Government


Fed Seeks Industry Standard for Botnet Mitigation

The Departments of Commerce and Homeland Security met with various other government agencies and private-sector leaders yesterday to discuss the need for a code of conduct for detecting, mitigating, and otherwise dealing with botnets.


One of the biggest talks at this year’s Black Hat Briefings was a presentation on the structural problem with digital certificate authorities by Moxie Marlinspike. The subsequent hack of Dutch certificate authority DigiNotar and a damning report on that attack only weeks later, and more recent reports of exploitable holes in both TLS and SSL only underscore the problems facing the entire PKI-based system for ensuring online identities.  

Dennis Fisher talks with Gary McGraw of Cigital about the release of the data collected during the BSIMM 3 software security measurement project, the most pressing challenges facing companies involved in software security programs and the reasons that the US government is falling farther behind on this front.

The Stuxnet worm may be the most famous piece of malicious software ever written. When it was first detected, a little over a year ago, the worm sounded a warning to nations around the world that critical infrastructure systems were potential targets of attack for foreign governments and cyber criminal organizations alike. But with the anniversary of the Stuxnet worm’s discovery just past, the Department of Homeland Security admits that it is now reevaluating whether it makes sense to warn the public about all of the security failings of industrial control system (ICS) and SCADA software. 

The FBI continued its pursuit of members of the hacking group LulzSec on Thursday, arresting a 23 year old Phoenix, Arizona man believed to be part of an online hacking crew that attacked systems belonging to Sony Pictures, the Bureau said in a statement Thursday.