tag:blogger.com,1999:blog-4088979.post2917489838319712012..comments2023-10-16T06:06:25.012-04:00Comments on TaoSecurity Blog: Reaction to Cyber ShockwaveRichard Bejtlichhttp://www.blogger.com/profile/13512184196416665417noreply@blogger.comBlogger10125tag:blogger.com,1999:blog-4088979.post-87801851602943555772010-03-30T16:56:15.788-04:002010-03-30T16:56:15.788-04:00I was involved in something similar in 2002 and th...I was involved in something similar in 2002 and the biggest impact was the "wake up call" that things needed to be fixed and changed.johnhttp://adminkernel.com/mikrotik-routeros/noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-49388696746931912892010-03-02T10:20:14.277-05:002010-03-02T10:20:14.277-05:00Your thoughts...
http://www.newsfactor.com/story....Your thoughts...<br /><br />http://www.newsfactor.com/story.xhtml?story_id=1210046875U0&nl=2&full_skip=1<br /><br />Microsoft Uses Court Order To Cripple Waledac Botnet<br />By Jennifer LeClaire February 25, 2010 10:11AM <br /><br />Microsoft has virtually shut down the Waledac botnet through a court order shutting down 277 domain names. Microsoft's Operation b49 moved to act before the Waledac cybercriminals could respond. Waledac is one of the most active spam bots and one of the 10 largest in the U.S. While Microsoft broke the Waledac control links, affected PCs remain infected.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-4088979.post-13957730386524375652010-02-24T09:05:15.442-05:002010-02-24T09:05:15.442-05:00Hey Richard. I through a post up on the VRT blog ...Hey Richard. I through a post up on the VRT blog and referenced this. I'm pretty firmly in the camp that the program was the worst combination of cyber-theater and FUD.<br /><br />Raising awareness is only of use if it is informed awareness. If an otherwise uninformed viewer came away from this with the idea that this was the face of the cyber threat, then a disservice has been done. There is simply no intelligent interpretation that could be taken from this.<br /><br />Nothing fails to scale like security and nothing is of the scale of the Fed. While the government can take the lead in encouraging (by carrot or stick) critical infrastructure and DIB improvements in security, incident response is, by necessity the realm of the affected agency/company/organization. If the fed wants to help, then they need to provide a highly interactive coordination center where companies can come to work together in a trusted environment.Matt Olneyhttps://www.blogger.com/profile/15503080145847585643noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-37179987376614704142010-02-22T12:43:37.168-05:002010-02-22T12:43:37.168-05:00In the scenario that the simulation assumed, the b...In the scenario that the simulation assumed, the battle is already lost. The government's inability to prevent such severe and widespread effects implies such soft targets, and such a dearth of cyber capabilities, that the possibility of an appropriate response is already lost.<br /><br />In real life, the response would probably be something crude and stupid, which would only make things worse - bombs, severing cables, or trying pointlessly to chase elusive hackers in remote jurisdictions.<br /><br />Obviously the only rational way to approach this issue is to secure the computer systems here in the US, so they're not so vulnerable to this sort of thing. That in turn would necessitate replacing the easy-to-exploit operating system that predominates today with a default-secure one, and replacing proprietary code with open source.<br /><br />But of course this real solution is politically impossible as long as corporations rule the government. No one dares to even mention it. Consequently the cyber-security crisis grows ever worse, and the pols resort to onerous and harmful impositions on citizens to avoid addressing the real problem.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-4088979.post-3298791948874852142010-02-22T00:23:38.141-05:002010-02-22T00:23:38.141-05:00If I may summarize for those that don't want t...If I may summarize for those that don't want to have their brains ooze out their ears..<br /><br />All your private networks are belong to the Gubment.<b>*</b><br /><br /><b>*</b> <i>only during times of 'crisis' of course.</i>Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-4088979.post-16141474717444977002010-02-21T21:57:01.450-05:002010-02-21T21:57:01.450-05:00Richard;
Just caught the last 40 minutes or so of...Richard;<br /><br />Just caught the last 40 minutes or so of the CNN presentation of the event. IMHO, and as you pointed out, the most important aspect of this exercise wasn't what was done or how the panelist reacted, but will be the future lessons learned report that will come from this. I was involved in something similar in 2002 and the biggest impact was the "wake up call" that things needed to be fixed and changed. I hope that message and the subsequent results will be the outcome of this as well.<br /><br />RegardsUnknownhttps://www.blogger.com/profile/04907394747360233246noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-68453164575107658052010-02-21T21:45:28.553-05:002010-02-21T21:45:28.553-05:00Thanks so much Richard, for your thoughtful review...Thanks so much Richard, for your thoughtful review! I missed CNN's first showing so will schedule the DVR to grab it and after watching, will return to your comments.<br /><br />I'd be interested in viewer demographics outside us security folks and public-affairs people. If even a portion of the average CNN audience watched it, some benefit in security awareness must have occurred.<br /><br />We'll see...Bill Wildprettnoreply@blogger.comtag:blogger.com,1999:blog-4088979.post-88198091799159801952010-02-21T19:50:41.837-05:002010-02-21T19:50:41.837-05:00I'll be spending some time this week going ove...I'll be spending some time this week going over it in more detail, but the only criticism I have thus far of the exercise itself is the name. "Cyber ShockWave"? Seriously? Did a thirteen-year-old name this? :pKyle Maxwellhttps://www.blogger.com/profile/02028811120307956640noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-64038262243644474232010-02-21T15:54:53.442-05:002010-02-21T15:54:53.442-05:00Excellent Richard. I may be one of the few people...Excellent Richard. I may be one of the few people in the US without TV so I cannot view the show until CNN posts it. Thank you for the detailed analysis. <br /><br />StiennonSecurity Leaders Grouphttps://www.blogger.com/profile/13345287430589597890noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-16894101824662511292010-02-21T08:17:31.601-05:002010-02-21T08:17:31.601-05:00Richard,
In 2010, we are satisfied with just &quo...Richard,<br /><br />In 2010, we are satisfied with just "raising awareness?" We shouldn't be. DHS's CyberStorm I (which I participated in) involved the actual organizations and individuals in government and critical infrastructure asset owners and vendors. Of course whether anything was actually learned/implemented from those exercises is another story, but that is beside the point.<br /><br />In comparison, Cyber Shockwave seems much more manufactured (Cyber Storm lacked the titillating teaser videos and a 2 hour CNN special with the talking heads) and would seem to designed to exploit the media's appetite for all things Cyber-scary in this new decade. As was the case with 60 Minutes piece a while, I don't believe that any dumbed-down coverage of digital security is good for "the cause." I don't see much practical value media expose's and public show exercises (CyberStorm was FOUO, BTW) and their only possibly value could be to prepare the way for imminent legislation.<br /><br />- mdfMatt Franzhttps://www.blogger.com/profile/00973881935128108475noreply@blogger.com