Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Obama Launches Cyberthreat Intel-Sharing Center
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
2/12/2015 | 10:09:42 AM
Re: My takeaway point from the CTIIC announcement
@aws0513: I'm with you there. Security practices should evolve relative to the changing threat landscape. The username/password authentication method is almost as old as computing itself. MFA should have replaced that model a long time ago. It does incur a sometimes hefty investment, but as we look at security investments as a whole, this particular one is well worth the cost. Certainly, it would have rendered a lot of the recent breach resulting attacks irrelevant to some extent.
User Rank: Ninja
2/12/2015 | 10:02:37 AM
Is there a hole in this strategy?
There is this excerpt from the Federal Times regarding this topic: The new center will not be an intelligence gathering institution, said Lisa Monaco, assistant to the president for homeland security and counterterrorism, who introduced the CTIIC during a talk at the Wilson Center on Feb. 10. Rather, the CTIIC "will analyze and integrate intelligence already collected," Monaco explained. "That will enable the existing cyber centers to be more effective."

I understand the importance of analyzing existing data, and I'm sure there are voluminous amounts of it, but I am a little confused. If they do not intend to gather intelligence, I sure hope that any new data will also be funneled into the CTIIC by other organizations for analysis, and that "not be an intelligence gathering institution" simply means that the particular function will not be an integral part of the CTIIC. With the rapidly evolving threat landscape and the changing tactics employed by attackers, existing data, although still relevant, tend to become stale rather quickly.
User Rank: Ninja
2/11/2015 | 3:31:26 PM
My takeaway point from the CTIIC announcement
"Making cyberspace intrinsically more secure, including eliminating passwords as the default security tool and enhancing consumer protection."

To me, this is a smoke signal of mandated MFA on regulatory data environments in the future. 
I hope such a mandate becomes the reality.  MFA would substantially help to improve security in many environments that I have encountered.

HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-04-04
Common/Grav.php in Grav before 1.6.23 has an Open Redirect.
PUBLISHED: 2020-04-04
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
PUBLISHED: 2020-04-04
bit2spr 1992-06-07 has a stack-based buffer overflow (129-byte write) in conv_bitmap in bit2spr.c via a long line in a bitmap file.
PUBLISHED: 2020-04-04
Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.
PUBLISHED: 2020-04-04
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS responses.