Identifying the Person Behind Bitcoin Fog

The person behind the Bitcoin Fog was identified and arrested. Bitcoin Fog was an anonymization service: for a fee, it mixed a bunch of people’s bitcoins up so that it was hard to figure out where any individual coins came from. It ran for ten years.

Identifying the person behind Bitcoin Fog serves as an illustrative example of how hard it is to be anonymous online in the face of a competent police investigation:

Most remarkable, however, is the IRS’s account of tracking down Sterlingov using the very same sort of blockchain analysis that his own service was meant to defeat. The complaint outlines how Sterlingov allegedly paid for the server hosting of Bitcoin Fog at one point in 2011 using the now-defunct digital currency Liberty Reserve. It goes on to show the blockchain evidence that identifies Sterlingov’s purchase of that Liberty Reserve currency with bitcoins: He first exchanged euros for the bitcoins on the early cryptocurrency exchange Mt. Gox, then moved those bitcoins through several subsequent addresses, and finally traded them on another currency exchange for the Liberty Reserve funds he’d use to set up Bitcoin Fog’s domain.

Based on tracing those financial transactions, the IRS says, it then identified Mt. Gox accounts that used Sterlingov’s home address and phone number, and even a Google account that included a Russian-language document on its Google Drive offering instructions for how to obscure Bitcoin payments. That document described exactly the steps Sterlingov allegedly took to buy the Liberty Reserve funds he’d used.

Premium Domain Names – transcom.uk
Transcom ISP – The UK’s Best Business ISP
DoubleCheck any website at doublecheck.uk

Stupid Is as Stupid Does: XDR Is About the Journey, Not the Destination

Music is lovely, isn’t it?

It has the ability to brighten days with upbeat bars or provide a comfortable place of solace and reflection via gentle, soothing notes. Whether you typically opt for Black Sabbath, Shakira, or Bob Marley, music meets our ears in many different ways – and harmony is not always one-size-fits-all. We recognize this when a friend, sibling, partner, or stranger earnestly (yet tonelessly) attempts to mimic Mariah Carey’s five-octave range, resulting in room-clearing screeches that can only be found in a nature documentary.

While I’m not a Grammy-winning artist myself, my point is that harmony is relatable and relevant across any industry, method, measure, or format – even security. Trends and messaging have increasingly pointed to the consolidation of everything across Security Operations Centers (SOC) so they can act in a harmonious manner, not missing a beat to provide protection across the entire enterprise. We’ve seen this as conversations shift from endpoint detection and response (EDR) to extended detection and response (XDR), with the latter promising lower total cost of ownership as well as improved protection and productivity. Who wouldn’t want this!

But the truth is, it isn’t lack of desire for full protection in the most cost-effective and efficient manner, but lack of knowledge or perceived roadblocks. Enterprises across the world have been affected by the global pandemic, uprooting familiar processes. Companies were forced to introduce quick, sometimes temporary solutions for larger systemic issues all without 100 percent certainty where endpoints may lie and what damage this vulnerability presents, especially as bad actors extort the chaos created by COVID-19 to double down on attacks.

This upheaval has started to settle down and enterprises now have more time and energy to audit their businesses and processes with fresh eyes. It isn’t a matter of the pandemic, with hope, nearing its end, to just re-plug in an existing solution stack – but rather looking at how the business has changed and adapting to these changes for now and into the future. This includes changes across staff, solutions, shifting skillsets to manage increased workloads, and yes – increased, and perhaps hasty, consolidation attempts.

Penning the Lyrics

According to Enterprise Strategy Group, more than 80 percent of organizations are singing the tune of change with plans to increase spending on threat detection and response. They are hearing the melodious mandate to meet the needs of today’s “new-normal-digitally transformed-modern” enterprise. For many, this means an investment in extended detection and response (XDR) technology.

Enterprises are already feeling the pressure. They have their bottom lines trapped on repeat, looping in their minds. They are seeking counsel, support, and direction – not to be chastised by their choices – but rather guided to create and implement strategies that best fit their business.

That being said, the potential for XDR is tremendous. But you have to crawl before you can walk. I’m sure many of us may feel silly, or even stupid, thinking back to when we carried Walkman and Discmans, clunkily fumbling for them in our pockets or purses, forever tethered to the device if you wanted to listen to music. But at the same time, we recognize the progression from Walkman to iPod to iPhone to Bluetooth and voice-activated technology, and more. The Discman and Walkman crawled so digitized music could walk.

This natural progression is no different in the security industry, and the onus is on vendors to make this connection. Enterprises, after all, are not still storing floppy disks locked in a filing cabinet as a security measure. While XDR is the latest technology, the journey to XDR includes the fundamental need of endpoint detection and response (EDR) capabilities. EDR is a foundational piece in getting XDR right – or put another way, XDR is an efficient evolution of EDR platforms. EDR crawled so XDR could walk. XDR will walk so the next technology can fly.

Hitting the Right Notes

This is what true innovation is, the constant desire to advance processes, products, and experiences. It is what XDR promises, to improve and streamline processes across enterprise SOCs, providing meaningful context, actionable intelligence, and the visibility and control necessary to connect solutions that orchestrate together in symphonic harmony.

In fact, from a philharmonic standpoint, symphonies by definition are made up of different types of instruments (endpoints) generating music (data) where each requires incredibly specific methods of tuning and expertise by musicians (SOC analysts) in order to ensure they can be harmonious with the group. Musicians are not born with their skillset, but rather they test and learn – and fail – trying to see which instrument is the best fit for them, which notes they can hit, and which notes are best suited for another instrument or musician to manage.

We must be the conductor and connecting point here to show the true benefits and value of XDR. While the journey is different for every enterprise (and vendor), the end goal is a protected society where good prevails over bad. It is our job to guide these choices and take responsibility regardless of where an enterprise is at in their journey – to show how innovation builds on itself, always striving to better experiences and outcomes.

Where are you in the journey to XDR? Check out the on-demand webinar below and start asking questions.

The post Stupid Is as Stupid Does: XDR Is About the Journey, Not the Destination appeared first on McAfee Blogs.

Premium Domain Names – transcom.uk
Transcom ISP – The UK’s Best Business ISP
DoubleCheck any website at doublecheck.uk

McAfee Recognised in 2021 Gartner Solution Scorecard Report

Industry analysts perform a huge service in evaluating markets, technology, vendors and sharing their insights with customers via one-on-one discussions and regular publications and events. Gartner publishes Magic Quadrant reports that review a particular market and evaluate vendors for their Completeness of Vision and Ability to Execute.

Gartner also has a separate team of analysts called the Technical Professionals Team that evaluates single products in greater depth. Their reports review each product or product family across hundreds of criteria and produce a scorecard, key findings and customer recommendations.

We are proud to read new Solution Scorecard for McAfee MVISION Cloud by Gartner, where we scored “94 out of 100 against Gartner’s 480-point Solution Criteria for Cloud Access Security Brokers”. MVISION Cloud was the only CASB product to score 94 out of 100 in the 2021 scorecards.

We have licensed it for anyone to read.

We believe, for this review, they reviewed 480 sets of criteria across eleven areas from architecture, management and functions such as data security, threat protection and Cloud Security Posture Management. Once they had reviewed and weighted each attribute, MVISION Cloud came out with a total blended total score of 94 out of 100.

The framework that they used splits each of the criteria into one of three categories – Required, Preferred and Optional. We are pleased to see that they consider MVISION Cloud provides 97% of the Required functionality.

We have also licensed the Magic Quadrant for Cloud Access Security Brokers report from October 2020 – available here.

 

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from McAfee. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s Research & Advisory organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Gartner, Solution Scorecard for McAfee MVISION Cloud, 5 April 2021, Sushil Aryal, Dennis Xu, Patrick Hevesi

 

The post McAfee Recognised in 2021 Gartner Solution Scorecard Report appeared first on McAfee Blogs.

Premium Domain Names – transcom.uk
Transcom ISP – The UK’s Best Business ISP
DoubleCheck any website at doublecheck.uk

5 Ways to Reset Your Family’s Digital Habits this Summer

Ahhhh. Can you feel it? Summer is so close. Everything feels a little more buoyant, a little brighter. We’re in the home stretch of social distancing, a sense of normalcy is returning, and there’s a collective energy that’s ready to throw the screen door open, run outside, and pounce on summer.

There’s no doubt you’ve established great digital ground rules that worked well during quarantine. However, as we begin the mental trek toward some degree of our former life, summer may be the perfect window to think about a digital reset.

A reset is simply taking a moment to pause, assess, and adjust where it makes sense. Consider what digital expectations and ground rules you established during the pandemic, what worked for your family, and what needs to be phased out before the new school year approaches.

Where we’ve been

We know that during quarantine, kids’ screen time doubled for several reasons, including learning from home, needing to connect with friends online more, and boredom. During the pandemic, we also knew that helping kids manage the ongoing stress of homebound life was crucial for helping them maintain digital, emotional, and physical health. All of these factors impacted our digital routines and expectations.

Where we’re going                 

Summer routines will look different for every family. Some students are attending school on site throughout the summer as many districts strive to bridge 2020 learning losses. Other students will enjoy a traditional summer break before starting back to school in a few months.

Whichever way your family’s summer routine rolls out, here are a few small shifts you can begin making today that will slowly help you re-establish smart digital habits.

5 ways to reset your digital habits

1. Pause, assess, adjust.  Stop to evaluate the role technology has grown to occupy in your home over the past year. Assess your family’s screen time and device habits that shifted or grew. Where do you need to help your kids slowly pull back? How many hours a day do the kids play video games? How much TikTok or YouTube scrolling is going on? Are the TV binges out of control? Is there still a phone curfew in place, or have kids started taking their phones to bed?

2. Give parental controls a go.  If you gave your kids a little more device freedom during the pandemic and put the idea of  parental controls on hold, summer is a great time to give this option a go. Test monitoring features, content filters, and make adjustments that fit your family’s needs. If your goal for your kids is less device time and more outside time this summer, parental controls include screen limits to help you reset any poor habits that have set in.

3. Safety and Privacy revamp. During summer especially, take time to understand the friends your kids connect with online – new friend groups can form over the summer. Review privacy and location settings on apps. Teens often leave their location on for one another so they can find things to do. This practice isn’t always a good idea since location-based apps can open your family up to risks.

4. Screen-free zones.  Another wise habit that may have gone by the wayside is creating screen-free zones such as the dinner table, the bedroom, restaurants, and family trips. Setting a tech curfew is also a great way to help kids get into consistent sleep patterns. These few steps can add hours of family time to your day and give kids a much-needed device break. If you are going on vacation, creating screen-free zones on your trip will ensure you are fully engaged and don’t miss out on the experience.

5. Get a plan.  The summer has a way of flying by, especially if kids end up playing video games, watching YouTube videos, or chatting on social media all day. Get in front of that temptation with a plan. Collaborate on a wish list of things every family member would like to do over the summer. Maybe it’s canoeing, a trip somewhere fun, a family project, volunteering, or a new hobby that taps into their creativity.

As you ease back into new habits, remember to share your reasoning for the reset. Handing down digital edicts rarely sticks, but when kids understand the mental and physical benefits of balancing their technology, they will be more likely to get on board with the change.

Stay Updated  

To stay updated on all things McAfee and on top of the latest consumer and mobile security threats, follow @McAfee_Home on Twitter, subscribe to our email, listen to our podcast Hackable?, and ‘Like’ us on Facebook.

The post 5 Ways to Reset Your Family’s Digital Habits this Summer appeared first on McAfee Blogs.

Premium Domain Names – transcom.uk
Transcom ISP – The UK’s Best Business ISP
DoubleCheck any website at doublecheck.uk

PC Gamers (and Parents of Gamers) Rejoice!

Of all the pastimes that took off during the pandemic, it’s not surprising that online gaming was one of them. After all, gaming offers excitement, new experiences, and social interaction, all from the comfort of home. It’s no wonder then that the gaming industry saw a 20% increase in revenue in 2020, as new and previously-retired gamers returned to this pastime. 

But while the gaming industry was finding a lot of new allies, the players themselves faced growing exposure to malware and threats. Our 2020 Mobile Threat Report found that gamers are being targeted with phishing attacks and malicious apps, aimed at stealing usernames and passwords. With this information, hackers could potentially steal hard-earned in-game collectibles, as well as real-world money and personal information. And PC gamers face similar threats, from viruses and spyware to network attacks that could potentially put their personal information and property at risk. 

While 75% of gamers surveyed worry about their security while gaming in the future, some worry they’ll have to compromise performance to be protected. That’s why McAfee® Gamer Security offers robust protection to PC gamers with one of the lowest impacts on system performance in the industry. 

To protect the growing number of gamers against increasing threats, we are offering one free year of McAfee Gamer Security for one gaming PC to multi-device McAfee ® Total Protection  and McAfee® Live Safe™ users in the U.S. This powerful software was built from the ground up to address the challenges gamers face, with speedy performance, system optimization, uninterrupted gaming, and no pop-up apps. 

But don’t just take it from me. This is what one of our users have to say: “I believe [McAfee Gamer Security] had a positive impact … because it increased the speed of my game as well as gave me peace of mind that I was protected during my gameplay​.” 

We know that gamers are some of the most tech-savvy and connected users out there, so it’s important that we meet them where they are by giving them the performance and security they need to play at full throttle. After all, many users are seeking stress relief through gaming, not the extra worry over their online security. 

With McAfee Gamer Security we made security for players more fun, by including a gamer-centric interface that was inspired by familiar apps like game launchers — you can check the current status of your system and key resources that impact in-game performance, like GPU, CPU, and memory, as well as perform real-time optimization. And of course, we’ve also included monitoring for your all-important FPS (frames per second). You can even access past performance data to better understand your game-by-game trends. 

Let’s keep the excitement of gaming while adding the extra confidence of knowing that your digital life is protected. Whether you are new to McAfee or already enjoying our personal protection, you can download McAfee Gamer Security for free in under one minute with a qualifying subscription! In our mission to provide users with personal protection, we are welcoming PC gamers with open arms. 

Stay Updated 

To stay updated on all things McAfee and on top of the latest consumer and mobile security threats, follow @McAfee_Home  on Twitter, subscribe to our email, listen to our podcast Hackable?, and ‘Like’ us on Facebook. 

The post PC Gamers (and Parents of Gamers) Rejoice! appeared first on McAfee Blogs.

Premium Domain Names – transcom.uk
Transcom ISP – The UK’s Best Business ISP
DoubleCheck any website at doublecheck.uk

The Mothers of Invention: Women Who Blazed the Trail in Technology

It’s easy to imagine where we would be without women in technology.

We’d be poorer for it.

With Mother’s Day upon us, I couldn’t help but think once more about the stark employment figures I shared in my International Women’s Day blog just a few weeks ago. Millions of women have involuntarily left the workforce at a much higher rate than men during the pandemic—with roughly one third of women in the U.S. aged 25-44 citing that childcare was the reason for that unemployment.

Reflecting on this further, I thought about the women in technology who’ve left their positions during this past year. It’s a loss of talent and capability that’s set back decades of advances by trailblazing women who not only shine in their field yet also do so in male-dominated realms of study, research, and employment.

So as we look ahead to recovery, we should also look back. By celebrating just a few of the women in technology who shaped our world today, women who truly are “mothers of invention,” perhaps we can remember just how vital women are in our field—and how we should double down on our efforts to welcome them back.

Margaret Hamilton—The software that ran the moon landing

Imagine a time when the term “software engineering” wasn’t recognized, even though it was crucial to us landing on the moon.

Such were the days when Margaret Hamilton began her work at Massachusetts Institute of Technology (MIT) as a job to support her family while her husband went to law school at Harvard. This was in 1959 and would introduce her to Edward Lorenz, the father of chaos theory, and put her on the path to help humanity set its first footsteps on the moon.

It was her work and her code that developed a software-driven system that warned astronauts of in-flight emergencies, an advance she credits her young daughter for inspiring, as recounted in this interview:

Often in the evening or at weekends I would bring my young daughter, Lauren, into work with me. One day, she was with me when I was doing a simulation of a mission to the moon. She liked to imitate me – playing astronaut. She started hitting keys and all of a sudden, the simulation started. Then she pressed other keys and the simulation crashed … I thought: my God – this could inadvertently happen in a real mission.

I suggested a program change to prevent a prelaunch program being selected during flight. But the higher-ups at MIT and NASA said the astronauts were too well trained to make such a mistake. Midcourse on the very next mission, Apollo 8, one of the astronauts on board accidentally did exactly what Lauren had done. The Lauren bug! It created much havoc and required the mission to be reconfigured. After that, they let me put the program change in, all right.

Karen Spärck Jones—The intelligence behind search

When you search online, you have this woman to thank.

A true pioneer, Karen Spärck Jones worked at Cambridge, during which time she developed the algorithm for deriving a statistic known as “term frequency–inverse document frequency” (TFIDF). In lay terms, TFIDF determines how important a word is relative to the document or collection of terms in which it is found. Sound familiar? It should, as her work forms the basis of practically every search engine today.

Spärck Jones remained outspoken with regards to what she referred to as “professionalism” in technology. This had two layers: the first being the technical efficacy of a solution, the second being the rationale for even doing it in the first place. In her words,

“[T]o be a proper professional you need to think about the context and motivation and justifications of what you’re doing … You don’t need a fundamental philosophical discussion every time you put finger to keyboard, but as computing is spreading so far into people’s lives you need to think about these things.”

Rear Admiral Grace M. Hopper

Her vision for computing and her hands-on work led to development of COBOL, a programming language still in use today. Driving that vision was the belief that human language could be used as the basis for a programming language, making it more accessible, particularly for business use. The result was the FLOW-MATIC programming language, which was later developed into COBOL, a language that is estimated to be used in 95% of ATM card swipes.

During her time as a naval officer, she helped transform centralized Defense Department systems into smaller, distributed networks akin to the internet we now know and use. At her retirement near the age of 80, she went to work in the private sector where she held the role of full-time senior consultant until her passing at age 85. This 1983 profile of her, aired when she was 76, is certainly worth a watch.

Radia Perlman—Internet Hall-of-Famer

Quite plainly, Perlman’s work paved the way for the routing protocols that underpin the modern internet.

Prior to Perlman’s work, as networks grew and accordingly became more complex, data would often flow into loops that prevented them from reaching their intended destination. Enter her creation of the Spanning Tree Protocol (STP), which can handle large clouds of computers and network devices. While its since evolved, the concept of an adaptive network remains squarely in place.

Another advance of hers was introducing computer programming to young children aged 3 to 5 back in the 1970s. While working at MIT’s LOGO Lab, she created TORTIS (Toddler’s Own Recursive Turtle Interpreter System), which used buttons from programming and allowed for experimentation with a robotic turtle that would follow a toddler’s commands. In the abstract for her paper that documented the work, she emphasized what she felt was a vital point, “Most important of all, it should teach that learning is fun.”

Getting Involved

These women have led and inspired, and likewise it’s on all of us in technology to build on the advances they made possible through both our work and the workplace cultures we foster—particularly as we begin our recovery from this pandemic.

One of the many reasons I’m proud to be a part of McAfee is our Women in Security (WISE) community. It’s truly a forward-thinking program, which we introduced to enrich and support women in the tech sector through mentorship programs and professional development conferences. It’s one of the several, tangible ways we actively strive for a vibrant and diverse culture at McAfee.

Another powerful voice for women in tech is AnitaB.org, which supports women in technical fields, as well as the organizations that employ them and the academic institutions training the next generation. A full roster of programs help women grow, learn, and develop their highest potential.

And for looking forward yet further, there’s Girls Who Code, which is building the next generation of female engineers and technologists. Their data shows why this is so vital. They found that 66 percent of girls aged six to 12 show interest in computing, but that drops to 32 percent for girls aged 13 to 17, and then plummets to only 4 percent for college freshmen. Accordingly, they support several programs for school-aged girls from third grade up through senior year of high school, help educators and communities launch clubs, and advocate for women in their field through their work in public policy and research.

And that’s just for starters. For an overview of yet more organizations where you can get involved, check out this list of 16 organizations for women in tech—all of which help us realize a better world with women in technology.

Stay Updated 

To stay updated on all things McAfee and on top of the latest consumer and mobile security threats, follow @McAfee_Home  on Twitter, subscribe to our email, listen to our podcast Hackable?, and ‘Like’ us on Facebook.

The post The Mothers of Invention: Women Who Blazed the Trail in Technology appeared first on McAfee Blogs.

Premium Domain Names – transcom.uk
Transcom ISP – The UK’s Best Business ISP
DoubleCheck any website at doublecheck.uk

British Prime Minister’s Cell Phone Number Exposed

British Prime Minister’s Cell Phone Number Exposed

A personal cell phone number belonging to the UK’s prime minister, Boris Johnson, has reportedly been publicly accessible online for fifteen years. 

Johnson’s number was listed on a think tank press release published on the internet back in 2006 when he was the Member of Parliament for the riverside town of Henley in Buckinghamshire. 

The security breach was first reported by the website Popbitch in a piece headlined ‘Hoping not to butt-dial Boris’.

“It’s not as though the Prime Minister’s personal phone number could just be floating out there on the internet, is it?” quipped the site. 

“It would be absolutely insane if it was tacked on to the bottom of an old press release that he dished out freely while MP for Henley, and Shadow Minister for Higher Education.”

According to the BBC, the exposed number appears to still be in use by the Conservative prime minister.  

Leader of the opposing Labor party Sir Keir Starmer described news of the number’s availability as “a serious situation [that] carries a security risk.”

Starmer said: “A lot of people will be concerned, not just about who has got the number but who has been using it.”

Johnson has come in for criticism recently concerning his use of messaging apps and SMS messages after it was reported that he personally texted businessman Sir James Dyson with a promise to “fix” Dyson’s tax issue.

“What has come out in recent weeks is [about] privileged access—those who can WhatsApp the prime minister for favors—and this all is further evidence that there is one rule for them and another rule for everybody else,” said Starmer.

Speaking on BBC Radio 4’s Today program, former national security adviser Lord Ricketts said that “hostile states with sophisticated cyber capabilities or criminal gangs” could have exploited Johnson’s number.

He added that for a prime minister to change their number after taking office is an “elementary security precaution these days.”

Home Office minister Victoria Atkins said that the PM was “aware of his responsibilities” on national security and that she had “complete and utter confidence” that he and his advisors would meet those responsibilities.

Premium Domain Names – transcom.uk
Transcom ISP – The UK’s Best Business ISP
DoubleCheck any website at doublecheck.uk

Software Company Self-Reports Illegal Exports

Software Company Self-Reports Illegal Exports

A software company based in Germany has self-disclosed violating United States sanction laws by exporting American products and services to Iran.

SAP SE, which is headquartered in Walldorf, admitted to carrying out thousands of export violations over a seven-year period. 

After self-reporting its transgressions, the company agreed to pay combined penalties of more than $8m as part of a global resolution reached with the United States Departments of Justice (DOJ), Commerce, and Treasury. 

SAP entered into a non-prosecution agreement with the three agencies that requires the company to disgorge $5.14m of ill-gotten gains. 

From around January 2010 through approximately September 2017, SAP and its overseas partners released US-origin software more than 20,000 times to users located in Iran. Software exported by SAP without a license included upgrades and patches. 

“Certain SAP senior executives were aware that neither the company nor its U.S.-based content delivery provider used geolocation filters to identify and block Iranian downloads, yet for years the company did not remedy the issue,” stated the DOJ.

Most of the Iranian downloads went to 14 companies, which SAP’s partners in Turkey, United Arab Emirates, Germany, and Malaysia knew to be under Iranian control. The remaining downloads were sold to several multinational companies then downloaded by their Iranian-based operations.

During the same period, SAP’s Cloud Business Group companies (CBGs) permitted approximately 2,360 Iranian users to access US-based cloud services from Iran.

The DOJ praised SAP for voluntarily confessing its violations, running an extensive internal investigation, and for cooperating with the US government over a three-year period. 

“During this time, SAP worked with prosecutors and investigators, producing thousands of translated documents, answering inquiries and making foreign-based employees available for interviews in a mutually agreed upon overseas location,” stated the DOJ.

SAP also spent more than $27m on remediating its export compliance and sanctions program. Changes introduced by the company included the implementation of GeoIP blocking, the deactivation of thousands of Iran-based user accounts for cloud services, and the suspension of SAP partners who sold to customers affiliated with Iran. 

Assistant Attorney General John Demers said: “SAP will suffer the penalties for its violations of the Iran sanctions, but these would have been far worse had they not disclosed, cooperated, and remediated.”

Premium Domain Names – transcom.uk
Transcom ISP – The UK’s Best Business ISP
DoubleCheck any website at doublecheck.uk

INSA Forms Critical Infrastructure Subcommittee

INSA Forms Critical Infrastructure Subcommittee

A new Critical Infrastructure Subcommittee has been established by the Cyber Council of the Intelligence and National Security Alliance (INSA).

The creation of the delegation was officially announced yesterday along with an overview of the subcommittee’s mission.

The main goal of the newly formed assemblage will be to assess cyber-threats to America’s critical infrastructure and examine actions taken by the government and industry to secure the nation’s essential networks. 

Privately owned infrastructure across the defense industrial base and telecommunications, finance, and energy and electric sectors will be evaluated in terms of what impact they could have on national security.

Another goal that the group has been set is the promotion of strategies that will mitigate cyber-threats to select critical infrastructure operations.

Meeting quarterly, the subcommittee also aims to foster a spirit of cooperation by identifying and addressing obstacles to greater public-private collaboration, with a specific focus on how this could be achieved through Sector Coordinating Councils (SCCs), Information Sharing and Analysis Centers (ISACs), and other forums.

INSA said that the goal of the subcommittee is to also “serve as a forum for government and industry experts to share perspectives, develop new insights, better account for risk, build resiliency, and promote best practices.”

Chris Boyer, vice president of global security and technology policy at telecommunications giant AT&T, has been named as the subcommittee’s chair. 

Vice chair positions have been accepted by Amentum’s vice president for mission engineering Rich Johanning and by the CME Group’s global information security external engagement team lead, Sydney Jones. 

Initial areas that the subcommittee will focus on include threat briefs on cyber-threats to critical infrastructure sectors, securing critical infrastructure supply chains, and expediting the process of securing clearances for critical infrastructure. 

They will also get cracking with a look at ways in which the speed of declassification and tearline report publication could be improved to facilitate faster industry response to cyber-threats.

INSA vice president for policy Larry Hanauer said: “It’s critical that government agencies and critical infrastructure operators improve their cybersecurity cooperation and share information on cyber threats more effectively.”

Premium Domain Names – transcom.uk
Transcom ISP – The UK’s Best Business ISP
DoubleCheck any website at doublecheck.uk

Cautious Welcome for Ransomware Task Force Proposals

Cautious Welcome for Ransomware Task Force Proposals

Security experts have welcomed the proposals of a new ransomware report from big tech and law enforcers, but argued that tackling the menace must begin with improved cyber-hygiene.

Convened by the Institute for Security and Technology and trailed since last December, the Ransomware Task Force (RTF) is a team of over 60 experts from software companies, cybersecurity vendors, government agencies, non-profits, and academic institutions.

It includes representatives from the FBI, Europol, the UK’s National Crime Agency and many of the world’s biggest tech companies including Amazon, Cisco and Microsoft.

Its framework document makes five key recommendations to tackle the cyber-threat. The most eye-catching of these is that governments require cryptocurrency exchanges, crypto kiosks, and over-the-counter (OTC) trading ‘desks’ to adhere to the same regulatory standards as banks. That means following anti-money laundering (AML), Know Your Customer (KYC) and Combatting Financing of Terrorism (CFT) laws.

Other recommendations include that the US government “execute a sustained, aggressive, whole of government, intelligence-driven anti-ransomware campaign, coordinated by the White House.”

It emerged last week that a new Department of Justice taskforce will work to manage efforts across the federal government to disrupt C&C infrastructure, seize profits, coordinate training and intelligence sharing and more to try and disrupt ransomware groups.

The RTF also called for prioritized law enforcement efforts across jurisdictions and “a clear, accessible, and broadly adopted” international framework to help organizations prepare for, and respond to, ransomware attacks.

However, some security experts were skeptical about the RTF’s recommendations.

ImmuniWeb founder, Ilia Kolochenko, argued that even if cryptocurrencies were regulated, cyber-criminals would find ways to bypass regulations. Indeed, the current AML regulatory regime is widely seen to have failed.

“I’d rather suggest treating the root cause of ransomware: the widespread lack of basic cyber-hygiene,” Kolochenko argued.

“Even the largest organizations from regulated industries often fail to follow the basics: maintain an up-to-date asset inventory, implement risk-based and threat-aware security controls, perform continuous security monitoring and anomaly detection, conduct ongoing security training and awareness, maintain software and patch management programs, and to enforce centralized identity management.”

Others were more welcoming of the task force’s efforts, but agreed that organizations must do more from a corporate cybersecurity perspective.

“It is important for cyber-awareness training to be regular in the workplace, as only then will it build employee knowledge of security and educate them on the significant part they play in protecting the organization,” argued Mimecast’s head of e-crime, Carl Wearn.

“In the face of this increasing level of threat to all organizations, cyber-hygiene and user awareness training will be critical to maintaining security. Hopefully this news will help businesses to understand just how big of a threat ransomware is.”

Fedor Sinitsyn, security expert at Kaspersky, explained that the ransomware landscape had fundamentally changed over the past year, putting enterprises in the crosshairs.

“The primary focus will likely continue to be on companies and large organizations, and that means ransomware attacks will continue to become more sophisticated and more destructive,” he added. “It’s imperative that businesses adopt a holistic, comprehensive set of security practices to protect their data.”

Premium Domain Names – transcom.uk
Transcom ISP – The UK’s Best Business ISP
DoubleCheck any website at doublecheck.uk