Category Archives: Internet Security
cloudtamer.io Announces Availability of Compliance Jumpstarts for Cloud Governance Solution – PR Web
Our Compliance Jumpstarts now come out-of-the-box and can be quickly applied across all the cloud accounts in the enterprise.
FULTON, Md. (PRWEB) December 02, 2019
cloudtamer.io today announced the initial release of its Compliance Jumpstarts for Amazon Web Services (AWS) to expedite customer efforts in meeting various industry security and compliance standards. The initial release of the cloudtamer.io Compliance Jumpstarts includes both the National Institute of Standards and Technology (NIST) Special Publication 800-171 Rev. 1 as well as the Center for Internet Security (CIS) AWS Foundation Benchmark v1.2.0. The NIST 800-171 standard defines how non-federal systems and organizations should safeguard and distribute non-classified sensitive material. The CIS Benchmark for AWS provides best practices to secure cloud accounts.
cloudtamer.io's Compliance Jumpstarts deliver two key capabilities to customers:
"The initial release of cloudtamer.io's Compliance Jumpstarts represents our commitment to simplify security and compliance in the cloud for our customers. We have seen organizations struggle with understanding, implementing, and documenting the necessary controls within AWS to better secure their cloud account configuration. Our Compliance Jumpstarts now come out-of-the-box and can be quickly applied across all the cloud accounts in the enterprise," said Brian Price, cloudtamer.io CEO. "Along with our constantly evolving library of Cloud Rules to proactively enforce compliance and security standards, our Compliance Jumpstarts help everyone hit the ground running to better implement and align best practices to their governance, risk management, and compliance (GRC) controls."
The cloudtamer.io Compliance Jumpstarts for NIST SP 800-171 Rev. 1 and CIS AWS Benchmark v1.2.0 are available now to all cloudtamer.io customers.
To learn more about how to accelerate compliance in the cloud, visit the cloudtamer.io website or schedule a demonstration.
About cloudtamer.ioAt cloudtamer.io, headquartered in Fulton, Maryland, we build software products to help government and commercial customers achieve success and realize full value from their cloud operations. Our mission is to make peoples lives easier in the cloud through innovative products built by passionate employees. Our solution, cloudtamer.io, does this by delivering comprehensive cloud governance to provide visibility, enforce budgets, and ensure compliance across public cloud workloads. For more information, visit the cloudtamer.io website or follow us on Twitter and LinkedIn.
Share article on social media or email:
Continued here:
cloudtamer.io Announces Availability of Compliance Jumpstarts for Cloud Governance Solution - PR Web
5G hackers: These eight groups will try to break into the networks of tomorrow – ZDNet
European computer security agency Enisa has listed the groups it thinks are most likely to attempt to hack into 5G networks, warning that security threats to telecoms infrastructure and beyond will expand with the arrival of next-generation mobile connectivity.
5G will introduce new risks because it will play a role in connecting up everything from smart cities, connected cars, automated factories and the internet of things.
"This will attract the attention of existing and new threat agent groups with a large variety of motives," Enisa said in a report into the security threats facing the next generation of mobile networks. It warned that 5G will introduce a set of new vulnerabilities that will expand the ways networks and connected devices could be attacked.
"These facts may cause an unprecedented shift of capabilities and objectives of existing threat agent groups in ways that have not been seen in the past," Enisa said.
SEE: IT pro's guide to the evolution and impact of 5G technology (free PDF)
The list of potential 5G threats includes:
Cyber criminals Given the advanced capabilities of organised cybercrime, 5G is a likely target for them, either through attempts to steal data or via frauds. "Though not yet representing a significant monetizing vector, such attacks (or preparations hereto), will be part of their activities," Enisa predicted.
Insiders These could be a key threat, mainly because they are in constant proximity with the core of 5G technology. The increased complexity of 5G might increase the amount of unintentional damage caused by clumsy insiders anyway, and dishonest insiders "may misuse their access to vital network function to cause high impact/large scale availability issues in the network itself," Enisa said. Disgruntled and dissatisfied insiders are also a target for other malicious groups, and could be recruited to abuse their insider knowledge for money.
Nation states This is an important group due to their ability to compromise 5G networks and their potential motivation to do so, Enisa said: "Given the importance of 5G to the sovereignty of nation states, they will most probably be a target of state-sponsored attack." It is also "indisputable" that vendors of 5G components are in a better position to cause devastating attacks to the operation of self-developed components, Enisa said, especially when governments influence them, a possible nod to the ongoing debate about which companies from which nations should be allowed to build 5G infrastructure.
Military 5G infrastructure will be one of the most vital components to protect in the technology landscape, Enisa said, and is also likely to be a technology of use to the military. "Such a development will amplify the protection requirements and the attractiveness of 5G as a target of cyberwar," Enisa said. "5G mobile networks are going to comprise a significant target for military operations, but also as a platform used for military purposes."
SEE: AI, quantum computing and 5G could make criminals more dangerous than ever, warn police
Enisa also put 'hacktivists' on its list, but admitted that it's unclear how this group is going to be engaged in malicious activities surrounding 5G: "While the most probable is to see this group engaging in regional campaigns, it cannot be excluded that it could achieve high impact activities in national and even global 5G infrastructures". Enisa also warned that corporations may themselves be a threat to 5G networks as they will be interested in tracking the development of patents and intellectual property related to 5G infrastructure.
"Through the integration of multiple verticals, 5G will provide a single attack surface that once targeted, may result in damages in the physical space (e.g. hybrid threats)," Enisa said. And while acknowledging that there is little evidence for significant activity of cyber terrorists, Enisa noted that: "5G stakeholders will need to take the protection of this infrastructure very seriously to avoid high impact events that would cause severe harm to society".
Script kiddies Individual junior hackers might still pose a threat to 5G because it has so many components, such as IoT devices, phones, and cloud storage spaces that are within the control of individuals, for example. "In the past, we have seen high impact attacks (e.g. DDoS) spreading from home devices and gadgets," Enisa said, adding that: "With the availability of high-speed 5G networks and interconnected devices, activities of this threat agent group may cause significant impact though cascaded events affecting upstream components of 5G operators."
Continued here:
5G hackers: These eight groups will try to break into the networks of tomorrow - ZDNet
Opinion | What Iran Did Not Want You to See – The New York Times
Video by Alexander Stockton and Adam Westbrook
Parts of Iran are back online, and videos suppressed by the nations internet shutdown are starting to trickle onto social media. In the Video Op-Ed above, Raha Bahreini sheds light on the eye-opening stories that Irans government did not want you to see.
While internet service has been partly restored, many Iranians still do not have internet access on mobile phones, and government officials there have warned that connectivity may be blocked indefinitely. In a call for evidence of government repression during the blackout, the United States State Department says it has received almost 20,000 messages, videos and photographs.
A hike in fuel prices sparked protests across Iran. Ms. Bahreini exposes and analyzes footage of human rights abuses by Iranian security forces, including shootings into crowds of unarmed protesters. And she warns of what may come next incarceration, torture and forced confessions that will further oppress the Iranian people. If the world does not take a stand, Ms. Bahreini fears, Irans internet blackout may foreshadow the nations darkest days.
Raha Bahreini (@RahaBahreini) is a human rights lawyer and a researcher on Iran for Amnesty International.
Original post:
Opinion | What Iran Did Not Want You to See - The New York Times
Multi-domain operations: Like bringing Waze to the battlefield – FedScoop
Written by Billy Mitchell Dec 2, 2019 | FEDSCOOP
In about a months time, the U.S. Air Force will host the first demonstration of its Advanced Battle Management System the networking concept that will serve as the technological backbone of the militarys shift to an advanced way of seeing the battlefield.
Through multi-domain operations, the military servicesaim to link togetherair, sea, land, space, cyber and information assets to better identify and eliminate threats. And while the idea could leave to revolutionary jump forward in awareness and information sharing for warfighters, the technology necessary to achieve it isnt at all revolutionary, said Will Roper, Air Forces assistant secretary for acquisition, technology and logistics.
Well connect F-22s, F-35s, SpaceX Starlink satellites, Navy ships, Army soldiers, Roper said at a recentCenter for a New American Security discussion. Were going to connect them in an internet-like style. What were really doing to enable multi-domain is finally building the internet in the Air Force. Its all the stuff that you know. There are no show-stoppers here.
Rather, its taking the best of what already exists in the commercial world things military personnel have access to and expect in their personal lives and cloning that for command and control.
The great news is this exists, he said. We just simply have to be able to clone it and probably put a little more security in it. But its not unachievable. But it is going to be different to become a digital service, a digital department.
Roper pointed to navigation app Waze as an example. Every time he drives home from the Pentagon and uses Waze, he thinks about how would this work on the battlefield?
Below such an app, he said, are strong software development capabilities with cloud infrastructure and platforms to build on. Hereferred to theAdvanced Battle Management System as a whole internet company in the Air Force, built on the services Cloud One, Platform One and Data One programs.
The way that this will work well have kind of a big cloud, a big [Department of Defense] cloud, and if youre a system and youre connected to big cloud, and very similar to the app Waze, or pick your favorite, we have a user profile for you based on your mission, Roper said. And the data that hits our cloud, we can recognize, Oh this is something [you] should see, because youre driving a ship and you dont know that threat is over there and we just collected on it. And we can push it to you in a way thats very similar to Waze, easy to engage with, and as you respond to it, we get better at recognizing you.
But its also very different from an app like Waze because adversaries will be constantly trying to take it offline, Roper said. So the real secret sauce is going to be when the disconnect happens, how much are we able to locally store and process? Can I inform you how long you will have digital superiority, digital stealth so that when you connect back up because I dont think any adversary will be able to keep us disconnected forever we can immediately refresh your data, almost like were kind of resetting the clock.
To do that, he said, the military is going on the same digital journey that many successful companies have already gone on. Roper said the Air Force has already recruited a cadre of internet-type gurus who have joined our team as pioneers to build this system-of-systems out. So were not designing this in a traditional defense fashion. Were designing this with champions of commercial internet technology who are willing, just out of patriotism, to be contracted designers, to make sure that we dont get outside of what worked for the internet.
If the Air Force gets theABMS program right, the benefit will be that finally for once, if the government has a piece of data that can help the warfighter, we can getit to them, Roper said. And its crazy in the world we live in where you right now with your personal device are connected to the entire world. Think about how much ability there is to interact, to understand, to command control things, your house, your car, you control everything. We live in that world. Our operators go home with that capability. And they come into a military where things cant talk to each other.
The biggest challenge in all of this, Roper said, will beconvincing Congress to deliver the required funding.Its a big risk to put billions of dollars into digital transformation, he said. You cant take a picture of it. But you know that behind your phone is an amazing, powerful architecture that allows that phone to be so much more than a platform.
But, he anticipates sizable dollars will be dedicated in fiscal 2021 to support the ABMS development.
Itsenough money to actually do real stuff, and its not tied to any platform, Roper said. So, ABMS will basically be a competition among existing platforms. Whoever can kind of make their platform look more like an Internet of Things-type system, you get first dibs to the pot.
See the original post here:
Multi-domain operations: Like bringing Waze to the battlefield - FedScoop
With Brutal Crackdown, Iran Is Convulsed by Worst Unrest in 40 Years – The New York Times
Iran is experiencing its deadliest political unrest since the Islamic Revolution 40 years ago, with at least 180 people killed and possibly hundreds more as angry protests have been smothered in a government crackdown of unbridled force.
It began two weeks ago with an abrupt increase of at least 50 percent in gasoline prices. Within 72 hours, outraged demonstrators in cities large and small were calling for an end to the Islamic Republics government and the downfall of its leaders.
In many places, security forces responded by opening fire on unarmed protesters, largely unemployed or low-income young men between the ages of 19 and 26, according to witness accounts and videos. In the southwest city of Mahshahr alone, witnesses and medical personnel said, Islamic Revolutionary Guards Corps members surrounded, shot and killed 40 to 100 demonstrators mostly unarmed young men in a marsh where they had sought refuge.
The recent use of lethal force against people throughout the country is unprecedented, even for the Islamic Republic and its record of violence, said Omid Memarian, the deputy director at the Center for Human Rights in Iran, a New York-based group.
Altogether, from 180 to 450 people, and possibly more, were killed in four days of intense violence after the gasoline price increase was announced on Nov. 15, with at least 2,000 wounded and 7,000 detained, according to international rights organizations, opposition groups and local journalists.
The last enormous wave of protests in Iran in 2009 after a contested election, which was also met with a deadly crackdown left 72 people dead over a much longer period of about 10 months.
Only now, nearly two weeks after the protests were crushed and largely obscured by an internet blackout in the country that was lifted recently have details corroborating the scope of killings and destruction started to dribble out.
The latest outbursts not only revealed staggering levels of frustration with Irans leaders, but also underscored the serious economic and political challenges facing them, from the Trump administrations onerous sanctions on the country to the growing resentment toward Iran by neighbors in an increasingly unstable Middle East.
The gas price increase, which was announced as most Iranians had gone to bed, came as Iran is struggling to fill a yawning budget gap. The Trump administration sanctions, most notably their tight restrictions on exports of Irans oil, are a big reason for the shortfall. The sanctions are meant to pressure Iran into renegotiating the 2015 nuclear agreement between Iran and major world powers, which President Trump abandoned, calling it too weak.
Most of the nationwide unrest seemed concentrated in neighborhoods and cities populated by low-income and working-class families, suggesting this was an uprising born in the historically loyal power base of Irans post-revolutionary hierarchy.
Many Iranians, stupefied and embittered, have directed their hostility directly at the supreme leader, Ayatollah Ali Khamenei, who called the crackdown a justified response to a plot by Irans enemies at home and abroad.
The killings prompted a provocative warning from Mir Hussein Moussavi, an opposition leader and former presidential candidate whose 2009 election loss set off peaceful demonstrations that Ayatollah Khamenei also suppressed by force.
In a statement posted Saturday on an opposition website, Mr. Moussavi, who has been under house arrest since 2011 and seldom speaks publicly, blamed the supreme leader for the killings. He compared them to an infamous 1978 massacre by government forces that led to the downfall of Shah Mohammed Reza Pahlavi a year later, at the hands of the Islamic revolutionaries who now rule the country.
The killers of the year 1978 were the representatives of a nonreligious regime and the agents and shooters of November 2019 are the representatives of a religious government, he said. Then the commander in chief was the shah and today, here, the supreme leader with absolute authority.
The authorities have declined to specify casualties and arrests and have denounced unofficial figures on the national death toll as speculative. But the nations interior minister, Abdolreza Rahmani Fazli, has cited widespread unrest around the country.
On state media, he said that protests had erupted in 29 out of 31 provinces and 50 military bases had been attacked, which if true suggested a level of coordination absent in the earlier protests. Irans official media have reported that several members of the security forces were killed and injured during the clashes.
The property damage also included 731 banks, 140 public spaces, nine religious centers, 70 gasoline stations, 307 vehicles, 183 police cars, 1,076 motorcycles and 34 ambulances, the interior minister said.
The worst violence documented so far happened in the city of Mahshahr and its suburbs, with a population of 120,000 people in Irans southwest Khuzestan Province a region with an ethnic Arab majority that has a long history of unrest and opposition to the central government. Mahshahr is adjacent to the nations largest industrial petrochemical complex and serves as a gateway to Bandar Imam, a major port.
The New York Times interviewed six residents of the city, including a protest leader who had witnessed the violence; a reporter based in the city who works for Iranian media, and had investigated the violence but was banned from reporting it; and a nurse at the hospital where casualties were treated.
They each provided similar accounts of how the Revolutionary Guards deployed a large force to Mahshahr on Monday, Nov. 18, to crush the protests. All spoke on condition of anonymity for fear of retribution by the Guards.
For three days, according to these residents, protesters had successfully gained control of most of Mahshahr and its suburbs, blocking the main road to the city and the adjacent industrial petrochemical complex. Irans interior minister confirmed that the protesters had gotten control over Mahshahr and its roads in a televised interview last week, but the Iranian government did not respond to specific questions in recent days about the mass killings in the city.
Local security forces and riot police officers had attempted to disperse the crowd and open the roads, but failed, residents said. Several clashes between protesters and security forces erupted between Saturday evening and Monday morning before the Guards were dispatched there.
When the Guards arrived near the entrance to a suburb, Shahrak Chamran, populated by low-income members of Irans ethnic Arab minority, they immediately shot without warning at dozens of men blocking the intersection, killing several on the spot, according to the residents interviewed by phone.
The residents said the other protesters scrambled to a nearby marsh, and that one of them, apparently armed with an AK-47, fired back. The Guards immediately encircled the men and responded with machine gun fire, killing as many as 100 people, the residents said.
The Guards piled the dead onto the back of a truck and departed, the residents said, and relatives of the wounded then transported them to Memko Hospital.
One of the residents, a 24-year-old unemployed college graduate in chemistry who had helped organize the protests blocking the roads, said he had been less than a mile away from the mass shooting and that his best friend, also 24, and a 32-year-old cousin were among the dead.
He said they both had been shot in the chest and their bodies were returned to the families five days later, only after they had signed paperwork promising not to hold funerals or memorial services and not to give interviews to media.
The young protest organizer said he, too, was shot in the ribs on Nov. 19, the day after the mass shooting, when the Guards stormed with tanks into his neighborhood, Shahrak Taleghani, among the poorest suburbs of Mahshahr.
He said a gun battle erupted for hours between the Guards and ethnic Arab residents, who traditionally keep guns for hunting at home. Iranian state media and witnesses reported that a senior Guards commander had been killed in a Mahshahr clash. Video on Twitter suggests tanks had been deployed there.
A 32-year-old nurse in Mahshahr reached by the phone said she had tended to the wounded at the hospital and that most had sustained gunshot wounds to the head and chest.
She described chaotic scenes at the hospital, with families rushing to bring in the casualties, including a 21-year-old who was to be married but could not be saved. Give me back my son!, the nurse quoted his sobbing mother as saying. Its his wedding in two weeks!
The nurse said security forces stationed at the hospital arrested some of the wounded protesters after their conditions had stabilized. She said some relatives, fearing arrest themselves, dropped wounded loved ones at the hospital and fled, covering their faces.
On Nov. 25, a week after it happened, the citys representative in Parliament, Mohamad Golmordai, vented outrage in a blunt moment of searing antigovernment criticism that was broadcast on Iranian state television and captured in photos and videos uploaded to the internet.
What have you done that the undignified Shah did not do? Mr. Golmordai screamed from the Parliament floor, as a scuffle broke out between him and other lawmakers, including one who grabbed him by the throat.
The local reporter in Mahshahr said the total number of people killed in three days of unrest in the area had reached 130, including those killed in the marsh.
In other cities such as Shiraz and Shahriar, dozens were reported killed in the unrest by security forces who fired on unarmed protesters, according to rights groups and videos posted by witnesses.
This regime has pushed people toward violence, said Yousef Alsarkhi, 29, a political activist from Khuzestan who migrated to the Netherlands four years ago. The more they repress, the more aggressive and angry people get.
Political analysts said the protests appeared to have delivered a severe blow to President Hassan Rouhani, a relative moderate in Irans political spectrum, all but guaranteeing that hard-liners would win upcoming parliamentary elections and the presidency in two years.
The tough response to the protests also appeared to signal a hardening rift between Irans leaders and sizable segments of the population of 83 million.
The governments response was uncompromising, brutal and rapid, said Henry Rome, an Iran analyst at the Eurasia Group, a political risk consultancy in Washington. Still, he said, the protests also had demonstrated that many Iranians are not afraid to take to the streets.
Follow this link:
With Brutal Crackdown, Iran Is Convulsed by Worst Unrest in 40 Years - The New York Times
Can New Norms of Behavior Extend the Rules-Based Order Into Cyberspace? – World Politics Review
Over the past quarter century, the internet has transformed human existence, dramatically altering everything from daily life, societal interactions and economic exchange, to political debates and geopolitical rivalries. In 1996, only 36 million people were online. Today, 3.7 billion are, and the remaining half of humanity will soon join them in the connected world. Although the benefits of cyberspace are undeniable, malicious state and criminal actors often use it to further their nefarious ends, while at times endangering its digital infrastructure. Hoping to protect this vulnerable domain, the Global Commission on the Stability of Cyberspace recently issued its final report, Advancing Cyberstability.
The commission, co-chaired by former U.S. Secretary of Homeland Security Michael Chertoff and former Indian Deputy National Security Adviser Latha Reddy, toiled for three years, consulting globally with governments, international organizations, private corporations, technical experts and members of civil society. According to Foreign Minister Stef Blok of the Netherlands, which helped underwrite the commissions work, one overriding conviction animated its efforts: Cyberspace cannot be an ungoverned space where bad guys can do what they want, he said in issuing the report at last months Paris Peace Forum. The rules-based order and international law must extend into cyberspace. ...
Link:
Can New Norms of Behavior Extend the Rules-Based Order Into Cyberspace? - World Politics Review
What is the Internet of Things? Your IoT roadmap – Ericsson
Cellular IoT can address both the relatively simpler requirements of connecting devices that have a lower complexity such as wearables, simple metering, etc. as well as the highly specific, sensitive demands of complex environments and applications such as manufacturing or logistics.
Cellular IoT itself is a rapidly growing ecosystem based on 3rd Generation Partnership Project (3GPP) global standards. 3GPP works with telecommunications standard development organizations and provides its members with a stable environment to produce the reports and specifications that define 3GPP technologies.
3GPP standards are supported by an increasing number of communications service providers (CSPs) as well as device, chipset, module and network infrastructure vendors. It offers better performance than other Low-power wide-area (LPWA) network technologies in terms of unmatched global coverage, quality of service, scalability, security and the flexibility to handle the different requirements for a comprehensive range of use cases.
View original post here:
What is the Internet of Things? Your IoT roadmap - Ericsson
Now even the FBI is warning about your smart TVs security – TechCrunch
If you just bought a smart TV on Black Friday or plan to buy one for Cyber Monday tomorrow, the FBI wants you to know a few things.
Smart TVs are like regular television sets but with an internet connection. With the advent and growth of Netflix, Hulu and other streaming services, most saw internet-connected televisions as a cord-cutters dream. But like anything that connects to the internet, it opens up smart TVs to security vulnerabilities and hackers. Not only that, many smart TVs come with a camera and a microphone. But as is the case with most other internet-connected devices, manufacturers often dont put security as a priority.
Thats the key takeaway from the FBIs Portland field office, which just ahead of some of the biggest shopping days of the year posted a warning on its website about the risks that smart TVs pose.
Beyond the risk that your TV manufacturer and app developers may be listening and watching you, that television can also be a gateway for hackers to come into your home. A bad cyber actor may not be able to access your locked-down computer directly, but it is possible that your unsecured TV can give him or her an easy way in the backdoor through your router, wrote the FBI.
The FBI warned that hackers can take control of your unsecured smart TV and in worst cases, take control of the camera and microphone to watch and listen in.
Active attacks and exploits against smart TVs are rare, but not unheard of. Because every smart TV comes with their manufacturers own software and are at the mercy of their often unreliable and irregular security patching schedule, some devices are more vulnerable than others. Earlier this year, hackers showed it was possible to hijack Googles Chromecast streaming stick and broadcast random videos to thousands of victims.
In fact, some of the biggest exploits targeting smart TVs in recent years were developed by the Central Intelligence Agency, but were stolen. The files were laterpublished online by WikiLeaks.
But as much as the FBIs warning is responding to genuine fears, arguably one of the bigger issues that should cause as much if not greater concerns are how much tracking data is collected on smart TV owners.
The Washington Post earlier this year found that some of the most popular smart TV makers including Samsung and LG collect tons of information about what users are watching in order to help advertisers better target ads against their viewers and to suggest what to watch next, for example. The TV tracking problem became so problematic a few years ago that smart TV maker Vizio had to pay $2.2 million in fines after it was caught secretly collecting customer viewing data. Earlier this year, a separate class action suit related to the tracking again Vizio was allowed to go ahead.
The FBI recommends placing black tape over an unused smart TV camera, keeping your smart TV up-to-date with the latest patches and fixes, and to read the privacy policy to better understand what your smart TV is capable of.
As convenient as it might be, the most secure smart TV might be one that isnt connected to the internet at all.
More:
Now even the FBI is warning about your smart TVs security - TechCrunch
Cybersecurity: The web has a padlock problem – and your internet safety is at risk – ZDNet
Internet users are being taught to think about online security the wrong way, which experts warn might actually make them more vulnerable to hacking and cyberattacks.
Websites that want to demonstrate their secure credentials will usually do so by displaying a padlock sign in the address bar that aims to show the website is usingHTTPS encryption.
The Hypertext Transfer Protocol Secure (HTTPS) is the more secure version of the Hypertext Transfer Protocol (HTTP) used across the web to load pages using hypertext links it's there to transfer information between devices, allowing users to enter and receive information.
SEE: 10 tips for new cybersecurity pros (free PDF)
HTTPS encrypts that information, allowing the transmission of sensitive data such as logging into bank accounts, emails, or anything else involving personal information to be transferred securely. If this information is entered onto a website that is just using standard HTTP, there's the risk that the information can become visible to outsiders, especially as the information is transferred in plain text.
Websites secured with HTTPS display a green padlock in the URL bar to show that the website is secure. The aim of this is to reassure the user that the website is safe and they can enter personal information or bank details when required. Users have often been told that if they see this in the address bar, then the website is legitimate and they can trust it.
However, as security researcher Scott Helme warned in his keynote address at the SANS Institute and National Cyber Security Centre (NCSC) Cyber Threat 19 conference in London, this information is potentially misleading, because it isn't difficult for cyber attackers to register HTTPs domains for use inphishing attacksand other hacking campaigns.
But because web users have been told the padlock is a sign of safety, they're potentially vulnerable to falling victims to attacks.
"This is why phishers are using it on phishing sites, because they know that people who use the websites think that means its OK when it's not," said Helme. "The padlock doesn't guarantee safety, it never has, that's just a misunderstanding of the interpretation of what this actually means."
In December 2017, a television advert for Barclays Bank in the UK warned users to check for a green padlock to ensure that the website is genuine. There were complaints that this advice was misleading, because it would be possible for attackers to exploit HTTPS for their own ends.
The complaint was upheld by the Advertising Standards Authority, which concluded that the advice from Barclays was inaccurate because "the padlock measure alone could not ensure safety".
Because it turns out, it's actually relatively easy for a criminal to acquire HTTPS for malicious websites to help them look entirely legitimate. By buying a Transport Layer Security (TLS) certificate, attackers can encrypt traffic on their fake website and make it look legitimate. And because the traffic is encrypted, the browser can be fooled into believing that website is safe.
"Cyber criminals started to use HTTPS and their trust scores can be higher than normal websites, they really care about this stuff," said James Lyne, CTO at SANS Institute.
So by asking the user to notice when something is wrong, it's putting unfair pressure on them, especially, as Helme argued, as it doesn't happen in other aspects of life.
He pointed to cars and how there isn't a warning light that tells the driver everything is OK. That light only comes on when the driver needs to be aware of an issue, there's no light or alert that appears just to show that things are working as expected and that model should also be applied to the internet.
SEE:A winning strategy for cybersecurity(ZDNet special report) |Download the report as a PDF(TechRepublic)
"We should only be bugging the user with new information when there's a problem, not when everything is OK, not when the connection is secure. It should be that all connections are secure and that's the default and a non-encrypted connection is the exception," Helme explained.
"We need to flip the model around, we need encryption to become the default and non-encrypted HTTP to become the exception, the thing that we warn about like the warning light on your car, indicating there is a problem," he added.
Even now, encryption is sometimes discussed as if it's a bonus when using the internet, when it needs to become the standard way of doing things everywhere on the internet, Helme explained.
"We need it to become so ingrained and embedded into everything that we do that it's boring and we don't need to talk about it because it shouldn't be special. Encryption should be the boring default that we don't need to talk about," he said.
The security industry therefore needs to step up and help fix the issue, Helme argued, because by doing this, it takes the responsibility for deciding if a website is safe or not away from the user something that will help make the internet safer for everyone.
"We need to take encryption and make it the default, universal it needs to be everywhere," he said, adding: "The lack of encryption on the web is actually a bug. And what we're doing now isn't adding a new feature for an improvement or a new thing: we're going back and fixing a mistake we made in the beginning."
In the mean time, it's going to remain difficult to convince internet users that something they've been told means that a website can be trusted can't actually be used as an indicator of whether the page is safe or not.
"We've beaten into people that's safe, only go to websites with a padlock. But now it turns out that a cyber criminal can go out and buy a padlock for a dollar. That turns it around, so how do you unwire all of that?" said Paul Chichester, director of operations at the NCSC.
"Cybersecurity is a really challenging discipline to operate in. If you think about driving a car and, over many years of driving, you learn certain things and it doesn't generally change, the practices keep you safe. Nobody tells you not to use the brakes any more," he added.
SEE: 10 great gifts for the hacker in your life
To fix that, the industry needs to improve its messaging, because cybersecurity can be complicated for the average web user and changing advice all the time isn't going to help, especially if people stick to adhering to the first thing they were told like believing the padlock automatically means the website is safe.
"We're pivoting in much shorter periods of time and, even within our community, sharing practices can be tough, particularly when a new practice isn't as simple to convey as the original because those ideas stick," said Lyne. "That's where the average person has lost reasonable expectation it's genuinely hard".
More:
Cybersecurity: The web has a padlock problem - and your internet safety is at risk - ZDNet
Chuck Todd challenges John Kennedy on Ukraine: Putin is only other person ‘selling this argument’ | TheHill – The Hill
NBC host Chuck ToddCharles (Chuck) David ToddRepublican Senator says he's 'very comfortable' with Trump making call on Navy SEAL review Sanders campaign says it reached 4 million individual donations Johnson: I'm writing a letter to 'lay out what I know' about Ukraine aid MORE on Sunday confronted Sen. John KennedyJohn Neely KennedyMORE (R-La.) over the unfounded theory that Ukraine interfered in the 2016 election, saying that Russian President Vladimir PutinVladimir Vladimirovich PutinDemocrats: The 'Do Quite a Lot' Party Rudy Giuliani's reputation will never recover from the impeachment hearings The Hill's Morning Report Dems and Trump score separate court wins MORE is the only other person outside the U.S. promulgating this argument.
Todd made the remarks on "Meet The Press" while pushing back against Kennedy's assertion that both Russia and Ukraine meddled in the latest U.S. presidential election.
Todd strongly disputed the accusations, noting that the U.S. intelligence community has concluded that Russia interfered in the 2016 election to boost President TrumpDonald John TrumpHouse Intelligence Committee to review impeachment investigation report Monday Comedian Rosanne Barr to speak at Trumpettes' Gala at Mar-A-Lago Israeli, Palestinian business leaders seek Trump boost for investment project MORE and harm Democratic presidential nominee Hillary ClintonHillary Diane Rodham ClintonStill upset by Trump's historic win? Beat him if you can in 2020 Michael Bloomberg's billions can't save an unserious campaign Fears mount about Biden's South Carolina firewall MORE. There is no evidence to suggest Ukraine meddled in the 2016 election.
Kennedy claimed that reporting in outlets such as Politico and The Economist indicated that the former Ukrainian presidentfavored Clinton over Trump.
WATCH: @ChuckTodd asks @SenJohnKennedy if he is "at all concerned that he has been duped" into believing that former Ukraine president worked for the Clinton campaign in 2016 #MTP #IfItsSunday@SenJohnKennedy: "No, just read the articles." pic.twitter.com/A0rLu03F8j
"You should read the articles, Chuck. Theyre very well documented," Kennedy said, apparently referencing reports about former Ukrainian President Petro Poroshenko's administration.
"The fact that Russia was so aggressive does not exclude the fact that President Poroshenko actively worked for Secretary Clinton," he later added, prompting Todd to quickly express dismay over the remark. It is unclear which report he was referencing when making the claim.
"My goodness. Wait a minute,Sen. Kennedy. You now have the president of Ukraine saying he actively worked for the Democratic nominee for president. I mean, now come on," Todd said. "You realize the only other person selling this argument outside the United States is is this man, Vladimir Putin."
Todd went on to accuse Kennedy of doing "exactly what the Russian operation is trying to get American politicians to do."
"Are you at all concerned that youve been duped?" he asked.
"No, just read the articles," Kennedy said.
Speaking at an economic forum in Russia last month, Putin said that he was thankful "internal political battles" were putting an end to accusations of Russian interference in the U.S.
"We see what is going on there in the U.S. now," Putin said. "Thank God nobody is accusing us anymore of interfering in the U.S. elections. Now theyre accusing Ukraine."
The conspiracy theory that Ukraine meddled in the 2016 election has gained increased attention as the House probes Trump's dealings with Ukraine.
During a July 25 phone call with Ukrainian President Volodymyr Zelensky, Trump asked the new leader to look into matters related to CrowdStrike, an internet security company that initiallyexaminedthe breach of the DNCservers in 2016. The request was an apparent reference to a conspiracy that casts doubt on the assessment that Russia was to blame for the hack of the DNC servers.
Multiple former administration officials have denounced the theories that Ukraine, not Russia, hacked the Democratic National Committee (DNC) and interfered in the 2016 election.Tom Bossert,a former homeland security adviser in the Trump administration, said in late September that the allegation was a "completely debunked" conspiracy theory.
Fiona Hill, a former top Russia analyst for the White House, testified last month thatthe claim was a "fictional narrative that has been perpetrated and propagated by the Russian security services themselves."
Kennedy last week suggested that there was still a possibility that Ukraine was responsible for the DNC hack. He walked back those comments days later but has continued to insist Ukraine interfered in other ways.
Trump, meanwhile, has continued to push the unsubstantiated allegations. In an appearance on "Fox & Friends" following Hill's deposition, the presidentclaimed thatofficials gave a DNC server to "CrowdStrike, which is a company owned by a very wealthy Ukrainian." CrowdStrike is a U.S.-based company.
Read the rest here:
Chuck Todd challenges John Kennedy on Ukraine: Putin is only other person 'selling this argument' | TheHill - The Hill