Category Archives: Internet Security
How gangs are using spoof applications to dupe people – Hindustan Times
Gurugram:
Members of several gangs posed as bank executives and duped at least 200 people across Haryana in the last two months on the pretext of increasing their credit card limits by using call spoofing applications, said police.
Police said similar cases were registered at Gurugram, Faridabad, Palwal, Nuh, Rewari, Hisar, Jind, Rohtak and Sonipat. They are still investigating over 400 complaints. Cyber crime police stations in all districts have written to banks and application developers to ensure safe and secure transactions but the process is taking time, said police.
Commissioner of police KK Rao said that victims believed the perpetrators because they used spoofing apps to make it seem like they were calling via banks real customer care numbers. People shared their credit card details and one-time passwords (OTP) with the perpetrators, who then transferred money from the victims bank accounts to their own, and withdrew it from different locations so that they could not be identified. The process of obtaining the perpetrators IP addresses and mobile locations is taking time, because of which the registration of several cases is getting delayed, he said.
Rao added, The suspects are using spoof applications such as X-lite, Eyebeam and Indicall and posing as bank officials, telecom executives and insurance agents to dupe people.
NK Singh, a senior manager with an automobile company and a resident of Sector 57 in Gurugram, said that he was duped of 1.75 lakh after a man posing as a bank executive offered to redeem points on his credit card and offered him an iPhone 13 Pro Max. I was on my way to a meeting and was in a hurry when the bank executive called me. He informed me that I had been offered the latest mobile phone and they want to send it to my house. I shared my address and he asked me to verify the credit card details. While on call, I received an OTP which he asked me to share with him and before the call got disconnected money was transferred from my savings account, he said.
In another incident, a 40-year-old woman was duped of 1.50 lakh after she shared the details of her bank account and OTP with a man posing as a bank executive. I received a call on December 15 from a man who introduced himself as a bank executive and offered me a free holiday package. It was a 15-minute call, I shared the OTP I received and 1.50 lakh was transferred from my account, she said.
The Gurugram Police have arrested over 55 members of at least six different gangs from Rajasthan, Uttar Pradesh, Madhya Pradesh, Bihar, Jharkhand, Telangana, Delhi and Nuh in the last two months in connection with similar cases.
According to police, during questioning, most suspects revealed they used different modus operandi to dupe people using spoof applications and emails. In many cases, they use mobile apps to create spoof emails supposedly sent by telecom providers, banks or social media sites. Once a user clicks on a link provided in the email, they are then susceptible to fraud.
In several cases, perpetrators also used the names of well-known placement companies and matrimony sites to dupe unsuspecting victims.
We received over 200 complaints whereing victims said they were duped on the pretext of jobs, loans and dating offers via emails. We tracked the emails and found that all the companies in question had no information about such mails being sent out. A thorough check revealed that the fraudulent mails were being sent with the help of spoofing apps, said Narender Kadiyan, Faridabad deputy commissioner of police (crime).
Police said it is convenient for perpetrators anywhere to send an email to anyone from any ID.
Narender Bijarnia, the superintendent of police (SP), Jind, said that perpetrators target victims after scanning their details and grievances on social media accounts and take advantage of their concerns and call them using spoofing apps. At times people post their bad experience son social media regarding banks, companies or loan issues. Perpetrators note the details and call the victims from a toll-free number posing as bank executives from the credit card division or senior managers of job portals, he said.
He added that victims follow their instructions and lose money from their accounts.
Commissioner Rao said: Perpetrators make spoof calls using X-lite and Eyebeam--these two apps are very popular these days. They display actual toll-free numbers of banks so that if anyone checks on the Internet, they assume it is a genuine call, he said.
According to cyber experts, hackers use several methods to steal victims money. Using spoofing applications is one method. There are also other applications such as Easy Loan- the moment you install the app, all your personal data is stolen from your device, including contacts and photos, which can then be misused to extort money. Also, by using screen-sharing apps such as Anydesk or Team Viewer, anyone can try to steal your OTPs, etc. from your device. They can also ask you to install apps such as SMS Forwarder, which automatically gives your OTP to hackers. Stay safe and call 155260 in case of any monetary loss or log on to http://www.cybercrime.gov.in, said Rakshit Tandon, a cyber security advisor.
Police said they have been spreading awareness and have asked people not to share their OTPs with anyone as no bank or insurance company asks for it.
.
Leena Dhankhar has worked with Hindustan Times for five years. She has covered crime, traffic and excise. She now reports on civic issues and grievances of residents....view detail
Link:
How gangs are using spoof applications to dupe people - Hindustan Times
Neenah schools will be closed Tuesday because of a ‘technology security situation’ that shut down internet, phone systems – Post-Crescent
NEENAH All Neenah Joint School District schools will be closed Tuesday because of a "technology security situation."
According to a letter from the district, the security situation "involves potential unauthorized access to the school data system" that caused an outage of the internet, phone systems and several software applications.
At this point, the district has no reason to believe any confidential or personal information was compromised, the letter said.
After the district discovered the issue, it notified local and federal law enforcement and brought in cyber security experts to begin a forensic investigation, the letter said.
The district hopes to have phones and other systems working again by Wednesday so students and staff can return to school, but students will likely work "in a non-digital environment, possibly into next week."
This story will be updated when more information becomes available.
Reach AnnMarie Hilton at ahilton@gannett.com or 920-370-8045. Follow her on Twitter at @hilton_annmarie.
See the rest here:
Neenah schools will be closed Tuesday because of a 'technology security situation' that shut down internet, phone systems - Post-Crescent
Google wants to work with government to secure open-source software – Engadget
Google has called on the US government to take a more proactive role in identifying and protecting open-source projects that are critical to internet security. In a blog post the company published following the White Houses Log4j vulnerability summit on Thursday, Kent Walker, president of global affairs and chief legal officer at Google and Alphabet, said the country needs a public-private partnership that will work to properly fund and staff the most essential open-source projects.
For too long, the software community has taken comfort in the assumption that open source software is generally secure due to its transparency and the assumption that many eyes were watching to detect and resolve problems, he said. But in fact, while some projects do have many eyes on them, others have few or none at all.
According to Walker, the partnership would look at the influence and importance of a project to determine how critical it is to the wider ecosystem. Looking to the future, he says the industry needs new ways to identify software that may, down the line, pose a systemic risk to internet security.
Walker said theres also a need for more public and private funding, noting Google is ready to contribute to an organization that matches volunteers from companies like itself to critical projects that need the most support. Open source software is a connective tissue for much of the online world it deserves the same focus and funding we give to our roads and bridges, he said.
The importance of open-source software has been a topic of a lot of discussions following the discovery of the Log4Shell vulnerability. Log4j happens to be one of the most popular and widely used logging library, with services like Steam and iCloud depending on it. Security researcher Marcus Hutchins, who helped stop the spread of WannaCry, called the vulnerability extremely bad as it left millions of applications open to attack.
All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Go here to read the rest:
Google wants to work with government to secure open-source software - Engadget
This year, Russia’s internet crackdown will be even worse – Atlantic Council
When Russian President Vladimir Putin signed a law in 2019 allowing the state to isolate the internet within Russia in the event of a security incident, international media outlets extensively covered the development, with many (incorrectly) likening it to Chinas Great Firewall. The spotlight quickly swiveled back to Beijings grip on online content and dataeven though a Kremlin campaign continues to ratchet up pressure on US technology giants, and could soon create a disruptive playbook for other states.
While Moscow made headlines after throttling Twitter and coercing Google and Apple into censoring opposition leader Alexei Navalnys election app last year, Western media coverage of internet repression and security threats still tends to focus on China. This penchant persists despite Russian developments that impinge on both the internet ecosystem and human rights in the countryand which constitute broader cyber threats and efforts to undermine the global internet.
In no small part, this pattern stems from the fact that Russian state control of the internet differs from that in China: It relies less on technical measures and more on traditional, offline mechanisms of coercion such as harassment, intimidation, and vague and inconsistently enforced speech laws. Notably, Russias domestic efforts to control the internet quite closely parallel its efforts overseas to shape information and to both weaponize the internet and undermine its global nature.
As the world watches Putins moves in and around Ukraine, these developmentswhile of course not comparable to the possibility of large-scale armed conflictare worthy of attention, given their impact on the Russian cyber and internet landscape more broadly.
The more the Kremlin cements its control over the internet, the more it can potentially suppress dissent and control information and data flows at home. And the more it slowly works on implementing the domestic internet law, the more it centralizes its control of the architecture of the internet in Russiawhich could also affect Russian cyber behavior abroad, such as by encouraging more assertive operations against global internet infrastructure. Though US policy debates often separate Russian internet governance and technology policy at home from Russian cyber behavior abroad, there is actually great interdependence and entanglement between the two.
As the Kremlin demonstrates and further develops a model of internet and information control that appeals to states without Chinas technical capacity, Moscows techniques may portend the future of internet repression elsewhere. Several recent, but largely overlooked, developments signal that the Kremlin may crack down on the internet more than ever in 2022while US tech companies and the US government increasingly have little room to push back.
Last year was a stifling one for Russian internet freedom. When citizens took to the streets to protest state corruption and the Kremlins jailing of Navalny, the government sent censorship orders to YouTube, Facebook, Instagram, Twitter, TikTok, VKontakte (Russias leading social network, also known as VK), and other domestic and foreign tech firms. Many caved and removed protest-related content. When Twitter refused to comply, the government leveraged newly deployed deep packet inspection capabilities to throttle it from within Russia. That was only partly successful, as many other websites were inadvertently affected by the traffic slowdown, but it still demonstrated to foreign technology firms that Moscow was expanding its censorship capabilitieswhich it also threatened to use again as desired.
The crackdowns hardly ended there. The government demanded that foreign tech companies set up local offices in Russia, and the Foreign Ministry called in the US ambassador to complain that US tech firms were not complying with the Kremlins censorship ordersdecrying the companies behavior as election interference and describing them as tools of the American state. The government blocked access to the website for TOR (short for the Onion Router), an anonymizing browser often used to bypass government restrictions when surfing the web. It also blocked access to six major virtual private network (VPN) websites, where citizens were accessing software to circumvent online censorship; set up a registry to track tech company compliance with censorship orders; blocked many other websites, including those for Navalnys campaign; and used its foreign agents designation to crack down on numerous online media.
As more and more Russians get their news from social media, and as internet mobilization and outreach become more important to protesters and opposition figures, the states crackdown on the web means citizens will have an even harder time accessing and sharing news that criticizes (or merely reflects poorly on) the Putin regime.
Several recent developmentsincluding official pressure on Google, the expansion of domestic software and a push for domestic internet, as well as local office requirements for tech firmsillustrate how both economic and security motivations drive Russias new campaign to control and shape the domestic internet environment. They also underscore just how wide-ranging this campaign is.
In September, when Apple and Google refused to delete Navalnys election app from their platforms, the Russian government threatened their employees in Russia and sent armed thugs to Googles Moscow office; both companies then removed the app. Since then, the State Duma (Russias lower house of parliament) met with Google to issue even more demands (for example, edit Google Maps in Russia to show illegally annexed Crimea as part of Russia), while a Moscow court fined it $40,400 for not removing content the Kremlin deemed illegalthen fined it a record $98.4 million for not complying with state censorship orders. Google was targeted again just last month, when another Moscow court upheld a ruling from last April that found Google-owned YouTube must restore the account for Tsargrad, the TV channel owned by sanctioned Putin ally and oligarch Konstantin Malofeev. Though unsurprising, the ruling nonetheless gives the state another reason to increase its pressure on Google.
Meanwhile, a recently published BBC analysis found that between 2011 and 2020, the Russian government had filed more than 123,000 individual requests to Google search or YouTube to delete contentmany times more than the number issued by Turkey (14,000), India (9,800), the United States (9,600), Brazil (8,000), Israel (2,000), or China (1,200). Moscow continued issuing those censorship orders in 2021, mostly focused on removing content related to Navalny. The Russian governments commitment to fining Google a percentage of its annual revenue in Russia for not removing content signals increased Kremlin frustration at Google not bending the knee and suggests the pressure will ramp up even further.
Google matters as a stand-alone issue here because YouTube is the most widely used social media platform in Russia. It also provides cloud and other services to Russian citizens, while opposition leaders have used Google services as wellsuch as when the Navalny campaign used Google Docs to share a list of opposition candidates. Moreover, how the Kremlin treats Google, and its mixed record of compliance with the Russian government, could foreshadow how the state will treat other foreign tech companies facing similar demands.
The Russian government has increasingly been pushing the development and use of domestic software. Driven by economic and security factors, Russia aims to replace Western software with its Russian versions where possible. (However, if forced to choose between those two considerations, security would likely win out: While the Russian government doesnt want to undermine the operations of Russian tech firms, the Putin regime has demonstrated increasing concern about Western espionage through Western technologies.)
Moscow has been making this push on multiple fronts. For one, it has been updating its domestic software registry, established in 2015, which lists government-approved software that state bodies and companies should use when replacing foreign software. It also implemented a law requiring that smartphones, laptops, smart TVs, and many other consumer devices sold in Russia have state-approved, Russian software preinstalled. This is primarily economically drivena way to theoretically give domestic firms a leg up against foreign software developers and big US tech companiesbut security factors (like Moscow wanting to secure backdoor access to Russian phones) may play a role as well.
The Russian government also updated its tax incentives for domestic technology production, making Russian companies with at least seven employees and 90 percent or more of their revenue from information technology (IT) eligible for reductions in their social security and corporate profit taxes. Given broader issues in Russian tech production (such as the quality of domestic hardware and the brain drain of IT talent to foreign countries), the effectiveness of this initiative seems questionable.
Overall, there has been mixed success in Moscows push to develop domestic tech. While some Russian companies have made small gains as Western technology is expelled from government and business systems, in many cases Chinese firms take slightly more market share in Russia. Chinese telecom company Huawei Technologies, for instance, has played into Kremlin fears of Western espionage to accelerate expansion in Russia.
It remains to be seen whether Russias increased use of domestic software will better protect the state against espionage or end up undermining the cybersecurity of Russian citizens and the Russian internet ecosystem.
On January 1, a new law came into effect requiring any foreign internet company with five hundred thousand daily Russian users to open an office in Russia. This is a blatant tool of coercion which fits neatly into the Russian governments internet control model. Technical measures play a part, but traditional forms of physical, offline coercionsuch as stalking and intimidation by the security services, including the Federal Security Service (or FSB, the KGBs successor) in the digital sphereare a means of scaring citizens, keeping tech firms in check, expanding surveillance, and generally controlling the shape of internet conversation.
The Kremlin demonstrated the power of this tool when it sent armed, masked thugs to Googles Moscow office: When a company has employees on the ground, those are people who can be stalked, harassed, intimidated, threatened, jailed, or even killed. As of a few months ago, Google and Apple had complied with the local-office law; other major companies with users in Russia, such as Facebook and Twitter, have not.
Russian authorities have said they will not begin fining companies immediately for noncompliance if they demonstrate they are working on setting up an office. The list of companies which are required to open offices is notable: Facebook, Twitter, Telegram, TikTok, Zoom, Pinterest, and Spotify. It will be key to watch if they complyand whether doing so would create any new legal or jurisdictional challenges amid any Kremlin censorship or data-access requests.
In December 2021, a law came into effect mandating that only Russian entities can own cross-border communications lines. While many telephone and internet cable systems in Russia are already owned by Russian entities (and, often, by state-owned firms such as Rostelecom), its unclear what this means for the undersea cables that link the Russian internet to the global internet and are owned by multiple companies, some of them foreign.
The government also set up a registry of autonomous systems (routing internet traffic) that would be critical to the operation of the planned domestic internet, as well as mandated that internet providers work on countering Kremlin-defined threats on their networks.
In short, the Russian government continued building out components of the domestic internet law this year and has slowly started centralizing control over internet infrastructure in Russia.
While its a very different internet and political environment, Western tech companies are at least generally familiar with a similar story in China: Companies wanted to enter the market and remain in the country to provide services and make moneyyet they all reached a point at which the Chinese government was cracking down harder on the internet, and at which compliance with Beijings demands was simply too much. Many US tech companies exited the market, or at least closed their local offices. The Russian government has far less technology leverage than Chinas vis--vis market size and power, as well as its chokehold on the global tech supply chain; but it has also demonstrated a considerable willingness to use outright force against foreign companies.
The Kremlins escalating pressure on Google portends a growing intolerance of Western technology companies that dont comply with its demands. Importantly, the states will and ability to crack down will not apply equally or identically to all firms. Twitter, for instance, has been resisting the Russian governments local office requirementwhich meant the Kremlin had no Twitter employees in Russia to threaten when it wanted the company to censor protest content in March 2021. Still, companies are likely to face even more Kremlin pressure in 2022, and there is increasingly little that they can do to push back.
Filing appeals in the Russian courts is not a viable option, nor is looking for market leverage to negotiate with Russian officials. The US government is likewise in a tricky position, because any efforts to support Internet freedom in Russia will only exacerbate Moscows accusations, as conspiratorial and deluded as they are, that the internet and US tech firms are tools of the CIA and American subversion. If the Russian pressure campaign on tech companies ramps up further, as appears highly likely this year, it may prompt some (especially smaller) foreign tech companies to contemplate exiting the market altogether.
Many factors will influence whether and how the Kremlin will act, including traditional political considerations. Tech-company actions or inactions that intersect with high-priority issue areas for the Russian government, such as election opposition and mass demonstrations, are likely to continue receiving Kremlin attention (and therefore more coercive force). Conversely, it remains to be seen if historically lower-priority areas, such as enforcing Russias 2015 data-localization law, will get any more buy-in amid the domestic internet push.
Website or platform popularity and the reach of particular content may also be factors in the Kremlins response. YouTube, for instance, is the most widely used social media platform in Russia (with 85.4 percent penetration versus VKs 78 percent penetration), whereas Twitter is much less popular among Russians. Even if Russian tech companies can functionally operate without YouTube in the Russian market, a severe crackdown on it would still be a serious decision given the platforms immense popularity with Russians.
Notably, this campaign marks a departure from years past, when laws were enacted (such as on encryption, source code inspections, or data localization), but not necessarily enforced with high-level political buy-in. So while the pressure now seems like a means for the Kremlin to achieve compliance with its wishes, there is no guarantee it will stop there. Companies may find themselves facing a regime willing to use these tools for outright punishment as well.
Justin Sherman is a nonresident senior fellow at the Atlantic Councils Cyber Statecraft Initiative. Follow him on Twitter: @jshermcyber
Wed, Jan 12, 2022
UkraineAlertByHarley Balzer
While Russia has attempted to reduce its dependence on the SWIFT payment system, it remains vulnerable to a sanctions cut-off in the event of a new Kremlin offensive in Putin's eight-year undeclared war against Ukraine.
Image: Russians attend a rally to protest against tightening state control over internet in Moscow, Russia, on March 10, 2019. Photo by Shamil Zhumatov/REUTERS
Read more here:
This year, Russia's internet crackdown will be even worse - Atlantic Council
Continuous security and compliance for hybrid cloud, the Red Hat way – The Register
Paid feature Assessing what can go wrong in a hybrid cloud environment can be daunting. Applications can be poorly coded, security vulnerabilities may be present but hard to detect or manage, and applications and the IT infrastructure may not be designed for DevSecOps.
Security layers designed to shield them can be misconfigured or not exist at all. Perhaps a developer or IT operations misunderstands and blindly trusts the default controls on a cloud platform and leaves valuable data exposed, and thats before factoring in the danger from shadow IT.
Its not that developers or employees are always being willfully careless - mistakes are inevitable in a complex IT environment. But human errors have become a big enough issue that Gartner has estimated that between now and 2025 99 percent of cloud security failures will be the customers [rather than the service providers] fault.
That might sound like an exaggeration today but theres no doubt the rise of cloud and hybrid cloud have expanded the number of points of failures. Meanwhile, in the background is the troubled issue of maintaining compliance, and the need to dodge either delays to projects while software is fixed or fines for breaches after the fact.
Security controls are safeguards or countermeasures that organizations utilize to avoid, detect, counteract, or minimize security threats. Unfortunately, cloud compliance has always been a complex process and keeps becoming more so. The number of security controls that organizations must take account of is growing and their demands are becoming more onerous across multiple geographies.
In addition, many compliance frameworks were created 20-plus years ago and have older compliance requirements that do not apply to new cloud technologies (containers, Kubernetes, public cloud, etc.). Many of these older compliance frameworks assume that you are doing the security work after the server is deployed, and therefore focused on things like patching, vulnerability scanning, etc.
However, in a cloud environment, you have an immutable infrastructure so once you deploy, you dont make changes. If changes are needed, you re-deploy vs directly change the systems. Security work that needs to be done is done before deployment (at the application lifecycle pipeline).
JavaScript Disabled Please Enable JavaScript to use this feature.
Compliance has become so demanding in cloud deployments that many organizations have moved from manual security checks to procedures based on continuous automated monitoring and compliance, notes Lucy Huh Kerner, Red Hats Director of Security Global Strategy and Evangelism.
This makes sense. Too many things change, not only between audits but from day to day and hour to hour. Misconfigurations and human errors can strike at any moment. Continuous security and compliance are how these issues can be prevented for better security and not merely for check-the-box compliance. Compliance is expensive and difficult but so too is non-compliance or real-world breaches.
A lot of security checks in compliance frameworks were written 20-plus years ago and assume you are securing the system after the fact, once it has already been deployed, says Kerner. But a lot of compliance controls from this long-ago era dont apply to cloud technologies or take DevSecOps practices into account.
You cant deploy some of the recommended controls in a cloud or containerized immutable infrastructure, says Kerner. For example, a common recommended security control is to install third party security agents, such as anti-virus. However, in a containerized environment that is immutable, these types of policies dont make sense.
Therefore, security teams need to educate the compliance teams and auditors that this defend the castle perimeter based security model is no longer sufficient and may not apply in an immutable cloud environment. Organizations also need to automate their continuous security and compliance to handle the scale that cloud technologies bring to detect and fix issues in an automated and repeatable way. Done properly, continuous security and compliance should be a constant iterative process of detecting and fixing issues rather than manually detecting and fixing issues in a reactive way.
The whole objective of continuous security and compliance is to minimize manual processes because these slow everything down. The question is how to make this work using automation, continuous integration/continuous deployment (CI/CD), and DevSecOps practices. This has given rise to the compliance-as-code concept which turns the prevention, detection, and remediation of non-compliance into a programmatic, automated process for consistency and repeatability to do security and compliance at scale.
At Red Hat, the ComplianceAsCode upstream project is used to codify and create security policy content for various platforms as well as products. Using this content, provided as both Security Content Automation Protocol(SCAP) and Ansible content, you can do automated security scanning and remediations for both compliance and vulnerabilities.
OpenSCAP, which is included in a Red Hat Enterprise Linux subscription, can perform compliance and vulnerability scanning on Red Hat Enterprise Linux systems and help teams identify and remediate problems as they crop up. OpenSCAP is a SCAP compliant scanner. SCAP scanners are driven by several different industry policies, profiles, and rules.
The SCAP Security Guide, which is based on the ComplianceAsCode project, includes Red Hats interpretation of the policies, rules, and related Ansible playbooks for remediation to facilitate automation of configuration and auditing.
Because this is integrated into Red Hat products, OpenSCAP allows for vulnerability and compliance from the get-go, right from when the system is first installed. In addition, scanning for a compliance standard is not just a one-off task. You need to scan your systems regularly to ensure that you are maintaining compliance with the standard and any deviation from the policy will need to be remediated.
With OpenSCAP and Red Hat Ansible Automation Platform, you can automate security and compliance scans and remediations at scale in hybrid environments. This means that you can use OpenSCAP using several products in Red Hats portfolio, including Red Hat Ansible Automation Platform, Red Hat Smart Management with Red Hat Satellite, and Red Hat Insights to scan across your deployment portfolio.
Just as youve made an automated pipeline to create your applications, you need to embed compliance automation into your lifecycle, says Kerner. You dont want to be carrying out checks and remediations manually since this will lead to human errors.
You are using automation to save time and effort while removing human errors from the equation.
And you want to automate not only the compliance and security checks, but you want to automate the remediations of these issues as well, stresses Kerner. The big thing the auditors want is for organizations to prove that their systems and applications have passed those security and compliance checks. Logically, this must be done on a continuous basis rather than at the point of deployment at which point checking and fixing things becomes a major undertaking.
The customer can use the OpenSCAP tool to scan all their Red Hat Enterprise Linux systems for vulnerabilities and compliance, while also getting scan reports for audits and Ansible playbooks for remediations.
Since acquiring StackRox in early 2021, Red Hat now also has the ability to carry out Kubernetes cluster-wide compliance. Red Hat Advanced Cluster Security, powered by StackRox technology, will assess compliance across hundreds of controls for Center for Internet Security (CIS) benchmarks, payment card industry (PCI), Health Insurance Portability and Accountability Act (HIPAA), and NIST SP 800-190.
It will deliver at-a-glance dashboards of overall compliance across each standards controls with evidence export to meet auditors needs. In addition, it will provide a view of compliance details to pinpoint clusters, nodes, or namespaces that dont comply with specific standards and controls across your Kubernetes clusters.
The world Kerner outlines is one in which robot sysadmins and automation do almost everything and humans are only engaged to oversee the admin function or to deal with unusual exceptions. Compliance and security are simply turned on all the time, running in the background.
Sponsored by Red Hat.
View post:
Continuous security and compliance for hybrid cloud, the Red Hat way - The Register
Neenah schools to close for second consecutive day following cyber security issue – WGBA-TV
NEENAH (NBC 26) For the second day in a row, schools within the Neenah Joint School District will remain closed Wednesday due to a cyber security situation affecting the district.
Neenah schools closed Tuesday as the investigation into the IT security incident continues. Mary Pfeiffer, Neenah Joint School District superintendent, said a potential unauthorized access to the school data system caused an outage to the district's internet, phone systems and several software applications.
At this time, Pfeiffer said they don't believe confidential or personal information has been compromised.Teachers spent Tuesday creating non-digital lesson plans, a challenge when a lot of that information is on the district's server.
"In March of 2020, we shifted our staff to all virtual - at least for a short period of time - and now were telling them, no more technology," Pfeiffer said. "It's been an incredible year. Another incredible year. And now to have to pivot one more time for something that we didn't have control of, that can be pretty frustrating."
Michael Patton, director of the Cybersecurity Center of Excellence at the University of Wisconsin-Oshkosh, doesn't have direct knowledge of this investigation, but said a concern in this type of situation would be that data is taken. He said access to an organization's server can happen with just one click on a faulty link or video.
Whatever you open has as much access to your work computer as you do. They get to do things essentially as you," Patton said. "Your organization may have permissions in their network that allow for you to share things across computers. So the bad actors would leverage that sharing capability, and move throughout your network and infect lots of other things."
That's why Patton said it's best to separate work and personal.
"Maybe we want to check our Facebook or do some online shopping. Just recognize that if you're doing that from your work machine, that could allow whatever mistakes you make into your work space," Patton said.
He added people should always be vigilant and skeptical about things they open online.
The Neenah Joint School District is working to restore phone and internet access for students and staff. The district hopes to resume classes on Thursday.
More here:
Neenah schools to close for second consecutive day following cyber security issue - WGBA-TV
Klobuchar needs to put her antitrust legislation to the sunshine test | TheHill – The Hill
Winter is coming for Americas tech industry. Sen. Amy KlobucharAmy KlobucharKlobuchar needs to put her antitrust legislation to the sunshine test Hillicon Valley: Amazon's Alabama union fight take two Senate Judiciary Committee to debate key antitrust bill MORE (D-Minn.) is marshaling forces to push antitrust legislation that would put Washington bureaucrats in charge of innovation and business decisions that have made Apple, Amazon, Google, and Microsoft so popular here and around the world.And as with the winter weather here in the capital, the best antidote is sunshine in the form of an open hearing to air very real concerns about how Klobuchars bills would hurt consumers and undermine Americas competitive standing in the world.
That kind of sunshine was absent last June when similar antitrust bills were marked-up in a closed House Judiciary Committee meeting that went all night long, without any input or testimony.But thats the point of going straight to a closed markup it lets the sponsors avoid a public hearing that puts sunshine on the proposed legislation. Still, that messy markup session tainted those antitrust bills to the point where Speaker Nancy PelosiNancy PelosiKlobuchar needs to put her antitrust legislation to the sunshine test President Biden is blaming everyone else for surging inflation Fetterman calls for ban on congressional stock trading MORE (D-Calif.) has held them back from the House calendar so far.
But those bills could break loose if the Senate rams related legislation through, again without a hearing.
What would we learn at an open hearing on Klobuchars antitrust bills, with testimony from economists and internet security and privacy experts?First, herAmerican Innovation and Choice Online Actwould prohibit innovation that has given American consumers so many choices online.In her own words, Klobuchars bill wouldPrevent self-preferencingand discriminatory conduct.That bars Amazon from showing its generic products as alternatives to products from big name brands. Amazons 150 million Prime customers would no longer see a Prime badge signaling next-day shipping, since that would discriminate against sellers who dont have their products shipped from Amazon distribution centers.
A hearing on Klobuchars bill would also reveal that Google search results may no longer default to showing a Google map and reviews if search results include a nearby destination.Klobuchar says that would be illegal for biasing search results in favor of the dominant firm.
Perhaps most worrying for bill sponsors is that internet security experts would describe consequences when Klobuchars law stops a dominant platform from preventing another businesss product or service from interoperating. Apple could be penalized for blocking an app from its App Store, even when Apple believes there are risks of security or privacy breaches, whether from the app provider or from hackers who exploit access granted to the app.
At a hearing, wed learn that the bills mandated interoperability is precisely how a university researcher allowed Cambridge Analytica to steal the private data of millions of Facebook users.
A hearing would give Americans the chance to hear Klobuchar explain how her bill could constrain politically driven prosecution by FTC and DoJ officials demanding that a company do more to stop global warming or to advance economic and social justice for their workers.
If were lucky, the Senate hearing could also address Klobuchars second antitrust bill, thePlatform Competition and Opportunity Act. That bill would bar the largest American companies from acquiring related businesses, putting the brakes on growth and innovation at Amazon, Apple and Google. The highlight of the hearing would be Klobuchar explaining why her bill would lock-in those few companies as the enforcement targets, while carving-out Walmart and her home-state retailer Target even if they later grew beyond the size threshold in the law.
Finally, an open Senate hearing puts sunshine on what will alarm Americans whose retirement savings are invested in Apple, Amazon, Google, Meta, and Microsoft. Those companies lead the world in R&D investment and innovation, yet would be prosecuted by a subjective and destructive antitrust regime untethered to traditional standards of consumer welfare. That would reduce Americas technological standing in the world, at a time when other nations are helping their own champions compete with us.
Unfortunately, Senate leadership may bow to Klobuchars pressure to bypass hearings and move straight to a closed markup in a committee she chairs. All major legislation, particularly when it impacts America's world-leading tech industry, needs to pass the Sunshine Test a fully open process of probing questions and debate.
If theres no Senate hearing, the concerning consequences discussed above would only be revealed when enforcement of the law begins. And thats when winter really comes for American consumers.
Steve DelBianco is President & CEO of NetChoice
Continued here:
Klobuchar needs to put her antitrust legislation to the sunshine test | TheHill - The Hill
Apples Private Relay Roils Telecoms Around the World – WIRED
When Apple pushed iOS 15 out to more than a billion devices in September, the software update included the companys first VPN-like feature, iCloud Private Relay. The subscription-only privacy tool makes it harder for anyone to snoop on what you are doing online, by routing traffic from your device through multiple servers. But the tool has faced pushback from mobile operators in Europeand more recently, by T-Mobile in the US.
As Private Relay has rolled out over the past few months, scores of people have started to complain that their mobile operators appear to be restricting access to it. For many, its impossible to turn the option on if your plan includes content filtering, such as parental controls. Meanwhile in Europe, mobile operators Vodafone, Telefonica, Orange, and T-Mobile have griped about how Private Relay works. In August 2021, according to a report by the Telegraph, the companies complained the feature would cut off their access to metadata and network information and suggested to regulators that it should be banned.
Private Relay will impair others to innovate and compete in downstream digital markets and may negatively impact operators ability to efficiently manage telecommunication networks, bosses from the companies wrote in a letter to European lawmakers. However, Apple says that Private Relay doesnt stop companies from providing customers with fast internet connections, and security experts say theres been little evidence showing Private Relay will cause problems for network operators.
Apples Private Relay isnt a VPNwhich carriers freely allowbut it has some similarities. The option, which is still in beta and is only available to people who pay for iCloud+, aims to stop the network providers and the websites you visit from seeing your IP address and DNS records. That makes it harder for companies to build profiles about you that include your interests and location, in theory helping to reduce the ways youre targeted online.
To do this, Private Relay routes your web traffic through two relays, known as nodes, when it leaves your iPhone, iPad, or Mac. Your traffic passes from Safari into the first relay, known as the ingress proxy, which is owned by Apple. There are multiple different ingress proxies around the world, and theyre based in multiple locations, Apple says in a white paper. This first relay is able to see your IP address and the Wi-Fi or mobile network you are connected to. However, Apple isnt able to see the name of the website that youre trying to visit.
The second relay your web traffic passes through, known as the egress proxy, is owned by a third-party partner rather than Apple itself. While it can see the name of the website youre visiting, It doesnt know the IP address youre browsing from. It instead assigns you another IP address thats near where you live or within the same country, depending on your Private Relay settings.
The result is, neither relay knows both your IP address and the details of what youre looking at onlinewhereas a typical a VPN provider will process all your data. Also unlike a VPN, Apples system doesnt let you change your devices geographic location to avoid regional blocks on content from Netflix and others.
See original here:
Apples Private Relay Roils Telecoms Around the World - WIRED
After turbulent cyber year, agencies enter 2022 with fresh security crisis on hand – Federal News Network
A year after the SolarWinds compromise, federal agencies are once again entering the new year in the middle of a cybersecurity emergency, with IT offices racing to identify and patch instances of widely used software code on their networks.
But after 12 months of blocking and tackling, experts say the federal enterprise is better positioned to handle cybersecurity incidents and primed for more progress in 2022.
Agencies had until Dec. 23 to identify and patch instances of Log4j on their Internet-facing systems, according to an emergency directive issued by the Cybersecurity and Infrastructure Security Agency last week. The vulnerability in the widely used Apache open source logging software emerged earlier this month.
The directive also tells agencies to report all affected software applications to CISA by Dec. 28.
CISA is very pleased with the urgency with which agencies are addressing Log4j vulnerabilities, a CISA official told Federal News Network on-background. The official said CISA has hosted multiple calls attended by thousands of staff across civilian agencies, including chief information officers and chief information security officers, as well as IT operations and security operations center personnel.
Federal IT and Cybersecurity leaderships commitment to urgently addressing these vulnerabilities as a cohesive enterprise has been clear since the onset, the official said. We have no confirmed compromises across federal civilian networks relating to the Log4j vulnerability.
Efforts to address Log4j will bridge 2022 to a year that saw the creation of the National Cyber Directors office, the establishment of CISAs Joint Cyber Defense Collaborative, and efforts to implement President Joe Bidens cybersecurity executive order, among other federal developments.
Mark Montgomery, senior advisor to the recently shuttered Cyberspace Solarium Commission, said 2020 was a watershed year in cybersecurity, when lawmakers included 26 of the commissions recommendations in the annual defense bill, including the creation of the NCD.
2021 was much, much more of blocking and tackling, Montgomery said. More changes to CISA authorities, the establishment of a Response and Recovery Fund, building better public-private partnership programs in the Department of Defense and Department of Homeland Security. Those are smaller issues, but important issues that that help in in getting the cybersecurity agenda moving forward.
Chris Cummiskey, a consultant and former Department of Homeland Security under secretary for management, said it was a rebuilding year for federal cybersecurity after the Trump administration did away with the former White House national cybersecurity coordinator position.
Theres much better coordination now between the White House key cyber functions, the National Security Agency, the FBI, and CISA, Cummiskey said. When you have that coming together on all cylinders, its a much more effective response.
Bidens May cybersecurity executive order, spurred on by the SolarWinds breach, also set tight deadlines for agencies to begin improving their cyber practices, including through the shift to zero trust architectures. Chris DeRusha, federal chief information security officer, recently said that agencies are now entering the execution phase of the EO.
Cummiskey said past cyber executive actions have lacked sufficient accountability and performance tracking measures. But he believes officials like National Cyber Director Chris Inglis, CISA Director Jen Easterly and DeRusha will hold agencies accountable to the latest EO.
The difference this time is that youve got a lot of seasoned veterans in leadership roles that are helping other agencies kind of understand that if were going to move to zero trust architecture, or if were going to strengthen the enterprise, cybersecurity functions at agencies, its got to be more than just a reporting requirement through FITARA, Cummiskey said, referring to the Federal Information Technology Acquisition Reform Act that requires annual reports from agencies on IT inventories and plans.
The executive order put CISA in charge of multiple action items to improve federal cybersecurity, including the designation of critical software and the establishment of a Cyber Safety Review board.
CISA also saw continued support from Congress this year, especially funding. The American Rescue Plan added $650 million in emergency funds on top of CISAs $2 billion annual budget. Lawmakers are proposing increasing CISAs budget to $2.4 billion in fiscal year 2022.
However, in spite of a scourge of ransomware attacks, including incidents that shut down Colonial Pipeline and a major meatpacking plant, Congress could not come to an agreement on including cyber incident reporting requirements in legislation by the end of the year.
Tatyana Bolton, former cyber policy lead at CISA, said the continued policy of voluntary reporting for critical incidents leaves a major hole in the U.S. approach to cybersecurity. Bolton was also on the staff of the Solarium Commission and directs cyber policy for the R Street Institute.
The fact that we couldnt have that very simple provision into law is very unfortunate, and I think were going to see over the course of the next year how not having that tool in the toolbox for the federal government is going to be a weakness of our cyber strategy, Bolton said.
But she and Montgomery expect lawmakers will make another strong to pass reporting requirements in 2022.
Bolton also predicts Inglis and the National Cyber Directors office will make progress next year on efforts to introduce more resilience into the U.S. cybersecurity approach, taking a wider view of incidents like ransomware attacks and Log4j.
His efforts on resilience is focusing on the broader picture, she said. Its the forest for the trees.
Meanwhile, CISAs emergency directive shows the agency will continue to monitor the Log4j situation into the new year. CISA is planning to provide a report by Feb. 15 to both DHS Secretary Alejandro Mayorkas and the White House on identifying cross-agency status and outstanding issues, according to the directive.
Here is the original post:
After turbulent cyber year, agencies enter 2022 with fresh security crisis on hand - Federal News Network
Chinese Police Hunt Overseas Critics With Advanced Tech – The New York Times
For Chinese security forces, the effort is a daring expansion of a remit that previously focused on Chinese platforms and the best-known overseas dissidents. Now, violations as simple as a post of a critical article on Twitter or in the case of 23-year-old Ms. Chen, quoting, I stand with Hong Kong can bring swift repercussions.
Actions against people for speaking out on Twitter and Facebook have increased in China since 2019, according to an online database aggregating them. The database, compiled by an anonymous activist, records cases based on publicly available verdicts, police notices and news reports, although information is limited in China.
The net has definitely been cast wider overseas during the past year or so, said Yaxue Cao, editor of ChinaChange.org, a website that covers civil society and human rights. The goal is to encourage already widespread self-censorship among Chinese people on global social media, she said, likening the purging of critics to an overactive lawn mower.
They cut down the things that look spindly and tall the most outspoken, she said. Then they look around, the taller pieces of grass no longer cover the lower ones. They say, Oh these are problematic too, lets mow them down again.
Chinese security authorities are bringing new technical expertise and funding to the process, according to publicly available procurement documents, police manuals and the government contractor, who is working on overseas internet investigations.
In 2020, when the police in the western province of Gansu sought companies to help monitor international social media, they laid out a grading system. One criterion included a companys ability to analyze Twitter accounts, including tweets and lists of followers. The police in Shanghai offered $1,500 to a technology firm for each investigation into an overseas account, according to a May procurement document.
Read the rest here:
Chinese Police Hunt Overseas Critics With Advanced Tech - The New York Times