My #2 personal privacy and security prediction for 2014: NSA-GCHQ-NRO will dominate

Here is another of the privacy and security predictions I am making for 2014. This is in addition to the ones I contributed to We Live Security where I had the honor of presenting predictions from my fellow researchers at ESET. Note that the following are my personal opinions, which may differ from those of my employer (although my employer has some pretty cool opinions).

The #1 privacy and security story in 2014 will be the NSA

Snowden-sourced papers will continue to leak, further revealing just how thoroughly America's National Security Agency has pursued the goal set by its leadership: make sure no piece of information about any person anywhere is beyond reach. While the NSA has dominated much of the privacy and security news in 2013, the story may evolve into a triple play in 2014, with GCHQ on one side, NRO on the other.

The National Reconnaissance Office has already made a big play for attention with its latest spy satellite, NROL-39, launched in early December sporting a logo that many pundits will claim says it all: NOTHING IS BEYOND OUR REACH.

While NSA and GCHQ are initials known to millions around the world, the NRO has lurked in the shadows, despite having a budget about the same size as the NSA; that's $10.3 billion and $10.8 billion, for the NRO and NSA respectively for 2013, according to the Washington Post.

Note that in the mid-1990s the budgets were $6 billion and $3.6 billion, with NRO spending far-outpacing the NSA and CIA.

Expect someone to put more detailed spending numbers together as the work of these agencies comes under increased scrutiny in 2014. For example, all three have a history of using military employees who are paid out of their respective armed forces budgets. So the total U.S. spend on surveillance and code-breaking activities may be more than has yet been reported.

If the NROL-39 logo is any indication, very little of the NRO budget has gone into public relations and incident response planning. It is hard to imagine more disastrous imagery and sloganeering for a spy satellite launched post-Snowden. No wonder that within a few days we heard loud and clear from the world's technology giants demanding global surveillance reform. (A topic I discussed recently over on Tech Republic.)

My #1 personal privacy and security prediction for 2014: Antivirus will be slandered, again

Here is one of the privacy and security predictions I am making for 2014. This is in addition to the ones I contributed to We Live Security where I had the honor of presenting predictions from my fellow researchers at ESET. Note that the following are my personal opinions, which may differ from those of my employer (although my employer has some pretty cool opinions).

The media will repeat a massive lie about antivirus technology

I predict that in 2014 every major newspaper and magazine will perpetuate, to the detriment of data security and human understanding, the grossly erroneous notion that "for an antivirus firm to spot malware, it first needs to have seen the malware, recognized that it's malicious code, and written a corresponding virus signature for its products."

I predict that, although this assertion is simply not true, and has not been true for many years, that fact will not deter people from repeating it, over and over. This is a bit like Car and Driver or Consumer Reports saying that cars cannot be started without first engaging the crank handle.

True, there was a time, long ago, when crank handles were routinely used to start cars, just as some antivirus programs were, in the distant past, based solely on signatures derived from known bad code. I've got a free t-shirt and more for the first mainstream journalist who breaks rank from the ill-informed herd and points out that any AV app worthy of the name today uses a lot more than signature matching to protect systems from malicious code. 

(With huge hat tip to the guys in Norway who posted that YouTube video of a hand-crank start: they are braver men than me; I've seen how much pain a crank handle can cause.)

Free professional security advice for Palestinian hackers

First of all, welcome. I am glad you found this page. Please don’t hack it.

Who am I? I am a computer security professional with over 20 years experience, just one of many people in the computer security world who have great sympathy for the Palestinian people. We agree with you that the Palestinian people deserve to live in peace. We let our politicians know what we think. We use social media to spread news and awareness of the injustices suffered by the Palestinian people at the hands of Western governments and their allies in the region (for example, see my pins of infographics about the Occupation).

As computer security professionals, we also work hard to protect the privacy and cybersecurity of hundreds millions of individuals around the world. Some of those people are Palestinians. For example, I work at ESET, a company which protects the computers and smartphones of many millions of people in more than 180 different countries. I’m guessing some of them are Palestinian sympathizers.

More information security articles from Stephen and Michael

Here's an update on the information security stuff we've been writing. Three articles from SearchSecurity by Mike and a link to my archive on We Live Security.

• Expert Michael Cobb discusses why known Java security vulnerabilities are on so many endpoints and how to contain them -- without updating Java. 
• Identifying and locking down known Java security vulnerabilities
   
• The recent Ruby on Rails security vulnerabilities can be patched. Expert Michael Cobb discusses the fallout and offers help with remediation planning. 
• Remediation planning for Ruby on Rails security vulnerabilities

• Is Microsoft's Bing search engine more susceptible to search engine poisoning than Google? Expert Michael Cobb discusses Bing security.  
• Bing security: Is search engine poisoning a problem for Bing users? 

• From NIST's Cyber Security Framework to NSA's impact on Wall Street. 
• Stephen Cobb's articles on WeLiveSecurity.com

Criminal hackers force down volunteer site serving hemochromatosis help

Just a quick note to say that the website I created at CelticCurse.org is offline at the moment due to compromise by illegal access. It looks like criminal hackers forced their way into the server that hosts the site and installed their own code to launch DDoS attacks.

If you are not familiar with the site, it is an entirely volunteer project that serve up information and resources for people with hemochromatosis, a potentially fatal genetic disorder that affects millions around the world. Due to low awareness in the medical community hemochromatosis is widely under-diagnosed and often ill-treated, leading to a lot of needless pain and suffering.

I am working to restore the site, but in the meantime people who need more information about hemochromatosis can visit:

• The Facebook Hemochromatosis page (please Like the page, it will help spread the word).

If you want THE book on hemochromatosis, we highly recommend:

More security articles from Michael Cobb, CISSP-ISSAP

• Heading Off Advanced Social Engineering Attacks

  March 18, 2013
  An inside look at how social engineering attacks are developed -- and how you can protect your organization

• What Antivirus Shortcomings Mean For SMBs

  January 23, 2013
  Accepting the risks that come with relying solely on AV not only puts data at risk, but also could kill future earning potential

• Six Security Services Every Small Business Must Have

  January 10, 2013
  A look at managed services for small and midsize businesses, and how to choose the ones that work for your organization

• Five Security Tools Every Small Business Must Have

  January 08, 2013
  Small businesses often are short on security skills, staffing and budget. Here are five tools that can help

• Measuring Risk: A Security Pro's Guide

  August 07, 2012
  A look at the tools for evaluating security risks -- and some tips for putting the resulting data into business context

• Evaluating And Choosing Threat Intelligence Tools

  July 15, 2012
  So you want to collect and analyze your own threat data. What tools do you need? Here are some tips for finding the right ones

• When To Outsource Security -- And When Not To

  June 04, 2012
  New Dark Reading report offers insights on the advantages and pitfalls of bringing in a third party to help with security

• How Did They Get In? A Guide To Tracking Down The Source Of An APT

  April 18, 2012
  Advanced persistent threats can be complex and sophisticated. Here are some tips on how to analyze them

• How To Detect And Defend Against Advanced Persistent Threats