A Review of the Best News of the Week on Cyber Threats & Defense
What Is DNS Hijacking? (Wired, Sep 04 2017)
“A recent attack on WikiLeaks illustrates a vulnerability deep in the routing system of the internet itself…”
SIDH in Go for quantum-resistant TLS 1.3 (Cloudflare Blog, Sep 01 2017)
“Wide interest in developing quantum-resistant (or post-quantum) cryptography: cryptography that works on ordinary computers we have today, but which is secure against a possible quantum computer.”
Cloud Security Alliance Offers Metrics for Cyber Resiliency (Dark Reading, Aug 30 2017)
“CSA’s report introduces two key metrics: Elapsed Time to Identify Failure (ETIF) and Elapsed Time to Identify Threat (ETIT). It says measuring these metrics, and implementing processes to lower their value, improves resiliency for an information system.”
Sponsored by LogRhythm
SIEM Magic Quadrant
Gartner Positions LogRhythm in SIEM Leaders Quadrant for 5th Consecutive Year. Get the report
Inside an Epic Hotel Room Hacking Spree (Wired, Aug 29 2017)
A vulnerability in hotel keycard locks was a security disaster—and a huge opportunity for one burglar….
How Hackers Hide Their Malware: The Basics (Dark Reading, Aug 29 2017)
“Malware depends on these four basic techniques to avoid detection: 1) Packers, 2) Crypters, 3) Polymorphic Malware, and 4) Downloaders, Droppers, and Staged Loading”
Security Analytics: Making the Leap from Data Lake to Meaningful Insight (Dark Reading, Aug 29 2017)
“During the four phases of a data lake project (build data lake; ingest data; do analysis; deliver insight), the hurdles to success are different.”
Cybersecurity Analysis Is Tricky (Netswitch, Sep 01 2017)
“Most mid to large companies have dozens of security point solutions and all of these are generating tens of thousands of “events” every day. And every day, a team of security analysts are tasked with sorting through all of this data clutter in an effort to find something harmful amid the junk. Not only is this a daunting process, it also seems strangely nineties’ish.”
Microsoft’s perspective on cyber resilience (Microsoft Secure Blog, Aug 23 2017)
Microsoft’s Detection and Response Team published anonymized customer scenarios, which point to the need for a cyber resilience plan…
August 2017: Top Hacks and Breaches (Checkmarx, Sep 04 2017)
“At the end of 2016, predictions were being made that the amount of cyberattacks are set to double in 2017 – as we are inching towards the end of 2017, those predictions were made true.”
Just a Passing Fad? Fidget Spinners and the Malware Sandbox (X-Force Research, Aug 29 2017)
“The necessity to evolve the malware sandbox must outpace the strides made by malware creators. Such tricky behaviors as environmental awareness and time-based evasion in a virtualized malware sandbox environment have been introduced specifically to avoid detection by a sandbox that can only run OS-level diagnostics.”