Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
White House Cybersecurity Strategy at a Crossroads
Newest First  |  Oldest First  |  Threaded View
juliabeyers
50%
50%
juliabeyers,
User Rank: Apprentice
9/20/2019 | 5:26:59 AM
Thanks
Thanks for your analytics
ragediver24
87%
13%
ragediver24,
User Rank: Strategist
7/18/2018 | 11:44:23 AM
Re: Analysis
Russian Hacking has been going on since before Obama and even further. Everyone is listening to everyone elses communications. The NSA is gobbling up everything with SIGINT and OSINT and yet there's still no evidence that the Russian's meddled in the election to an extent that swayed the vote count. The DNC used poor security practices and even gave people with questionable foreign ties access and security clearance to congressional and campaign documentation, and then tried to ccover it up when it became poltically expedient to do so. Saying that there's no clear Cybersecurity plan from Trump is disingenous. Obama administration published the NICE framework as well as other Executive Orders to enhance Cybersecurity and that did little to stop Russian trollls, Bots, etc. Trump published this https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ 

Which more or less says the same thing Obama said in generic terms. The difference is in backing up actual threats with actions. Unless you sit in a SOC, NOC, NSA cell that has direct information on what threats are actually occurring on a daily basis, saying that Trump somehow gave away the keys to the kingdom is flat out false. All that aside, as a security professional, I come to your site to avoid politics, but more and more tech journalists can't help but throw in their political spin. 
zzx375
50%
50%
zzx375,
User Rank: Strategist
7/18/2018 | 10:03:12 AM
Missing something
I'm missing something in all of this brouhaha and I could be accused of having simple/slow brain:

Where is the specific list of offenses that constitutes this meddling?  If bogus information dissemination is all there is to it, then I suggest the concern might rightly have to do with a society (ours) that has the lost the ability of critical analysis.  If something doesn't read "right", if the first thought "This seems hokey" it just might be.  Hacking I get although I don't get skipping the basics to prevent (patch your servers and desktops, teach people not to click on links in emails, keep following the established approval chain despite a "hair-on-fire" phone call or email from the Big Cheese - always get confirmation).  Fear of Russian meddling might be doing more harm than good.  
jenshadus
50%
50%
jenshadus,
User Rank: Strategist
7/18/2018 | 10:01:26 AM
Re: Analysis
I was thinking the same thing.  Where is the proof?  Has anyone ever heard of the enemy within?  And who in the heck was the DEM HQ security hack?  I think they all did this to themselves in case they lost.  Who know, and the lack of direction that Mueller has been bulldogging is not reassuring.  Thanks for putting it down so well.
jenshadus
100%
0%
jenshadus,
User Rank: Strategist
7/18/2018 | 9:59:23 AM
Re: White House Cybersecurity Strategy
Thanks for mentioning this technology.  I'll have to look into it.  Sounds interesting
tcritchley07
100%
0%
tcritchley07,
User Rank: Moderator
7/18/2018 | 9:20:08 AM
White House Cybersecurity Strategy
The internet's security is irretrievably insecure. I suggest the US looks at RINA (Recursive InterNetworking Architecture). I have no personal interest in this; I just think it looks as though it should be investigated as a alternative to the current cybersecurity 'patch and pray' philosophy.
PanamaVet
80%
20%
PanamaVet,
User Rank: Strategist
7/18/2018 | 9:12:24 AM
Analysis
The report which is the basis for the current Russian indictments identifies perpetrators not found in the current list of those indicted.

Mueller was held accountable during the previous round of Russian indictments when one defendant was represented in court and demanded that Mueller produce the evidence of a crime.  He first tried to delay and then produced data that did not contain evidence.

It appears the current list is intended to exclude any Russian who may actually show up in court demanding accountability and so it is difficult to take seriously.

In other words, the basis for this analysis of Cybersecurity performance is based on a political ploy that has already proven worthless when it comes to drawing conclusions.

The fact is that a number of state sponsored attempts including our own are working every minute of every day to gather whatever information can be produced.

In the future let's stick to that and not waste time playing politics.

 </PanamaVet>

 


COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/30/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5425
PUBLISHED: 2020-10-31
Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity provider...
CVE-2020-15703
PUBLISHED: 2020-10-31
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivile...
CVE-2020-5991
PUBLISHED: 2020-10-30
NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.
CVE-2020-15273
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can ac...
CVE-2020-15276
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.