Apple Corp. introduced the latest versions of its iPhone mobile phone yesterday to great fanfare, though the fever pitch that was common during the reign of Steve Jobs was noticeably absent. There were a flurry of articles and opinion pieces like this one, wondering whether Apple had lost its mojo, were common. And it goes without saying that if the headline is wondering whether you’ve lost your mojo, then you most certainly have. Still, Apple didn’t disappoint with its iPhone and iOS updates, particularly in the security arena. Indeed, the long-rumored addition of a finger print reader may have been the most prominent new feature in an update where the most prominent changes (a faster, 64-bit processor, higher resolution camera, etc. ) were transparent to the user. So what do you need to know about the new iPhone and its biometric authentication feature? And how will the new iPhone 5S […]
Technology
BitSight: A Equifax For Security Risk?
I’ve opined in these pages and elsewhere that one of the big problems in the IT security space is the absence of actionable data. After all, problems like denial of service attacks, network compromises and inadvertent data leaks are all just risks that organizations and individuals must grapple with in our increasingly wired world. True – they’re new kinds of risks, but otherwise they’re not fundamentally different from problems like auto accidents, property crime or illness – things that we do a good job accounting for. The difference, as I see it, is an absence of accepted and independent means of assessing the relative security posture of any organization. IT security is still so much dark magic: we rely on organizations to tell us about how secure they are. Organizations, in turn, rely on a complex and patchy network of security monitoring and detection tools, then try to read the […]
Report: Crematoriums To Caterpillars Shodan Reveals Internet Of Things
What kind of stuff is lurking out there on the vast (and growing) Internet of Things? A recent story in Forbes makes the point that its a lot more varied than you might think – everything from Caterpillar trucks to public school classrooms to a crematorium. And “yes,” I said “crematorium.” The idea that surveillance cameras can be accessed from the public Internet isn’t really new. Security researchers have been showing off ways to sidestep security features for IP enabled surveillance cameras for years. We wrote last week about the Federal Trade Commission’s case against a California company, TRENDNet, which made a line of balky, in secure home surveillance gear. But Kashmir Hill makes the point in her story that surveillance cameras are just the tip of the iceberg. Hill interviewed security researchers and professional Shodan jockeys, who use that hardware focused search engine to uncover supposedly secure equipment and industrial control […]
Why The Mailpile Misstep Is No Joke To PayPal
PayPal and Mailpile, the scrappy secure mail startup ended the week on a high note: hugging it out (via Twitter) after the online payments behemoth froze more than $40,000 in payments to the crowd-funded startup then donated $1,000 to the project, to boot. But making it right with the tiny secure email firm is just the beginning of the story at PayPal, which is making the whole mix-up as something of an object lesson in how it needs to change to address a fluid and fast-moving online payments market. First, some background: Mailpile, of Reykjavík, Iceland, has raised more than $145,000 in a month-long campaign on the crowd funding web site Indiegogo.com to build a “fast, web-mail client with user-friendly encryption and privacy features.” Beginning on Saturday, PayPal froze more than $40,000 of those donations, suspecting fraud. The company’s spokespeople told company executive Brennan Novak that it wanted to see […]
U.S. Cyber Security Framework Is Good News-For Hackers
Ralph Langner, the renowned expert on the security of industrial control- and SCADA systems, warns that the latest draft of the U.S. Government’s Cyber Security Framework (CSF) will do little to make critical infrastructure more resistant to devastating cyber attacks. Writing on his blog, Langner said that a draft of the National Institute of Standards and Technology’s (NIST’s) Preliminary Cybersecurity Framework does little to compel critical infrastructure owners to improve the security of their systems, or guarantee uniform (and robust) cyber security standards in the critical infrastructure space. NIST released the latest draft of the CSF late last month (PDF). But Langner, writing on Wednesday, likened the framework to a recipe that, if used by three different chefs, produces three totally different dishes…or just a messy kitchen. “A less metaphorical words, a fundamental problem of the CSF is that it is not a method that, if applied properly, would lead to predictable results,” […]
