World War Web Advisory #4: S.2105 Cybersecurity Act of 2012

[ironboltbruce]

http://veritasvirtualvengeance.files.wordpress.com/2012/02/s2105_cybersecurity_act_of_2012.jpg

WORLD WAR WEB ADVISORY #4: S. 2105 CYBERSECURITY ACT OF 2012 A.K.A. THE EMPIRE STRIKES BACK

Before eyes not blinded by a mainstream media controlled by the corporate fascist elite, Orwell's 1984 nightmare continues to unfold as the reach and powers of the Department of Homeland Security (DHS) are once again extended and codified:

"Introduced Tuesday, the Cybersecurity Act of 2012 [S 2105] would direct the Department of Homeland Security to work in concert with industry members and relevant government agencies to conduct a series of risk assessments and determine which private-sector firms would be deemed to operate "covered critical infrastructure," a crucial designation that would determine whether a private-sector entity could be subjected to new regulatory oversight."

http://www.itworldcanada.com/news/u-s-cybersecurity-bill-to-empower-homeland-security/144890

"The legislation would codify some of the authority the Obama administration has granted the Department of Homeland Security over federal civilian agency IT security and create the National Center for Cybersecurity and Communications [NCCC] within DHS, headed by a Senate-confirmed director, to coordinate federal efforts to battle cybersecurity threats facing the government and the nation's critical information infrastructure, the mostly privately owned networks that control the flow of money, energy, food, transportation and other vital resources that the economy needs to function."

http://www.govinfosecurity.com/articles.php?art_id=4506

"The Cybersecurity Act of 2012 would have the Department of Homeland Security determine what qualifies as critical infrastructure and require compliance with a set of security standards. The legislation defines as critical infrastructure systems 'whose disruption from a cyberattack would cause mass death, evacuation, or major damage to the economy, national security, or daily life'."

http://www.france24.com/en/20120215-us-senate-new-cybersecurity-push

"The Act [includes] an exemption to the Freedom of Information Act (FOIA) rules... The question remains how a private citizen is going to find out that the information being monitored went beyond an attempt to detect a cybersecurity threat... Another concern that will likely be raised is that the government will able to require compliance by a company by designating an entity as a covered critical infrastructure."

http://www.dataprivacymonitor.com/federal-legislation/the-cybersecurity-act-of-2012--what-does-it-mean/

Full Text of S2105, The Cybersecurity Act of 2012:

http://docs.ismgcorp.com/files/external/CYBER_The_Cybersecurity_Act_of_2012_final.pdf

Note: Until a few moments ago, Reddit.com was blocking every article we attempted to post re S. 2105 to "r/Politics".

###

NO MORE LEFT. NO MORE RIGHT. TIME TO UNITE. STAND AND FIGHT!

IronBoltBruce via VVV PR ( http://veritasvirtualvengeance.com | @vvvpr )

Img: http://veritasvirtualvengeance.files.wordpress.com/2012/02/s2105_cybersecurity_act_of_2012.jpg

Vid: http://www.youtube.com/watch?v=A6xERbRHH-E

Spt: https://www.wepay.com/donate/ironboltbruce

Tag: #s2105, #nccc, #cybersecurity, #infosec, #dhs, #obama, #fascism, #ows, #worldwarweb, #vvvpr

Key: s.2105, s. 2105, s2105, s 2105, cybersecurity act, cybersecurity act of 2012, cybersecurity, information security, obama, dhs, department of homeland security, dhs, nccc, national center for cybersecurity and communications, security industrial complex, intelligence industrial complex, internet security, fascism, corporate fascism, ows, occupy wall street, world war web, vvv pr

[Mister D]

Didn't Anonymous fold like lil' bitches when the Mexican cartels went after them?

[Conley]

:laugh: I never did hear how that turned out. Anonymous is a lot of people though, and they're spread out. Kind of like AQ in that I don't think there's any official membership roster. It is, after all, anonymous.

[Mister D]

:laugh: I never did hear how that turned out. Anonymous is a lot of people though, and they're spread out. Kind of like AQ in that I don't think there's any official membership roster. It is, after all, anonymous.

Those dudes they hung from a bridge weren't anonymous enough...:undecided: Now if the "Empire" really was anywhere near as ruthless as Anonymous likes to portray it they wouldn't be so brave.

[Conley]

True, the cartel leaves a lot of bodies without heads. That does make identification difficult. :shocked:

[Chris]

Anonymous is like a starfish, cut off a limb and it just regrows another.

The Starfish and the Spider: The Unstoppable Power of Leaderless Organizations (http://www.starfishandspider.com).

[Conley]

Anonymous is like a starfish, cut off a limb and it just regrows another.

The Starfish and the Spider: The Unstoppable Power of Leaderless Organizations (http://www.starfishandspider.com).

That book looks interesting. That strategy makes for quite a formidable opponent. The AQ info seems a bit dated as it came out in 2006 I believe. Still, probably worth a read.

[MMC]

Anonymous backed off from the Cartels.....as those people that were hung were discovered thru use of the computer. So Anonymous backed away as the Cartels used the same thing that Anonymous is known for. The Hackers got hacked!

[waltky]

Machines versus hackers?...
http://www.politicalforum.com/images/smilies/confused.gif
Can machines keep us safe from cyber-attack?
Tue, 02 Aug 2016 - Artificial intelligence could soon be spotting and sealing security bugs in software before malicious hackers can slip through the holes.


After robot cars and robot rescue workers, US research agency Darpa is turning its attention to robot hackers. Best known for its part in bringing the internet into being, the Defence Advanced Research Projects Agency has more recently brought engineers together to tackle what it considers to be "grand challenges". These competitions try to accelerate research into issues it believes deserve greater attention - they gave rise to serious work on autonomous vehicles and saw the first stumbling steps towards robots that could help in disaster zones. Next is a Cyber Grand Challenge that aims to develop software smart enough to spot and seal vulnerabilities in other programs before malicious hackers even know they exist. "Currently, the process of creating a fix for a vulnerability is all people, and it's a process that's reactive and slow," said Mike Walker, head of the Cyber Grand Challenge at Darpa.


http://ichef-1.bbci.co.uk/news/320/cpsprodpb/15885/production/_90579188_gettyimages-86871480.jpg

This counted as a grand challenge, he said, because of the sheer complexity of modern software and the fundamental difficulty one computer had in understanding what another was doing - a problem first explored by computer pioneer Alan Turing. He said the need for quick fixes would become more pressing as the world became populated by billions of small, smart net-connected devices - the so-called internet of things. "The idea is that these devices will be used in such quantities that without automation we just will not be able to field any effective network defence," he said. The cyber challenge climaxes this week at the Def Con hacker convention, where seven teams will compete to see whose software is the best hacker.

Blowing up

But automated, smart digital defences are not limited to Darpa's cyber arena. Software clever enough to spot a virus without human aid is already being widely used. A lot of what anti-virus software did had to be automatic, said Darren Thomson, chief technology officer at Symantec, because of the sheer number of malicious programs the bad guys had created. There are now thought to be more than 500 million worms, Trojans and other viruses in circulation. Millions more appear every day. That automation helped, said Mr Thomson, because traditional anti-virus software was really bad at handling any malware it had not seen before. "Only about 30-40% of all the things we protect people against are caught by these programs," he said.

For the rest, said Mr Thomson, security companies relied on increasingly sophisticated software that could generalise from the malware it did know to spot the malicious code it did not. Added to this are behavioural systems that keep an eye on programs as they execute and sound the alarm if they do something unexpected. Some defence systems put programs they are suspicious about in a virtual container and then use different techniques to try to make the code "detonate" and reveal its malicious intent. "We simulate keystrokes and make it look like it is interacting with users to make the malware believe it's really being used," Mr Thomson said.

Clever code (http://www.bbc.co.uk/news/technology-36923794)

See also:

Yahoo probes possible huge data breach
Tue, 02 Aug 2016 - Yahoo is investigating claims a hacker has uploaded 200 million Yahoo accounts to the dark web.


Usernames, passwords and dates of birth are being offered for sale for three bitcoins (£1,360). Using the name Peace, the hacker said the data was "most likely" from 2012. Yahoo said it was taking the claim "very seriously" and was "working to determine the facts". "Yahoo works hard to keep our users safe, and we always encourage our users to create strong passwords, or give up passwords altogether by using Yahoo Account Key, and use different passwords for different platforms," it said in a statement.

Dictionary attack

The passwords appear to be hashed - which means they have been scrambled - but the hacker has also published details of the algorithm allegedly used for the hash. "The algorithm MD5 is considered to be weak, and for the vast majority of passwords it is easy to reverse what it was using what we call a dictionary attack," said Prof Alan Woodward, a security expert from Surrey University. He added though that caution needed to be exercised about the alleged breach. "We have seen claims about similar dumps in the past weeks which have proved to be fake or just old data," he said. "People are still trying to work out if it is real or not." Motherboard, which first reported the alleged breach, obtained a small sample of the data - some 5,000 records, and tested whether they corresponded to real accounts on the service.

It found that most of the first two dozen Yahoo usernames tested did correspond to actual accounts. However, attempts to contact more than 100 of the addresses in the sample saw many returned as undeliverable with auto-responses reading: "This account has been disabled or discontinued," which might suggest that the data is old. Brendan Rizzo, technical director at HPE Security, said: "Data has high value to attackers, and even though the information for sale on the black market is several years old, it can still be used for social engineering attacks for spear phishing to attempt to gain access to deeper systems with even more lucrative data that can be monetised directly if stolen." Earlier this month, Yahoo was sold to US telecoms giant Verizon for nearly $5bn (£3.8bn).

http://www.bbc.co.uk/news/technology-36923794

[waltky]

Ever Vigilant is the catch phrase of Cybersecurity...
http://www.politicalforum.com/images/smilies/icon_wink.gif
Constant Vigilance Crucial Element of Cybersecurity
August 05, 2016 - Inside the secretive world of cybersecurity experts is a phrase that quickly determines the severity of a cyberattack: Is this mischief or calamity?


For the higher-ups at the Democratic National Committee, hit by a cyberattack that vacuumed up thousands of emails, which WikiLeaks then leaked, it sure felt like a calamity. It was the night before the opening of the party convention, and the world had an up-close peek at the rough-and-tumble world of American politics: emails that showed party leaders were doing everything they could to ensure that former Secretary of State Hillary Clinton, not Vermont Senator Bernie Sanders, would win the party's nomination for president. The hack was quickly laid at Russia’s doorstep, which prompted some mudslinging by Donald Trump, who had just become the Republican presidential candidate at his party's convention the week before. Trump grabbed headlines again when he called on Russia to find “the 30,000 missing emails” that Clinton's staff said they had deleted because they were purely personal. The DNC tried to ignore the controversy, but just hours into day one of the convention, the party's national committee chairwoman, Debbie Wasserman Schultz, stepped down.

For cyber experts, this was small stuff … mischief. No one died. No sovereign nation was violated. No infrastructure destroyed. Cyberattacks happen all the time, all over the world. The DNC was embarrassed, but that’s nothing compared to a loss of life. However, the connection with Russia hung around. Not because of Trump, but because of the implication that President Vladimir Putin was meddling in U.S. political affairs — a presidential election, no less. President Barack Obama, hosting Prime Minister Lee Hsien Loong of Singapore at the White House, was asked how the alleged Russian connection to the DNC hack might impact America’s already strained relations with Putin. “In terms of how it affects our relationship with Russia, look, I think we’ve already got a lot of differences with Russia on a whole bunch of issues," Obama said. “If, in fact, Russia engaged in this activity, it’s just one on a long list of issues that me and Mr. Putin talk about and that I’ve got a real problem with. And so I don’t think that it wildly swings what is a tough, difficult relationship that we have with Russia right now.”


http://gdb.voanews.com/1E8384BE-7C12-4023-906D-181450F007AA_w640_r1_s_cx0_cy5_cw0.jpg
Demonstrators make their way around downtown July 25, 2016, in Philadelphia, during the first day of the Democratic National Convention after some of the 19,000 emails, presumably stolen from the DNC by hackers, were posted to the website WikiLeaks.

He reiterated that the United States is ready to “impose potentially certain proportional penalties.” Obama gave no specifics, but said the FBI is still investigating. That Russia was behind the DNC breach is widely accepted. Shocking as it may sound, China routinely hacks the United States and has done so successfully, said Fred Kaplan, a columnist for Slate.com and author of "Dark Territory: The Secret History of Cyber War." “The distinction between China and Russia when it comes to cyber activities is that China is kind of indiscriminate about it," Kaplan said Wednesday, during a radio appearance (Stand Up! with Pete Dominick on SiriusXM). “Russia tends to be a bit cagier about it, and some of their hacks are much harder to trace. They’re subtler and they cover their tracks well.”

Scary? Yes, with scenarios of blacking out the power grids of entire countries swirling around one’s head. Kaplan says the United States employs some of the world’s brightest cybersecurity experts at the National Security Agency, the most secret of all U.S. intelligence services. Those who are in charge of U.S. cybersecurity are focused on three key aspects of cyberwarfare: deterrence, detection and resilience. And Kaplan’s well-placed sources tell him “we are the best at this.” That's good to know.

http://www.voanews.com/content/constant-vigilance-crucial-element-to-cybersecurity/3451848.html

See also:

US Cyber Pros: Hackers Could Hit Electronic Voting Machines Next
August 03, 2016 | WASHINGTON—U.S. cyber security professionals say suspected foreign hackers who recently attacked computer systems of the Democratic Party could do something even more sinister in the future.


The cyber pros, who appeared on this week's Hashtag VOA program, said U.S. electronic voting systems are likely to be among the next targets. When the whistle-blowing website WikiLeaks published leaked emails of the U.S. Democratic National Committee last month, it caused major embarrassment to the party, and forced U.S. Congresswoman Debbie Wasserman Schultz to quit her position as the DNC chairperson. Cybersecurity analyst Richard Forno said that outcome shows foreign hackers can achieve political goals and incentivizes them to escalate their attacks. "Interfering with the electoral and political process of countries is a classic tool of intelligence and foreign policy,” said Forno, who directs the University of Maryland’s Center for Cybersecurity. “Even though we are moving toward an era of electronic and technology-enabled voting in more places, this [DNC cyberattack] reinforces the fact that the traditional threats are still with us, and are now moving further into cyberspace."

Electronic voting machines are part of that cyberspace. The vast majority of U.S. states will use them for this November's national elections. But a 2015 study by New York University found that 43 of those states had machines that were at least a decade old. Could they be hacked as well? Cyber security pros attending an annual Las Vegas conference known as Black Hat think so.

Attack in Ukraine

One of them is Toni Gidwani, research director at ThreatConnect, a cyberdefense platform used by 1,200 companies and organizations worldwide. She said there is a precedent for attacks on voting systems. "We saw that in Ukraine in 2014, where three days before the election, the Ukrainian central election committee suffered a massive hack that threatened their ability to hold voting on schedule,” she said. “And then malware was discovered right before results were announced – malware that would have projected a totally different outcome in which an ultranationalist candidate, who in reality received less than 1 percent of the vote, would have won. So this is not science fiction - we have already seen this happen." Some U.S. voting machines produce paper records that can be used in case of problems with a vote count. But keeping a paper trail might not be enough.

Yong-Gon Chon, another Black Hat attendee, said any organization seeking to protect itself from hackers needs all of its personnel to play their part. "It is no longer just the responsibility of a chief security officer or CIO to protect an organization's infrastructure - everyone has a role to play,” said Chon, who serves as CEO of Cyber Risk Management and has led global security teams for more than 20 years. “There is a shared level of responsibility, whether you are using cloud systems or your own systems within your organizations. And ultimately it is about being able to practice safe and healthy (cyber) activities on a day to day basis." One healthy habit recommended by Chon is being skeptical when you receive an email containing a hyperlink that could expose you to a hacker. “You should determine whether or not that is something that you should trust and is acceptable for your business,” he said.

http://www.voanews.com/content/us-cyber-pros-hackers-could-hit-electronic-voting-machines-next/3446923.html

[waltky]

Cybersecurity? - We're all screwed...
http://www.newsforum.com/images/smilies/eek.gif
The state of cyber security: we’re all screwed
Monday 8 August 2016 - Sophisticated cybercrime, privacy fears and ongoing confusion about security have soured the internet for many, and doing something about it won’t be easy


When cybersecurity professionals converged in Las Vegas last week to expose vulnerabilities and swap hacking techniques at Black Hat and Defcon, a consistent theme emerged: the internet is broken, and if we don’t do something soon, we risk permanent damage to our economy. “Half of all Americans are backing away from the net due to fears regarding security and privacy,” longtime tech security guru Dan Kaminsky said in his Black Hat keynote speech, citing a July 2015 study by the National Telecommunications and Information Administration. “We need to go ahead and get the internet fixed or risk losing this engine of beauty.”

There’s no lack of things to be worried about: organized cybercriminal gangs; government surveillance; not to mention hack attacks from nation states. That may be good news for the cybersecurity industry, which is expected to grow more than 10% annually and surpass $200bn worldwide by 2021, according to research firm Markets and Markets.

But it’s bad news for the rest of us. As we conduct more of our lives online, we’re being asked to become increasingly savvy about computer security. Many are simply uninterested or not up to the task. Add up all these factors, and the question becomes not why many consumers are losing confidence in the internet, but whether they should have any confidence at all.

Consumers: the new ATM for cyber crooks (https://www.theguardian.com/technology/2016/aug/08/cyber-security-black-hat-defcon-hacking)

[waltky]

Winter's comin', Granny wants to get a wood stove in case the hackers cut off the `lectricical...
http://www.politicalforum.com/images/smilies/icon_grandma.gif
US, UK Cybersecurity Officials: Destructive Hacks are Coming
October 19, 2016 — The world should brace itself for more physically destructive hacks, two senior cybersecurity officials said Wednesday, warning that a more dangerous era of hacking was already upon us.


Paul Chichester, the director of operations at Britain's new National Cyber Security Center, told attendees at an event hosted by British defense think tank RUSI that electronic intrusions were on their way to becoming more “destructive, disruptive and coercive.” “That will be our future,'' he told a crowd of officers, academics and industry experts gathered for a two-day symposium in central London. Chichester was seconded by Air Force Lt. Gen. James K. McLaughlin, deputy commander at U.S. Cyber Command, who told attendees that infrastructure-wrecking attacks were being seen “right now in the environment.”


http://gdb.voanews.com/A15FC2BD-BABB-4A3E-947E-18F3032541DE_w250_r1_s.jpg
A specialist works at the National Cybersecurity and Communications Integration Center in Arlington, Virginia

Neither official went into specifics about what they'd seen or why they felt the threat was intensifying, although McLaughlin invoked a cyberattack in Ukraine which knocked out three separate power distribution companies last year. The Dec. 23 incident, believed to have been pulled off by a team of hackers using stolen passwords, left 225,000 people without electricity, according to a U.S. Department of Homeland Security bulletin published two months later.

Cybersecurity experts long worried that hackers can hijack the vulnerable industrial control systems to wreak havoc in power plants, traffic systems, factories, dams or reservoirs. Still, publicly confirmed examples of real-world damage from hacking have — so far — been few and far between. The Ukrainian incident provided a rare and dramatic demonstration of the physical consequences of a well-organized cyberattack. McLaughlin said there was now no doubt such hacks were possible. “Three years ago these were just theoretical,” he said. “Now we see them. They're practically here in front of us.”

http://www.voanews.com/a/us-united-kingdom-cybersecurity-officials-destructive-hacks-coming/3558379.html

[waltky]

How do you make everything cybersecure?...
http://www.politicalforum.com/images/smilies/confused.gif
U.S. calls on automakers to make cyber security a priority
Mon Oct 24, 2016 | Automakers should make shielding the electronic and computer systems of vehicles from hackers a priority, developing layers of protection that can secure a vehicle throughout its life, U.S. regulators said on Monday.


The cyber security guidelines issued by the U.S. National Highway Traffic Safety Administration are recommendations, not enforceable rules. However, they mark a step toward establishing a road map for industry behavior as lawmakers and consumers pressure automakers to show how they will protect increasingly connected and automated vehicles from cyber attacks. Some of the agency's proposals, included in a paper titled "Cybersecurity Best Practices for Modern Vehicles," echo moves major manufacturers are making already, including establishing a group to share information about cyber security threats.


http://s2.reutersmedia.net/resources/r/?m=02&d=20161024&t=2&i=1158784711&w=&fh=&fw=&ll=780&pl=468&sq=&r=LYNXNPEC9N1GC
The Jeep Cherokee Trailhawk sports utility vehicle (SUV) is seen during the media preview of the 2016 New York International Auto Show in Manhattan, New York

Automakers will carefully review the technical aspects of the agency's proposals as well as proposals related to the disclosure of information about "the secret sauce" of electrical and data systems, which is highly competitive, Jonathan Allen, acting executive director of the Automotive Information Sharing and Analysis Center, said in an interview on Monday. The group, often referred to as the AUTO-ISAC, was established by automakers as a clearinghouse for companies to share information about cyber security threats and countermeasures. Automakers accelerated efforts to address hacking threats over the past year after data security researchers successfully took remote control of a Jeep Cherokee and publicized their feat. Fiat Chrysler Automobiles in July 2015 recalled 1.4 million vehicles to install software to protect against future data breaches.


http://s1.reutersmedia.net/resources/r/?m=02&d=20161024&t=2&i=1158784714&w=&fh=&fw=&ll=780&pl=468&sq=&r=LYNXNPEC9N1GA
Charlie Miller (L) and Chris Valasek give a briefing during the Black Hat USA 2015 cybersecurity conference in Las Vegas, Nevada August 5, 2015. Miller and Valasek talked about how they remotely hacked into a 2014 Jeep Cherokee

Other automakers, including BMW AG and Tesla Motors Inc, have disclosed actions to fix potential data security gaps. The security of data and communications systems in vehicles is also critical as more auto manufacturers gear up to follow Tesla's lead and begin offering significant vehicle upgrades through wireless data links. The Federal Bureau of Investigation earlier this year warned that criminals could exploit online vehicle software updates.


http://s2.reutersmedia.net/resources/r/?m=02&d=20161024&t=2&i=1158784716&w=&fh=&fw=&ll=780&pl=468&sq=&r=LYNXNPEC9N1GB
The 2015 Jeep Grand Cherokee is exhibited on a car dealership in New Jersey

The NHTSA recommends manufacturers conduct tests of vehicle systems to see if the cyber security systems can be breached, and document their testing and their assessment of the risks. Democratic U.S. Senators Ed Markey of Massachusetts and Richard Blumenthal of Connecticut said the NHTSA should do more. “If modern day cars are computers on wheels, we need mandatory standards, not voluntary guidance, to ensure that our vehicles cannot be hacked and lives and information put in danger," the lawmakers said in a statement Monday. The Alliance of Automobile Manufacturers said on Monday the NHTSA guidelines appear to support the steps being taken by the AUTO-ISAC. The Alliance represents General Motors Co, Ford Motor Co and Daimler AG, among others.

http://www.reuters.com/article/us-autos-cyber-idUSKCN12O2JG

See also:

U.S. takes aim at cyber attacks from connected devices as recalls mount
Mon Oct 24, 2016 | Obama administration officials sought on Monday to reassure the public that it was taking steps to counter new types of cyber attacks such as the one Friday that rendered Twitter, Spotify, Netflix and dozens of other major websites unavailable.


The Department of Homeland Security said it had held a conference call with 18 major communication service providers shortly after the attack began and was working to develop a new set of “strategic principles” for securing internet-connected devices. DHS said its National Cybersecurity and Communications Integration Center was working with companies, law enforcement and researchers to cope with attacks made possible by the rapidly expanding number of smart gadgets that make up the "internet of Things. Such devices, including web-connected cameras, appliances and toys, have little in the way of security. More than a million of them have been commandeered by hackers, who can direct them to take down a target site by flooding it with junk traffic.

Several networks of compromised machines were directed to attack big customers of web infrastructure company Dyn last week, Dyn officials and security researchers said. The disruption had subsided by late Friday night in America, and two of the manufacturers whose devices had been hijacked for the attack pledged Monday to try to fix them. But security experts said that many of the devices would never be fixed and that the broader security threat posed by the internet of Things would get worse before it gets better. “If you expect to fix all the internet devices that are out there, force better passwords, install some mechanism for doing updates and add some native security for the operating system, you are going to be working a long time,” said Ed Amoroso, founder of TAG Cyber and former chief security officer at AT&T. Instead, Amoroso said he hoped that government officials would focus on recommending better software architecture and that business partners would insist on better standards.

In the meantime, fresh responses by two of the companies involved in the attacks illustrated the extent of the problem. Chinese firm Hangzhou Xiongmai Technology Co Ltd, which makes components for surveillance cameras, said it would recall some products from the United States. Another Chinese company, Dahua Technology, acknowledged that some of its older cameras and video recorders were vulnerable to attacks when users had not changed the default passwords. Like Xiongmai, it said it would offer firmware updates on its website to fix the problem and would give discounts to customers who wanted to exchange their gear. But neither company has anything like a comprehensive list of their customers, many of whom will never learn of the problems, said Dale Drew, chief security officer with communications provider Level 3. “I wouldn’t be surprised if the only way they are going to reach their consumers is through media reports, Drew said.

http://www.reuters.com/article/us-usa-cyber-devices-idUSKCN12P047

[waltky]

Military cybersecurity opportunities...
http://www.politicalwrinkles.com/images/smilies/thumbsup.gif
Uncle Sam May Want You for Cyber War
9 Mar 2017 | Brig. Gen. Patrick Higby is director of Cyberspace Strategy and Policy, Office of Information Dominance and Chief Information Officer, U.S. Air Force. The opinions in this column are his own.


Imagine this scenario: America is at war and it's getting messy. Our enemies exploit cyber vulnerabilities, inflicting severe losses on our economy and national security without fear of consequence or reprisal. Should the country explore every available response, whether under the confines of current law or through new methods to unleash the untapped potential from private citizens, communities and corporations? Fears of an "electronic Pearl Harbor" have been with us for more than a decade, and threats to American cyber security grow more profound by the day. In recent years, foreign hackers have infiltrated everything from government networks and databases to banks, movie studios and political organizations. Just recently, Defense Secretary James Mattis noted a significant increase in the hacking of NATO country databases during recent years.

In addition to the traditional approaches to countering cyber threats, perhaps it is time to start thinking unconventionally about safeguarding our electronic infrastructure and, more importantly, our data. There is, after all, a long-standing tradition of American pragmatism and ingenuity used to turn the tables on our adversaries and leverage the private sector. America's most famous example of "privateering" came in June 1812, when our young nation was at war with Britain. Our Navy fielded perhaps a dozen ships. Britain's battle-hardened Royal Navy boasted over 500 warships, with 85 of these operating in American waters when the War of 1812 broke out. Something was needed to quickly even the odds as the Royal Navy pummeled our commerce and interdicted our harbors.


http://images01.military.com/media/news/service/air-force-cyber-flag-1500-ts600.jpg
Three airmen perform cyber operations at Lackland Air Force Base, Texas

Enter the privateers -- armed private ships manned by civilian crews motivated by patriotism and profit. These brave sailors were given Letters of Marque as authorized by Article 1 of our Constitution and constrained under an admiralty court to seize British ships as prizes. These actions bolstered the meager U.S. Navy and allowed private citizens and corporations to actively fight back to inflict great consequences upon our adversary. Today, our nation is at war with many non-state actors, including the Islamic State, who are leveraging social media and the dark web to further their repugnant objectives. A recent article in "The Atlantic" magazine by Emerson Brooking and Peter Singer outlined the problem: "While the Islamic State has shown savvy in its use of social media, it is the technology itself -- not any unique genius on the part of the jihadists -- that lies at the heart of the group's disruptive power and outsize success. Other groups will follow."

That innovation in exploiting the new cyberspace domain should not be confined to our adversaries. We can just as easily unleash American ingenuity in service of national interests without having to resort only to traditional military options. We are suffering significant losses in cyberspace as savvy enemies continue to hack government databases and other critical infrastructure without fear of real or immediate consequences. The continued message of using strictly military solutions, technology-based defenses and cyber hygiene alone will no longer suffice. As was the case with our privateers, American citizens, communities and corporations must be empowered to fight back and inflict more immediate and unpredictable consequences upon our adversaries to change the calculus. Today's challenges call for no less ingenuity than those faced by previous generations.

http://www.military.com/daily-news/2017/03/09/uncle-sam-want-you-cyber-war.html

[waltky]

New York Offers Free Cybersecurity Tools to Public to Deter Hackers...
:cool2:
New York Offers Free Cybersecurity Tools to Public to Deter Hackers
March 29, 2018 - New York City will offer free cybersecurity tools to the public as part of a new effort to improve online safety, officials said Thursday, a week after Atlanta was hit with a ransomware attack that knocked some municipal systems offline.


The program, dubbed NYC Secure, will launch a free smartphone protection app to warn users when suspicious activity is detected on their devices, New York Mayor Bill de Blasio announced at a news conference. "New Yorkers aren't safe online. We can't wait around for other levels of government to do something about it or the private sector," de Blasio said. The program will cost the city about $5 million per year, he said. "It's our job in government to make sure that people are safe online. It's a new reality," de Blasio said.

City agencies will also beef up security protection on public Wi-Fi networks by the end of the year to protect residents, workers and visitors. Those networks will be secured with a tool, dubbed Quad9, that is available to anybody in New York City and beyond at https://quad9.net. Quad9 routes a user's web traffic through servers that identify and block malicious sites and email.

Atlanta cyberattack

NYC Secure was unveiled as Atlanta officials worked alongside federal law enforcement and technicians from private security firms to investigate the cause of the attack that encrypted data on computers. Atlanta City Council President Felicia Moore said she was waiting to hear more about how the hackers breached city networks, the scope of the attack and when city services would be fully operational. "Everybody in the public wants to know. I want to know, too," Moore said at a news conference. "But I do think that we need to give them an opportunity to get the information."

Atlanta on Thursday reactivated a website that allows residents to make requests for trash pickup, report traffic signal outages and ask for other public works-related services. Municipal court services remained offline Thursday and City Hall employees told Reuters their work computers were still unusable a week after the hack was detected.

https://www.voanews.com/a/new-york-free-cybersecurity-tools-deter-hackers/4323141.html