username and password to install the service.
Youll get a fast, secure VPN system that encrypts your traffic and protects your company from malicious actors online. Get an extra 3 months free of ExpressVPN when you sign up at ExpressVPN.com/Kim.
Now, for password managers, youll want to look for something that can automatically generate complex passwords that cant be easily cracked. Using a strong password manager to generate employee logins will fortify your account system and make it difficult for hackers to take advantage of remote employee access.
We recommend our sponsor Roboform, since it can automatically generate strong passwords and encrypts them during storage. Tap or click here to find out more about Roboform.
Once you generate your employees passwords, make sure they dont save them to their browsers. Internet browsers can be compromised much easier than encrypted documents.
Of course, people cant just work from home with no direction. As an employer, youll want to have access to your workers beyond simple phone calls and text messages. To keep the spirit of collaboration alive, video conferencing and virtual meetings are a must.
Virtual meetings can help employees feel a sense of normalcy, particularly under extraordinary circumstances. It also can help prevent mistakes and misunderstandings much better than phone calls or texts, where subtle facial expressions and intonations can be missed.
Here are some of our favorite virtual meeting tools. These include video conferencing programs, as well as business-oriented instant messaging tools for quick collaboration and discussion.
Zoom is one of the most popular virtual meeting apps on the web and includes video meetings, chat and screen-sharing features. Zooms infrastructure lets users work without the lag and stuttering you might experience in other free software, and has the added bonus of split-screen video conferencing so you can see everyone at once just like an in-person meeting.
Zooms basic package is free of charge and can host up to 100 users, each of whom can hold one-on-one meetings. The Pro package is $15.00 per month per host and lets you access group meetings in split-screen mode.
More expensive packages increase the number of participants youre allowed to have, so be sure to check out the plans and packages to choose the right one for your business. Tap or click here to see more plans and packages.
Skype is a service many of us are familiar with, and its still heavily relied upon in the business world. The free version offers one-on-one meetings and access to tools like screen sharing, but has limited cloud storage and a user cap.
Microsoft Teams, the new name for business-oriented Skype subscriptions, gives you access to larger group calls as well as live document collaboration. Its also included as part of the Office 365 suite we described earlier, or can be used as a free standalone app.
Slack is designed as an all-purpose chatting app that helps your employees stay in touch with one another. Unlike with email, youre limited to your employee network only. This is good because it keeps conversations private, encrypted and secure.
Slack offers a free version for small teams, but teams of up to 15 workers will want to upgrade to the standard version for $6.67 per user per month. Additional upgrades are available depending on the size of your team. Tap or click here to read more about Slacks plans and pricing.
Just like with Microsoft Teams, Google Hangouts is included as a part of your G Suite subscription. Functionally, it works like an instant messenger program but it only includes the members of your workgroup or business.
Google Hangouts is particularly useful due to its availability as a mobile app. If youre signed up for Hangouts, your employees can download the app to their mobile devices. This way, theyll never miss an important update from you or their coworkers.
As the disease spreads around the world, it will be up to us to keep ourselves and our loved ones healthy. By organizing your business so it can run via remote work or at a reduced capacity, youll protect your workers as well as your profits. As the saying goes, an ounce of prevention is worth a pound of cure.
Read the rest here:
How to prepare your business and employees for the coronavirus - Komando
3 Things That Keep This Election Security Expert Up at Night – PCMag
SAN FRANCISCOWith voters heading to the polls later this year, securing American elections was a frequent theme at the RSA Conference, but voting machines have taken a backseat to concerns like voting rolls and the software used to report outcomes.
Aaron Wilson,Senior Director of Election Security at the Center for Internet Security (CIS), says his organization has the solution.
Election technology is more than just voting machines, Wilson explained. Electronic poll books, for example, contain lists of eligible voters, election night reporting systems, voter registration systems, and the electronic ballot delivery used by citizens living overseas. And those books have "a greater attack surface than our voting systems because [they're] internet-connected in one way or another," he said. Take the app used to report Iowa caucus results, where poor design led to a long delay in releasing the results.
Wilson has three election-related concerns he believes are likely to occur. The first is a denial of service (DoS) attack. In this scenario, attackers might flood critical websites or services with bogus requests that make them unusable. It's particularly concerning to me because you know exactly when to wage the attack," Wilson said.
Similarly, Wilson fears aransomware attack, which could hold critical infrastructure or data hostage and throw an election into chaos. Last year was a banner year for ransomware, with hospitals and municipalities among those victimized. As with a DoS attack, the bad guys would know that if they launch the attack the day of the election, it will be much harder for officials to recover and report results.
These two attacks offer "the best return on investment for a rational attacker...and we agree that they are rational actors," Wilson said.
The last likely attack Wilson imagines is unauthorized data modification. This would include anything from website defacement to manipulation of results transmitted to an online portal. A defaced website might be used to spread disinformation, perhaps incorrect dates or voting locations. Vote totals being manipulated is a real nightmare scenario, and demonstrates how outcomes could be swayed or confidence in elections shaken without touching the voting machines or ballots.
Election technology has always been a bit of a niche industry, and thats even more true for supporting technologies, Wilson said. Of the companies that serve this space, the largest has 40 to 50 employees. Wilson and the CIS have compiled 160 best practices, which are divided into groups ranging from easy to advanced tactics, so companies can quickly raise baseline security.
While we geared it for technology providers we also wanted to give election officials something to read and understand, said Wilson. The goal is to teach them the right questions to ask of their technology providers and of their staff.
Companies and election organizations should, for example, set up backup communications in case established lines are disabled. During the Iowa caucuses, the backup phone number for reporting results was tied up by trolls from 4chan.
Wilson also emphasized advanced planning. Individuals should know their roles in an emergency situation, for example. He also stressed that companies and election agencies should have complete system backups of their equipment and train on how to quickly access and distribute those backups.
CIS also designed a system for testing and validating systems and updates to those systems, called RABET-V. Current voting system process doesnt support change very well, said Wilson. Change, including security patches, are expensive to deploy.
Other speakers at the RSA Conference touched on the issue of certifying voter equipment, where there are currently "disincentives to updating that equipment," said Jeffrey Rothblum, Senior Professional Staff Member on the Senate Homeland Security and Governmental Affairs Committee. The issue is that to apply an update requires that the equipment be re-certified, creating a "false choice between a certified thing versus a more secure thing,"Rothblum said.
With RABET-V, a system might take 2-3 months to pass an initial review, but subsequent reviews would be much faster. A RABET-V pilot program launched this month with two poll book systems, two result reporting systems, and one auditing platform, and the goal is to further refine RABET-V and make it a viable process. Were submitting we can reduce the cost of re-verification of a system, said Wilson. But we need to be able to prove that.
More:
3 Things That Keep This Election Security Expert Up at Night - PCMag
#RSAC: Election Security Beyond the Ballot Box – Infosecurity Magazine
There has been a lot written in recent years about election security and ensuring the integrity of voting systems. While voting machines are important, so too are non-voting election technologies, which was the topic of a session at the RSA Conferencein San Francisco.
Aaron Wilson, Senior Director of Election Security at the Center for Internet Security (CIS), explained that non-voting election systems include things that support elections. Those systems include electronic poll books, election night reporting systems, voter registration systems, and electronic ballot delivery.
"There is a lot to that attack surface, but there are not a lot of standards and regulations," Wilson said.
The Center for Internet Security has developed a guide to help secure those non-voting election systemsthat has 160 best practices to help reduce risk and improve confidence. The overall goal, according to Wilson, isn't necessarily that every election official will do all the steps, but rather they will have a guide that provides questions to ask vendors and IT staff.
Core Recommendations
There are three key areas that Wilson suggested election officials should look at. The first is dealing with Denial of Service (DoS) risks.
"Denial of Service is concerning because you know exactly when to wage the attack against an election system," he said. "If you can take a service down in a moment of critical need it can have significant impact."
Ransomware is also a risk that election officials need to defend against. Wilson said that both DoS and ransomware attacks areessentially about availability and denying access to assets.
The third key area is something Wilson referred to asunauthorized data modification. That's a critical area for non-voting election system integrity, as an unauthorized change can throw an election into doubt.
Among the key recommendations that Wilson provided to reduce the risk of unauthorized data modification are the following:
Verifying Election Technology
Going a step beyond best practices, there is also an ongoing need to verify that systems are in fact operating as intended on a continuous basis. That's where the RABET-V: Rapid Architecture-Based Election Technology Verification framework comes into play.
"RABET-V is an election technology verification process that supports rapid product changes by design," Wilson said.
The RABET-V effort was launched in February 2020 as a pilot program and is available as an open source effort on github.
"It provides a consistent basis from which approval authorities can draw information, resulting in quicker decisions and reduced, amortized overall cost," Wilson concluded.
Link:
#RSAC: Election Security Beyond the Ballot Box - Infosecurity Magazine
MacBook, iPad among billions of devices hit by Kr00k Wi-Fi security flaw – Laptop Mag
Security researchers at ESET -- a Slovakia-based internet security company -- discovered a huge security flaw that leaves billions of Wi-Fi-connected devices susceptible to data exploitation.
The cybersecurity threat, dubbed Kr00k, can allow routers to decode your encrypted Wi-Fi traffic and spy on your personal information. Devices with Broadcom and Cypress WiFi chipsets, commonly found in smartphones, laptops and tablets, are primarily vulnerable to Kr00K.
Personally tested by ESET, the internet security confirmed that the following devices are vulnerable to Kr00k:
ESET also noted that some access points to Asus and Huawei were vulnerable to cyber security attacks, too. It's important to point out that this list is not exhaustive.
Thankfully, though, users who are vulnerable to Kr00k won't be exposed to this vulnerability for long -- companies have disseminated fixes for this major security flaw.
"Patches for devices by major manufacturers have been released by now," ESET wrote. To protect yourself, as a user, make sure you have applied the latest available updates to your Wi-Fi-capable devices, including phones, tablets, laptops, IoT devices, and Wi-Fi access points and routers."
ESET publicly presented their research findings for the first time at the 2020 RCA Conference.
Total Defense Anti-Virus For...
Original post:
MacBook, iPad among billions of devices hit by Kr00k Wi-Fi security flaw - Laptop Mag
The Most Reliable, Free and Ad-free VPN Application You Can Use: 1.1.1.1 – Somag News
Cloudflare, one of the most experienced companies in the internet world, made the 1.1.1.1 DNS protocol a mobile application. We explain how to use 1.1.1.1, which is free, ad-free and offers a faster connection than other applications.
DNS and VPN have come to the rescue of internet users for years, who want to connect to the internet faster, freer and more secure. With the mobilization of the internet, more devices are connected, more information is available on the internet networks. So it is very natural that we have security concerns.
Apart from that, it is not always possible to overcome internet access problems in our country or region. The IP address of the non-profit Asia Pacific Network Information Center (APNIC) (1.1.1.1) comes into play at such times. Agreeing with Cloudflare, a leader in areas such as internet security and server services, APNIC has created one of the most reliable and useful VPN applications on the market.
So how is the 1.1.1.1 application used?Download the app and open it,Read and accept the terms and conditions,When you come to the 1.1.1.1 screen, you will see a big button,Activate this bot,The application will want to install a VPN profile on your phone,Give approval,You will see the key symbol in the notification bar,This symbol means that you are connected to the VPN network.Now you can surf the internet with unlimited VPN quota without seeing ads.
For those who have speed problems, there are 2 options in the application:
1.1.1.1: Standard VPN connection
1.1.1.1 with WARP: Second option for those with speed and privacy issuesWhen you activate the VPN connection for the first time in the application, you actually meet all the conditions to access the sites that are blocked from access. Sometimes, however, some users experience low speed connectivity due to their connection speed and region. If this is the case, you may notice your Enable 1.1.1.1 with WARP feature free, which is a more private internet article below.
You can try to increase your connection speed with the second option of the application with the Activate button next to the warning. WARP, which Cloudflare offers as an additional feature, has been added as an extra feature that is said to improve the connection speed. We tried the second option for you, although it didnt always work, we found it to be much faster than other VPN apps and the standard 1.1.1.1 connection.
So what is WARP +?Standard services of the application are quite sufficient. However, Cloudflare also offers WARP +, which is even safer and faster, to users who wish. Users who wish can invite their friends to earn 1 GB WARP + connection and try this feature of the application. However, as we said, the first 2 options, which are already free, are enough for VPN seekers.
Why is the most reliable application 1.1.1.1, who is behind the application?Cloudflare, a US-based company, offers services related to internet security and domain servers that protect websites against DDoS attacks. Of course, since it is a private company, you can ask why not to use the information obtained over the VPN network.
This is where the agreement that Cloudflare made and which allows us to use 1.1.1.1 application is entering. The company is able to offer this application through an agreement with the non-profit organization Asia Pacific Network Information Center (APNIC). APNIC is just one of the five largest Network Information Centers in the world.
Where does the 1.1.1.1 application store our data?Cloudflare has been a leader in trust in this area for many years, as its core service is a network security company. The company promises to store its data on its own servers for 1.1.1.1 implementation. If you wish, you can reach the Privacy Policy page here. On the relevant page, you can clearly see what data your application has collected. Also on the map above, there are all servers owned by Cloudflare.
As a result, nothing in the internet environment is 100% reliable. However, 1.1.1.1 is one of the most stable and secure options in the market instead of insecure, data breach, advertised and paid applications in application markets. In addition, 1.1.1.1 may share your information with official authorities upon official requests from government agencies.
How to use CloudFlare 1.1.1.1 DNS on Mac and Windows computersWindows 1.1.1.1 settings:Click the start menu,Click on Control Panel,Click Network and Internet,Click Change Adapter Settings,Right click on the Wi-Fi network (or wired network) you are connecting to,Then click on the Properties tab.Select Internet Protocol Version 4 (or Version 6 if desired),Click Properties,Click Use DNS Server Addresses below,Replace these addresses with 1.1.1.1 DNS addresses:
For IPv4: 1.1.1.1 and 1.0.0.1For IPv6: 2606: 4700: 4700: 1111 or 2606: 4700: 4700: 1001Click OK and then Close,Restart your browser.MacOS 1.1.1.1 settings:Open System Preferences,Search DNS Servers and select them from the drop down menu,To add a DNS Server, click the + button and enter 1.1.1.1,Click the + symbol again and enter 1.0.0.1,Click OK and then click Apply.
1.1.1.1 How to make DNS modem settings?Connect to your preferred wireless network,Enter the IP address of your router in your browser,If prompted, enter your username and password,Find DNS server settings on the configuration page of your router,Type the DNS server entry,Change the required places as follows,For IPv4: 1.1.1.1 and 1.0.0.1For IPv6: 2606: 4700: 4700 :: 1111 and 2606: 4700: 4700 :: 1001Save your settingsRestart your browser.
Read the original post:
The Most Reliable, Free and Ad-free VPN Application You Can Use: 1.1.1.1 - Somag News
How coronavirus infected the internet – Livemint
The next time you receive an email that claims to have important" or urgent" information on the Wuhan novel coronavirus, exercise some caution. With almost 80,000 cases across the globe, the disease, which originated in mainland China, continues to spread. Cyber criminals, however, have been using the global coverage of the epidemic for destroying, blocking, modifying or copying data" and interfering with computer networks.
Cyber-security firms are reporting how email attachments claiming to have information on the virus end up infecting a users system with malware. According to cyber- threat research company Check Point Researchs Global Threat Index for January, the most recent coronavirus-themed campaign targeted users in Japan. A Trojan known as Emotet was circulated through malicious email attachments. The email would appear to be from a Japanese disability welfare service provider, claiming to have information on how the infection was spreading in Japanese cities. Once the document was opened, Emotet would get downloaded.
Originally a banking Trojan used to steal financial data, Emotet is now being used to spread other malware.
Pune-based security solutions provider Quick Heal reported that hackers were using Emotet in emails that had attachment headings primarily in Japanese and other Asian languages. According to a news release from Quick Heal, attackers used current dates for the emails to make them look very urgent". Fake email IDs of local health organizations were also used to alarm users about an outbreak in a particular region.
An additional report from Moscow-based cyber-security and antivirus provider Kaspersky explains that it detected malicious files disguised" under the guise of .pdf, .mp4 and .docx files claiming to contain more information about the coronavirus. The names of the files indicated that they contained video instructions on how to protect oneself from the virus, further updates on the threat and virus detection procedures. The files, however, were ridden with Trojans.
See more here:
How coronavirus infected the internet - Livemint