Author: admin

The need for new approaches to improve cyber-threat intelligence was highlighted during a keynote at the RSA conference

Long article about Joshua Schulte, the accused leaker of the WikiLeaks Vault 7 and Vault 8 CIA data.

Well worth reading.

If your PC runs on Windows 10, you’re in very good company. The Microsoft operating system is the most widely used OS in the world. Many Windows 10 users have also been upgraded to Windows 11 through a rollout that began in 2021. Microsoft plans to complete the Windows update by mid-2022. 

Unfortunately, its success as a widely used operating system makes Windows attractive to hackers. And if malicious software like malware can make a home in Windows, there are a lot of targets. So, this might raise the question of how best to protect your Windows 10 or 11 device.  

 Should you just use Windows Defender — Microsoft’s free version of antivirus software — or buy additional protection?  

Read on to learn what Microsoft Defender covers and how additional virus protection can secure all of your connected devices. 

Does Windows 10 come with antivirus software?

For years, Microsoft has offered anti-malware protection, but the current version provides effective security against viruses. Windows Defender is a free antivirus tool that’s built into the Windows operating system.  

While it’s considered one of the best free antivirus software programs, it doesn’t have any extra features that might come with paid security software. If you’re just looking for good antivirus software, though, Windows Defender can get the job done.  

How to check if Windows Defender is on

If you’re not using third-party antivirus protection, you’ll want to make sure that your Windows Defender antivirus coverage is working on your computer. Here’s how to check: 

1. Go to the control panel and click System and Security. 
2. Click Windows Defender Firewall. 
3. A window will open showing if the firewall is on. 
4. If you need to turn on Windows Defender, use the menu. 
5. Close all browser windows and restart your computer. 

To make sure your Windows security is running, follow these steps: 

1. Click CTRL+Alt+Del and select Task Manager. 
2. Look at the tabs and click Services. 
3. Scroll down to Windows Defender and see if it is classified as “running.” 

Do you need additional antivirus software?

With built-in coverage, you may wonder if you should invest in paid antivirus software. The answer is, of course, yes! It can be a good idea to get another antivirus solution because blocking malware and viruses should just be one part of your threat protection.  

Today’s cybercriminals are using elaborate ruses to try to access your personal information, such as your bank and credit card numbers. And some of their scams might even target your devices with risky apps or links on social media.  

As they always say, it’s better to be safe than sorry! Having another antivirus program can make sure you have real-time protection and access to the latest security features. 

4 features you want in an antivirus software

There are a lot of antivirus protection programs out there, but they aren’t all created equal. When looking for the best antivirus software for your needs, here are some things to consider for your devices running on Windows 10 or 11. 

Compatibility across multiple operating systems

If you have a Windows PC, use an iPhone, and your tablet runs on Chrome, it helps to have an antivirus app that works across multiple operating systems. The good news is that McAfee Total Protection is compatible with Windows, Mac, iOS, and Android devices, so you can continue enjoying all of your different devices without losing protection. 

Protection against a variety of online threats

For greater cybersecurity, antivirus software should defend against a variety of online threats like viruses, spyware, and ransomware. And that’s exactly what you get with McAfee Total Protection. Our antivirus software can also help you avoid phishing attacks, which are fake messages to trick you into providing information or clicking a malicious link. The software will give you a warning when it recognizes a risky link, website, or file. 

Easy to use

Functionality is another thing you’ll want to consider when looking for antivirus software. If the program isn’t easy to use to begin with — especially if you want to easily manage multiple devices — what good will it do you?  

But you don’t have to worry with McAfee Total Protection, which allows you to connect and manage all of your computers and mobile devices from one single dashboard. 

Real-time and scheduled scanning

To keep your devices free from online threats like malware, good antivirus software will scan your files for threats. McAfee Total Protection provides 24/7 protection with real-time, on-demand, and scheduled scanning of files and applications.  

Additional features beyond antivirus software

McAfee Total Protection was developed with an understanding of how cybercriminals operate. Scammers may use a variety of tactics to try to steal your personal information, so our all-in-one protection also includes:  

1. VPN: A virtual private network (VPN) is one of the biggest benefits of using third-party antivirus protection. When you connect to public Wi-Fi, such as in a coffee shop, it’s possible for a hacker to see your data. A VPN encrypts your data to protect it from prying eyes. It also conceals your device’s IP address and geolocation. 
2. Identity monitoring: Get 24/7 monitoring of your email addresses and bank accounts with up to $1 million of ID theft coverage with McAfee Total Protection. With early detection, an easy setup, and extensive monitoring (keeping tabs on up to 60 unique types of personal information), you can continue to live your best life online.  
3. Protection score: We’ll look at the health of your online protection and give you a protection score. We’ll also recommend how to address weak spots and improve your security. 
4. PC optimization: There’s nothing more frustrating than trying to work on a computer that loads pages slowly or keeps freezing. To help speed up your online activities, McAfee  PC Optimizer automatically pauses auto-play on pop-up videos. This gives you more bandwidth and saves battery power. The software also disposes of temporary files and cookies to free disk space. 
5. Password manager: One good way to keep your data secure is to use strong passwords that are unique for each website. Our password manager generates complex passwords, stores them, and even lets you access shared passwords on your mobile devices. 

Personalized protection for your digital life

Using Microsoft’s built-in antivirus software can protect your Windows devices from viruses and malware. But to really keep your network and all of your devices secure, it’s good to rely on comprehensive protection like McAfee Total Protection. With services like identity monitoring, safe browsing, and a secure VPN, you can enjoy the internet without worry. 

The post Does Windows 10 or 11 Need Antivirus Software? appeared first on McAfee Blog.

Deja-Vu data from this year’s DBIR report feels like we are stuck in the movie ‘Groundhog Day.’

Zero-day announced – here’s what you need to know

Octopus and squid genes are weird.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Read my blog posting guidelines here.

The cybercriminal group is distancing itself from its previous branding by shifting tactics and tools once again in an aim to continue to profit from its nefarious activity.

Back in November 2020, in the middle of the COVID-19 pandemic, I gave a virtual talk at the International Symposium on Technology and Society: “The Story of the Internet and How it Broke Bad: A Call for Public-Interest Technologists.” It was something I was really proud of, and it’s finally up on the net.

The U.S. Department of Justice (DOJ) recently revised its policy on charging violations of the Computer Fraud and Abuse Act (CFAA), a 1986 law that remains the primary statute by which federal prosecutors pursue cybercrime cases. The new guidelines state that prosecutors should avoid charging security researchers who operate in “good faith” when finding and reporting vulnerabilities. But legal experts continue to advise researchers to proceed with caution, noting the new guidelines can’t be used as a defense in court, nor are they any kind of shield against civil prosecution.

In a statement about the changes, Deputy Attorney General Lisa O. Monaco said the DOJ “has never been interested in prosecuting good-faith computer security research as a crime,” and that the new guidelines “promote cybersecurity by providing clarity for good-faith security researchers who root out vulnerabilities for the common good.”

What constitutes “good faith security research?” The DOJ’s new policy (PDF) borrows language from a Library of Congress rulemaking (PDF) on the Digital Millennium Copyright Act (DMCA), a similarly controversial law that criminalizes production and dissemination of technologies or services designed to circumvent measures that control access to copyrighted works. According to the government, good faith security research means:

“…accessing a computer solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability, where such activity is carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs, or those who use such devices, machines, or online services.”

“Security research not conducted in good faith — for example, for the purpose of discovering security holes in devices, machines, or services in order to extort the owners of such devices, machines, or services — might be called ‘research,’ but is not in good faith.”

The new DOJ policy comes in response to a Supreme Court ruling last year in Van Buren v. United States (PDF), a case involving a former police sergeant in Florida who was convicted of CFAA violations after a friend paid him to use police resources to look up information on a private citizen.

But in an opinion authored by Justice Amy Coney Barrett, the Supreme Court held that the CFAA does not apply to a person who obtains electronic information that they are otherwise authorized to access and then misuses that information.

Orin Kerr, a law professor at University of California, Berkeley, said the DOJ’s updated policy was expected given the Supreme Court ruling in the Van Buren case. Kerr noted that while the new policy says one measure of “good faith” involves researchers taking steps to prevent harm to third parties, what exactly those steps might constitute is another matter.

“The DOJ is making clear they’re not going to prosecute good faith security researchers, but be really careful before you rely on that,” Kerr said. “First, because you could still get sued [civilly, by the party to whom the vulnerability is being reported], but also the line as to what is legitimate security research and what isn’t is still murky.”

Kerr said the new policy also gives CFAA defendants no additional cause for action.

“A lawyer for the defendant can make the pitch that something is good faith security research, but it’s not enforceable,” Kerr said. “Meaning, if the DOJ does bring a CFAA charge, the defendant can’t move to dismiss it on the grounds that it’s good faith security research.”

Kerr added that he can’t think of a CFAA case where this policy would have made a substantive difference.

“I don’t think the DOJ is giving up much, but there’s a lot of hacking that could be covered under good faith security research that they’re saying they won’t prosecute, and it will be interesting to see what happens there,” he said.

The new policy also clarifies other types of potential CFAA violations that are not to be charged. Most of these include violations of a technology provider’s terms of service, and here the DOJ says “violating an access restriction contained in a term of service are not themselves sufficient to warrant federal criminal charges.” Some examples include:

-Embellishing an online dating profile contrary to the terms of service of the dating website;
-Creating fictional accounts on hiring, housing, or rental websites;
-Using a pseudonym on a social networking site that prohibits them;
-Checking sports scores or paying bills at work.

ANALYSIS

Kerr’s warning about the dangers that security researchers face from civil prosecution is well-founded. KrebsOnSecurity regularly hears from security researchers seeking advice on how to handle reporting a security vulnerability or data exposure. In most of these cases, the researcher isn’t worried that the government is going to come after them: It’s that they’re going to get sued by the company responsible for the security vulnerability or data leak.

Often these conversations center around the researcher’s desire to weigh the rewards of gaining recognition for their discoveries with the risk of being targeted with costly civil lawsuits. And almost just as often, the source of the researcher’s unease is that they recognize they might have taken their discovery just a tad too far.

Here’s a common example: A researcher finds a vulnerability in a website that allows them to individually retrieve every customer record in a database. But instead of simply polling a few records that could be used as a proof-of-concept and shared with the vulnerable website, the researcher decides to download every single file on the server.

Not infrequently, there is also concern because at some point the researcher suspected that their automated activities might have actually caused stability or uptime issues with certain services they were testing. Here, the researcher is usually concerned about approaching the vulnerable website or vendor because they worry their activities may already have been identified internally as some sort of external cyberattack.

What do I take away from these conversations? Some of the most trusted and feared security researchers in the industry today gained that esteem not by constantly taking things to extremes and skirting the law, but rather by publicly exercising restraint in the use of their powers and knowledge — and by being effective at communicating their findings in a way that maximizes the help and minimizes the potential harm.

If you believe you’ve discovered a security vulnerability or data exposure, try to consider first how you might defend your actions to the vulnerable website or vendor before embarking on any automated or semi-automated activity that the organization might reasonably misconstrue as a cyberattack. In other words, try as best you can to minimize the potential harm to the vulnerable site or vendor in question, and don’t go further than you need to prove your point.

Melissa Bischoping, security researcher with Tanium and Infosec Insiders columnist, urges firms to consider the upstream and downstream impact of “triple extortion” ransomware attacks.