TaoSecurity Blog

For many years, private organizations in the West have endured attacks by the Chinese government, its proxies, and other parties. These intruders infiltrated private organizations to steal data. Those not associated with the targeted organizations were generally not directly affected. Today an action by the Chinese government is affecting millions of users around the world. This is unacceptable. You may be aware that an American technology company, GitHub , is suffering a massive distributed denial of service attack, at the time of writing. According to Insight Labs , Internet traffic within China is being manipulated, such that users are essentially attacking GitHub. They are unwittingly requesting two sites hosted by GitHub. The first is a mirror of the Chinese edition of the New York Times (blocked for several years ). The other is a mirror of the GreatFire.org Web site, devoted to discovering and exposing Internet filtering by China's "Great Firewall." As n...

Recently Bloomberg published an article titled The Dark Science of Interrogation . I was fascinated by this article because I graduated from the SERE program at the US Air Force Academy in the summer of 1991, after my freshman year there. SERE teaches how to resist the interrogation methods used against prisoners of war. When I attended the school, the content was based on techniques used by Korea and Vietnam against American POWs in the 1950s-1970s. As I read the article, I realized the subject matter reminded me of another aspect of my professional life. In intelligence, as in the most mundane office setting, some of the most valuable information still comes from face-to-face conversations across a table. In police work, a successful interrogation can be the difference between a closed case and a cold one. Yet officers today are taught techniques that have never been tested in a scientific setting. For the most part, interrogators rely on nothing more than intuition, experienc...

I noticed an AFP story posted by Al Jazeera America titled  Iran could allow in Google, other tech companies if they follow rules . It included the following: Iran could allow Internet giants such as Google to operate in the the country if they respect its "cultural" rules, Fars news agency said on Sunday, quoting a senior official. "We are not opposed to any of the entities operating in global markets who want to offer services in Iran," Deputy Telecommunications and Information Technology Minister Nasrollah Jahangard reportedly told Fars. "We are ready to negotiate with them and if they accept our cultural rules and policies they can offer their services in Iran," he said. Jahangard said Iran is "also ready to provide Google or any other company with facilities" that could enable them to provide their services to the region. These statements caught my eye because they contrast with China's actions, in the opposite direct...

I'd like to make a quick note on strategy, after reading  After high-profile hacks, many companies still nonchalant about cybersecurity in the Christian Science Monitor today. The article says: In a survey commissioned by defense contractor Raytheon of 1,006 chief information officers, chief information security officers, and other technology executives, 78 percent said their boards had not been briefed even once on their organization’s cybersecurity strategy over the past 12 months... The findings are similar to those reported by PricewaterhouseCoopers in its Global State of Information Security Survey last year in which fewer that 42 percent of respondents said their board actively participates in overall security strategy . Does this worry you? Do you want to introduce strategic thinking into your board discussion? If the answer is yes, consider these resources. 1. Check out my earlier blog posts on strategy , especially the first two articles. 2. Wa...

I am not a fan of the way many media sources cite "statistics" on digital security incidents. I've noted before that any "statistic" using the terms "millions" or "billions" to describe "attacks" is probably worthless. This week, two articles on security incidents caught my attention. First, I'd like to discuss the story at left, published 17 February in The Japan Times, titled  Cyberattacks detected in Japan doubled to 25.7 billion in 2014 . It included the following: The number of computer attacks on government and other organizations detected in Japan doubled in 2014 from the previous year to a record 25.66 billion , a government agency said Tuesday. The National Institute of Information and Communications Technology used around 240,000 sensors to detect cyberattacks... Among countries to which perpetrators’ Internet Protocol addresses were traced, China accounted for the largest share at 40 percent, while South K...

Butler's Interception (left) Made Brady's Touchdowns (right) Count In Kara Swisher's interview on cyber security with President Obama , he makes the following comment: "As I mentioned in the CEO roundtable, a comment that was made by one of my national security team — this is more like basketball than football in the sense that there’s no clear line between offense and defense. Things are going back and forth all the time,” he said. I understand why someone on the President's national security team would use a basketball analogy; we all know the President is a big hoops fan. In this post I will take exception with the President's view, although I am glad he is involved in this topic. The following are five reasons why digital security is like American football, not basketball. 1. Different groups of athletes play offense, defense, and special teams in football. It is rare to see a single player appear on more than one squad. (It does happen, though....

Source: The Economist, 31 Jan 2015 TaoSecurity Blog readers know I am a fan of Edward Tufte . When I see a diagram that I believe captures the tenets of his philosophy of presenting information, I try to share it with readers. Two weeks ago in its 31 January 2015 edition, The Economist newspaper published Saudi Arabia: Keeping It in the Family . The article discussed the ascension of King Salman to the Saudi crown. The author emphasized the advanced age of Saudi kings since the founding of the monarchy in 1932. To make the point graphically, the article included the graphic at left. It captured the start and end of the reigns of the monarchs, their ages at the beginning and end of their reigns, and the median age of the population. Readers are able to quickly compare the duration of each monarch's reign, the monarch's ages, and the trend toward older monarchs. Readers can see the traditional widening gap in ages of rulers compared to the population, as well as the r...