Remediation is the Foundation of your Security Strategy! In many ways, this year’s RSA conference was overwhelming. In other ways, it was a disappointment in how the market is providing solutions to mitigate our security risks. As several colleagues have pointed out, “remediation” is a huge gaps at 2015 RSA, As Adam Stein pointed out, Read More
Category: Operator’s Security Toolkit
How to prevent a “security embarrassment?”
On Oct 7, 2014, a security researcher, Jonathan Hall, posted details of a potential Bash/Shellshock vulnerability on Yahoo’s infrastructure: http://www.futuresouth.us/yahoo_hacked.html https://www.reddit.com/r/technology/comments/2ifbjb/yahoo_got_hacked_this_morning_hooray_for/ As it turned out, it was NOT a Bach/Shellshock issue. As Alex Stamos, Yahoo’s chief information security officer wrote, “it turns out that the servers were in fact not affected by Shellshock.” (see https://news.ycombinator.com/item?id=8418809). Read More
Security Questions to ask Vendors
What security questions are you asking your vendors? The Bloomberg article, “How Russian Hackers Stole the Nasdaq,” is a sobering insight into today’s risk. It should be a wake-up call for all organizations in all parts of the world to understand that even the best security teams are facing an overwhelming threat. The focused expertise used by Read More
Everyone should be deploying BCP 38! Wait, they are ….
Have you deployed BCP 38 in your network? For most networks, the answer is yes. During last week’s FCC CSRIC III meeting, several people called on operators to deploy “BCP 38.” This IETF best common practice (BCP) is packet filter placed on the edge of networks to insure that the IP source cannot pretend to Read More
U.S. Anti-Bot Code of Conduct (ABCs) for Internet Service Providers (ISPs) is now posted
The FCC’s Communications Security, Reliability and Interoperability Council’s (CSRIC) has now posted the U.S. Anti-Bot Code of Conduct (ABCs) for Internet Service Providers (ISPs). This voluntary code of conduct is a milestone for the industry – placing new expectations on the eco-system required to safe guard our telecommunications system. The core of the code is Read More
If I say it over an over again, it must be true …
“Keeping to your message, repeat it many times, and ignore the criticism” are key principles of success in Washington DC policy work. If you say something over and over again, it must be true. It does not matter if the message is true, based on facts, or have any empirical data to support your assertion. Read More
NSP-SEC Top 10 SP Security Techniques – Updated Slides
NSP-SEC Top 10 SP Security Techniques is one of the core foundation tutorials for ALL Telcos, ISPs, Cloud Operators, Mobile Companies, and other large ASNs (including Enterprises). This is the foundation for network security. If you are being stupid if not doing these basics and trusting your “firewall.” Note though this that all the recommendations Read More
The flaws with the 60 Minute Report on “Cyberwar: Sabotaging the System”
We need to expect more out the press, policymakers, and the pontificating “Cyberwarfare Experts” producing stacks of reports about the “Cyber-security threat.” Graham Messick, the CBS producer of this 60 minutes episode on “Cyberwar: Sabotaging the System,” did not do his due diligence as a reporter. A standard tool for building balance in a story Read More
DOS Trends Are Changing – More Effective Attack Classes.
Yes, DOS trends are changing. CERT-FI‘s release of the “Sockstress” details yesterday has a few people confused. Outpost24 discovered some new TCP state abuse technique which can cause a range of issue on a TCP stack (see CERT-FI’s release details). It is a serious issue. But, if it is serious, why is there not a Read More
The “Cyberwar” Dialog can be easily polluted …..
Watching discussions about cyberwar is a humorous diversion in the day. Take this New York Times article, “Halted ’03 Iraq Plan Illustrates U.S. Fear of Cyberwar Risk.” It starts interesting, talking about a battle plan that was considered as a lead into the 2003 attack on Iraq. Good News! War planning is good. Evaluating collateral Read More