Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Beware Cognitive Bias
Newest First  |  Oldest First  |  Threaded View
cumulonimbus
50%
50%
cumulonimbus,
User Rank: Apprentice
5/21/2014 | 1:43:13 PM
Re: know your enemy
You make some good points about timing and involvement. I believe much more needs to be done to protect IP and other valuable data, particularly with offshoring and cloud. All too often (and all too late) companies find themselves vulnerable and are left with an extremely vexing problem. These problems should not occur, or at least be very rare, and are somewhat symptomatic of the C21 M.O., both in the private and public sectors. In some ways, it behooves us to think like a hacker. Ironically, in eastern philosophy our adversary is also our master.
levigundert
50%
50%
levigundert,
User Rank: Guru
5/21/2014 | 11:18:13 AM
Re: know your enemy
Certainly, though the accompanying Interpol Red Notice means that these suspects will be extradited if they ever travel.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/21/2014 | 9:23:54 AM
Re: know your enemy
It appears the DOJ indictiment has opened the floodgates for more naming and shaming. The bad news is that many of the defendants will never be prosecuted, but the good news is that putting faces to the attacks raises awareness among businesses and the general public. 
levigundert
50%
50%
levigundert,
User Rank: Guru
5/21/2014 | 12:04:42 AM
Re: know your enemy
Thanks @kjhiggins. Beyond what I stated in the article, given the latest DOJ indictments of the five Chinese PLA employees, I hope there are new incentives to pursue attribution in conjunction with law enforcement.

I agree though that businesses are still struggling with the appropriate response after breaches, specifically around the decision (and timing) to involve law enforcement.
levigundert
50%
50%
levigundert,
User Rank: Guru
5/20/2014 | 11:47:33 PM
Re: know your enemy
Thank you for taking the time to read and comment, I appreciate the feedback!
levigundert
50%
50%
levigundert,
User Rank: Guru
5/20/2014 | 11:45:20 PM
Re: Keep it local
Thanks for taking the time to comment. I agree that objectivity does require an incredible amount of self discipline.
cumulonimbus
50%
50%
cumulonimbus,
User Rank: Apprentice
5/19/2014 | 8:26:09 AM
Keep it local
Cognitive bias, indeed any bias. is the natural order. It is how we think and how we came to be; a natural product of evolution. Objective observation requires an overwhelming act of self discipline. In the field of IT we are constantly dealing with the threat of cyber crime, thus trust in our IT personnel is paramount.

All that stands between us (our data) and them (the dark side of human behavior) is a false sense of security; an electronic barrier that ultimately cannot withstand penetration by a persistent and highly informed attack. The attraction of this kind of act is the anonymity and obscurity provided by the worldwide interconnection that is the internet. Notwithstanding the fact that over the shoulder attacks are probably the most frequent, our best defense lies in multi-factor authentication, personal representation (local and accountable human resources), multi-layer boundaries, and constant vigilance. Other than that, what is offline is, for the most part, no longer a target.
Bprince
50%
50%
Bprince,
User Rank: Ninja
5/18/2014 | 12:39:38 AM
Re: know your enemy
I would say that knowing the who is important, especially if we are talking about a national security issue/attack on the defense industry. I agree with the overall point of the article 100 percent. If there are going to be assertions made about who is responsible for an attack, the proof needs to be carefully vetted.

BP
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/16/2014 | 11:12:31 AM
know your enemy
Interesting piece, @LeviGundert. There are mixed perspectives among security vendors on how important it is to know the *who* (threat group/region) behind the attack versus the attackers' M.O. and what they are after. I wonder if that clouds the issue for enterprises trying to map out their security strategies and tools.


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-24376
PUBLISHED: 2021-06-21
The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory w...
CVE-2021-24377
PUBLISHED: 2021-06-21
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on t...
CVE-2021-24378
PUBLISHED: 2021-06-21
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute w...
CVE-2021-24379
PUBLISHED: 2021-06-21
The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some...
CVE-2021-24383
PUBLISHED: 2021-06-21
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue