Bloomberg is hosting a conference on Cybersecurity. Bloomberg is on the cutting edge of the field and they are doing a great job bringing threats into the public eye.
Researcher uncovers hundreds of different custom malware families used by cyberspies -- and discovers an Asian security company conducting cyberespionage
This article raises some serious questions in my opinion. As we move more into an environment where cyber warfare is to be used against different countries, where are the lines drawn between declaring war. As this article discusses, it is not as easy to see who actually was behind the attack, and an attack coming from Chinese, or some other countries IP space, is not neccessarily a state sponsored attack, nor is it neccessarily coming from someone inside the country. In a hack back scenario, it could be determined after the fact that whatever country was thought to initiate the first move, was actually a victim of a "zombie/bot" type of controlled attack that was actually initiated in another country. Can you say, Wargames? Edited 3222013: as I spoke yesterday, today guess what? http://news.yahoo.com/skorea-misidentifies-china-cyberattack-origin-071350510.html
This standards publication (FIPS 140-2) is a key standard's document. Skim through it and see if you can find some ideas for emerging threats against the standard(s).
FIPS 140-3 is on its way and is needed as 140-2 is quite old now. Interestingly however, crypto is one of the slower moving changes in information security. Many of our algorithms have been around for many years; we have moved forward by increasing key size rather than changing the algorithms. AES and 3DES are still FIPS approved, whereas RC4 is not (which is used by many internet giants such as google and facebook).
Any time you are allowed to introduce code into a program, you have a chance for error. By allowing cryptographic software and firmware to be updated, I think you will always have the chance for emerging threats to be introduced in the form of malware. Recently, the U.S. has stopped allowing the use of Chinese built hardware for certain DOD/ Federal agencies. if we allow the enemy to build the devices we use to form our security foundations, we have already lost the war.
I believe the frequency of review of this policy is untimely to the speed technology advances in. If they could move the review from 5 years to 2 years will suffice. At times, once the policy is published folks are already working on the revision to keep up with technology growth.
"Since a standard of this nature must be flexible enough to adapt to advancements and innovations in science and technology, this standard will be reviewed every five years in order to consider new or revised requirements that may be needed to meet technological and economic changes."
Two things I found very interesting about Flame is the size of the malware as well as the ability to utilize Bluetooth to collect data. Considering Bluetooth usage has increased in some countries and is automatically turned on by default on cell phones, this could enable a lot of information to be collected.
We will see more of this type of modification of Stuxnet and Flame. The bad thing about finding stuff like this, is others who could not have made malware as technically advanced as this, will be able to modify it much easier than if they would have had to design it from scratch.
focused on the comment made by the analyst on the differentiation of cyber "war" vs. cyber "espionage" as it appears that Flame is more on cuber espionage since it is desgined to collect infor from specific targets.
Interesting article, It seems to me that this is just another one of those cases about flexing the "muscle" of the Freedom of Information Act. In my opinion it is pretty common knowledge that targeted drone strikes are being used to eliminate enemies; so why is it so important here that the C.I.A. has to acknowledge these attacks? What would that accomplish? The media outlets already report on successful drone strikes and now there are even military medals to recognize drone pilots.
http://www.fsunews.com/article/20130318/FSVIEW0303/130317001/New-military-medal-stirs-controversy-?odyssey=mod|newswell|text|frontpage|s
I just wonder how long it's going to take before something comes out of these attacks. Using these drones to fly into other countries like Pakistan, and "take out" suspected enemies is pretty borderline in my opinion. If this were to happen in America, we would certainly not stand for it, and would declare war on the country that carried out the action. Pushing the button from California on a drone missle is alot like conducting cyber warfare from one country to another. The damage that can be done is becoming greater and greater every day as technology is starting to tie together national infrastructures. In my opinion, drones are the some of the first of the cyber warfare machines.
Advanced technology is a competitive advantage for the United States, and it must be used if the country is to win its war on terrorism. Biometric technologies-such as iris recognition, handgeometry, finger recognition, facial recognition, and voicerecognition-have substantial potential to improve national securityby providing a means to identify and verify people in manycontexts.