Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
White House Cybersecurity Strategy at a Crossroads
Newest First  |  Oldest First  |  Threaded View
juliabeyers
50%
50%
juliabeyers,
User Rank: Apprentice
9/20/2019 | 5:26:59 AM
Thanks
Thanks for your analytics
ragediver24
87%
13%
ragediver24,
User Rank: Strategist
7/18/2018 | 11:44:23 AM
Re: Analysis
Russian Hacking has been going on since before Obama and even further. Everyone is listening to everyone elses communications. The NSA is gobbling up everything with SIGINT and OSINT and yet there's still no evidence that the Russian's meddled in the election to an extent that swayed the vote count. The DNC used poor security practices and even gave people with questionable foreign ties access and security clearance to congressional and campaign documentation, and then tried to ccover it up when it became poltically expedient to do so. Saying that there's no clear Cybersecurity plan from Trump is disingenous. Obama administration published the NICE framework as well as other Executive Orders to enhance Cybersecurity and that did little to stop Russian trollls, Bots, etc. Trump published this https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ 

Which more or less says the same thing Obama said in generic terms. The difference is in backing up actual threats with actions. Unless you sit in a SOC, NOC, NSA cell that has direct information on what threats are actually occurring on a daily basis, saying that Trump somehow gave away the keys to the kingdom is flat out false. All that aside, as a security professional, I come to your site to avoid politics, but more and more tech journalists can't help but throw in their political spin. 
zzx375
50%
50%
zzx375,
User Rank: Strategist
7/18/2018 | 10:03:12 AM
Missing something
I'm missing something in all of this brouhaha and I could be accused of having simple/slow brain:

Where is the specific list of offenses that constitutes this meddling?  If bogus information dissemination is all there is to it, then I suggest the concern might rightly have to do with a society (ours) that has the lost the ability of critical analysis.  If something doesn't read "right", if the first thought "This seems hokey" it just might be.  Hacking I get although I don't get skipping the basics to prevent (patch your servers and desktops, teach people not to click on links in emails, keep following the established approval chain despite a "hair-on-fire" phone call or email from the Big Cheese - always get confirmation).  Fear of Russian meddling might be doing more harm than good.  
jenshadus
50%
50%
jenshadus,
User Rank: Strategist
7/18/2018 | 10:01:26 AM
Re: Analysis
I was thinking the same thing.  Where is the proof?  Has anyone ever heard of the enemy within?  And who in the heck was the DEM HQ security hack?  I think they all did this to themselves in case they lost.  Who know, and the lack of direction that Mueller has been bulldogging is not reassuring.  Thanks for putting it down so well.
jenshadus
100%
0%
jenshadus,
User Rank: Strategist
7/18/2018 | 9:59:23 AM
Re: White House Cybersecurity Strategy
Thanks for mentioning this technology.  I'll have to look into it.  Sounds interesting
tcritchley07
100%
0%
tcritchley07,
User Rank: Moderator
7/18/2018 | 9:20:08 AM
White House Cybersecurity Strategy
The internet's security is irretrievably insecure. I suggest the US looks at RINA (Recursive InterNetworking Architecture). I have no personal interest in this; I just think it looks as though it should be investigated as a alternative to the current cybersecurity 'patch and pray' philosophy.
PanamaVet
80%
20%
PanamaVet,
User Rank: Strategist
7/18/2018 | 9:12:24 AM
Analysis
The report which is the basis for the current Russian indictments identifies perpetrators not found in the current list of those indicted.

Mueller was held accountable during the previous round of Russian indictments when one defendant was represented in court and demanded that Mueller produce the evidence of a crime.  He first tried to delay and then produced data that did not contain evidence.

It appears the current list is intended to exclude any Russian who may actually show up in court demanding accountability and so it is difficult to take seriously.

In other words, the basis for this analysis of Cybersecurity performance is based on a political ploy that has already proven worthless when it comes to drawing conclusions.

The fact is that a number of state sponsored attempts including our own are working every minute of every day to gather whatever information can be produced.

In the future let's stick to that and not waste time playing politics.

 </PanamaVet>

 


Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3656
PUBLISHED: 2019-12-10
JBoss KeyCloak: XSS in login-status-iframe.html
CVE-2013-0293
PUBLISHED: 2019-12-10
oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation
CVE-2013-1793
PUBLISHED: 2019-12-10
openstack-utils openstack-db has insecure password creation
CVE-2013-2095
PUBLISHED: 2019-12-10
rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection
CVE-2019-19698
PUBLISHED: 2019-12-10
marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.