Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
The Promise and Reality of Cloud SecurityCloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises.
The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
User Rank: Ninja
3/23/2015 | 2:46:21 PM
the list goes on, as you know, and then on and on. and it doesn't take a genius to figure out: Unless we turn over a new leaf and mend the error in our ways hacking will continue to get worse. Will you be next ?
the solution is available,-- and has been. First it is essential to use a secure operating system. A secure Operating system is one which will not allow itself to be corrupted by the activity of an application program.
second: we need to take up the practice of authenticating transmittals. transmittals include not just eMails but also software downloads and financal instruments of every sort, -- Forms 1040, online puchasing, and the like. The broadcast system used with x.509 certificates is a start but the bradcasting is too susceptible of intrusion as hackers have demonstrated in their attacks on Diginotar, RSA, and Comodo. x.509 certificates should be sent with marginal trust only. each of us needs to use PGP or the Gnu Privacy Guard (GPG) to countersign those x.509 certificates that we actually need to trust. this will dramatically reduce the attack surface against x.509
to do this we all need a copy of PGP or GPG --and local services such as Credit Unions need to provide the needed authentication service for our Public Keys.
Today we are forced to conduct busines in a compromised environment: all our usual credentials, such as SocSec Number, name, address, Date of Birth, dog's name etc -- have all been compromised and are easily available to crooks operating from the DarkNet market ( See Brian Krebs article on SuperGet ).
to conduct business in this compromised environment we need s a signature such that can be offered and verified (authenticated) in public -- but which we can retrain control of the use of privately. this is precisely what PGP or GPG does; it's what that software was created to do. we should use the new Eliptic Curve option with PGP and GPG.
these are initial steps; refinement will be needed and in particular, change in product liability law -- as has been noted by Bruce Schneier.
where is the "Tipping Point" ?
when it is no longer economical for merchants to just shrug off hacking as "part of he cost of doing business" then action will have to be taken. we all need to note carefully: passwords are NOT the problem: Hacking is facilitated by un-authorized programming.
Un-Authorized Programming, often called "Malware", or "Computer Virus" are changes to the programming in a victim's computer. Examples would include the BLACKPOS or BACKOFF malware that was inserted into the Point of Sale terminals in merchants who have bveen recently victims of credit card theft. malware is generaly inserted into a victim by making advantage of a weakness in an operating system or by "phishing". "Phishing" involves sending fake messages to persons having update authority. Proper authentication of messages such as eMail will make "phishing" much more difficult. Today,-- "phishing" is trivial.
these un-authorized programs do not need you password: they operate AFTER the victim computer is running and use the victim's credentials to do their Dirty Deeds.