Page 3,784«..1020..3,7833,7843,7853,786..3,7903,800..»

Senators Pretend That EARN IT Act Wouldn’t Be Used To Undermine Encryption; They’re Wrong – Techdirt

March 13, 2020 | Author: admin

from the plausible-deniability dept

On Wednesday, the Senate held a hearing about the EARN IT Act, the bill that is designed to undermine the internet and encryption in one single move -- all in the name of "protecting the children" (something that it simply will not do). Pretty much the entire thing was infuriating, but I wanted to focus on one key aspect. Senators supporting the bill, including sponsor Richard Blumenthal -- who has been attacking the internet since well before he was in the Senate and was just the Attorney General of Connecticut -- kept trying to insist the bill had nothing to do with encryption and wouldn't be used to undermine encryption. In response to a letter from Facebook, Blumenthal kept insisting that the bill is not about encryption, and also insisting (incorrectly) that if the internet companies just nerded harder, they could keep encryption while still giving law enforcement access.

This bill says nothing about encryption, Sen. Richard Blumenthal..., said at a hearing Wednesday to discuss the legislation...

[....]

Strong law enforcement is compatible with strong encryption, Blumenthal said. I believe it, Big Tech knows it and either is Facebook is lying and I think theyre telling us the truth when they say that law enforcement is consistent with strong encryption or Big Tech is using encryption as a subterfuge to oppose this bill.

No, the only one engaged in lying or subterfuge here is Blumenthal (alternatively, he's so fucking ignorant that he should resign). "Strong" encryption is end-to-end encryption. Once you create a backdoor that lets law enforcement in, you've broken the encryption and it's no longer stronger. Even worse, it's very, very weak, and it puts everyone (even Senator Blumenthal and all his constituents) at risk. If you want to understand how this bill is very much about killing encryption, maybe listen to cryptographer Matthew Green explain it to you (he's not working for "Big Tech," Senator):

EARN IT works by revoking a type of liability called Section 230 that makes it possible for providers to operate on the Internet, by preventing the provider for being held responsible for what their customers do on a platform like Facebook. The new bill would make it financially impossible for providers like WhatsApp and Apple to operate services unless they conduct best practices for scanning their systems for CSAM.

Since there are no best practices in existence, and the techniques for doing this while preserving privacy are completely unknown, the bill creates a government-appointed committee that will tell technology providers what technology they have to use. The specific nature of the committee is byzantine and described within the bill itself. Needless to say, the makeup of the committee, which can include as few as zero data security experts, ensures that end-to-end encryption will almost certainly not be considered a best practice.

So in short: this bill is a backdoor way to allow the government to ban encryption on commercial services. And even more beautifully: it doesnt come out and actually ban the use of encryption, it just makes encryption commercially infeasible for major providers to deploy, ensuring that theyll go bankrupt if they try to disobey this committees recommendations.

Its the kind of bill youd come up with if you knew the thing you wanted to do was unconstitutional and highly unpopular, and you basically didnt care.

Or listen to Stanford's Riana Pfefferkorn explain how the bill's real target is encryption. As she explains, the authors of the bill (including Blumenthal) had ample opportunity to put in language that would make it clear that it does not target encryption. They chose not to.

As for the "subterfuge" Blumenthal calls out, the only real "subterfuge" here is by Blumenthal and Graham in crafting this bill with the help of the DOJ. Remember, just the day before the DOJ flat out said that 230 should be conditioned on letting law enforcement into any encrypted communications. So if Blumenthal really means that this bill won't impact encryption he should write it into the fucking bill. Because as it's structured right now, in order to keep 230 protections, internet companies will have to follow a set of "best practices" put together by a panel headed by the Attorney General who has said multiple times that he doesn't believe real encryption should be allowed on these services.

So if Blumenthal wants us to believe that his bill won't undermine encryption, he should address it explicitly, rather than lying about it in a Senate hearing, while simultaneously claiming that Facebook (and every other company) can do the impossible in giving law enforcement backdoor access while keeping encrypted data secure.

Filed Under: earn it, earn it act, encryption, intermediary liability, richard blumenthal, section 230

See more here:
Senators Pretend That EARN IT Act Wouldn't Be Used To Undermine Encryption; They're Wrong - Techdirt

Read More..
Posted in Encryption | Leave a Comment

Patent hints that encrypted displays could appear on future Apple devices – TechSpot

March 13, 2020 | Author: admin

Why it matters: Regardless of the security and privacy measures we take on our devices, the content reaching us through their screens is ultimately susceptible to shoulder surfing and is often the source of amusement for overly inquisitive peers. Although third-party and in-built privacy screens have tried to address the problem and succeeded to some extent, Apple seems to be developing a solution that visually encrypts the display itself to make it impossible for unwanted observers to figure out the actual screen content.

Shoulder surfing remains a common practice among folk who have little regard for user privacy and often engage in this unethical activity, either for personal amusement or to social engineer their way to someone's sensitive information.

There have been attempts to curb this phenomenon with products like HP's Sure View display technology built into some of its laptops and third-party privacy filters for several form-factor devices. Apple users, however, might not have to worry long about this problem as the company recently filed for a patent that tracks the user's gaze as they operate the device and visually encrypts content to protect it from unwanted observers.

PhoneArena reports that Apple's 'gaze-dependent display encryption' technology could appear in multiple Apple devices in the future, including iPhones, iPads, monitors, the Apple Watch - basically anything with a display and other hardware required for the tech to function.

Using the camera to identify and track the user's gaze, along with special processing circuitry, the device's screen can generate visually encrypted frames when an onlooker is detected. These frames are made up of two regions: one that includes unmodified content for the intended user, based on their gaze and proximity from the camera, and a second obscured region that shows manipulated content through text scrambling, color altering, and image warping techniques.

The area within these circles represents unmodified information currently under user view

The patent also suggests that content manipulation will take place dynamically as "display content is not to be visually encrypted" when an onlooker's gaze is away from the display. When they do take a peek (intentionally or otherwise), the processing circuitry will begin generating visually encrypted frames, seemingly unnoticeable to the user.

The whole idea potentially makes sure that information reaches its desired user safely, much like the Compubody Sock from several years ago that set out to achieve the same objective, albeit in a much simpler, low-tech fashion.

The Compubody Sock was certainly effective but risked you getting more attention than usual

It remains to be seen if Apple implements this technology in its future products or simply decides to add this patent to its ever-growing pile of unused ones. The company's Face ID tech could eventually evolve to support this feature, further improving the user privacy of its devices; however, the processing and financial costs associated with this technology are likely going to make for even more expensive Apple products in the future.

Excerpt from:
Patent hints that encrypted displays could appear on future Apple devices - TechSpot

Read More..
Posted in Encryption | Leave a Comment

Why Are Internet Security Standards Badly Deployed and What to Do About It? – CircleID

March 12, 2020 | Author: admin

In 2019 under the aegis of the Internet Governance Forum, a pilot project was conducted into the causes of and solutions for the, in general, slow deployment of internet security standards. Standards that on mass deployment make the Internet and all its users safer, indiscriminately, immediately.

The report

Recently the report 'Setting the standard. For a more Secure and Trustworthy Internet. The Identification of Pressure Points in Society to Speed up Internet Standards Deployment', was published on the IGF website. Information was gathered by means of an international survey, breakout sessions at the IGF, dozens of interviews with stakeholders and desk research. It focused on two questions: 1) What are the reasons for slow deployment? and; 2) What are solutions to speed up deployment? This showed that underneath all other provided reasons lies a collective action problem. To break out of this state of inertia, 6 recommendations, 25 identified pressure points in society, and 7 action plans are presented including identified stakeholders who have to be(come) involved to have a chance at success in speeding up deployment.

Six standards

The project took six standards as examples to start the discussion, three internet standards by the official definition, DNSSEC, RPKI and bcp38 and three not: OWASP top 10, ISO 27001 and the Safe Software Alliance principles. For ease of writing and reading, all are called internet standards within this context.

Causes

Many participants agreed on the main cause for the slow uptake: the lack of a business case. If there is no demand, in general, there's no offer. Research showed that there are underlying causes. The report shows that there is a lack of pressure on decision-makers; from the sides that matter. As far it was able to ascertain and no one pointing to another conclusion, there is no(t enough) pressure from laws/regulation, media, or consumer organisations. As one of the interviewees stated: "No one cares if you deploy and no one cares if you don't."

Additionally, the overwhelming majority of consumers are not willing to pay for security measures, while/because of not understanding the implications of insecurity. The entrepreneurs willing to deploy, face a negative business case, or operate in a niche market.

Another important conclusion is that it is not (just) technically proficient employees deciding on deployment of the standards. Yet, outreach from the technical community is often aimed at these people. Unfortunately, not reaching the level of success needed to make the Internet safer, as they do not decide on deployment. This calls for different aims and for a change of narrative. It is the owners, board members, financial officers who need convincing. That may take pressure from other stakeholders to achieve change.

Governments have not taken internet standards into law (ISO 27001 is a voluntary exception), as is the preferred situation of nearly all we've spoken to. At the same time most of the efforts of governments (agencies) but also e.g., banks concerning cybersecurity are aimed at the only stakeholder with limited power where deployment of standards is concerned: the consumer or "user" as the internet industry prefers to call its customers. In other words, there are no carrots and no sticks of any kind, making it far worse than having no business case.

Collective Action Problem

All this results in a collective action problem, where there is no demand and no incentive to change behaviour and deploy the Internet standards. Usually, it is the government that society looks towards for solutions. In many sectors, this is completely normal and accepted behaviour. Health, (air)traffic , agriculture, etc., etc.. A question in need of an answer is, what makes the Internet so different and justifies the absence of governments, while the market cannot solve the enormous security challenges facing it? Perhaps it becomes necessary to look at the problem as a (digital) health issue. What perspectives does that provide to act upon?

This report does not answer these questions. It searched for potential solutions and pressure points in society that can contribute to breaking up the collective action problem. A few examples are presented below.

Recommendations

The six recommendations are an accumulation of advice provided. Although there is a near consensus among participants that action is needed, there is no consensus on the precise way forward. The first five were tested in the breakout sessions (number 6 came out of the sessions) at the IGF and are seen as sensible.

1. 'Create a business case for the deployment of internet standards.'2. 'To deploy internet standards successfully, they need to be incorporated by reference into law or legally binding regulations, including a designated regulator.'3. 'To deploy internet standards successfully requires building security by design/default into products and services.'4. 'All stakeholders should collaborate on coherent strategies for multilingual awareness-raising of internet standards and their effect on internet security.'5. 'Internet standards and architecture must become part of education curricula.'6. 'Standardisation processes are advised to include a consultation phase with government and industry policy makers and civil society experts.'

The paradox this report bares is that a large proportion of the participants see legislation as the only option to force the industry into deploying, yet no one wants it. As legislation is seen as the least desirable option, this comes with a moral obligation to step up on all others. No legislation can and may not equal non-deployment. Hence the pressure on those having to deploy needs to be created elsewhere. The report mentions 25 options, from parliamentarians addressing the issue to industry, to consumer organisations testing ICT services and products, from regulation to media publications.

Next steps

Where deployment of standards is concerned, a government can take on a few roles. Standards could be demanded by them through procurement. Standards could be demanded on the basis of duties to care. A question in need of an answer is what regulators can achieve on the basis of current laws, whether telecommunication, privacy, consumer, etc.. When all else fails, the government is the legislator, but even then, cooperation is of utmost importance.

Mistrust of governments is one of the reasons mentioned why the technical community remains more or less aloof from other stakeholders that could play a role in making deployment happen. It is of the greatest importance that these others understand what internet standards are, why they exist, how they are made, and what the importance of deployment is for a more secure internet. To ensure that the future measures are the right ones, interaction is key. Hence the reason this report invites IETF en ISOC to participate actively in the next phase and assist in the creation of a change of narrative and the direction of outreach, to prevent legislation where possible. Their role lies in leading the other stakeholders forward and to make plausible deniability of not having heard of Internet standards in need of deployment impossible at the highest levels of industry and society at that. Why? The decision to deploy seldom is a technical decision but a financial one, an investment (without return). This calls for a different approach and narrative.

All this translates into seven actions that you can find in the report. To massively deploy internet standards is and will be a herculean task involving many stakeholders with different and most likely competing interests. Deep down, however, all stakeholders around the globe have the same interest: not to be hacked, not to have compromised or lost data, not to lose money, etc.. This is a starting point. And, when all is said and done, all will have to pay for security. That goes without saying.

Conclusion: a no-brainer

Ideally, this report is not the end but a beginning. To start work on deployment by enacting the recommendations and gather the stakeholders in the action groups. The IGF is a neutral platform where all involved are equal. The first and most difficult steps can be conducted here before the results are taken outside of the IGF to be implemented. All with one aim: to make deployment of security raising standards a no-brainer for all involved.

You can find my report on the IGF website: https://www.intgovforum.org/multilingual/content/implementing-internet-standards-and-protocols-for-a-safer-internet

See the original post:
Why Are Internet Security Standards Badly Deployed and What to Do About It? - CircleID

Read More..
Posted in Internet Security | Leave a Comment

The Internet Avoided a Minor Disaster Last Week – WIRED

March 12, 2020 | Author: admin

The impact of pulling those certificates would be swift and severe. Once browsers like Chrome and Firefox found them missing, they would flash warnings to any visitors that the sites werent safe. Some browsers would block access altogether. A not insignificant chunk of the internet would effectively be taken out of commission. All because of this one small flaw in one niche corner of the Lets Encrypt operation.

Within two minutes of confirming the bug, the Lets Encrypt team stopped issuing any new certificates in a bid to stanch the bleeding. A little over two hours after that, they fixed the bug itself. And then they let everyone know what was coming.

We cant contact everybody, so we started contacting the largest subscribers, telling them about the situation, getting them as informed as possible, says Aas. And then we worked with them to get them to replace their certificates as quickly as possible.

Once a site operator renewed a certificate, Lets Encrypt could safely revoke the old one. No harm would befall the site. Which sounds like a simple enough solutionbut nothings simple at this kind of scale.

Bigger organizations had an easier time fixing the problem, because they generally have the resources to monitor any signs of trouble that surface and the tools to automate the renewal process. If youve got a dozen or two dozen servers or something, thats some poor sleepy-eyed soul in the middle of the night at a keyboard, says MongoDBs White. We reissued a little over 15,000 certificates [for clients], and we did it in a few hours. There was some work involved, but it wasnt catastrophic. We had measures in place to be able to rotate quickly.

Smaller sites got a big assist from the Electronic Frontier Foundation, which operates Certbot, a free software tool that automatically adds Lets Encrypt certificates to sites and renews them every 60 days. In the last two months alone, Certbot has generated certificates for 19.2 million unique sites. Fortunately we had anticipated the need to check revoked certificates for renewal in 2015, says EFF engineering director Max Hunter. Because Let's Encrypt communicated the issue early, and the code path for the query was already in place, our work was relatively straightforward. By Tuesday a team from EFF, along with volunteers in Paris and Finland, had updated Certbot to renew any revoked certificates.

Meanwhile, Lets Encrypt sent an email to every address it had on file. It created a searchable database of every affected domain so that hosting companies could see if they needed to act. We marked those certificates as expired in our internal system, and then our normal automated processes kicked in to generate and deploy new certificates, says Justin Samuel, CEO of Less Bits, a startup that operates hosting company ServerPilot.

On Tuesday night, 30 minutes before the deadline, Lets Encrypt made another announcement. Of the 3 million potentially impacted sites, 1.7 million had managed to renew their certificates, an astonishing number given the short window of time. No other CA comes close to making large-scale cert reissuing not only feasible but also fast, says Samuel.

That success also emboldened Aas to make a difficult call. Lets Encrypt would let the remaining certificates slide. We made the decision that instead of breaking more than a million websites, potentially, we just arent going to revoke them by the deadline, says Aas. We think its the right decision for the health of the internet.

It was the internet equivalent of a call from the governor minutes before midnight. Lets Encrypt will continue to revoke certificates if it can confirm that the sites have renewed them, but otherwise it is content to leave them be in their slightly broken form. The security risk is small, Aas says, and since Lets Encrypt certificates are only viable for 90 days to begin with, any stragglers will have washed out of the ecosystem by summertime at the latest.

If anything, this just reinforces that they are one of the most transparent, modern certificate authorities in the world, says MongoDBs White, who points to previous certificate snafus that for-profit companies like Symantec have badly mishandled. Its easy to armchair quarterback. But I think if people are overly critical thats misplaced.

The intricacies of internet infrastructure are generally ignored until something goes terrible wrong. This time, though, its useful to reflect on what went right. For once, the story is that nothing broke.

More Great WIRED Stories

See the original post:
The Internet Avoided a Minor Disaster Last Week - WIRED

Read More..
Posted in Internet Security | Leave a Comment

The Internet of Things is a security nightmare reveals latest real-world analysis: unencrypted traffic, network crossover, vulnerable OSes – The…

March 12, 2020 | Author: admin

No less than 98 per cent of traffic sent by internet-of-things (IoT) devices is unencrypted, exposing huge quantities of personal and confidential data to potential attackers, fresh analysis has revealed.

Whats more, most networks mix IoT devices with more traditional IT assets like laptops, desktops and mobile devices, exposing those networks to malware from both ends: a vulnerable IoT device can infect PCs; and an unpatched laptop could give an attacker access to IoT devices - and vast quantities of saleable data.

Those are the big conclusions from a real-world test of 1.2 million IoT devices across thousands of physical locations in the United States, carried out by Palo Alto Networks.

The company also focused in on the healthcare industry and found a truly alarming security situation: no less than 83 per cent of medical imaging devices run on unsupported operating systems; a massive 56 per cent jump from two years ago because of the end of support for Windows 7.

That leaves hospitals vulnerable to attacks that can disrupt care or expose sensitive medical information, the report notes. In addition, 72 per cent of healthcare VLANs mix IoT and traditional assets, so the potential for hackers to access personal health data is a ticking time bomb.

The researchers estimate that more than half - 57 per cent - of IoT devices are currently vulnerable to medium or high-severity attacks, making them an obvious target for hackers. We found that, while the vulnerability of IoT devices make them easy targets, they are most often used as a stepping stone for lateral movement to attack other systems on the network, the report noted. Furthermore, we found password-related attacks continue to be prevalent on IoT devices due to weak manufacturer-set passwords and poor password security practices.

In short, the poor IoT security that people have been warning about for years now risks compromising larger networks because they are being attached to the same network; and thanks to a failure to upgrade imaging equipment to newer operating systems, hackers also have an extra route in networks where they could gather vast amounts of data from unencrypted IoT devices. A double-whammy in other words.

There is a small amount of good news: Californias new IoT law (SB-327) that requires a different password for every device - rather than manufacturer defaults - came into effect at the start of the year and is expected to cut down on easy hacks.

While that is an improvement, as we previously noted the law only deals with the lowest hanging fruit and did not include things like secure software updates which are, over time, a greater security risk - as those running Windows 7 are likely to find out over the next few years. Even a law requiring manufacturers to periodically prompt users to upgrade their software could have a massively positive security impact.

Laws requiring encryption would also be a huge help. As would a data-minimization law that requires companies to only request and store data that is needed for the functioning of their products. As would some kind of compulsory two-factor authentication.

The fear is that lawmakers will take their focus off terrible IoT security now that they passed a law eliminating default passwords. As far as we are aware, that appears to be playing out with no new security legislation working its way through the corridors of power.

The report also has some interesting observations about specific security risks and OS use. Were witnessing a shift away from attackers primary motivation of running botnets to conduct DDoS attacks via IoT devices to malware spreading across the network via worm-like features, enabling attackers to run malicious code to conduct a large variety of new attacks, the authors noted.

As for the operating systems that critical hospital equipment is using: 56 per cent are on now-unsupported Windows 7 and a vaguely terrifying 11 per cent are still using WinXP. Seven per cent are running unsupported Linux or Unix; with just two per cent using supported Linux.

The report has several pieces of advice to limit exposure to IoT related threats. First up, find out whether you have IoT devices on your network and if so, segment them across VLANs. Then patch, patch, patch - especially easy things like printers. And lastly, switch to active monitoring so you find out faster if something is going on.

Sponsored: Quit your addiction to storage

Read more:
The Internet of Things is a security nightmare reveals latest real-world analysis: unencrypted traffic, network crossover, vulnerable OSes - The...

Read More..
Posted in Internet Security | Leave a Comment

How The Internet Of Things Can Transform Workplace Safety | Baird Capital | Security News – SecurityInformed

March 12, 2020 | Author: admin

As New York City hip hop group Non Phixion boldly proclaimed in their 2002 debut album: The Future Is Now. From drone fleets and autonomous transportation systems to smart homes with computer-controlled lighting, heating, media and security systems, a new group of highly-automated technologies is gripping the popular imagination. These technologies known collectively as the Internet of Things (IoT) form advanced ecosystems of interrelated devices with the capacity to monitor, detect, communicate and act on the real world independently of human intervention. Promising to fulfill all of our wildest technological dreams and needs, the IoT age has arrived and it looks like its here to stay.

While the consumer applications of IoT tend to receive the most attention, one area that is seeing strong growth in the uptake of IoT devices is workplace safety. Workplace safety costs businesses billions every year, and industries with especially hazardous working environments Construction, Oil & Gas, Mining, Utilities, Rail, etc. are beginning to adopt IoT technology to help minimize risk and address preventable threats. Before exploring these IoT solutions, however, let us first consider some of the key threats faced by workers in these industries.

Construction is one of the worlds most dangerous occupations, accounting for 1 in 5 worker deaths in the US and incurring tens of thousands of short- and long-term injuries each year. In construction, the major risk is falling from a height, which accounts of 26 per cent of fatal injuries in the workplace. Additional risks come from being struck by vehicles and heavy moving objects, proximity to overhead/underground high voltage power lines, confined spaces, high noise environments, and exposure to dust and fumes.

In underground mining operations, hazards include respiratory health problems

In Mining & Quarrying, sustained overexertion is the most common threat to workplace safety, accounting for 24 per cent of nonfatal injuries. In surface mining operations, specifically, the leading hazards come from geological instability (i.e. falling rocks), blast debris and collisions with large and heavy plant equipment. In underground mining operations, hazards include respiratory health problems (e.g. Black Lung), explosions and gas leaks (particularly in coal mines), heat stress, confined spaces and ionising radiation.

Other industries are often faced with some combination of the above, or similar, threats. In the Rail sector, for instance, there is high risk from collisions with vehicles, objects and machinery and vulnerability to electric shock. In Utilities, the number one risk is slips, trips and falls, accounting for 30 per cent of Lost Workday Injuries (LWIs) in 2016. And in Oil & Gas extraction, exposure to flammable gas, chemical emissions and oxygen-deficient atmospheres creates vulnerability to explosions and chemical poisoning.

What, then, is being done to tackle these threats? In a high-tech world, many safety measures currently in use hardhats, earplugs, gloves, gas masks, guardrails, harnesses, protective goggles and high visibility clothing appear decidedly primitive. Therefore, whilst these measures are still useful in minimizing risk, companies have started to integrate IoT technologies to enhance their application. These technologies bring together real-time analytics, machine learning, advanced sensors and embedded systems to offer a number of key functionalities:

Wearable technology is used to monitor a workers physiological state in real-time. Japanese wearable tech company Mitsufuji is active in this space, creating smart clothes woven from silver-metallised fibres that collect a range of data about its wearer, including heart rate and body temperature. Other examples include wristbands with bio-sensors to accurately measure stress levels and glasses that detect eye movements to identify fatigue and periods of micro-sleep.

Sensors used to measure temperature, radiation, gas leaks, carbon monoxide and other harmful chemicals can automatically alert workers to unsafe external conditions. Additionally, visual imaging software can map 3D representations of a workers environment, facilitating effective two-way communication between supervisors and personnel in the field, and remote guidance technologies provide live assistance to workers caught in serious danger (e.g. guide a miner trapped in a tunnel to the best way out).

Augmented Reality (AR) technologies offer new ways to support decision making in the field by providing holographic representations of physical equipment, while Virtual Reality (VR) technologies offer immersive situational training without the risks associated with real-life procedures. These technologies also offer up valuable behavioral data, which can be used to gauge a workers risk tolerance level and tendency to respond to danger.

Proximity detection systems utilize wearable sensors to monitor workers location, map their movements, and alert them to nearby hazards. One example of this are radio-frequency identification (RFIDs), which can measure a workers proximity to moving equipment and alert them to possible collisions and near misses. Another piece of kit is the smart helmet, which can immediately detect an accident, determine the workers location and send an alert containing coordinates to a safety control centre. The centre is able to make video and audio contact and communicate with the worker until help arrives.

Exoskeletons can assist with heavy lifting and the prevention of musculoskeletal disorders (MSDs) by analyzing worker movements and providing the necessary support. The Chairless Chair, for example, used by factory floor workers, fixes around the back and legs to provide support whenever the worker sits or crouches. Exoskeletons are also used to monitor worker movements, identifying repetitive movements and sustained periods of overexertion.

IoT innovations are helping to improve workplace safety on multiple fronts

Taken together, these IoT innovations are helping to improve workplace safety on multiple fronts. Firstly, they are preventative. By closely monitoring ones environment both internal and external IoT technologies can pre-empt and alert workers to potential dangers. Secondly, they are responsive. In the case of an accident, IoT technologies can alert supervisors and help coordinate a quick and effective response. Thirdly, they are informative. By accumulating and analyzing rich pools of data, IoT technologies can help optimize work in the field and find improved ways to limit risk.

While IoT certainly cannot eliminate all risk from the workplace it cannot prevent rocks falling in quarries, explosions on oil rigs or gas leaks in mines it can go a long way to make these environments safer and better places to work. Because when it comes down to it, workplace safety is certainly no accident!

Read the original here:
How The Internet Of Things Can Transform Workplace Safety | Baird Capital | Security News - SecurityInformed

Read More..
Posted in Internet Security | Leave a Comment

Applying the 80/20 rule to cloud security – Help Net Security

March 12, 2020 | Author: admin

The 80/20 rule, which was first introduced as Paretos principle in 1941 by American engineer Joseph Juran, suggests that 20 percent of your activities (in life, business, athletics, etc.) will account for 80 percent of your results. Simply put: work smarter, not harder.

How can we apply Paretos principle to cloud security? Within your security activities, what is the key 20 percent that will produce 80 percent of your results when it comes to reducing risk?

One effort that absolutely falls into the 20 percent bucket is reducing threat actor dwell time. Just like a small kitchen fire is far less damaging than a full house fire, the faster you can identify and respond to an incident the more likely it is you escape it without serious damage. If a threat is swiftly and effectively addressed following detection, then subsequent cost factors such as lost business and reputational damage are drastically reduced if not eliminated completely. The 80/20 rule at work!

A focus area to reduce threat actor dwell time is cloud security misconfigurations that accidentally expose data to the internet at large. Exposed data was the most cited cloud security incident (27 percent) and the biggest overall concern of leaders (64 percent) in Cybersecurity Insiders 2019 Cloud Security Report. Garner estimates that up to 95 percent of cloud breaches occur due to human error such as configuration mistakes. Fifty-one percent of companies publicly exposed at least one cloud storage service in 2018, according to RedLocks Cloud Security Trends report.

This presents a challenge because traditional security technologies like IDS/IPS or endpoint protection products are not designed to account for cloud workloads and whether or not they are configured properly. The 2019 Cloud Security report also found 66 percent claimed their traditional security solutions didnt work or were limited in the cloud. Major IaaS providers like Amazon Web Services (AWS) do offer native tools to monitor for misconfigurations, but it is still your responsibility to keep track of your cloud assets and integrate these tools into your security stack, which are both challenges in their own right.

Regardless, the principle of reducing dwell time still applies. More accurately, its about reducing the time that sensitive data is exposed to the internet. To accomplish this, organizations need to be able to execute on three fundamental steps:

If you cant execute these steps, youre more likely to end up in good company with others who have experienced cloud security breaches. Only 37 percent claim confidence in their cloud security posture and 41 percent admit a lack of expertise and training in their staff, according to Cybersecurity Insiders 2019 Cloud Security Report. Capital One, Dow Jones, FedEx and Tesla are some of the most notable companies that have experienced breaches due to exposed cloud services.

So, how to make the 80/20 rule work for you in this context?

Managed Detection and Response (MDR) services have emerged as one of the most effective options to help organizations reduce threat dwell time. MDR often represents a turnkey solution to bolster detection of and response to advanced threats that traditional security solutions miss.

As part of its industry-leading MDR platform, eSentire recently announced its esCLOUD portfolio of services to help organizations hunt and neutralize threats to IaaS and Software as a Service (SaaS) investments. It includes esCLOUD for IaaS, a service that monitors your AWS, Azure or Google Cloud Platform assets, responds and remediates exposed services on your behalf 24x7x365. A welcome addition to our MDR platform and to the 20 percent of security efforts that should drive 80 percent of your results in risk reduction.

To learn more, check out https://www.esentire.com/capabilities/managed-detection-and-response/cloud/escloud.

Read the original:
Applying the 80/20 rule to cloud security - Help Net Security

Read More..
Posted in Internet Security | Leave a Comment

Internet Security Audit Market Report 2020: Acute Analysis of Global Demand and Supply 2025 with Major Key Player: Symantec, Intel Security, IBM,…

March 12, 2020 | Author: admin

The Global Internet Security AuditMarket Research report provided by Reports Monitor is a detailed study of the Global Internet Security AuditMarket, which covers all the essential information required by a new market entrant as well as the existing players to gain a deeper understanding of the market. The Global Internet Security AuditMarket report is divided in terms of regions, product type, applications, key players and other important factors. The report also covers the global market scenario, providing deep insights into the cost structure of the product, production and manufacturing processes and other essential factors. The report also covers the global market scenario, highlighting the pricing of the product, production and consumption volume, cost analysis, industry value, barriers and growth drivers, major market players, demand and supply ratio of the market, the growth rate of the market and forecast till 2025.

TheTop Leading players operating in the market: Covered in this Report: Symantec, Intel Security, IBM, Cisco, Trend Micro, Dell, Check Point, Juniper Networks, Kaspersky, Hewlett Packard, Microsoft, Huawei, Palo Alto Networks, FireEye, AT&T Cybersecurity, AVG Technologies, Fortinet, ESET, Venustech, H3C Technologies, NSFOCUS & More.

To Download PDF Sample Report, With 30 mins free consultation! Click Here: https://www.reportsmonitor.com/request_sample/887996

With this global Internet Security Auditmarket research report, all the manufacturers and vendors will be aware of the growth factors, shortcomings, threats, and the lucrative opportunities that the market has to offer in the next few years. The Internet Security Auditmarket research report also highlights the revenue, industry size, types, applications, players share, production volume, and consumption to gain an understanding about the demand and supply chain of the market.

Product Type Coverage (Market Size & Forecast, Major Company of Product Type etc.):System Level AuditApplication Level AuditUser Level AuditApplication Coverage (Market Size & Forecast, Different Demand Market by Region, Main Consumer Profile etc.):GovernmentEducationEnterpriseFinancialMedicalAerospace, Defense and IntelligenceTelecommunicationOthers

Global Internet Security AuditMarket: Regional SegmentationNorth America(United States, Canada, and Mexico)Europe(Germany, France, UK, Russia, and Italy)Asia-Pacific(China, Japan, Korea, India, and Southeast Asia)South America(Brazil, Argentina, Colombia, etc.)Middle East and Africa(Saudi Arabia, UAE, Egypt, Nigeria, and South Africa)

Grab Your Report at an Impressive Discount! Please click [emailprotected]https://www.reportsmonitor.com/check_discount/887996

Years that have been considered for the study of this report are as follows:

What does the report offer?

Click to view the full report details, Reports TOC, Figure and [emailprotected]https://www.reportsmonitor.com/report/887996/Internet-Security-Audit-Market

Contact UsJay MatthewsDirect: +1 513 549 5911 (U.S.)+44 203 318 2846 (U.K.)Email:[emailprotected]

Read the original:
Internet Security Audit Market Report 2020: Acute Analysis of Global Demand and Supply 2025 with Major Key Player: Symantec, Intel Security, IBM,...

Read More..
Posted in Internet Security | Leave a Comment

Students Showed Trend Micro a World Without the Internet – Business Wire

March 12, 2020 | Author: admin

DALLAS--(BUSINESS WIRE)--Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global leader in cybersecurity solutions, through its Internet Safety for Kids and Families (ISKF) program, today announced the winners of its Whats Your Story? 2020 video competition. This years challenge was to create an impactful video around the question, If the internet disappeared today, what would your life be like?

Contestants and schools across 22 states and 2 provinces submitted entries focused on a variety of topics ranging from the fears of economic impact to the relief of being freed from devices in order to do new things offline. Judges for this years competition included representatives from TikTok, Twitter, iCanHelp, MediaSmarts, the National Association for Media Literacy Education, the Cyberbullying Research Center, and ConnectSafely.

Every year we are utterly amazed at the creativity of our contestants. This year we received entries from familiar cities, provinces and schools and welcomed new ones stretching as far as Hawaii and Alaska, said Lynette Owens, global director of the Internet Safety for Kids and Families program for Trend Micro. However, what inspired us most by this years entries was how the youngest generation sees a world that has always had the internet. We did not just see negative reactions, but many that expressed relief, hope, curiosity and the determination to move forward in what would be a new world.

The grand prize in the individual category was awarded this year to Kunwoo Kim of Honolulu, HI for the entry The Perfect Plan. This entry gave judges a short glimpse into his perfect day and how reliant we are as individuals on the internet, and what changes would occur for him without it. Runner-ups included Anna Tai of Carmel, IN who submitted an inspirational animation The Aha Moment and Brad Kendrick of Logan, UT who poked fun at his own internet reliance through Chads No Internet Life.

For the school category, the grand prize was issued to teacher Zachary Mondres and the Rocky Run Film Club of Chantilly, VA. The entry A Dream Pursued focused on a young girl who realizes that without the weight of the internet pushing on her she could pursue her dream of playing basketball for her school team. Runners-up included student Coble Hartman of Alexander Early College of Taylorsville, NC for a dystopian view of an internet-free world in 2 Months After and student Isaiah Gonzalez and Long Branch High School, Long Branch, NJ who submitted A Day Without the Internet calling upon viewers to try 24 hours without internet access.

Whats Your Story? is an annual international competition that encourages students to explore multiple issues related to safe, responsible and successful technology use. Unlike most video contests, participants must both submit an entry and demonstrate that they can be an advocate for their own message. Contestants are asked to encourage their fans and communities to view and rate their entries as evidence of this advocacy. A complete list of the 2020 winners and finalists, past winners, and more about the contest can be found at whatsyourstory.trendmicro.com.

About Trend Micro Internet Safety for Kids & Families

Founded in 2008, the mission of Trend Micro's Internet Safety for Kids & Families is to enable and empower kids, parents, teachers, and schools around the world to make the Internet a safe and secure place for today's youth. ISKF does this through a worldwide employee volunteer program, grants and donations to eligible organizations, strategic partnerships with organizations working to protect youth, educational programs, and a robust series of online tips and solutions for parents, educators, and youth. For ISKF's free Internet safety tips, tools and advice, visit: https://internetsafety.trendmicro.com/.

About Trend Micro

Trend Micro Incorporated, a global leader in cybersecurity solutions, helps to make the world safe for exchanging digital information. Our innovative solutions for consumers, businesses, and governments provide layered security for data centers, cloud environments, networks, and endpoints. All our products work together to seamlessly share threat intelligence and provide a connected threat defense with centralized visibility and control, enabling better, faster protection. With more than 6,000 employees in over 50 countries and the worlds most advanced global threat intelligence, Trend Micro secures your connected world. For more information, visit http://www.trendmicro.com.

Read more:
Students Showed Trend Micro a World Without the Internet - Business Wire

Read More..
Posted in Internet Security | Leave a Comment

The Hidden Dangers of China’s Digital Silk Road – The National Interest

March 12, 2020 | Author: admin

China switched on the largest commercial 5G network to date on October 31, 2019. Thats when Chinas three state-owned wireless carriers, China Mobile, China Unicorn, and China Telecom, unveiled 5G subscription packages. The wireless carriers noted that they would be charging customers for speed rather than data useand peak speed would cost around $45 a month. Beijing has promised that the next-generation network will unleash a technological revolution. The announcement is a message to the United States and the world that Chinas push toward 5G global dominance will not be slowed by U.S. opposition.

Chinas investment in next-generation technologies, including information communications technology (ICT), artificial intelligence, big data analytics, cloud computing, and blockchain among others has become a high priority under President Xi Jinping. A series of government directives, white papers, initiatives, and planning strategies have pushed Chinese tech firms toward the right technologies. This ambition to turn China into a global technological and cyber power is openly geopolitical in nature as the 2016 Outline of the National Strategy for Innovation-Driven Development shows: disruptive technologies are constantly emerging, continually reshaping the worlds competitive landscape, and changing the balance of power among states.

Beijings rapidly-expanding digital and telecoms infrastructure projectsall part of the Digital Silk Roadacross the Eurasian landmass will have real-world effects on the people who live within such systems, impacting systems of governance and state power over data. As Chinese tech firms export these complex ecosystems of technologies, norms, and standards in the Smart City and Smart Port programs, the United States and its allies will have to monitor how they impact recipient nations.

For while the normative impact of these technologies is of concern, it is their wider structural potential on the global order that is the most alarming.If one considers the constituent components of the Western orderfinance, banking, technological dominance, influence over market and trade rulesit is clear that Beijing is offering alternatives at every level, constructing a vast new order that suits its own preferences. Despite the disparate nature of Chinas activities, collectively they form the basis for future hegemony. In this article, we focus on three areas in which the PRC is using technology to advance its aims: values and governance, markets and trade, and shipping.

Values and Governance

As aforementioned, Smart Cities, built on the data-rich bedrock of 5G networks, integrate disparate information from different sources to create a centralized data-exchange platform critical to day-to-day operations of administrative, industrial, environmental, energy, and security systems. The premise is that a better-integrated and effectively-operated city boosts economic activity, and promotes sustainable growth into the future, a promising technology for many municipalities in South Asia where population growth is creating fast-growing new cities. However, China will export values and norms as it trains future users of its equipment, using research networks like the National Engineering Laboratory (NEL) for Big Data Application on Social Security Risks Sensing, Prevention and Control. A 2018 Freedom House report noted how China offers training packages to foreign officials on how to handle big data on public opinion management and new media development. ZTE has helped Venezuela surveil and control its population through a smart ID card system. Linked to Chinas satellite system, the cards store location data, financial information, banking transactions, healthcare, and even voting records. The government uses the cards to control access to public benefits. Some states are shaping their cyber laws to mimic those of China with Vietnam, Egypt, Tanzania, and Uganda, producing laws, not unlike the 2016 China Internet Security Law, which requires the collection and verification of users identities.

There is a very real danger that as the chief architect and administrator of these digital networks and Smart Cities, Beijing will have access to reams of data in recipient nations, either through intelligence-sharing pacts or through direct server accessanother requirement of the 2016 Internet Security Law. Access to this dataand the ability to harvest it using big data analyticswould give Beijing leverage in the form of kompromat, using sensitive information to influence key foreign leaders on issues critical to Chinese interests.

Markets and Trade

The proliferation of Chinese mobile payment appssuch as Alipay, Baidu Wallet, and WeChat Paywill increase the amount of financial data going through Chinese hands as all such transactions must pass through a Peoples Bank of China clearinghouse, Wanglian. This enables not only Chinese tech companiesbut also its state bankto know foreign financial transactions in real-time. Aside from the expansion of mobile Chinese electronic payments systems, Chinese-built ICT networks and systems across the Digital Silk Road push recipient nations to favor both Chinas currency and its companies. In addition to currency swap agreements with many BRI partners, China has made clear its intent to de-entrench the world economy from the dominance of the dollar. The Cross-Border Inter-Bank Payments System is thought by some to be a challenge to the U.S.-led Society for Worldwide Interbank Financial Telecommunication.

As Chinese fintech grows, Chinese firms will benefit from valuable consumer information, similar to how Amazon employs real-time search aggregation to gain insights into consumer trends and wants. Chinese companies can use artificial intelligence to assess real-time market needs on a global scale. Privileged companies can bring desired products to the market ahead of domestic or U.S. companies. Moreover, Chinese companies understand the exact capacities and needs of the host countries, giving them a distinct competitive advantage over both Western and local firms in product design and production. This advantage is likely to be particularly acute in areas that China believes to be strategically important, such as in autonomous vehicles, artificial intelligence, and the Internet of Things.

SLOC Transportation Pillar

One of the oldest pillars of hegemonic power has been controlling thesea lanes and the trade that takes place upon them. Eighty percent of global trade is transported by sea and nearly two-thirds of sea trade passes through Chinese-owned ports. As of 2019, Chinese State-owned enterprises like COSCO and China Merchants own forty-two major ports in thirty-four countries across the Eurasian and African coastlines. Here, Chinas Digital Silk Road and its Maritime Silk Road come together in the form of Smart Ports. Centralizing data and increasing automation will create efficiencies and automation in loading, thus increasing capacity.

In one network, the Big Data Risk Monitoring Platform at Nannings Customs Office tracks cross-border trade with twenty-six ports across Southeast Asia. This platform allows China to track the real-time status of goods, destinations, and relationships around the world. While shipping manifests do track the movement of goods, never before have ports had the capability to comprehensively map real-time global supply chains. This information allows for an unofficial sanction system that targets the goods of nations (or even individuals) that the PRC wishes to influence. Indeed, China has already done this in a low-tech way when it restricted Philippine banana exports from entering Asian markets between 2016 and 2018 over bilateral tensions related to the South China Sea.

The world is rapidly changing and there are signs that Chinas ambitions with the Belt and Road Initiativeand all its digital componentsare part of the sticky power of a new hegemony. Chinese leaders recognize that new disruptive technologies are harbingers of change for people-to-people contacts and can also change how states trade, police, and run their municipalities. Beijings promotion of its tech firms across the Eurasian landmass allows for the future exploitation of international data for political effectallowing Chinese leaders to set rules, create norms and standards, and to control trade and political activity. We are entering an age of competition and it is not only between nations but between ideologies and the states that host them.

Dr. John Hemmings is an associate professor at the Security Studies College of the Daniel K. Inouye Asia Pacific Center for Security Studies, a US Department of Defense regional center as well as a senior associate fellow at the Henry Jackson Society, a London-based think tank. He writes in his own personal capacity.

Patrick Cha is an intern at the Daniel K. Inouye Asia Pacific Center for Security Studies. He is a 2019 graduate of the Woodrow Wilson School of Public and International Affairs at Princeton University.

Image: Reuters

Read more here:
The Hidden Dangers of China's Digital Silk Road - The National Interest

Read More..
Posted in Internet Security | Leave a Comment