View allAll Photos Tagged spearphishing
CISPA, the Privacy-Invading Cybersecurity Spying Bill, is Back in Congress
February 13, 2013 | By Mark M. Jaycox. Electronic Frontier Foundation.
It's official: The Cyber Intelligence Sharing and Protection Act was reintroduced in the House of Representatives yesterday. CISPA is the contentious bill civil liberties advocates fought last year, which would provide a poorly-defined "cybersecurity" exception to existing privacy law. CISPA offers broad immunities to companies who choose to share data with government agencies (including the private communications of users) in the name of cybersecurity. It also creates avenues for companies to share data with any federal agencies, including military intelligence agencies like the National Security Agency (NSA).
EFF is adamantly opposed to CISPA. Will you join us in calling on Congress to stop this and any other privacy-invasive cybersecurity legislation?
As others have noted, “CISPA is deeply flawed. Under a broad cybersecurity umbrella, it permits companies to share user communications directly with the super secret NSA and permits the NSA to use that information for non-cybersecurity reasons. This risks turning the cybersecurity program into a back door intelligence surveillance program run by a military entity with little transparency or public accountability.”
Last year, CISPA passed the House with a few handful of amendments that tried to fix some of its vague language. But the amendments didn't address many of the significant civil liberties concerns. Those remaining problems were reintroduced in today's version of CISPA. Here's a brief overview of the issues:
Companies have new rights to monitor user actions and share data—including potentially sensitive user data—with the government without a warrant.
First, CISPA would still give businesses1 the power to use "cybersecurity systems" to obtain any "cybersecurity threat information" (CTI)—which could include personal communications—about a percieved threat to their networks or systems. The only limitation is that the company must act for a "cybersecurity purpose," which is vaguely defined to include such things as "safeguarding" networks.
CISPA overrides existing privacy law, and grants broad immunities to participating companies.
At the same time, CISPA would also create a broad immunity from legal liability for monitoring, acquiring, or sharing CTI, so long as the entity acted “in good faith.” Our concern from day one has been that these combined power and immunity provisions would override existing privacy laws like the Wiretap Act and the Stored Communications Act.
Worse, the law provides immunity “for decisions made based on” CTI. A rogue or misguided company could easily make bad "decisions" that would do a lot more harm than good, and should not be immunized.
CISPA also raises major transparency and accountability issues.
Information provided to the federal government under CISPA would be exempt from the Freedom of Information Act (FOIA) and other state laws that could otherwise require disclosure (unless some law other than CISPA already requires its provision to the government).
Users probably won't know if their private data is compromised under CISPA, and will have little recourse.
CISPA's authors argue that the bill contains limitations on how the federal government can use and disclose information by permitting lawsuits against the government. But if a company sends information about a user that is not cyberthreat information, the government agency does not notify the user, only the company.
CISPA is a dangerous bill
These are just a couple of reasons of why CISPA is a dangerous bill and why President Obama threatened to veto the bill last year. CISPA essentially equates greater cybersecurity with greater surveillance and information sharing. But many of our cybersecurity problems arise from software vulnerabilities and human failings, issues CISPA fails to address. For instance, the recent series of hacks suffered by New York Times were suspected to be from spearphishing and victims downloading malicious software masked as email attachments—the types of issues that CISPA doesn't deal with.
We were heartened to hear that President Obama's new Executive Order on cybersecurity will encourage government agencies to more readily share cybersecurity information with companies, and may even reduce unnecessary secrecy around cybersecurity information. Let's use the momentum from the Executive Order to turn a new leaf in the cybersecurity debate, beginning a broader public dialogue about cybersecurity that doesn’t assume that surveillance is the right solution.
Please join EFF in opposing CISPA by contacting Congress today.
"A single #spearphishing #email carrying a slightly altered #malware can bypass multi-million dollar #enterprise #security solutions if an adversary deceives a cyber-hygienically apathetic #employee into opening #attachment or #clicking a #malicious link..."-James Scott, Senior Fellow, ICIT, CCIOS and CSWS
#spearphishing #email #malware #enterprise #security #employee #malicious
bit.ly/2jWSg0e Download the book that informs cyber risk professionals on ways to take back control of their cyber security.
"A Nation State or Cyber-Mercenary won't hack #evoting machines one by one. This takes too long and will have minimal impact. Instead, they'ill take an easier approach like #spearphishing the #manufacturer with malware and poison the #voting machine update pre-electiion and allow the manufacturer to update each individual machine with a self-deleting payload that will target the #tabulation process."- James Scott, Senior Fellow, Institute for Critical Infrastructure Technology (ICIT)
#JamesScott #ICIT #CCIOS #CSWS #America
Don’t Act on Requests from Trusted Sources (Spearphishing) - Spearphishing is a more targeted type of phishing. Spear phishing attempts can take many different forms like the most common method of hacking involves tricking you into entering in your login and password, or other vital information. Log on tellemgrodypr.com/
Don’t Act on Requests from Trusted Sources (Spearphishing) - Spearphishing is a more targeted type of phishing. Spear phishing attempts can take many different forms like the most common method of hacking involves tricking you into entering in your login and password, or other vital information. Log on tellemgrodypr.com/
Don’t Act on Requests from Trusted Sources (Spearphishing) - Spearphishing is a more targeted type of phishing. Spear phishing attempts can take many different forms like the most common method of hacking involves tricking you into entering in your login and password, or other vital information. Log on tellemgrodypr.com/
Wikipedia - Misinformation is false or inaccurate information.[1] Examples of misinformation include false rumors, insults and pranks, while examples of more deliberate disinformation include malicious content such as hoaxes, spearphishing and computational propaganda[2]. News parody or satire may also become misinformation if it is taken as serious by the unwary and spread as if it were true. The terms "misinformation" and "disinformation" have been associated with the neologism "Fake News," defined by some scholars as “fabricated information that mimics news media content in form but not in organizational process or intent.”[3]
"#SpearPhish the #voting machine manufacturer admin, elevate privileges, pinpoint update server, inject payload: geo-targeted decimalization #malware that self-deletes...just hacked your #election...now tell me that an #AirGap is a defense!"- James Scott, Sr. Fellow, ICIT,CCIOS, CSWS
#WeekendWisdom #security
Spear phishing is a highly targeted and well-researched attempt to steal sensitive information, including financial credentials for malicious purposes, by gaining entry into computer systems.
via
This week, ESET researchers released their findings about Operation In(ter)ception, a campaign that leveraged LinkedIn-based spearphishing and took aim at aerospace and military companies in Europe and the Middle East between September and December 2019. Another major research effort by ESET experts revealed a campaign by the InvisiMole group that targeted high-profile organizations in the
The post Week in security with Tony Anscombe appeared first on WeLiveSecurity
Article source here: Week in security with Tony Anscombe tomhomesecurtyguide.blogspot.com/2020/06/week-in-security...