Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Cyber Security Needs Its Ralph Nader
Threaded  |  Newest First  |  Oldest First
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
11/24/2014 | 3:15:55 PM
Who will be the Cyber Ralph for data security?
My guess is the whisteblower will come out of financial services. It's doubtful that anyone will ever die from a data breach, but the idea of millions of people getting bribed, defrauded or burgled is something that is not seem particularly far-fetched. Thought anyone?
Bprince
Bprince,
User Rank: Ninja
11/24/2014 | 8:32:03 PM
Re: Who will be the Cyber Ralph for data security?
That is a good guess. I think retail is more on the minds of consumers/voters though. I think slowly but surely things are changing as awareness is growing. We've already seen attempts to improve data breach laws all over the country.
Dr.T
Dr.T,
User Rank: Ninja
11/25/2014 | 9:53:44 AM
Re: Who will be the Cyber Ralph for data security?
I hope there is not death because of data breaches. If it goes beyond what it is now that is not unimaginable. If they are able to attack electricity grids, or nuclear reactors that may result into more unexpected damages.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
11/25/2014 | 1:47:42 PM
Re: Who will be the Cyber Ralph for data security?
You would think that the general public would be outraged (and frightened) about how insecure our public infrastructure actually is. But I think that is an area where people show the least concern of all...
ODA155
ODA155,
User Rank: Ninja
11/25/2014 | 4:13:41 PM
Re: Who will be the Cyber Ralph for data security?
@Marilyn Cohodas,... "a cyber Ralph Nader"... yes, I like that , but you know what would really be cool... a Cyber Wyatt Earp! Someone to clean it up! An agency charged AND empowered to wear two hats... one to get after the bad guys (by any means available) who make a living breaking into anything they consider to be worthy of targeting. And also to take whatever action necessary to "influence" business in this country to start taking this matter as serious as they take the bottom line at the end of the year. Give this person what she\he needs to make an impression on large corporate CEO's and without a doubt small business will fall in line. Make this person\position reportable to Congress and revisable by law so that it doesn't get too powerful or go stagnant. I would be nice if if this could be done at the private level, but as little faith that I have in our government with such things I have even less when it comes to letting business monitor itself, especially with something this serious, just look at PCI-DSS, when VISA & MasterCard themselves are fined, then there will be something there to build on, until then it's just a good start of "what can be".

I know htis is all "pie in the sky"... but a security guy can wish (no time to dream)... can't I?

 

Happy Holiday's Everyone!
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
11/25/2014 | 4:32:27 PM
Re: Who will be the Cyber Ralph for data security?
It's a great thought @ODA155. So far we have suggestion for Cyber Ralph, CyberWyattEarp and Cyber Eisenhower. Al good role models. (And Happy Thanksgving to you too!)
TsionG898
TsionG898,
User Rank: Apprentice
11/25/2014 | 5:50:11 PM
Re: Who will be the Cyber Ralph for data security?
Yeah, but wouldn't you agree Nader had the best sounding name of them all? :)
TsionG898
TsionG898,
User Rank: Apprentice
11/25/2014 | 5:54:31 PM
Re: Who will be the Cyber Ralph for data security?
I agree! I think the question has always been 'how big should the goverment role be?'. I personally think the goverment should get more involved. And put down regulations that really push companies to do more than what they'd like to. Just like the goverment did other things to save lives...I remember when I was forced to put on a seat belt... I didn't like that first also. 
tjgkg
tjgkg,
User Rank: Apprentice
11/24/2014 | 4:32:50 PM
This is not just a consumer problem
Data security goes beyond a consumer arena. Nation-states are hacking into banks, utilities, companies, military and this threatens our existence. We need more than Ralph Nader. We need someone like Eisenhower to run cyber security. It needs a military grade solution because in a war, this country could be brought to its knees by a small power that could never match us on the battlefield. The cyber-field is a different story.
Dr.T
Dr.T,
User Rank: Ninja
11/25/2014 | 9:56:05 AM
Re: This is not just a consumer problem
I agree, it requires different skill sets tough to protect us from cyber-security breaches. We always think security as a defensive approaches, we ned to get out of that mindset and become more proactive and maybe offensive at the same time.
Keith Graham
Keith Graham,
User Rank: Author
12/2/2014 | 11:48:28 AM
Re: This is not just a consumer problem
Further to tjgkg's point, it really does go beyond the consumer arena. One concern we should have IS the loss of life as a result of a breach, and I don't just mean in terms of damage to public infrastructure (like nuclear power facilities, or natural gas processing plants), which I think is much less likely, but at time of war. As a basic example, some nation state actor with the capability of compromising military and government systems could prevent the use of kinetic weapons in response to a kinetic attack, and entirely undermine our defenses. We shouldnt kid ourselves that these capabilities do not exist, or are not being developed. 
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
12/2/2014 | 1:20:42 PM
Re: This is not just a consumer problem > Vs time of war r
@Keith Graham, I would assume that our military has a strategy in place against the kinetic attacks that you mention. At least I hope so. Am I being naive? 

Keith Graham
Keith Graham,
User Rank: Author
12/2/2014 | 1:42:35 PM
Re: This is not just a consumer problem > Vs time of war r
@Marilyn Cohodas, I would hope so too! I guess we're beyond the realms there of what is known in the public domain.
Dr.T
Dr.T,
User Rank: Ninja
11/25/2014 | 9:49:59 AM
Auto vs. computer
I know we had to go through regulations around auto industry, I am not sure it made us more secure or it made whole product more expensive and not high tech. I do not really want to compare auto industry to computer/information industry. I am basically in favor of secure and advanced automobiles, not only secure. You still have to user your arms, legs and head to drive a car. There must be an easier way to do it.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-42247
PUBLISHED: 2022-10-03
pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name.
CVE-2022-41443
PUBLISHED: 2022-10-03
phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.
CVE-2022-33882
PUBLISHED: 2022-10-03
Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop app (ADA). An attacker could leverage this vulnerability to escalate privileges and execute arbitrary code.
CVE-2022-42306
PUBLISHED: 2022-10-03
An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange during registration and cause a NULL pointer exception, effectively crashing the pbx_exchange process.
CVE-2022-42307
PUBLISHED: 2022-10-03
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.