CyberWire Daily - The CyberWire 12.22.15

Episode Date: December 22, 2015

Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com surveillance policy in China, the UK and the US,

and calls for a Manhattan Project to break encryption fall on skeptical ears. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Tuesday, December 22, 2015. New Yorkers react to yesterday's report that in 2013, Iranian hackers gained access to control systems at a small dam in the downstate town of Rai, and the New Yorkers aren't happy. The Department of Homeland Security has declined to comment on the incident, but did note its continuing work with private and public sector partners to secure infrastructure. continuing work with private and public sector partners to secure infrastructure. An AP report has also fingered Iranian cyber operators with multiple intrusions into the U.S. electrical grid. These probes appear to have amounted to reconnaissance and data theft,

as opposed to attempts to manipulate control systems. Administrators should patch the back door in Juniper ScreenOS firewalls immediately, if they haven't already done so. Unpatched systems are being actively scouted in the wild, and attacks have begun hitting honeypots. No one yet knows, or at least no one who knows is saying, how the backdoor got there in the first place. Observers see potential for serious exploitation of unpatched systems. As debates over surveillance policy continue in several countries, of unpatched systems. by government and industry that would enable investigative and intelligence services to access secure messages without compromising privacy or civil liberties. Few observers think such a project is feasible,

but several current or aspiring policymakers repose great confidence in the tech community's powers of innovation. Manhattan-like project or not, Ed Snowden thinks secure app Telegram, said to be the ISIS app of choice for command and control, isn't really that secure. Telegram disputes Mr. Snowden's review. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security,

but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC.

Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Thank you. and I approach can keep your company safe and compliant. Joining me is John Petrick, editor of the Cyber Wire. Let's talk encryption. There is a big debate going on with encryption, and it's only been amplified by the tragedies in Paris. There are two sides to this story. There are two sides to this story.

In a lot of ways, this encryption debate is the second round in a debate that's been running since the 1990s. The crypto wars, version one, were fought back in the days when encryption was actually treated by United States law as really kind of a weapon. And its export was restricted. You couldn't have it. You could no more have encryption than you would be permitted, for example, to own a machine gun. The lawyers who fought and won the case that basically ended the first round of the crypto wars said to their client that we think it should be possible to whisper in someone's ear from a thousand miles away. And it was that kind of libertarian sentiment that animated the pro-encryption side back then and continues to do so now. I've heard two main arguments about encryption.

On the one side, you have law enforcement saying that we need a back door we need access there are there are things hidden on uh bad guys devices there are things hidden on good guys devices that would help us uh solve crimes on the other hand you have uh it seems like the the device manufacturers and other parties are saying uh people have a right to their privacy. Neither side is lunatic. That when law enforcement says that there are serious bits of information hidden by encryption on bad guys' networks, on bad guys' devices, they're right. There is a lot of stuff hidden by encryption. And of course, encryption can be used to cloak all sorts of criminal activity. On the other hand, the people on the other side will argue, and they're also correct, that if there is such a thing as a natural or illegal right to privacy, it seems that the ability to secure your communications from eavesdropping by whomever is an important guarantor of that right.

So really, when you look at the debate, there are ways in which it is strikingly similar to debates within American politics over gun control. Also an issue over which neither side is lunatic. Both sides have their points. You're balancing a natural right to self-defense, let's say, against a natural right to safety. And how you adjudicate that is not at all obvious. to safety. And how you adjudicate that is not at all obvious. So we might say that if you want to understand the pro-encryption side here, they're saying, in effect, that crypto doesn't kill people. People kill people. So why not have a backdoor? What are the technical limitations for why computer scientists can't provide law enforcement with some way, perhaps under a judge's order, to have access to devices? There's no technical reason why you can't put a backdoor into a device. And in fact, backdoors are discovered all the time in devices. Here's the problem with it that the pro-encryption people will tell you.

Once you put a backdoor into a device, once you provide some way of subverting encryption, weakening encryption, what you've effectively done is you've weakened the whole internet. That you make it not only possible and easier for law enforcement to get into your devices, you make it possible and easier for everybody to get into your devices. All right. It's a complex issue. John Petrick, editor of the Cyber Wire. Thanks for joining us.

We'll talk again soon. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home. Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers.

I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.