Supported by 1Password and Julian Talbot.
Hi everyone,
This was quite a heavy week all around, including for the security industry. The resulting issue is longer than I usually like, even after some heavy filtering :-) I hope you get value out of the articles I've picked to share!
I'm really happy to welcome 1Password back as a sponsor! They supported this newsletter for years before my break, and offered to continue doing so now. Thank you so much!
. I think it's safe to say that ransomware isn't going away any time soon.
Pretty impressive research. Based on reading the electromagnetic radiation of 6000 operations the researchers were able to reconstruct the primary encryption key. Mind you: they themselves make it very clear that security keys are still extremely effective, and that the attack is very difficult to pull off. It requires prolonged physical access to the keys (in which case you can probably use them anyway), and there are certain server-side mitigations. It's really only a concern for extreme high-profile targets.
It's a clever find. Telegram has an opt-in "See who's nearby" feature, that can be abused to know exactly where someone is by spoofing your own location at three different points and then using the resulting distances to pinpoint the exact location. The researcher says that it could be fixed by rounding user locations to the nearest mile and adding a static random noise.
A new trend in ransomware where they go specifically after work machines of the exec team in the hopes of finding something highly sensitive or emberassing, which they can then use to pressure those same people into approving the ransom.
This is a good extortion tactic to be aware off. In this case one was forced to leave positive reviews for a crypto exchange called Coinmama, or else. The campaign backfired quite a bit, although it's worth pointing out that it might also be a smear campaign from a rival exchange.
Julian Talbot, lead author of Security Risk Management Body of Knowledge, has written a new book called Security Risk Management Aide-Mémoire. It’s an overview of the ideas, tools, models, and concepts that underpin security risk management, and absolutely worth checking out.
One of those important cautionary tales. After being fired this person created a fake staff account and used it to edit and delete thousands of shipping records, causing massive disruptions and down time. He'll serve a year in jail and have to pay $200k in fines. Ow, and the company's business is the shipping of protective equipment for the healthcare sector, which is kind of a big deal right now.
This is something I've never previously considered, but makes sense. Machine learning models like GPT-2 are trained on huge data sets, and it's possible to query them for personal information that was part of those data sets.
Highly capable people in positions of great responsibility. It's amazing how good that feels to read. Anne Neuberger, former Cybersecurity Director at the NSA, will join the newly forming National Security Counsil, President Biden's forum for national security and foreign policy. She'll be in charge of coordinating cybersecurity across federal agencies. With the aftermath of the Solarwinds attacks still in full swing, that's no small first item on the todo list.
There will also be a new bureau, created by Mike Pompeo, inside the US Department of State dedicated to addressing cybersecurity in foreign policy. It will be called the Bureau of Cyberspace Security and Emerging Technologies (CSET). The move is quite broadly critized as being too little too late, and that such an important function should sit above any specific office or bureau.
It's a huge challenge to get cybersecurity coordinated in the maritime sector, with a myriad of governements, companies and IT systems all having to work together. The report talks about the US Maritime Transportation System (MTS), but I imagine it's the same everywhere.
There's a certain amount of smirk happening when you read about advice from the NSA on -improving- encryption, but it seems like a very useful share. You can view the information sheet directly here.
First of all: please use a password manager. Since you're a subscriber here I'm pretty sure you already do, but just in case. Second: if you're not using 1Password yet, give them a try. I've been using them for many years professionally and migrated my personal Vault over two years ago. The experience was super smooth, and I haven't looked back ever since.