This is default featured post 1 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.

This is default featured post 2 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.

This is default featured post 3 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.

This is default featured post 4 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.

This is default featured post 5 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.

Showing posts with label build safety. Show all posts
Showing posts with label build safety. Show all posts

Thursday, May 26, 2011

China, US vie for mantle of world's biggest hacking victim

China and the US have been battling lately to portray themselves as the more pathetic victim of cyberattacks.
The US has lamented its own lack of preparedness for a major Internet hack attack and focused on the 30+ companies affected by the recent China-based hack that set Google off on its recent anti-censorship kick. But it is Beijing that has been most at pains to claim the mantle of "victim."

We're number 1!

"As one of the major victims of hacking in the world," said a Foreign Ministry spokesperson, "China advocates stronger international cooperation in combating hacking to protect citizens' privacy and safeguard cyber security according to law."
The accusations of Chinese hacking come as China tries to deflect the Google story, saying that it's a business dispute (and thus the US government should stay away), that the government had nothing to do with the hacking, and that Chinese people "fully enjoy the freedom of speech and have immediate access to adequate information in accordance with law, which is one of the important reasons that they firmly follow the path of socialism with Chinese characteristics."
"According to law" is important in this formulation, because it allows the Chinese to have a consistent focus on following the law. Google must censor search results in China because it is the law; China isn't behind hack attacks that break the law; let's all work together to make cybersecurity an international issue (according to law).
The spokesperson's last comments came on February 1 in response to questions about a meeting between China and US Secretary of State Clinton that came on the sidelines of an Afghan donor conference. The response is telling, because it fits into the emerging Chinese narrative about cyberattacks: "hey, we're huge victims!"
China has stressed its own victimization ever since it recovered from its initial confusion and began responding to the Google narrative. Back on January 19, the Foreign Ministry was stressing the "we're victims too" theme, saying that cyberattacks from abroad increased 148 percent in 2008. (Also: China's Internet "was open and managed in accordance with the law.")
On January 22, in the wake of Hillary Clinton's major speech on Internet freedom, the Foreign Ministry stressed that it was "a major victim of hacking in the world," asked for international cooperation, and claimed that China "supervises Internet according to law."
We're victims, too!
The US intelligence community remains skeptical of China's interest in stopping international cyberattacks of a certain kind: state-backed attacks trolling for data, corporate secrets, or infrastructure weaknesses.
In a report (PDF) submitted to Congress yesterday, Dennis Blair, the Director of National Intelligence, placed cyberattacks at the very top of the document. And, while China wasn't called out by name, Blair's single example was telling.
"The recent intrusions reported by Google are a stark reminder of the importance of these cyber assets, and a wake-up call to those who have not taken this problem seriously," he wrote.
How bad is the problem? Well, the US sees itself as a major victim of cyberattacks, too. "Sensitive information is stolen daily from both government and private sector networks," wrote Blair. "We often find persistent, unauthorized, and at times, unattributable presences on exploited networks, the hallmark of an unknown adversary intending to do far more than merely demonstrate skill or mock a vulnerability."
In the section on China, Blair noted four key areas of concern; one was "China’s aggressive cyber activities." (The US maintains such capabilities too, of course, and Blair called on Congress to deliver more funding.)

Source : http://arstechnica.com/tech-policy/news/2010/02/china-us-vie-for-mantle-of-worlds-biggest-hacking-victim.ars

Tuesday, May 24, 2011

Build Safety Into the Very Beginning of the Computer System

ScienceDaily (May 11, 2011) — A new publication from the National Institute of Standards and Technology (NIST) provides guidelines to secure the earliest stages of the computer boot process. Commonly known as the Basic Input/Output System (BIOS), this fundamental system firmware -- computer code built into hardware -- initializes the hardware when you switch on the computer before starting the operating system. BIOS security is a new area of focus for NIST computer security scientists.

"By building security into the firmware, you establish the foundation for a secure system," said Andrew Regenscheid, one of the authors of BIOS Protection Guidelines (NIST Special Publication 800-147). Without appropriate protections, attackers could disable systems or hide malicious software by modifying the BIOS. This guide is focused on reducing the risk of unauthorized changes to the BIOS.
Designed to assist computer manufacturers writing BIOS code, SP 800-147 provides guidelines for building features into the BIOS that help protect it from being modified or corrupted by attackers. Manufacturers routinely update system firmware to fix bugs, patch vulnerabilities and support new hardware. SP 800-147 calls for using cryptographic "digital signatures" to authenticate the BIOS updates before installation based on NIST's current cryptographic guidelines. The publication is available just as computer manufacturers are beginning to deploy a new generation of BIOS firmware. "We believe computer manufacturers are ready to implement these guidelines and we hope to see them in products soon," said Regenscheid.
The publication also suggests management best practices that are tightly coupled with the security guidelines for manufacturers. These practices will help computer administrators take advantage of the BIOS protection features as they become available.
BIOS Protection Guidelines, NIST SP 800-147, is available at http://csrc.nist.gov/publications/nistpubs/800-147/NIST-SP800-147-April2011.pdf.

Source : http://www.sciencedaily.com/releases/2011/05/110511162533.htm

Share

Twitter Delicious Facebook Digg Stumbleupon Favorites