Red Cross profile: How Jason Ramlow links service members in times of emergeny

Posted on by
Reply

When members of our armed services are on active duty, they are by definition almost always away from home. What happens when there is an emergency, either with them or their family members? That is where the American Red Cross comes into play with the Emergency communications program, under the umbrella of the Hero Care Network. The person responsible for providing management oversight of this service, in partnership with two casework volunteer leads, in the Missouri Arkansas region is Jason Ramlow, who is a Service to the Armed Forces and International Services Regional Program Manager. He has been working for ARC for close to 23 years. “The program is for family emergency communications, such as a serious illness or family death or birth.”

You can read more in my profile of Jason here.

SiliconANGLE: ‘Zero trust’ was supposed to revolutionize cybersecurity. Here’s why that hasn’t happened yet.

Posted on by
Reply

Despite more than a decade of talk, the seminal concept in cybersecurity of zero trust — the assumption that no user or device on a computer network can be trusted — hasn’t been implemented nearly as widely as one might expect from all of the attention.

The problems include numerous practical and perceptual obstacles, coupled with a complex collection of products that need careful coordination to deliver on its promises. The upshot: Zero trust won’t be a silver bullet for ever-growing cybersecurity woes anytime soon. Read my report for SiliconANGLE here to learn more.

Scott Helme and Probely join forces on SecurityHeaders.com

Posted on by
Reply

A well-known security tool, SecurityHeaders.com, is now part of many services that Probely offers. The company has a full range of web application and API vulnerability scanning solutions. That news story hides the history and importance of the union and its principal, Scott Helme. I had an opportunity to talk to him directly and find out what led to the change.

For those of you that aren’t familiar with Security Headers, it is a free website that can test your own site for weaknesses in various HTTP protocol and web policy implementations. Helme launched the site in 2015 after an experience testing his own home broadband router that could result in a compromised network. “I was just a guy with a hobby doing security research,” he told me recently. That led to a series of well-publicized other hacks, such as on the computers onboard the Nissan Leaf cars that he investigated with Troy Hunt. He also did some live hacks on TV of audience members’ equipment.

Since it was launched, the site has done 250M website scans.

Helme has worked with Probely since the company became a sponsor two years ago. “By joining forces with Probely, I’m incredibly happy that Security Headers will remain stable and viable for years to come!” said Helme. The union was designed for the site to be more sustainable and to leverage more resources, since until now it has been solely his own labors.

Helme’s goal with Security Headers was to make information security more comprehensible and actionable for the average person. That is why the site, and other tools that he offers, are all free and open. That will continue under the new regime at Probely. “I’ve put so much thought into it, working with these people, what they do, how they do it, and how they align with what I do,” he said.  “We have a lot in common.”

So I decided to try it out for myself, and I was quite surprised. I have had a website for almost 30 years, and while I knew about the Security Headers site never actually did a scan. Here are my results:

Pretty miserable, right? I basically failed every one of Helme’s six tests. But I was in good (or bad) company: about half of those 250M scans also resulted in an “F” grade.

So — I have a lot of work to do. The results page doesn’t just show the failures, but also provides links to content from Helme on how to learn more about these protocols and policies and what I need to do to fix them to get a better grade — and improve my site’s security. For example, the page links to improvements in hardening my response headers, doing a better job of defining my content security policies and implementing strict transport security protocols. The content is based on numerous talks that Helme has given (and will continue to give) over the years and is written clearly with copious code examples too.

But here is my dirty not-so-secret: I have zero experience with setting up website header parameters. This is probably the reason why my site received a failing grade. After years — decades — of experience setting up various web servers, I have never touched the header configurations of any of my servers. Back in the early days of the web, these parameters didn’t exist. So I can cut myself a little slack. But really, I should have known better, after all the stuff that I write about infosec down through the years. But that is one of the reasons why I try to be as hands-on as I can, and now I have some work to do and things to learn.

That is the essence of what he and Probely are trying to do — to teach us all how to have more secure sites.

(Note: this post is sponsored by Probely but is independent editorial content.)

SiliconANGLE: DNS is once again front and center for exploits and security policy

Posted on by
Reply

Two recent events are once again bringing the internet’s foundational Domain Name System into the news, and not in a good way.

The first event involving the DNS last week was a warning from the Cybersecurity Infrastructure and Security Agency issued on Friday for version 9 of the Berkeley Internet Name Domain, or BIND.

The second news item relevant to DNS concerns an open letter issued Friday by Vint Cerf, Stephen Crocker, Carl Landwehr and several others, entitled “Concerns over DNS Blocking.”

More specifics can be found in my story for SiliconANGLE here.

Book review: The edge of sleep

Posted on by
Reply

The Edge of Sleep: A Novel by [Jake Emanuel, Willie Block]This book is based on the podcast/TV series of the same name which has been out for several years. The thesis is that a worldwide plague hits when people go to sleep, so the obvious conceit is to stay awake to try to fight it and figure out an antidote. So we have the real-life pandemic to compare with the fictionalized version, and that may or may not sit well with some readers. We touch on several different groups of people in everyday situations around the world as they try to cope with the calamity, which I think works better in a TV version than trying to keep track of them throughout the novel. Think of it as a zombie apocalypse without the zombies, which has never been a favorite genre for me. The novel has some terrific descriptions and the plot takes us to some interesting places. In place of the hyper-science and politics of Covid, we have just ordinary folks who are trying to live their lives and cope with staying awake. Read on Amazon here.

SiliconANGLE: That next computer in the cloud could be an IBM mainframe

Posted on by
Reply

A small Minneapolis mainframe computer software startup is poised to change the way enterprises use and share data across the cloud.

Virtual Z Computing Inc. claims to be the first and only women-founded and women-led mainframe systems integrator in history. That is a bold position, but perhaps more important is its pair of revolutionary software applications called Lozen and Zaac that connect native mainframe data with various third-party distributed, cloud-based applications.

I explain how the company’s products fit into the future of cloud computing in this story for SiliconANGLE here. 

SiliconANGLE: The top five cloud cybersecurity threats – and what to do about them

Posted on by
Reply

Cybersecurity threats continue to plague cloud infrastructures, and sadly these threats are still mostly the same from years’ past.

But just because these threats continue doesn’t mean that cloud security, taken as a whole tapestry, isn’t as secure as on-premises equipment. That debate — which seems to have spanned a decade or more — should be put to rest forever. Two things many information technology managers have learned are that data center technology doesn’t age well, and it also accumulates tremendous technical debt, the implied cost of future reworking required when problems need to be fixed or approaches become less useful over time.

In this special report for SiliconANGLE, I review the top five threats and what you can do to fix them.

SiliconANGLE: Databases then and now: the rise of the digital twin

Posted on by
Reply

When I first started in IT, back in the Mainframe Dark Ages, we had hulking big databases that ran on IBM’s Customer Information Control System, written in COBOL. These mainframes ran on a complex collection of hardware and operating systems that was owned lock, stock, and bus and tag barrel by IBM. The average age of the code was measured in decades, and code changes were measured in months. They contained millions of transactions, and the data was always out of date since it was a batch system, meaning every night new data would be uploaded.

Contrast that to today’s typical database setup. Data is current to the second, code is changed hourly, and the nature of what constitutes a transaction has changed significantly to something that is now called a “digital twin,” which I explain in my latest post for SiliconANGLE here.

Code is written in dozens of higher-level languages that have odd names that you may never have heard of, and this code runs on a combination of cloud and on-premises equipment that uses loads of microprocessors and open source products that can be purchased from hundreds of suppliers.

It really is remarkable, and that these changes have happened all within the span of a little more than 35 years. You can read more in my post.

 

 

The nasty world of malware keeps getting worse

Posted on by
Reply

A couple of posts this week have crossed my virtual desk that shows the state of internet hacking continues to reach new depths. The first one is from Microsoft Research, the second is from a little-known security outfit called VulnCheck.

The Microsoft report found what it calls a multi-stage adversary-in-the-middle. Back in the day, we had man-in-the-middle and browser-in-the-middle exploits that involved ways to phish a target and then trick someone into giving up their account credentials. As we got better credentials, such as using multi-factor authentication (MFA), the crooks got more sophisticated at prying the additional factors out of us by putting up fake websites.

The new attacks take things to a more complicated level, and indeed, you need a diagram to show the various logic flows as a compromised email account is used to launch a new email campaign, which launches several new campaigns that target new organizations. All of them use what is called indirect proxies so the attackers can control the phishing pages you see, steal web session cookies, make changes to MFA methods, and other trickery. One thing that makes this attack harder to figure out is that unlike typical phishing attacks, no web traffic actually occurs between the target and the actual website that is being faked. The complete details are at the above link.

Russia cyber aggression fuels tensions with west | Financial TimesThe other post from VulnCheck describes research they uncovered recently. This attack impersonated security researchers by copying pictures of actual analysts and attaching them to fake names and social media accounts and GitHub projects, with each project claiming to have a zero-day attack as a lure. Try as they may, the VulnCheck folks would find and neutralize one fake GitHub account only to have it popup a few hours later. All of the claims are phony, and instead contained malware that the attackers try to download to their targets and further compromise things. All of the phonies had one thing in common — they all worked for the High Sierra Cyber Security company, which as you might guess, doesn’t exist. But give them props for all the effort involved in setting this up. If this sounds familiar, the same scenario was used during the Russia attempts on our 2016 election.