Cybersecurity

Governments and Governance

A United Nations task force recently held a two-day workshop on the question of who governs the Internet. U.N. Secretary General Kofi Annan challenged those of us present to ensure that the Internet and the World Wide Web support "the cause of human development."
Following in the long-standing tradition of skepticism about governments in the Internet community, some in the technical community and the Internet's chattering classes view the concerns expressed by the United Nations and countries such as Brazil, India and others, as a threat to the operation of the Internet itself. This article was originally published at CNET News.Com on April 6, 2004. more

SiteFinder vs. Engineers: Our Mistake Is Ignorance

We, as the Internet engineering community, have made a great mistake. Actually, it wasn't even one large mistake, but a series of small ones. Engineers are busy people, and most of us work under the constraints of the organizational entities we serve (be it ISPs, non-internet corporates, or even non-profits). Few of us have time for politics; even fewer have the desire and motivation for politics, and those of us who do try usually end up facing a brick wall of stubbornness, lack of understanding of the underlying technical issues, or just a deaf ear. more

DNS Gets A Formal Coordination System

CircleID recently interview Paul Vixie, Founder & Chairman of Internet Software Consortium (ISC), to discuss ISC's newly formed Operations, Analysis, and Research Center (OARC). OARC is launched in response to DDoS attacks at the Internet's core infrastructure and the vital requirement for a formal coordination system. OARC is also a part of US homeland security initiatives, such as the formation of Information Sharing and Analysis Centers (ISACs).

"Registries and registrars, ccTLD operators, large corporate NOCs, ISPs and ecommerce companies that host many domain names are all likely candidates. This is also a natural for law enforcement groups that are worried about attacks on the Internet." more

ICANN and IAB Ask VeriSign to Suspend Site Finder

The Internet Corporation for Assigned Names and Numbers (ICANN) has released an "Advisory" concerning VeriSign's deployment of DNS wildcard (Site Finder) service: "Since the deployment, ICANN has been monitoring community reaction, including analysis of the technical effects of the wildcard, and is carefully reviewing the terms of the .com and .net Registry Agreements. In response to widespread expressions of concern from the Internet community about the effects of the introduction of the wildcard..." more

Moving Target: Spammer Using Over 1000 Home Computers as DNS

Some individual appears to have hijacked more than a 1,000 home computers starting in late June or early July and has been installing a new Trojan Horse program on them. The Trojan allows this person to run a number of small websites on the hijacked home computers. These websites consists of only a few web pages and apparently produce income by directing sign-ups to for-pay porn websites through affiliate programs. Spam emails messages get visitors to come to the small websites.

To make it more difficult for these websites to be shut down, a single home computer is used for only 10 minutes to host a site. After 10 minutes, the IP address of the website is changed to a different home computer... more

98% Of Internet’s Main Root Server Queries Are Unnecccary: Should You Be Concerned?

A recent study by researchers at the Cooperative Association for Internet Data Analysis (CAIDA) at the San Diego Super Computer Center (SDSC) revealed that a staggering 98% of the global Internet queries to one of the main root servers, at the heart of the Internet, were unnecessary. This analysis was conducted on data collected October 4, 2002 from the 'F' root server located in Palo Alto, California.

The findings of the study were originally presented to the North American Network Operators' Group (NANOG) on October 2002 and later discussed with Richard A. Clarke, chairman of the President's Critical Infrastructure Protection Board and Special Advisor to the U.S. President for Cyber Space Security. more

Privacy Matters: Is It Time To Abolish The WHOIS Database?

Recently, I entered my domain name in a "WHOIS" database query to test the results of the database by using WHOIS on a number of domain name registrar websites. WHOIS is a database service that allows Internet users to look up a number of matters associated with domain names, including the full name of the owner of a domain name, the name of the domain name hosting service, the Internet Protocol or I.P. number(s) corresponding to the domain name, as well as personally identifying information on those who have registered domain names. I was astonished to find... more

Pentagon Investigates Military Base Freezer Failures as Suspected Cyberattack

The Pentagon is investigating unexplained refrigeration failures at six US military commissaries as a possible cyberattack, while French authorities examine attacks on Internet-connected refrigeration systems affecting hundreds of supermarkets. more

DNSSEC in Ghana: 99% Can Validate, But .gh Remains Unsigned

Ghana reports approximately 99% DNSSEC validation capability among measured users, yet its .gh domain remains unsigned, exposing a gap between resolver readiness and domain security that calls for coordinated deployment and operational planning. more

Google and Meta Undersea Cables Rank Among Pacific’s Most Vulnerable to Sabotage

New research ranks trans-Pacific submarine cables by sabotage vulnerability, identifying Google and Meta projects among high-risk systems while documenting Chinese research vessel activity near critical underwater communications infrastructure. more

CISA Unveils 2030 Strategy to Shift U.S. Cyber Defense Toward Proactive Threat Removal

CISA's new 2030 strategy shifts US cyber defense toward proactive threat removal, prioritizing critical infrastructure protection and national resilience, with implementation milestones set for the coming year. more

Vulnerability Windows and Exposure Costs: Modeling the Effects of Stale Trust

A Verisign Labs framework quantifies how compromised certificates remain trusted when revocation information is stale, using vulnerability windows and exposure costs to compare security risks and measure the benefits of faster certificate status updates. more

Too Many Providers, More Moving Parts: The Challenge of SSL Certificate Fragmentation

Research into SSL certificates at Forbes Global 2000 companies reveals widespread provider fragmentation, raising operational concerns as certificate validity periods shorten to 100 days in March 2027. more

CaribNOG SHIELD Aims to Build Caribbean Cybersecurity Capacity Through Local Training

CaribNOG's new SHIELD initiative aims to strengthen Caribbean Internet security through technical internships, routing security training and regional collaboration, with St Kitts and Nevis planning to introduce the programme in 2027. more

UK Proposes Tougher Undersea Cable Security Laws and Emergency Intervention Powers

The UK proposes stronger security obligations for undersea cable operators, tougher penalties for infrastructure damage and emergency intervention powers, raising questions about compliance costs, repair readiness and the resilience of international Internet connectivity. more