TaoSecurity Blog

I've been meeting with policymakers of all ages and levels of responsibility during the last few months. Frequently they ask "what can I read to better understand cyber security?" I decided to answer them collectively in this quick blog post. By posting these, I am not endorsing everything they say (with the exception of the last book). On balance, however, I think they provide a great introduction to current topics in digital security. Cybersecurity and Cyberwar: What Everyone Needs to Know by Peter W. Singer and Allan Friedman Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon by Kim Zetter @War: The Rise of the Military-Internet Complex by Shane Harris China and Cybersecurity: Espionage, Strategy, and Politics in the Digital Domain by  Jon R. Lindsay, Tai Ming Cheung, and Derek S. Reveron Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World by Bruce Schneier Spam Nation: The Inside Story of O...

I read Brian Krebs story  Tech Firm Ubiquiti Suffers $46M Cyberheist just now. He writes: Ubiquiti, a San Jose based maker of networking technology for service providers and enterprises, disclosed the attack in a quarterly financial report filed this week  [6 August; RMB]  with the U.S. Securities and Exchange Commission (SEC). The company said it discovered the fraud on June 5, 2015, and that the incident involved employee impersonation and fraudulent requests from an outside entity targeting the company’s finance department. “This fraud resulted in transfers of funds aggregating $46.7 million held by a Company subsidiary incorporated in Hong Kong to other overseas accounts held by third parties,” Ubiquiti wrote. “As soon as the Company became aware of this fraudulent activity it initiated contact with its Hong Kong subsidiary’s bank and promptly initiated legal proceedings in various foreign jurisdictions. As a result of these efforts, the Company has recovered $...

I just read  Hackers Remotely Kill a Jeep on the Highway - With Me in It by Andy Greenberg. It includes the following: "I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold... To better simulate the experience of driving a vehicle while it’s being hijacked by an invisible, virtual force, Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch from Miller’s laptop in his house 10 miles west. Instead, they merely assured me that they wouldn’t do anything life-threatening . Then they told me to drive the Jeep onto the highway. “Remember, Andy,” Miller had said through my iPhone’s speaker just before I pulled onto the I-40 on-ramp , “no matter what happens, don’t panic.” As the two hackers remotely toyed with the air-conditioning, radio, and windshield wipers, I mentally congratulated myself on my courage under pressure. That’s when they cut the transmission. Immediately my accelerator stopped w...

Over the last two weeks I listened to and watched all of the hearings related to the OPM breach. During the exchanges between the witnesses and legislators, I noticed several themes. One presented the situation facing OPM (and other Federal agencies) as confronting the following choice: You can either 1) "secure your network," which is very difficult and going to "take years," due to "years of insufficient investment," or 2) suffer intrusions and breaches, which is what happened to OPM. This struck me as an odd dichotomy. The reasoning appeared to be that because OPM did not make "sufficient investment" in security, a breach was the result. In other words, if OPM had "sufficiently invested" in security, they would not have suffered a breach. I do not see the situation in this way, for two main reasons. First, there is a difference between an "intrusion" and a "breach." An intrusion is unauthorized access ...

We've known for about a year that Tom Cruise is returning to his iconic "Maverick" role from Top Gun, and that drone warfare would be involved. A few days ago we heard a few more details in this Collider story: [Producer David Ellison]: There is an amazing role for Maverick in the movie and there is no Top Gun without Maverick, and it is going to be Maverick playing Maverick. It is I don’t think what people are going to expect, and we are very, very hopeful that we get to make the movie very soon. But like all things, it all comes down to the script, and Justin is writing as we speak. [Interviewer]; You’re gonna do what a lot of sequels have been doing now which is incorporate real use of time from the first one to now. ELLISON and DANA GOLDBERG: Absolutely... ELLISON:  As everyone knows with Tom, he is 100% going to want to be in those airplanes shooting it practically. When you look at the world of dogfighting, what’s interesting about it is that it’s not a w...

This post is a follow up to this post on CDM . Since that post I have been watching hearings on the OPM breach. On Wednesday 24 June a Subcommittee of the House Committee on Homeland Security held a hearing titled  DHS’ Efforts to Secure .Gov . A second panel (starts in the Webcast around 2 hours 20 minutes) featured Dr. Daniel M. Gerstein, a former DHS official now with RAND, as its sole witness. During his opening statement, and in his written testimony , he made the following comments: "The two foundational programs of DHS’s cybersecurity program are EINSTEIN (also called  EINSTEIN 3A) and CDM. These two systems are designed to work in tandem, with EINSTEIN  focusing on keeping threats out of federal networks and CDM identifying them when they are  inside government networks. EINSTEIN provides a perimeter around federal (or .gov) users, as well as select users in the .com  space that have responsibility for critical infrastructure. EINSTEIN ...

Last week I Tweeted about the Bloomberg "code" issue . I said I didn't know how to think about it. The issue is a 28,000+ word document, enough to qualify as a book, that's been covered by news outlets like the Huffington Post . I approached the document with an open mind. When I opened my mail box last week, I didn't expect to get a 112 page magazine devoted to explaining the importance of software to non-technical people. It was a welcome surprise. This morning I decided to try to read some of the issue. (It's been a busy week.) I opened the table of contents, shown at left. It took me a moment, but I realized none of the article titles mentioned security. Next I visited the online edition, which contains the entire print version and adds additional content. I searched the text for the word "security." These are the results: Security research specialists love to party. I have been asked if I was physical security (despite security we...