Sunday, December 15, 2013

My #2 personal privacy and security prediction for 2014: NSA-GCHQ-NRO will dominate

Here is another of the privacy and security predictions I am making for 2014. This is in addition to the ones I contributed to We Live Security where I had the honor of presenting predictions from my fellow researchers at ESET. Note that the following are my personal opinions, which may differ from those of my employer (although my employer has some pretty cool opinions).

The #1 privacy and security story in 2014 will be the NSA

Snowden-sourced papers will continue to leak, further revealing just how thoroughly America's National Security Agency has pursued the goal set by its leadership: make sure no piece of information about any person anywhere is beyond reach. While the NSA has dominated much of the privacy and security news in 2013, the story may evolve into a triple play in 2014, with GCHQ on one side, NRO on the other.

The National Reconnaissance Office has already made a big play for attention with its latest spy satellite, NROL-39, launched in early December sporting a logo that many pundits will claim says it all: NOTHING IS BEYOND OUR REACH.

While NSA and GCHQ are initials known to millions around the world, the NRO has lurked in the shadows, despite having a budget about the same size as the NSA; that's $10.3 billion and $10.8 billion, for the NRO and NSA respectively for 2013, according to the Washington Post.

Note that in the mid-1990s the budgets were $6 billion and $3.6 billion, with NRO spending far-outpacing the NSA and CIA.

Expect someone to put more detailed spending numbers together as the work of these agencies comes under increased scrutiny in 2014. For example, all three have a history of using military employees who are paid out of their respective armed forces budgets. So the total U.S. spend on surveillance and code-breaking activities may be more than has yet been reported.

If the NROL-39 logo is any indication, very little of the NRO budget has gone into public relations and incident response planning. It is hard to imagine more disastrous imagery and sloganeering for a spy satellite launched post-Snowden. No wonder that within a few days we heard loud and clear from the world's technology giants demanding global surveillance reform. (A topic I discussed recently over on Tech Republic.)

My #1 personal privacy and security prediction for 2014: Antivirus will be slandered, again

Here is one of the privacy and security predictions I am making for 2014. This is in addition to the ones I contributed to We Live Security where I had the honor of presenting predictions from my fellow researchers at ESET. Note that the following are my personal opinions, which may differ from those of my employer (although my employer has some pretty cool opinions).

The media will repeat a massive lie about antivirus technology

I predict that in 2014 every major newspaper and magazine will perpetuate, to the detriment of data security and human understanding, the grossly erroneous notion that "for an antivirus firm to spot malware, it first needs to have seen the malware, recognized that it's malicious code, and written a corresponding virus signature for its products."

I predict that, although this assertion is simply not true, and has not been true for many years, that fact will not deter people from repeating it, over and over. This is a bit like Car and Driver or Consumer Reports saying that cars cannot be started without first engaging the crank handle.

True, there was a time, long ago, when crank handles were routinely used to start cars, just as some antivirus programs were, in the distant past, based solely on signatures derived from known bad code. I've got a free t-shirt and more for the first mainstream journalist who breaks rank from the ill-informed herd and points out that any AV app worthy of the name today uses a lot more than signature matching to protect systems from malicious code. 

(With huge hat tip to the guys in Norway who posted that YouTube video of a hand-crank start: they are braver men than me; I've seen how much pain a crank handle can cause.)

Saturday, October 12, 2013

Free professional security advice for Palestinian hackers

First of all, welcome. I am glad you found this page. Please don’t hack it.

Who am I? I am a computer security professional with over 20 years experience, just one of many people in the computer security world who have great sympathy for the Palestinian people. We agree with you that the Palestinian people deserve to live in peace. We let our politicians know what we think. We use social media to spread news and awareness of the injustices suffered by the Palestinian people at the hands of Western governments and their allies in the region (for example, see my pins of infographics about the Occupation).

As computer security professionals, we also work hard to protect the privacy and cybersecurity of hundreds millions of individuals around the world. Some of those people are Palestinians. For example, I work at ESET, a company which protects the computers and smartphones of many millions of people in more than 180 different countries. I’m guessing some of them are Palestinian sympathizers.

Monday, September 02, 2013

More information security articles from Stephen and Michael

Here's an update on the information security stuff we've been writing. Three articles from SearchSecurity by Mike and a link to my archive on We Live Security.

Saturday, March 30, 2013

Criminal hackers force down volunteer site serving hemochromatosis help

Just a quick note to say that the website I created at CelticCurse.org is offline at the moment due to compromise by illegal access. It looks like criminal hackers forced their way into the server that hosts the site and installed their own code to launch DDoS attacks.

If you are not familiar with the site, it is an entirely volunteer project that serve up information and resources for people with hemochromatosis, a potentially fatal genetic disorder that affects millions around the world. Due to low awareness in the medical community hemochromatosis is widely under-diagnosed and often ill-treated, leading to a lot of needless pain and suffering.

I am working to restore the site, but in the meantime people who need more information about hemochromatosis can visit:
If you want THE book on hemochromatosis, we highly recommend:

Guide to Hemochromatosis

Monday, March 25, 2013

More security articles from Michael Cobb, CISSP-ISSAP