On several occasions I’ve written about insecurities of the Internet of Things – such as here, here, here, here and here. Recently, four US Senators decided to do something about it, and with the help of the Atlantic Council and Harvard University, have drafted a bill outlining minimum security requirements for IoT device purchases by US Federal agencies. The bill is bipartisan, proposed by two Republican Senators – Steve Daines (MT) and Cory Gardner (CO), and two Democrats – Mark Warner (VA) and Ron Wydon (OR). The proposed legislation is to be known as the Internet of Things Cybersecurity Improvement Act of 2017. It is a good start, and examining its provisions provides insight into many IoT device security vulnerabilities and solutions.
Continue reading
IoT device guidelines
Mac attack
After years of enjoying relative security through obscurity, many attack vectors have recently proved successful on Apple Mac, opening the Mac up to future attack. A refection of this is the final quarter of 2016, when Mac OS malware samples increased by 247% according to McAfee. Even though threats are still much lower than for Windows OS users, Mac users cannot afford to be blissfully complacent as they may have been in the past.
Securing autonomous vehicles
Roborace unveiled the design for their autonomous race car at Mobile World Congress in Barcelona this week. Without a driver the car is lightweight and high performing. Powered by four 300kW motors which run off a 540kWh battery, the vehicle is capable of speeds up to 200 mph.
Times are a changin’
At the start of a new year we look ahead to identify broad technological advancements with disruptive potential – and examine likely security implications. I believe there are two trends which will shape IT security in a profound way.
The changing face of ransomware
2016 saw a rapid rise to prominence of ransomware, with estimates of $1 billion in proceeds going to ransomware threat actors making it a major crime activity. I’ve written before about ransomware (here, here and here) – this post looks at interesting recent developments.
Continue reading
Winner at the Great British Entrepreneur Awards 2016
I am thrilled to have won the Great British Entrepreneur of the Year Award for cyber security at a gala event at the Lancaster Hotel in London last night. Thanks to the judges for selecting us ahead of finalists from companies such as Sophos, DarkTrace, Becrypt and others.
Cutting through the Dyn
Last Friday (21 Oct), one of the largest DDoS attacks ever seen, created widespread internet outage affecting services from Twitter, AWS, Reddit, Netflix, Spotify, CNN, Paypal, NY Times, WSJ, and others. The attack was directed at Dyn, a domain name service provider, whose servers interpret internet addresses, directing web traffic to the affected companies. Dyn are like an internet postal code or zip code lookup system. A statement from Dyn reported traffic from “10s of millions of IP addresses”, and customers of affected sites were unable to access web services for about two hours. Two things stood out about this DDoS attack: (1) The increased traffic was not aimed directly at the networks affected, but targeted at DNS servers hosted by Dyn, and (2) The attack was conducted through a botnet of infected IoT devices, known as Mirai.
Continue reading
