USA

New bill would allow hacking victims to ‘hack back’

Reps. Tom Graves (R-Ga.) and Kyrsten Sinema (D-Ariz.) introduced a bill Friday that would allow hacking victims to “hack back” when attacked.

The Active Cyber Defense Certainty Act allows individuals and companies to hack hackers if the goal is to disrupt, monitor or attribute the attack, or destroy stolen files.

US Senator Probes Pentagon on Russian Source Code Reviews

“A U.S. senator on Tuesday asked the Defense Department to explain how it manages the risks when it uses software that has been scrutinized by foreign governments, saying the practice may represent a national security threat.”

Replacing US Social Security Numbers with Estonia’s Cryptographic Model?

“Earlier this month White House cybersecurity czar Rob Joyce raised eyebrows when he proposed the radical idea of abandoning the venerable Social Security number (SSN) as a national identifier and replacing it with modern cryptographic identifiers. Amongst all of the buzz about what such a system might look like, whether it is even feasible and how secure it might be, it was surprising to see comparatively little discussion of Estonia’s national cryptographic identifier system which not only does everything being discussed for a future US system, but far, far more, representing a truly “digital first” society.”

DHS Order Federal Agencies to Bolster Cybersecurity with HTTPS, Email Authentication

“On Monday, the US Department of Homeland Security announced a new requirement for federal agencies to employ web and email encryption to boost cybersecurity protections. At a cybersecurity roundtable hosted by the Global Cyber Alliance, Jeanette Manfra, assistant secretary for the Office of Cybersecurity and Communications at the Department of Homeland Security, issued a Binding Operational Directive (BOD) for these federal agencies to implement these cyber policies.”

Australia

Australia’s IoT Security Rating Might Work, if Done Right

“As Vulture South reported Monday, Australia’s government hopes to have consumer Internet of Things products given security “star ratings” of some kind, so consumers know what they’re buying. The notion seems problematic: for example, what does a five-star security rating on a security camera mean, if it’s attached to a router with admin:password as its login credentials?”

China

China Data Protection Enforcement Update – A Focus on Platform Content

“Following the first enforcement actions by local authorities in Shantou and Chongqing for violations of the new Network Security Law that came into effect this year, authorities in China have recently shown a clear initial focus with several new cases targeting provisions of the law that require monitoring of platform content. As of the start of October 2017, enforcement actions by authorities in China have targeted platform content violations in nearly 70 percent of all actions under the new provisions of the data protection rules.”

EU

EU Commission’s First Annual Review Confirms Adequacy of the EU-U.S. Privacy Shield

On October 18, 2017, the European Commission published its report and supporting documents regarding its first annual review of the EU-U.S. Privacy Shield (Privacy Shield), which sets forth procedures and safeguards for transferring personal data from the European Union (EU) to the United States. The report concludes that Privacy Shield “ensures an adequate level of protection for personal data” transferred from the EU to the United States.

EU Encryption Plans Hope to Stave Off “Backdoors”

“The European Union will boost its law enforcement agency and free up funding to help police break encryption for investigations, but the move is unlikely to satisfy Europe’s most powerful governments that want broad access to chat messages and data. The Commission said Wednesday it wants to create a “toolbox” to help national law enforcement break encryption, provide up €500,000 to train European police and boost its police agency Europol’s ability to hack into phones, computers and private messages.”

India

Indian techies driving next-gen cyber security architecture: McAfee CEO

LAS VEGAS: As enterprises the world over scout for next-generation cyber security architecture to mitigate attacks, the Indian systems integrator (SI) community is helping major companies embrace state-of-the-art security structures, Chris Young, Chief Executive Officer of McAfee, has said.

Israel

Talking North Korea and Iran With Israel’s Rocket Man

‘Yitzhak Ben-Israel thinks Kim’s cyberwarriors are third-rate, U.S. missile defense is good, and the Iran deal is a keeper. Success, it is said, has many fathers, and that is certainly the case of Israel’s astonishing achievements in the areas of missile defense and cybersecurity. But if anyone is entitled to claim paternity, it is Isaac Ben-Israel. As a major general, he commanded the IDF unit in charge of military R&D and as the Director of Defense R&D in the Israeli Ministry of Defense, he oversaw the creation of Israel’s cutting edge anti-missile systems. As a civilian, he became the architect of Israel’s unique cyberdefense ecosystem. Today, at 68, he heads the department of security studies  at Tel Aviv University, chairs Israel’s Space Agency and its National Council for Research and Development and, in his spare time, writes influential books on high-tech military strategy and runs his own consultancy firm, RAY-TOP (Technology Opportunities) Ltd. He’s a busy man.’

North Korea

North Korea’s cyber-army should worry us all

‘It turns out that North Korea isn’t just a nuclear threat. It’s also a cyberthreat, and in some ways, this may be more frightening. Launched largely anonymously, cyberattacks can cripple essential infrastructure — power grids, financial networks, transportation systems — and inflict social disorder and political anarchy. Immediate retaliation is difficult. All this now seems plausible.’

Feature

Why CMOs Need to Become Cybersecurity Experts: An Interview with Norman Guadagno

By: Drew Neisser

Finding myself among the 145 million American’s who personal information was compromised by the gargantuan Equifax data breach, I welcomed the chance to talk with cybersecurity expert Norman Guadagno, senior VP of data security company Carbonite. Our conversation was both scary and enlightening as Guadagno pointed out how poorly Equifax handled the crisis, the inevitability of having your personal and company data hacked and, most important, the little-known fact that ever-growing marketing tech stacks are creating even greater security threats.

Why Educating Employees about Cybersecurity Isn’t the Solution to Stopping Cyber Breaches

By: Leonardo Cooper

“Cyber security training firms continue to stress the importance of educating employees in order to minimise the risk of cyber threats. ‘Staff’, they argue, ‘are both your company’s greatest asset and your biggest potential security risk’. And as employees are the weakest link in the security chain, they must be well trained and educated.    It is true that employees are a huge security weakness: 46% of IT security incidents are caused by employees each year globally and 55% of companies surveyed by Experian Data Breach Resolution said they ‘experienced one or more security incidents where the catalyzing event was a negligent or malicious employee.’”