policy Archives

policy

Senator Asks Automakers About Cyber Security, Privacy Plans

December 4, 2013 Paul Roberts

Cyber attacks on so-called “connected vehicles” are still in the proof of concept stage. But those proofs of concept are close enough to the real thing to prompt an inquiry from U.S. Senator Ed Markey, who sent a letter to 20 major auto manufacturers asking for information about consumer privacy protections and safeguards against cyber attacks in their vehicles. Markey’s letter, dated December 2, cites recent reports of “commands…sent through a car’s computer system that could cause it to suddenly accelerate, turn or kill the breaks,” and references research conducted by Charlie Miller and Chris Valasek on Toyota Prius and Ford Escape. That research was presented in an August demonstration at the DEFCON hacking conference in Las Vegas. [For more on the security threats facing connected vehicles, check out this link.] “Today’s cars and light trucks contain more than 50 separate electronic control units (ECUs), connected through a controller area network […]

Ephemeral, In-Memory Attack Used With New IE 0Day

November 11, 2013 Paul Roberts

It was just last week that we wrote about research from the security firm Triumfant that found evidence for the growing use of ephemeral “diskless” malware. That point was driven home over the weekend, with a report from the firm Fireeye that found a new Internet Explorer zero day vulnerability was being used in conjunction with a disk-less variant of the Hydraq (aka “McRAT”) Trojan horse program. Fireeye first called attention to the existence of attacks exploiting new, “zero day” (or previously unknown) vulnerabilities in the Internet Explorer web browser on Friday. The company discovered the malicious activity on the web site of a “strategically important website” that was being used as a “watering hole” to attack visitors who were “interested in national and international security policy.” The company described two IE vulnerabilities: an information leakage hole and an IE out-of-bounds memory access vulnerability. The information leak affects Windows XP […]

IT Pros: Internet Of Things Is A Governance Disaster

November 8, 2013 Paul Roberts

Not that we needed a survey to tell us this: but IT pros are seriously concerned about the risks posed by all the IP-enabled devices that are starting to connect to their corporate networks. That’s the conclusion of a survey of 2,013 members of ISACA, a worldwide association of information security professionals, which found almost unanimous agreement that the Internet of Things poses a governance problem for their networks, with increased security threats the most oft-cited governance issue raised by IoT adoption. The survey (PDF) also polled 4,000 consumers in the U.S., U.K., India and Mexico, finding that IT professionals were less sanguine than consumers about the transformative potential of the Internet of Things for enterprises. Just four in 10 agreed that the benefits of IoT adoption outweighed the risks, while half of the ISACA members polled felt that the benefits of IoT to consumers outweighed the risks. Around a quarter of […]

Week In Security: NSA Spies on Yahoo & Google, Adobe Hack and Healthcare.gov

November 3, 2013 Paul Roberts

There’s nothing like a Sunday morning for looking back over the week’s events and trying to make sense of at all – or at least what sense there is to be had. This Sunday was no different – especially after a week that saw continued revelations stemming from Edward Snowden’s leak of classified intelligence on NSA spying, the massive hack of software maker Adobe. Then there was the botched rollout of the federal Healthcare.gov marketplace – which morphed into an even bigger, uglier problem as the week progressed. To help me sort it all out, I called on Nick Selby, the CEO of StreetCred Software and an authority on cyber security, law enforcement, government procurement, Russia, Germany, aviation, travel journalism and all manner of other topics. I love talking to Nick because his wealth of life and professional experience make him predictably unpredictable when it comes to interpreting current events. […]

When Autonomous Vehicles Crash, Is The Software Liable?

October 11, 2013 Paul Roberts

Many industries are wrestling with the blinding speed of technologic change. Mobile devices like smartphones and tablets are transforming the way employees work and customers interact with a business. And that doesn’t even take into account the (coming) revolution of smart devices and remote sensors that is referred to as The Internet of Things. But few industries are wrestling as hard with the implications of that change as the Insurance industry, which must assess the long-term impact of huge forces like technology innovation or, say, climate change on risk. One example: how will the advent of autonomous vehicles or even computer augmented driving change the auto insurance business? And, when two computer-guided cars crash, who (or what) is liable? Those were some of the questions posed to attendees at this week’s Emerging Technology (or EmTech) Conference at The Massachusetts Institute of Technology (MIT). The speaker, Joe Coray, is the Vice […]