TaoSecurity Blog

Sunday evening 60 Minutes aired a segment titled Inside the Air War . The correspondent was David Martin, whose biography includes the fact that he served as a naval officer during the Vietnam War. The piece concluded with the following exchange and commentary: On the day we watched the B-1 strike, that same bomber was sent to check out a report of a single ISIS sniper firing from the top of a building. Weapons officer: The weapon will time out directly in between the two buildings. This captain was one of the weapons officers in the cockpit. David Martin: B-1 bomber. Weapons officer: Yes sir. David Martin: All that technology. Weapons officer: Yes sir. David Martin: All that fire power. One sniper down on the ground. I thought the captain's next words were right on target: Weapons officer: Sir, I think if it was you or me on the ground getting shot at by that sniper we would take any asset available to make sure we were no longer getting, you know, engaged by...

On Friday the Obama administration secured its second win toward establishing a new norm in cyberspace. The  Joint Fact Sheet  published by the White House includes the following language: "no country should conduct or knowingly support cyber-enabled theft of intellectual property, trade secrets, or other confidential business information with the intent of providing competitive advantages to its companies or commercial sectors ;" (emphasis added) This excerpt, as well as other elements of the agreement, mirror words which I covered in my Brookings piece To Hack, Or Not to Hack ? I recommend reading that article to get my full take on the importance of this language, including the bold elements. It's likely many readers don't think of South Korea as an economic threat to the US. While South Korean operations are conducted at a fraction of the scale of their Chinese neighbors, ROK spies still remain busy. In January Shane Harris wrote a great story titled  Our ...

In June 2011 I wrote a blog post with the ever polite title  China's View Is More Important Than Yours . I was frustrated with the Western-centric, inward-focused view of many commentators, which put themselves at the center of debates over digital conflict, neglecting the possibility that other parties could perceive the situation differently. I remain concerned that while Western thinkers debate war using Western, especially Clausewitzian, models, Eastern adversaries, including hybrid Eastern-Western cultures, perceive war in their own terms. I wrote in June 2011: The Chinese military sees Western culture, particularly American culture, as an assault on China , saying "the West uses a system of values (democracy, freedom, human rights, etc.) in a long-term attack on socialist countries ... Marxist theory opposes peaceful evolution, which... is the basic Western tactic for subverting socialist countries" (pp 102-3). They believe the US is conducting psychologic...

Yesterday on Bloomberg West, host Emily Chang reported on a breach that affected her personally identifiable information (PII). She asked what she should do now that she is a victim of data theft. This is my answer. First, I recommend changing passwords for any accounts associated with the breached entities. Second, if you used the same passwords from the breached entities at unrelated sites, change passwords at those other sites. Third, if any of those entities offer two factor authentication, enable it. This likely involves getting a code via text message or using an app that generates codes. Fourth, read Brian Krebs' post  How I Learned to Stop Worrying and Embrace the Security Freeze . It's a personal decision to go all the way to enable a security freeze. I recommend everyone who has been a PII or credit data theft victim, at the minimum, to enable a "fraud alert." Why? It's free, and you can sign up online with one credit bureau and the others will...