Category Archives: Internet Security
Microsoft patches IE vulnerability being exploited in the wild – SC Magazine
Home > Security News > Vulnerabilities
Microsoft issued a patchfor an Internet Explorer scripting engine memory corruption vulnerability thatcould lead remote code execution and that has been detected in the wild.
The vulnerability, CVE-2020-0674,carries a CVSS rating of 7.5 and since it has been detected being abused in thewild requires users to update their systems as soon as possible.
The problem itself isdue to a scripting engine in IE, which handles execution of scripting languagessuch as VBScript and Jscript, with the JScript component containing anunspecified memory corruption vulnerability. Any application that supportsembedding IE or its scripting engine component may be used as an attack vector toexploit this flaw.
To actually put this vulnerabilityto use a malicious actor would have to convince a user to click on and view aspecially crafted HTML document, such as an attached document or PDF file, orany type of document that supports embedded Internet Explorer scripting enginecontent, an attacker may be able to execute arbitrary code.
To mitigate this issue Microsoftis recommending that users updatetheir current system or as a workaround restrict access to the jscript.dlllibrary.
Please login or register first to view this content.
LoginRegister
Next post in VulnerabilitiesClose
Visit link:
Microsoft patches IE vulnerability being exploited in the wild - SC Magazine
The best antivirus protection of 2020 for Windows 10 – CNET
We should all know the rules of how to protect our privacy and internet security and keep Windows secure: Don't open mysterious messages and emails, don't give out personal information, don't tap questionable links or download apps from shady sites, use secure passwords, and keep your Windows software up to date.
You can also take a few extra internet security steps to make sure you're safe online with a PC: Use aVPNto protect your internet traffic, apassword managerto keep track of login credentials, and anend-to-end encrypted messaging appto keep people from spying on your communications.
But if you are looking for legitimate software to keep your Windows device secure, a good first step is to run the best antivirus software. The best antivirus suite and antivirus tools monitor your app downloads and watch for malicious software and suspicious software behavior.
And here's the first important thing for you to know about the best antivirus software and antivirus products: Microsoft Defender -- the free antivirus program and internet security software that comes free withWindows 10 and until recently was called MicrosoftWindows Defender -- does a fine job of protecting your PC and providing internet security. (Amazingly, Microsoft provided no built-in protection for Windows back in the days of Windows 98 and XP.) Using Microsoft Defender should be your starting point for the best antivirus security on Windows, and most users will find they don't need to go any further.
However, you can make the case that the Windows security ecosystem is healthier when users don't depend on just one company for protection from a virus or malware. If you favor robust platform diversity, you can easily find solid virus or malware protection from third-party security companies that are up to the task of guarding your PC for free. And most let you also protect all your devices with an annual subscription -- though, it's important to note, that's largely unnecessary outside the Windows realm.
To that end, we've put together a list of the best antivirus products for Windows, encompassing both free antivirus programs and subscription options. These picks of the best antivirus programs are a combination of recommendations from independent third-party labs AV-Test and AV-Comparatives and our hands-on testing.
Note that the free and paid security services discussed here are independently chosen by our editors. We're in the process of updating this full list, so check back before the end of the year for an update.
Update, October 21: This list previously included Avast's antivirus as an alternate free choice, but we've pulled that recommendation in light of a report fromAvast that its internal network was breached this year, possibly to insert malware into its CCleaner software. This is the second such security issue from Avast in under 3 years.
Looking for free antivirus protection or virus detection, willing to pay for broad antivirus coverage across all your devices, or needing to remove a virus ormalware from your PC right now? Here's where to start.
Free version? Yes, built into Windows 10
Paid version:Windows Defender Advanced Threat Protectionis available to corporate users for a fee
Honestly, if you consistently practice safe computing -- you keep your software up to date, you use strong passwords (with the help of password manager) and you steer clear of unexpected emails and links -- you probably can stay clear of zero-day attacks and ransomware attacks. And with Microsoft's free Microsoft Defender Antivirus software running on Windows 10, you have a safety net if you do let your guard down. (Note that Microsoft recently changed the name of Windows Defender to Microsoft Defender and has expanded the service to other platforms.) This antivirus program is literally built into Windows -- just leave it turned on (it is by default) and let it do its thing and this will cover the basics. Microsoft pushes new updates daily.
Read more: The best password managers and how to use them
Platforms:Windows 10 plus MacOS, Android, iOS
Cost:$100 per year for five devices, on sale for $60
For a long time, respected security company Norton Security from Symantec, now called NortonLifeLock, hasearned high marksfrom AV-Test for virus and malware detection. A five-device subscription via Norton Security is normally $99.99, but you can sign up for $59.99 to get coverage across PCs, Macs, Android devices, and iPhones and iPads. (But note, again, that we don't think antivirus protection is terribly useful outside the Windows realm.) In addition to malware and virus protection, you get 100GB of automatic backup to the cloud, safe-browsing tools, a VPN, an easy device management via a web-browser console and LifeLock identity-theft protection.
Read more: The guide to password security (and why you should care)
Platforms: Windows 10 plus MacOS, Android
Free version? Yes, after 14-day trial expires
Paid version: $40 per year for one device, $60 per year for three devices
Malwarebytes does protect your PC from a virus or malware, scoring well in recent independent testing for guarding against malware infections. But that's not really what Malwarebytes is known for. If you find yourself in trouble, the go-to disinfectant for many is Malwarebytes. You can get protection and disinfection for one device for $40 a year. To cover 10 devices -- any combination of Windows, MacOS and Android -- it's $130. To get the free antivirus version, download this trial version, which "downgrades" to a no-fee on-demand cleaner with fewer features that detects and removes viruses and malware when you run an on-demand scan.
In addition to the three antivirus apps we recommend above, a handful of other anti-malware tools are worth considering among the best antivirus protection if you find them at a better price or prefer to use one over our picks above.
Platform: Windows
Free version?Yes
Paid version:$80 per year for three PCs; $120 Family Pack per year for 15 devices
If you'd like to take a step up in securing your PC without taxing your wallet, it's hard to beat Bitdefender's free anti-virus software for Windows 10. The Windows security software offers real-time monitoring for viruses, malware and spyware and ransomware protection. Bitdefender Antivirus Free Edition is easy to set up and stays out of your way until you need it. And the protection it offers is solid. Bitdefenderconsistently earns top marks for its antivirus protection and usability from the respected AV-Test independent testing lab. The free antivirus version covers one Windows PC. For broader protection, Bitdefender Internet Security is $80 MSRP and available at the moment for$45. It lets you protect three computers, set up parental controls on a kid's computer and run a VPN. To protect every device you own, the Bitdefender Family Pack can secure 15 total device -- Windows, Android, iOS and MacOS -- in your home for $120 MSRP and discounted to$60right now.
Read More: This is the best free password manager
Platforms:Windows 10 plus MacOS, Android, iOS
Cost:$120 per year for 10 devices, on sale for $45
It feels like the company has been around forever, first on its own in the '80s, then as part of Intel starting in 2010, and then again on its own when Intel spun it off in 2017. And it's been around forever because quarter after quarter it creates solid security software that protects your PC. (In recent evaluations by AV-Test it had perfect scores on detecting 0-day attacks and blocking current widespread viruses and malware.) McAfee Total Protection guards against viruses and offers ransomware protection, wards off shady websites, includes a password manager and lets you manage all your protected devices through web console. A 10-device subscription is normally $120 MSRP, but currently is $45 for any combination of Windows, MacOS, Android and iOS devices.
Platforms:Windows 10 plus MacOS, Android, iOS
Cost:$90 per year for 10 devices, on sale for $50
Maybe not as well known to consumers because of its focus on enterprise security, Trend Micro quietly brings its business expertise to the home with its Trend Micro Maximum Security tools. Trend Micro's software earns high marks fromAV-Test-- scoring 100 percent of detecting 0-day attacks and widespread viruses and malware. And Trend Micro does a good job of not taxing system resources. Trend Micro's 10-device subscription for computers and mobile devices is $90 MSRP but discounted currently at $50.
Read more: This is the browser you'll want if you care about online privacy
Platform:Windows
Cost:$59 per year for three PCs
If you are looking for something easy to set up and use, ESET NOD antivirus may meet your needs. It earnstop scoresfor usability and offers solid virus protection. And its Android antivirus gets top marks in third-party tests.
Because the company has been in the news the past few years, let's talk about Kaspersky Lab -- specifically about the federal ban that blocks US government agencies from using Kaspersky products.
Based in Moscow, Kaspersky Lab has for years produced some of the best antivirus software for business antivirus needs and home customers. But in 2017 the US government prohibited Kaspersky software on federal government computers because of alleged ties between Kaspersky and the Russian government.
Notably, the ban does not apply to its consumer products. But, like China-based Huawei, the question remains: If the federal government doesn't think the products are safe enough for its own devices, should consumers avoid it as well?
In a statement sent to CNET, the company said, "Kaspersky Lab has no ties to any government, and the company has never, nor will ever, engage in cyber offensive activities. Kaspersky Lab maintains that no public evidence of any wrongdoing has been presented by the U.S. Government, and that the U.S. government's actions against Kaspersky Lab were unconstitutional."
In Kaspersky's favor, it continues toearn top scores and awards for virus and malware detection and endpoint security from independent testing labs. And it's reasonably priced, with basic antivirus protection for three devices running $30 a year, or blanket protection for 10 devices -- with Kaspersky Total Security -- for $75 a year. In comparison, the Webroot SecureAnywhere AntiVirus program costs $37.50 per year for three devices -- and a single device on Webroot SecureAnywhere AntiVirus costs $30 a year.
In the end, even though no one has ever publicly produced a "smoking gun" linking the company to Russian intrigue, we think any of the options listed above are a safer bet. And, if you are a US government employee or work with the federal government, you'll want to steer clear of Kaspersky.
Picking the best antivirus software for Windows means finding one that keeps your PC safe, doesn't take up a lot of system resources, is easy to use and stays out of the way till you need it. Here's what to look for.
Effectiveness. Antivirus scans for a known virus and malware, of course, and can offer real-time protection. And it watches for shady websites and suspicious links to keep you out of trouble. It can also offer ransomware protection and monitor unexpected behavior that may be a sign of new and not-yet-identified viruses and malware. You want antivirus that can successfully identify these unknown online threats without flagging too many false positives.
Light on system resources. You don't want antivirus that taxes your PC's resources. If after you install antivirus, websites open slowly, apps download or open sluggishly, or file copies take longer than expected, you may want to try another service. The good news is, all our picks offer a free trial to let you try out the antivirus program, so if your system feels sluggish after you install antivirus solutions, you may want to keep looking.
Cost and discounts. Don't just pay the sticker price for antivirus. Before you buy, check for discounts on a company's website. Another way to save: The prices we list above are for 10 devices -- if the company offered that package -- but you can trim your cost with antivirus packages if you need to cover just three or five devices. You may also find discounts on an app's Amazon page.
Privacy. To be effective, antivirus software needs to monitor what's going on with your PC and check in with company servers about unusual behavior. The companies say they anonymize this technical data as much as possible to protect your privacy. But if you want to know more, the security companies on our list post privacy policies on their websites, so read their privacy statement to learn what the companies do with the information you share.
Protection for other platforms. Microsoft is by far the biggest target for viruses and malware. But Android is second, with the largest threat coming from sideloaded apps -- those you install outsideGoogle's Play Store. Google said in the last quarter of 2018, 0.99 percent of apps installed outside the Play Store were a potentially harmful app, or PHA. For those installed from the Play Store, the number drops to 0.042 percent. To stay safe, we do not recommend sideloading apps, but sometimes, like with Fortnite, you might want to. In that case, running virus and malware protection from a trusted security company is not a bad idea.
The threat to MacOS and especially iOS are low, in part because of the tight control Apple has over its app stores. While the Macdoes rarely come under attackvia sideloaded apps, if you download apps only from the Mac and iOS app stores, and keep your guard up when clicking links and download files, you should be OK without an antivirus app on Apple devices.
Originally published earlier. Updated to clarify Norton pricing details and LifeLock service options, and to note the removal of the earlier Avast recommendation.
Here is the original post:
The best antivirus protection of 2020 for Windows 10 - CNET
Vigilantes and private security are policing the internet where governments have failed – The Conversation UK
The internet revolution of the past 20 years has opened up countless new ways for people to shop, bank, find love and to commit crimes. Every time we switch on a computer, open an email, view a website or make an online payment, there are multiple new opportunities for crimes to occur. In fact, almost half of all crimes against individuals in England and Wales now involve or are enabled by the internet.
These technological changes have fuelled a substantial new private policing sector that includes commercial companies but also online vigilantes. This change is comparable to the quiet revolution seen in the 1970s when conventional private policing, particularly the use of uniformed security officers, emerged on an industrial scale.
Despite its scale, online private policing activity has been largely ignored by researchers and politicians. Yet it is already creating some significant issues that need addressing.
This new online private policing sector exists most obviously in the numerous companies providing services. These include designing, testing and maintaining security systems, responding to cyber-attacks and moderating websites for harmful or illegal content.
But many other organisations have also developed their own cybersecurity structures to better protect themselves from online crime. In most large organisations, these structures are led by what are generally called chief information security officers (CISO) but there are also many other new cybersecurity roles such as security architects and ethical hackers.
Globally, this new sector is estimated to support around 6 million jobs and is predicted to be worth US$248 billion (190 billion) by 2023. This is much more than the traditional private security industry, which is only predicted to be worth around US$167 billion (128 billion) by 2025.
One of the most interesting roles to emerge in this new sector is that of the moderators who police the content published on the internet. They play an important role in preventing the publication of undesirable material, from hardcore pornography and footage from war zones through to abusive and inappropriate language.
There has been virtually no academic research of these important operatives. But media reports have raised concerns over the welfare of these staff, who often have to view large amounts of distressing content, including images. So their conditions of employment and capabilities should be more of a priority for researchers and regulators.
The internet hasnt just stimulated new forms of commercial private policing but has also enabled a new type of vigilantism to flourish. For example, the limited law enforcement response to the masses of scam emails and bogus websites were at risk from everyday has led to the growth of scambaitors. These are private individuals who try to engage with scammers and waste their time or simply raise awareness of their scams.
One of the problems with scambaiting is the humiliation and racism often involved. For example some scammers have been encouraged to do repetitive tasks such as draw street maps and rewrite books, paint themselves or pose naked in humiliating positions, all of which have then been publicised. Sometimes this is done with explicit or implicit racist commentaries, relating to the fact that many of the scammers are black West Africans.
Perhaps the most controversial area of online vigilantism that has emerged is paedophile hunting. Organised groups of internet users pose as children in online chatrooms to lure and expose paedophiles.
The actions of these groups have clearly helped the police and led to the exposure of real paedophiles who have subsequently been charged and convicted. In 2018, at least 150 people in England and Wales were charged using evidence provided by paedophile hunters.
But some groups have made their exposures and confrontations public, in some cases even live-streaming them online. This has led to innocent people being falsely and publicly condemned, while others have killed themselves after the exposure. It has also been revealed that some of the people enacting this justice are themselves convicted criminals whereas police forces themselves often bar people with criminal records from joining.
The rapid growth of both commercial and amateur attempts at policing the internet shows there is a demand that is not being met by the traditional provider of law enforcement, the state. But the problems that are emerging from this private security activity demonstrate why it isnt enough to leave such significant operations to the market or volunteers.
The first quiet revolution eventually resulted in many jurisdictions introducing regulations to better control the activities of private security. This new shift at least warrants further research and investigation to determine if the controls are adequate. The suspicion is that they are not.
The top UK cyber security companies – Information Age
Investing in the right cyber security for your company is more vital than ever, but which are the top UK cyber security companies right now?
It's important to know what kinds of services your company needs.
The following cyber security companies vary in what services they provide, from what devices or software they cater for, to the kinds of security they offer. Some completely focus on cyber security, and others deal in multiple services, including cyber security.
Looking for the right cyber security provider may depend on the size of your company, or the areas of the companys system that you feel are the most vulnerable.
With this in mind, lets take a look at the top UK companies in the space right now.
Professional services company EY offers cyber security advice to companies of all sizes, from start-ups to established multi-national firms.
The company has teams dedicated to cyber security, strategy, risk, compliance and resilience, and can offer guidance into securing a range of tech, including IoT and cloud.
Cyber security services offered by EY include a cyber maturity accelerator, vulnerability assessments and penetration testing.
Clearswift specialises in data loss prevention (DLP) and protecting against leaks.
The firm offers companies various products that focus on this issue, including its Adaptive Data Loss Prevention tool, which aids effective data storage and transfer, and SECURE gateways for email, web and Internet Content Adaption Protocol (ICAP).
The ICO told businesses that ultimately it is their responsibility to ensure customer data is secure Read here
Telecommunications provider BT offer network-based security in the form of behavioural analytics for guidance.
The company has its own cyber security platform, which protects its customers as well as its own infrastructure, as well as Cyber Defence Operations for larger corporations.
Specific specialist services that BT offer include asset oversight, threat identification and neutralisation, and continuity planning in the event of future Distributed Denial of Service (DDoS) attacks.
Professional services provider PwC offers two forms of network cyber security: IT risk identification and security, and cyber threat detection and response.
Services include rapid risk reduction, compromise discovery assessments and crisis management.
PwC adopts both proactive and preventive approaches in order to protect the networks of larger companies.
Defence, security and aerospace firm BAE offers cyber security to commercial and governmental customers.
Its services include fraud detection and prevention, incident response and services relating to regulation compliance.
The company focuses on helping its clients to stop cyber attacks from penetrating their systems in the first place using analytics.
Information Age explores Kineticas active analytics use cases, which is helping accelerate data innovation across industries. Read here
Data protection specialists Sophos deals in antivirus and encryption, as well as securing Wi-Fi and email gateways.
While the company also offers products for cyber at home, the business-orientated services that Sophos offer include endpoint protection, firewalls and protection for the cloud.
Acuity Risk Management analyses and guides larger corporations in dealing with cyber threats.
Risk management guidance is given via its software platform, STREAM Integrated Risk Manager, which features analytics, as well as dashboards and reports.
The services offered by Acuity through STREAM focus on governance, risk and compliance (GRC).
The services offered by Becrypt focus on endpoint encryption and protection for enterprise IT and the Internet of Things (IoT).
Its clientele range from governmental bodies to businesses and organisations with critical infrastructure.
Also offering USB/port control, Becrypt additionally managed devices on iOS and Android.
With GDPRs one-year milestone only less than a month away, businesses are still using unencrypted USB devices to store their data. Read here
SentryBay are a DLP company offer its services to a variety of industries, from financial services to insurance.
Its Data Protection Suite (DPS) is a prominent feature, but the companys capabilities also include anti-keylogging and mobile security.
Read more:
The top UK cyber security companies - Information Age
Cyber Minds: Expert Insights on Blockchain and Much More – Government Technology
Shira Rubinoff is the President and Co-Founder of Prime Tech Partners, which is a unique incubator in NYC. She is also the President of SecureMySocial, which warns people of social media problems in real time.
In Shiras new book Cyber Minds, we see a unique mix of cutting-edge perspectives on blockchain and where it is going, insights on several hot technologies like AI and the Internet of Things (IoT) as well as solid cybersecurity advice for technology and business leaders.
Cutting right to the core, this book offers the best practical content l I have seen regarding blockchains potential, future and cybersecurity opportunities and drawbacks. The materials on blockchain, which includes interviews with thought-leaders in the area, are simply ground-breaking.
Heres an excerpt from page 52 regarding blockchain:
If you look into the financial services space, weve blueprinted the financial architecture and sort of overlaid it with the crypto industry. When you look at that, you realize that within five year, something amazing has been built. Weve got exchanges, wallets, mining, interfaces, and so on. Its all moving towards institutional grade infrastructure.
Logistics is another example. In the past few weeks, weve heard the news of the biggest competitors in logistics coming together. I believe it was DHL, UPS, and FedEx coming together to think about how they can use blockchain to reduce and merge the burden of governance in the system. Well get more efficient Internet safety from that.
Blockchain is being used by farmers for cattle feeding and in Switzerland, its starting to be used in the watch industry and the butter industry among others.
Here's one other excerpt that I like from page 60 (quoting Sally Eaves) on the leading blockchain sectors:
"Yes, I would say two sectors (are leading) - financial services and supply chain. We are going to see more development in both, but I would love to showcase a sector outside of this too: healthcare.
I am seeing a lot of research and development focused on the 'marriage' of AI and blockchain technologies. As an example, we have opportunity to use blockchain as a method of security for our DNA data, negating fears of it being misused - while AI can enable rich insights to be anonymously extracted from it. ..."
Input From Experts
This book gets 5 stars from me for the blockchain material alone, but it also offers interviews and recommendations on cloud security, IoT, artificial intelligence (AI) and much more. From my perspective, the advice offered form these top global leaders is excellent:
Topics Covered in Book Cyber Minds
Heres an overview of the topics covered in the book:
I also like the straight-forward and easy to understand steps that Ms. Rubinoff uses to describe cyber hygiene, and those sections in the beginning and ending serve as a primer for readers who have less experience and insight into cybersecurity challenges. The workforce development strategies include:
After giving you these guidelines, Shira warns about the most common behaviors that could lead to a data breach and the psychology behind them.
This YouTube video show you Ms. Rubinoffs excellent speaking skills and abilities in communication on technical topics.
Final Thoughts
The interviews and insights offered in this book make it an excellent choice for technology, security and business leaders to learn the latest approaches and thinking on cybersecurity on a range of hot tech topics. I find the insights and interviews discussing topics like blockchain and cloud computing to be very insightful and different.
I have no hesitation in strongly recommending this book and giving it 5 stars.
Read the original:
Cyber Minds: Expert Insights on Blockchain and Much More - Government Technology
Recent IPO Cloudflare Closes Out 2019 Strong and Is Poised for More Growth – Motley Fool
After rising 20% after its debut as a public company in September 2019, Cloudflare (NYSE:NET) hasn't been able to hold on to any positive traction since. There are reasons for that, including a premium valuation factoring for continued double-digit sales growth and a lockup period on shares expiring the first half of March 2020 (which could trigger share price declines if too many of those shareholders decide to sell). Nevertheless, the cloud computing and internet security outfit has a unique growth strategy and plays in a fast-growing industry, and is thus worth a look after delivering a strong end to 2019.
During the final quarter of 2019, Cloudflare's sales accelerated from the pace set during the first nine months of the year. Revenue increased 51% to $83.9 million, and adjusted gross profit also grew as the company added more customers to its lineup of cloud-based web delivery and security services. In total, Q4 helped Cloudflare notch a 49% increase in revenue in its first year as a public concern, and adjusted net losses for full-year 2019 were $69.5 million compared with $59.5 million in losses in 2018 as cash was funneled back into the business to maximize growth.
Metric
Three Months Ended Dec. 31, 2019
Three Months Ended Dec. 31, 2018
Change
Revenue
$83.9 million
$55.5 million
51%
Adjusted gross profit margin
78.7%
76.9%
1.8 pp
Operating expenses
$95.7 million
$59.6 million
61%
Adjusted net earnings (loss)
($16.4 million)
($15.6 million)
N/A
Pp = percentage point. Data source: Cloudflare.
Of course, not all investors are going to be comfortable with a company that intentionally operates at a loss, and that is forecast to continue that way. Adjusted operating losses (which back out one-time expenses and noncash stock-based employee compensation) are expected to be $65 million to $61 million in 2020 as Cloudflare continues to invest in new services and foster sales. The upshot, though, is that the 2020 revenue outlook for $389 million to $393 million implies another 36% increase over 2019 at the midpoint, and the company is well funded to support its ambitions with $637 million in cash and equivalents in the bank.
Image source: Getty Images.
Based on those expectations, Cloudflare stock trades for 14 times one-year forward sales. It isn't cheap, but it is a relative value compared with some of the other cloud-native software and security providers that went public in 2019. And there is plenty of room for the company to keep growing at the rates it has been.
Cloudflare has taken a different approach to promoting its services, starting with small businesses and fellow start-ups to try out its web delivery, edge network, and cybersecurity offerings -- often for free. As the products are perfected, Cloudflare then moves upmarket with its software and starts picking up larger paying customers. It's the opposite approach to the one most cloud vendors utilize these days, but it's been working. CEO Matthew Prince said that the company ended the year with 2.6 million total customers. Only 82,000 of them pay, but that number was an 8% increase over the third quarter of 2019 alone.
This strategy has a number of potential benefits. First, Cloudflare is getting small but future high-growth companies into its ecosystem early. That gives the software outfit some built-in growth even if its total customer count were to suddenly stall. Second, while small businesses get the software tech they need for free or at a low cost, the strategy allows Cloudflare to test out new products of its own before going after larger deals.
As for those large customers (which Cloudflare defines as having billings of at least $100,000 per year), total count nearly doubled in 2019 and tallied up to 550 at the end of the year. Dollar-based net retention was also 112% in Q4, implying that existing paying customers were spending 12% more than a year ago.
In short, while Cloudflare may get overlooked from the 2019 class of tech IPO stocks, there is a lot of good going on at the cloud computing company. New products are continuously being released, and global spending on the cloud industry is still growing by double digits. Investors who can ride out the ups and downs and scoop up some more shares on the dips should put this stock on their radar.
Go here to see the original:
Recent IPO Cloudflare Closes Out 2019 Strong and Is Poised for More Growth - Motley Fool
5G and the Huawei controversy: is it about more than just security? – BBC Focus Magazine
Between the Internet of Things and smart cities, we expect half a trillion objects to be connected by 2030, from streetlamps to autonomous cars, factories and clothes. The overwhelming majority will rely on 5G and its successor, making wireless technology essential to our daily life, our security, and economy.
British internet providers are already upgrading their networks alongside existing 4G hardware. On the consumer side, the first 5G-capable smartphones hit the market last year, and the UK has allowed Huawei to help build non-core parts of the 5G network.
This has been met with concern, because China seems to be building a surveillance state that is tracking, ranking and controlling its entire population. The fear is that the Chinese government could leverage that data flowing through the parts of the network they build to expand its propaganda and censorship regime beyond its shores.
Read more about 5G:
For example, in early February, the US Department of Justice charged four members of the Chinese military of hacking into the Equifax credit agency in 2017 and stealing the data of 145 million Americans.
Pervasive connectivity of the Internet of Things raises security and human rights concerns, as the confidentiality of citizens data may be at risk.Back in 2007, local authorities in Estonia removed a Soviet-era statue; in response, Russian servers paralysed the Estonian banking system.
Similarly, if there was a diplomatic or military crisis between Chinese and European powers whether about Taiwan, Hong Kong or the Uighurs Huawei may not be able to resist pressures by the Chinese government to disrupt public transportation, industry, or energy grids in Paris, Berlin or London.
To alleviate the UK governments concerns, Huawei opened its source code to selected experts in 2010. So far, audits have revealed poor software engineering practice rather than malicious intent. However, manufacturers can always remotely update the software running on these platforms.
Usually, this is done to improve performance, introduce new features or fix vulnerabilities. Yet, they could be used to covertly introduce back door access, as well. This is particularly critical for 5G platforms, due to their dependence on software configurability.
At best, it is possible to balance these risks by diversifying providers and segregating virtual networks depending on their sensitivity. Even then, the UK National Cyber Security Centre states they are only able to provide limited assurance that the risks of embracing Huawei solutions could be mitigated. It is thus a matter of trust and risk balancing.
One of the reasons why Europeans are facing difficult policy decisions is down to under-investment in research and development of 5G.
Huawei has become one of the largest telecommunication companies, with tremendous financial capabilities. Huawei spends a third more on 5G research and development than its European competitors, Ericsson and Nokia, combined.
Read more about the internet:
But the Chinese government may have helped the company. A recent investigation by The Wall Street Journalfound that Huawei had received $75bn (58bn) worth of state aid in various forms.
In early February, France, Germany, Italy and Poland asked the EU Commission to push back against what they deemed to be unfair competition from both US and Chinese firms. But Europes weakness on 5G, and new technological development more widely, cannot only be attributed to skewed competition. It is as much the result of a lack of strategic vision and industrial policy.
If anything, this controversy emphasises the importance of political will. Without it, in the UK just as elsewhere, market forces are likely to take precedence over considerations of sovereignty or strategic autonomy.
Visit the BBCs Reality Check website at bit.ly/reality_check_ or follow them on Twitter@BBCRealityCheck
Here is the original post:
5G and the Huawei controversy: is it about more than just security? - BBC Focus Magazine
For Free Expression in Iran, the U.S. Can Act to Keep the Internet On – Just Security
Irans parliamentary elections on Feb. 21 will be neither free nor fair. Thousands of candidates have been disqualified, and there have been calls from Irans civil society leaders and others to boycott the process entirely.
But theres another reason to keep an eye on this election. The Iranian government has throttled slowed the flow of information online for users around elections in the past, and this one is unlikely to be an exception. The regimes willingness and capacity to wage such cyber as well as physical crackdowns was evident in November, when it shut off the internet for its population of 81 million people to quell nationwide protests, and then killed and jailed thousands of protesters under cover of online darkness.
Since then, the election boycott movement has gained support, and regional tensions have increased. Authorities may try even more draconian measures to restrict internet freedoms around the election, including ramping up the implementation of the long-planned national intranet, which would give them full control over what sites and content Iranian users can access. This could be more harmful than a complete shutdown, because it would force Iranians onto platforms the regime controls, thus exposing them to government surveillance and monitoring.
What can be done? While the Trump administration has been criticized for its hard-line policies on Iran, the United States has the power to limit or stop efforts to cut off Iranians from the global online world. The U.S. can do this by allowing American companies to provide technology services and platforms to the Iranian people without fear of violating sanctions.
The Trump administrations maximum pressure policy towards Iran has had unintentional consequences. Chief among them is that intensifying pressure around sanctions compliance has caused leading U.S. technology companies to purge Iranian users from their platforms wholesale. These include communication platforms such as Slack and Github, and cloud computing platforms such as Amazon Web Services, DigitalOcean, and Google Cloud. Companies purge users with no prior warning and without allowing users to backup and export their data.
In previous years, when authorities tried to block censorship circumvention tools, as they are likely to do during the election, technology teams outside Iran could still find ways to correspond with activists inside. Today, because of the purge of users from major U.S.-based platforms, it is difficult for even the most tech-savvy Iranian activists to reach the outside world.
These purges have also given authorities the perfect opportunity to force the Iranian technology community to move its infrastructure to domestic data centers, giving authorities full physical control and jurisdiction over every server and byte of data. Iranian users worried about the safety of their data were left with no choice.
U.S. technology companies claim they would be happy to provide services to Iranian users but that sanctions bar them from doing so. This is only partly true. Sanctions do prohibit provision of some services. But technology companies are cutting off more than they need to, because they fear litigation and U.S. government fines. The administration can help ease these fears by providing express guidance on what technology sanctions prohibit and permit.
The administration can also help expand existing sanctions exemptions. General License D1, which provides exemptions to technology sanctions for personal use, is ineffective in helping Iranian users access information. The language of the license is vague and has not kept pace with new technologies, such as cloud computing platforms essential for users to run censorship circumvention tools.
The U.S. House of Representatives recently passed a bipartisan resolution calling for an expansion of General License D1. With this bipartisan support, the Treasury Department should revisit the language of General License D1 to help the Iranian people access information freely.
There are many human rights issues in Iran that require attention. But should Iran be permitted to isolate the Iranian people from the global internet and conduct mass surveillance of human rights defenders and political dissidents, all other efforts at supporting human rights and democracy will be for naught. The Trump administration has voiced support for the Iranian people to freely assemble, protest, and express themselvesit also holds the tools to help stave off a total internet blackout. It should act, before its too late.
See original here:
For Free Expression in Iran, the U.S. Can Act to Keep the Internet On - Just Security
Akamai: API Attacks by Cybercriminals are on the Rise – Media & Entertainment Services Alliance M&E Daily Newsletter
Application programming interfaces (APIs) are increasingly being targeted in hostile takeover attempts, according to Akamai Technologies.
We have a really consistent amount of credential abuse going on, Steve Ragan, Akamai editor-security research and publications, said Feb. 20 during a webinar on the State of the Internet/Security: Financial Services Hostile Takeover Attempts.
Although the focus of the webinar, like the firms latest State of the Internet security report, released one day earlier, was on the financial services sector, its clear that the media and entertainment industry ought to be aware of the threat also, based on comments by Ragan and other Akamai representatives on the webinar and data in the report.
Akamais research findings showed that from May 2019 and continuing on until the end of the year, there was a dramatic shift by criminals who started targeting APIs in an effort to bypass security controls.
And, according to Akamais data, up to 75% of all credential abuse attacks against the financial services industry targeted APIs directly.
From December 2017 through November 2019, Akamai observed 85.4 billion credential abuse attacks, Ragan pointed out on the webinar. Almost 20% (more than 16.5 billion) of them, were against hostnames that were clearly identified as API endpoints, he said.
However, 20% was a conservative estimate, Martin McKeay, editorial director and security researcher, stressed on the webinar, adding that the actual number could actually be as high as 80%. After all, the 20% were just those that could obviously be identified as API endpoints.
Of the attacks, 473.5 million targeted organizations in the financial services industry, according to Akamai.
There were tens of millions and even up to hundreds of millions of API attacks a day, Ragan said, adding it was consistent all throughout the reporting period.
It started to spike around May 2019, he pointed out. The peak period happened in August, shortly after Akamai published its previous financial services report, he noted. That was the largest spike in targeted credential abuse since the firm started tracking these types of attacks, he said.
Part of the reason was a flood of credential lists that hit the criminal market, he said. There were many markets that were shut down due to law enforcement activity last summer, he pointed out. That led to fire sales by the criminals who didnt get arrested, who, he added, were dumping their lists and selling them really cheap and lower-tier criminals were scooping them up and just running them everywhere.
Another explanation: Criminals are very hyper-focused on their target, so if somethings not working, theyre going to try something else, he said, adding: Traditional means of credential stuffing just wasnt cutting it for them, so now they started targeting APIs in an effort to bypass mitigations that were up on the front end. Cybercriminals, after all, tend to be good at shifting their tactics on the fly, he noted.
When it comes to all vertical enterprise sectors, structured query language injection (SQLi) is the dominant type of attack that we see, but in financial services they make up a much lower percentage, he noted. The top type of web attack in financial services, he said, are ones that instead involve Local File Includes (LFI), a local file inclusion vulnerability that enables an attacker to include files that exist on the target web server.
Gaming is the largest distributed denial of service (DDoS) vertical when it comes to attack events, he pointed out. However, when looking at unique targets by verticals, financial services jumps to first place, he said.
Moving on to discuss the Zero Trust framework that was designed to address these attacks, Patrick Sullivan, senior director of global security strategy at Akamai, said that one major benefit is that, with this system, where you are is irrelevant in terms of the access that is granted to you.
Or, as Ragan said, Zero Trust is trust no one ever not even if theyre on your network.
High tech is the sector adopting Enterprise Application Access (EAA) to enable access and identity controls the fastest, according to Akamai, which pointed out in its report that high tech firms make up 27.7% of EAA customers. Video media trails far behind, at 7.1%, with other digital media at just 2.9%. Therefore, media organizations clearly have a long way to go to catch up.
What is key to combat API attacks are using multifactor authentication and rate limiting on APIs because these initiatives make the criminals look elsewhere, Ragan said during the webinars Q&A. That is because when an attempt fails, they tend to move on, he said.
However, those initiatives still are not a silver bullet you have to constantly keep up with your security program, he told listeners.
One more suggestion by the company at the end of the webinar: Stop recycling and sharing passwords.
Original post:
Akamai: API Attacks by Cybercriminals are on the Rise - Media & Entertainment Services Alliance M&E Daily Newsletter
CoinGeek London: When Bitcoin SV came of age – CoinGeek
The whole Internet can work this way, said Twetch CEO Josh Petty in his presentation at the CoinGeek London conference. It was a typically bullish sentiment from the two days in which dozens of speakers demonstrated their confidence in the momentum building around Bitcoin SV (BSV).
Superficially, that momentum was felt in the more than doubling of the number of attendees since the last conference in Seoul six months ago. Even more superficially, it was seen the extraordinary width and clarity of the screen at the back of the stagedesigned to be viewed by creatures with at least three eyes.
More importantly, it was noticeable in the way BSV technology and businesses were discussed on stage. Petty announced new features for Twetch, taking the social media app to a slicker, more user-friendly form: Everything you touch and feel is going to be a microtransaction, he said, with no more swipe.
Familiar faces from previous conferences spoke with new certainty about what they were doing and had new achievements to report and announcements to make. Jack Liu of the RelayX wallet provided a moment of drama when he unveiled the new look of his appwhich is essentially a blank screen, the idea being that your camera opens to scan a QR code. More broadly, users will access Relay through other apps, making the integration of money functions almost invisible for users.
Newcomers, such as Thomas J. Lee, from Fundstrat, endorsed and elaborated themes previously only heard from those inside the Bitcoin SV tent. With detailed financial graphs, he predicted a parabolic moment when institutions get serious about cryptosimilar to the effect on Teslas share price when Wall Street started paying attention to its potential (below):
Lee highlighted BSVs transaction growth over the past months and the potential of its nascent businesses as evidence of his prediction that the growth of BSV would be more than another speculative bubble. He singled out the coming Maxthon browser, the Baemail, email service and True Reviews as examples of more than 400 projects building on BSV, with more in prospect using the increased functionality provided by the Genesis fork.
The first day ended with a rousing speech by Dr. Craig Wright, which, apart from the odd swipe at the French, provided a laser-focused summary of his original intentions for Bitcoin as Satoshi Nakamoto and his present-day assessment of the prospects for BSV from microtransactions.
On Friday, there was more. Jeff Chen, the founder and CEO of Maxthon talked about his BSV browser. With his long track record of successful Internet browsers, this is no pipe dream, but a solid business proposition in development.
If you thought BSV innovation was limited to the world as seen through a computer screen, Stephan Nilsson and Ken Hill took us out into the real world. Hill described EHR Data, a new business that plans to revolutionise health information, putting patients in charge. And Nilsson, of UNISOT, demonstrated his app to track an item through a complex supply chain in this case, a haddock.
Finally, at the end of the second day, the veteran economist and technology commentator George Gilder, another newcomer to BSV gatherings, put Satoshis ideas into perspective. He was confident that BSV solves the two-fold scandal in the world economy, namely Internet security and the excesses of global currency trading.
Were now engaging in forging a new system of the world, he said. Its a system to replace the failed economic model of Google. In an information age, economies can change as fast as minds. Were moving to a world in which security comes first, everything is correctly valued and nothing is free.
Gilder gave an account of how he had been persuaded that Dr. Craig Wright is Satoshi. Sitting next to him in the final session of the day, he said, to applause that I think you can safely celebrate Craig. It was a fitting tribute to the man who had already changed the lives of everyone at CoinGeek London, all of whom are convinced that the best is yet to come.
202024BSV
CoinGeek.comCoinGeek
Go here to see the original:
CoinGeek London: When Bitcoin SV came of age - CoinGeek