Discussed Articles

1) Breaches suck!

Two pertinent quotes: Essentially, whoever has the lower level of security will be the one who will be responsible for the unauthorized transaction, said Doug Johnson, a senior vice president of payments and security policy at the American Bankers Association. and In the case of Home Depot, the lawsuit alleges that the retailer had ignored multiple warnings about its vulnerabilities since 2008. The suit says Home Depot failed to turn on a feature of the 2007 version of Symantec antivirus software specifically designed to spot malware that attacks point-of-sale terminals

* https://nytimes.com/2015/09/29/business/as-online-data-theft-escalates-banks-look-to-retailers-to-bear-the-losses.html

* https://danielmiessler.com/blog/insurance-infosec/

2) HTTPS are for premium services only!

* https://googleonlinesecurity.blogspot.com/2015/09/https-support-coming-to-blogspot.html

* http://www.troyhunt.com/2015/08/were-struggling-to-get-traction-with.html

* https://twitter.com/pinboard/status/323486920946622464

* http://googlewebmastercentral.blogspot.com.au/2014/08/https-as-ranking-signal.html

* https://surkatty.org/blog/posts/certificate_authorities.html

3) The Sad State of America's Voting Machines

How are you managing your company's asset lifecycle? See the Ops Report Card for a starter policy.

* http://www.wired.com/2015/09/dismal-state-americas-decade-old-voting-machines/

* http://www.opsreportcard.com/section/22

Breach of the Week

T-Mobile / Experian

What third-pary vendors and services are you implicitly or explicitly trusting to deliver your service to your customers? What is their security posture? Honorable mention - Patreon

* https://krebsonsecurity.com/2015/10/experian-breach-affects-15-million-consumers/

* http://arstechnica.com/security/2015/10/gigabytes-of-user-data-from-hack-of-patreon-donations-site-dumped-online/

Discussed Articles

1) Your Security Policy is So Lame

* https://isc.sans.edu/diary/Your+Security+Policy+Is+So+Lame/19991

2) Death to plugins of yore

* https://threatpost.com/google-patches-critical-vulnerabilities-in-chrome-45/114509

* http://advertising.amazon.com/ad-specs/en/policy/technical-guidelines

* http://arstechnica.com/information-technology/2015/08/google-chrome-will-block-auto-playing-flash-ads-from-september-1/

* http://googleadsdeveloper.blogspot.com/2015/08/handling-app-transport-security-in-ios-9.html

3) NSA w/ Quantum Resistant Computing initiative

* https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml

Breach of the Week

Ashley Madison

* http://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/

Discussed Articles

1) Google's Comments on the Wassenaar Arrangement

Send your comments to [email protected]

* http://googleonlinesecurity.blogspot.com/2015/07/google-wassenaar-arrangement-and.html

2) Finding Algorithmically Chosen DNS Names Using Entropy

Check out the code at https://github.com/MarkBaggett/MarkBaggett/tree/master/freq

* https://isc.sans.edu/forums/diary/Detecting+Random+Finding+Algorithmically+chosen+DNS+names+DGA/19893/

3) Google to Expand Use of Safe Browsing to Stop Unwanted Program

* https://threatpost.com/google-to-expand-use-of-safe-browsing-to-stop-unwanted-software/113824

Breach of the Week

Hacking Team Gets Hacked

Check out the Git repo for stolen source code

* http://www.csoonline.com/article/2943968/data-breach/hacking-team-hacked-attackers-claim-400gb-in-dumped-data.html

* https://github.com/hacked-team

Discussed Articles

1) A Month Without Flash

* http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/

2) Samsung Disabling Windows Updates

* http://bsodanalysis.blogspot.in/2015/06/samsung-deliberately-disabling-windows.html

3) Creating Security KPIs and KRIs

* http://www.csoonline.com/article/2940690/network-security/how-cisos-can-create-security-kpis-and-kris.html

4) Spiceworks Vulnerability Announcement

* https://community.spiceworks.com/blog/2047-more-details-on-the-7-4-desktop-vulnerability-and-next-steps

Breach of the Week

None :(

Skipped in favor of talking about how well Spiceworks handled their vulnerability.

* http://zombo.com/

Discussed Articles

1) Interview with Sean, author of the camb Linux IDS tool

Check out the code on his Github repo

* http://www.unixist.com/security/measuring-linux-at-runtime/index.html

* https://github.com/unixist/camb

2) Reassessing Airport Security

* https://www.schneier.com/blog/archives/2015/06/reassessing_air.html

3) Honorable Mention - LastPass Breach

* https://blog.lastpass.com/2015/06/lastpass-security-notice.html

4) Honorable Mention - Reasoning by Lego

* http://www.cryptofails.com/post/121201011592/reasoning-by-lego-the-wrong-way-to-think-about

Discussed Articles

1) Facebook PGP Encrypted Emails

* https://www.facebook.com/notes/protect-the-graph/securing-email-communications-from-facebook/1611941762379302

* http://www.thoughtcrime.org/blog/gpg-and-me/

2) Microsoft Supporting SSH in Windows

* http://blogs.msdn.com/b/powershell/archive/2015/06/03/looking-forward-microsoft-support-for-secure-shell-ssh.aspx

* https://threatpost.com/microsoft-to-support-ssh-in-windows/113120

3) Why Firewalls Won’t Matter In A Few Years

* http://etherealmind.com/why-firewalls-wont-matter-in-a-few-years/

Breach of the Week

IRS Blames Breach on Lack of Funding

* http://www.csoonline.com/article/2929749/cyber-attacks-espionage/security-short-take-blame-for-irs-data-breach-laid-on-cybersecurity-cuts.html#tk.rss_all

Discussed Articles

1) How to Crash a Surgical Robot

How could your security controls be used against you?

* http://www.theregister.co.uk/2015/04/28/packet_of_death_how_to_crash_a_surgical_robot/

2) Defenders think in lists. Attackers think in graphs

Are you thinking of your defense in the same way that your attackers are thinking about coming at you? Is that a good thing? What would be the blast radius if one of your boxes was compromised?

* http://blogs.technet.com/b/johnla/archive/2015/04/26/defenders-think-in-lists-attackers-think-in-graphs-as-long-as-this-is-true-attackers-win.aspx

3) SHA-1 Migration

Legacy software continues to be a pain. Migrate sooner rather then later. Write software that is future proof as much as possible.

* http://www.theregister.co.uk/2015/04/30/sha_2_migration_headaches/

Breach of the Week

Superfish Redux

Lenovo will continue to ship bloatware which provides avenues for exploitation. Who wins in these situations besides law firms? Flatten your boxes with a known good minimal image.

* https://www.unitedstatescourts.org/federal/cand/284981/1-0.html

* https://news.ycombinator.com/item?id=9525834

Discussed Articles

1) Verizon 2015 Data Breach Investigation Report

Threat intel still not all that valuable - Mobile devices not hugely owned, plus what could you really do with one if you did own it? - 99.9% of the exploited vulnerabilities were compromised more than a year after the CVE was published. - 70-90% (depending on the source and organization) of malware samples are unique to a single organization. - Average cost per record lost was 58¢

* http://www.verizonenterprise.com/resources/reports/rp_data-breachinvestigation-report-2015_en_xg.pdf

2) Researcher who joked about hacking a jet plane barred from United flight

Security researcher probably shouldn't have tweeted what he did - United overreacted - Security is a feeling and a reality

* http://arstechnica.com/security/2015/04/researcher-who-joked-about-hacking-a-jet-plane-barred-from-united-flight/

* https://twitter.com/Sidragon1/status/588433855184375808

3) Honorable Mention - The Sad State Of Sysadmin In The Age Of Containers

* http://www.vitavonni.de/blog/201503/2015031201-the-sad-state-of-sysadmin-in-the-age-of-containers.html

* https://news.ycombinator.com/item?id=9419188

Discussed Articles

1) President Obama Issues Executive Order In Response to Foreign Hackers

See also: USA Today article on the various states of National Emergencies declared

* https://www.whitehouse.gov/the-press-office/2015/04/01/executive-order-blocking-property-certain-persons-engaging-significant-m

* http://www.usatoday.com/story/news/politics/2014/10/22/president-obama-states-of-emergency/16851775/

2) Nuclear Arsenal Security Protocol Failures

For a more thorough background, check out the book Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety

* https://www.youtube.com/watch?v=1Y1ya-yF35g

* http://www.amazon.com/Command-Control-Damascus-Accident-Illusion/dp/0143125788?tag=braxtoncom0f-20

3) China/Github Attack Dubbed "Great Cannon"

Also check out Robert Graham's article on building a packet cannon.

* https://krebsonsecurity.com/2015/04/dont-be-fodder-for-chinas-great-cannon/

* http://blog.erratasec.com/2015/04/scalability-of-great-cannon.html#.VSrVfhPF-LE

4) Honorable Mention - DNS Root Name Server Security

* http://www.theguardian.com/technology/2014/feb/28/seven-people-keys-worldwide-internet-security-web

* http://en.wikipedia.org/wiki/Distributed_denial_of_service_attacks_on_root_nameservers

* http://blog.erratasec.com/2012/02/no-anonymous-cant-ddos-root-dns-servers.html#.VTLYJxPF-LE

Breach of the Week

TV5Monde hack

Social Media Accounts Credentials Also Broadcasted

* http://arstechnica.com/security/2015/04/french-tv-network-blames-an-islamist-group-for-11-station-blackout/

* http://arstechnica.com/security/2015/04/hacked-french-network-exposed-its-own-passwords-during-tv-interview/

Discussed Articles

1) Bloomberg attacks Kaspersky, Kaspersky responds

* http://www.bloomberg.com/news/articles/2015-03-19/cybersecurity-kaspersky-has-close-ties-to-russian-spies

* http://eugene.kaspersky.com/2015/03/20/a-practical-guide-to-making-up-a-sensation/

2) DDoS against GitHub

* http://insight-labs.org/?p=1682

3) Squid Bug in Beta Build

* https://bugzilla.redhat.com/show_bug.cgi?id=1202858

Breach of the Week

Premera

* http://www.premeraupdate.com/