Walking around the giant show floor at RSA I was struck by a thought: what a dismal industry this must be. If you are good at your job, you haven't created any new technology that makes processes more productive, or could be used to create new types of products -- you plug up the holes in the bucket that are known. You cannot reliably stop future attacks -- only the ones that are known. And all that work and cyber crime continues to grow and prosper.  

The cost of cyber crime is the loss itself-- predicted to be $6 trillion a year in 2021 -- plus the cost of buying the cyber security needed to bolt the stable door — plus all the engineers involved in developing the software, and then on the customer side implementing it,  all the sales people, field support staff, marketing,  VCs, etc.

It all seems such a dismal waste of human energies that could be used for other things rather than trying to frustrate computer hackers who seem to have no problem getting around those brilliant defenses and gallant efforts.

SECURING THE NEWS

Leon Panetta, the former Secretary of Defense and former Director of the CIA is an Oracle board member. Speaking at an evening RSA related event he said that attacks by nation state hackers is a huge problem. "Pay attention. National defense is not just the responsibility of government, everyone has a role."

His biggest nightmare is of a computer virus that attacks and disables US infrastructure. He estimates that such an attack could result in millions of lost lives -- it would be a digital Pearl Harbor.  

He warned that Russian and Chinese state financed hackers are starting to work together and share technologies to produce sophisticated cyber weapons.

Panetta also warned about attempts to divide US society -- a reference to fake news in elections. But fake news is in the realm of cultural hacking.  A meme acts like a computer virus but it cannot be stopped with the same cybersecurity tools. I asked him if there were any defenses developed by US agencies against fake news but he shook his head saying it was a different class of problem.

CYBERCURRENCY BOOSTS CRIME

Oded Vanunu runs a team of more than 200 people researching product vulnerabilities for Checkpoint. He says that nation states are well ahead of the cybersecurity industry in terms of discovering new vulnerabilities. There's no talent shortage here. He says the governments pay well for the best talent and they have developed very sophisticated attack technologies. He believes that malware might already be implanted in many different places and could be triggered by a code. 

"There are also many online markets that will pay people huge sums of money if they discover a vulnerability. Plus the rise of cyber-currencies makes it easy for criminals to hide their money," are fueling cybersecurity losses. Vanunu says the industry is behind and needs to catch up. 

JOBS FOR LIFE

John Chambers, the former CEO of Cisco is now a venture capitalist. He said computer security professionals had nothing to worry about from job losses due to AI and other technologies. He predicted that at least 30 million jobs would be lost over the next ten years. He said the problem with cybersecurity is that CEOs don't know if they have spent enough money on protection and they don't know how much protection they have bought. One of his startups is helping companies figure out this question.

CLOUDY SECURITY ISSUES...

Oracle and KPMG released their "Cloud Threat Report 2019" and one of the many interesting discoveries was that cloud users seem to misunderstand their security risk.

The use of cloud-based IT has been boosted by the complexity of the security architectures and the difficulties in keeping up with the fast patching pace of new vulnerabilities. The report found that 73% believe the cloud offers better security than they can provide in-house.

But cloud users need to read the fine print because according to the report they don't all understand that security is a shared responsibility. 

"Confusion around the shared responsibility security model has resulted in cybersecurity incidents. A lack of clarity on this foundational cloud security construct has had real consequences for many enterprises, including the introduction of malware and loss of data."

The cost of cybersecurity has become a burdensome tax on business and with 1.5 million IT security jobs unfilled, US corporations are losing to sophisticated criminal gangs, said security experts at a recent event in San Francisco.

"Cyber is a tax on business. Jamie Dimon [JP Morgan Chase CEO] has had to double his cybersecurity budget to $500 million. Things can't continue this way forever, we have to get ahead of the problem," said Ray Rothrock (photo), a veteran VC, now chairman and CEO of RedSeal, a startup that measures the effectiveness of enterprise security.

He said that the size of the problem and the opportunities are what lured him out of retirement in early 2014 to run RedSeal. He made 53 startup investments including "over a dozen" in cybersecurity when he worked at VC firm Venrock.

JP Morgan Chase last year doubled cybersecurity budgets to $500 million and expects to spend the same amount this year. The financial services giant had a bad computer security breach in 2014 when 76 million household accounts -- two-thirds of all US households -- were compromised.

Chris Webber, security strategist at ID security startup Centrify said there are1.5 million IT security jobs unfilled. It shows the size of the problem and that the criminals are winning. 

 "There are new security risks such as Apple's recent decision to speed up approval for software in its app stores. Will this let more malware escape scrutiny?" asked Domingo Guerra, co-founder and president of Appthority, a startup that monitors mobile apps for data risks in the enterprise.

Dwayne Hall, CEO of startup Opaque Communications, said his company is working with government security agencies on a way of preventing some people downloading its technologies for secure and untraceable messaging. "If they are on any watch lists then they could be blocked from downloading our software," Hall said.

Andy Grolnick from LogRhythm, a startup that analyzes data to spot security risks from within, said that companies cannot rely on perimeter defenses and that spotting criminal behavior relies on being able to normalize massive amounts of machine data.

 Foremski's Take: Is enterprise security achievable? I could buy everything at the annual RSA Data Security show and still not feel secure. There are countless new exploits being discovered, which means they could have been exploited for a long time before.

Add the fact that large enterprises don't know the location of all their sensitive data and therefore can't protect it or even know if it has been breached. Cybersecurity is a mess. 

Buying things online used to be a one-click process but that was many years ago. Additional security checks of different types make buying things online a chore and certainly not the frictionless experience we were promised.

Anything that disrupts the consumer experience is ultimately a danger to the entire economy of society. Ray Rothrock at RedSeal is right: we have to get ahead of the problem.

The challenge of protecting the enterprise from simple email phishing scams.

There’s no need to use advanced Black Hat technologies to get access to sensitive corporate data if you have a copy of a staff directory — as more than 21,000 employees of Sprouts supermarket chain found out recently. All had their social security numbers and other personal details exposed after an employee in the payroll department responded to an email from what looked like a senior executive asking for a copy of every employee’s W2. 

All of the Sprouts employees now face many years of anxiety over hackers patiently waiting to use and abuse their illicit data haul of taxpayer identities.

 Doug Oleic, at SC Magazine says that many others have fallen for a similar trick, 

Sprouts joins Seagate, Snapchat and several other high profile firms that have been hit with a similar attack. Security executives all pointed out the difficulty of preventing socially engineered phishing attacks…

At first look it would seem that there is no technical solution to such socially engineered data breaches beyond educating staff about such nefarious techniques. Even then, phishing has becoming a lot more sophisticated, making it even harder to distinguish a scam from the real thing. 

Here’s some views from two security experts:

Jonathan Sander, vice president at Lieberman Software: 

"You will never stop phishing, nor will you make perfect humans who are never fooled by bad guys in some way. What you can do is say that when systems are asked to give people extraordinary privilege to access sensitive information, those systems should be made smart enough to put a check on that power.” 

Brad Bussie, director of product management at STEALTHbits Technologies: 

“As a best practice, personal identifiable information should never be transmitted in an un-encrypted format. You want to ensure the integrity and confidentiality of the data related to employees at all times.”

Bussie warns that Sprouts employees will likely face years of problems from the “Dark Web.”

"Studies show that the dark web will often light up initially when a company has been compromised, but will then go dormant for a year or more. You will then see a massive resurgence of global hackers buying leaked data under the assumption that a year of scrutiny has expired and they can get to work capitalizing on the stolen information."

The IRS recently reported a massive 400% jump in phishing and malware disguised as its own official communications. It estimates tax fraud will reach a record $21 billion in 2016 - compared with $6 billion in 2014. 

Digital data plus online tax returns enables criminals to engage in fraud on a national scale compared to filing individual paper based tax returns. 

Working at Delphix, a virtual technologies startup in the heart of Silicon Valley, I've been learning a lot about enterprise software and the challenges facing global corporations as business becomes ever more digital. 

Data security is critical and its importance was underscored by the recent RSA Conference in San Francisco -- the world's largest gathering of computer security experts. About 40,000 people -- a jump of nearly 20% compared with last year -- attended its awards ceremonies, hundreds of presentations, and demonstrations from thousands of vendors of data protection technologies.

But if you bought everything at RSA would your organization be completely secure? 

Likely not -- you will always need to buy something new. This is troubling, especially if your job security relies on effective data security.

Computer security and CIO job security

A 2015 study by Big Data company Actian found that 43 percent of CEOs said they would fire their Chief Information Officer or Chief Technology Officer (CIO/CTO) in the event of a significant security event.

But with so many high-profile data breaches lately, even those with large IT budgets haven't been able to spend enough, or choose the right technologies to protect their organization.

And current trends don't bode well for CIO job security because they increase the risk of a major data breach. For example, the rush by global enterprises to develop more applications is particularly troubling.

Application development teams require fresh copies of the production database for testing. Finding bugs early is vital and speeding up application delivery speeds up business initiatives. But every database copy multiplies the risk of sensitive data being exposed in some way.

Protecting 20 database copies is hard and it is easy to lose track of where they are being used.

If you don't know where your data is, then you don't know if it has been stolen. A recent survey by RSA and ISACA found that 24 % of computer security professionals had no way of knowing if they had suffered a data loss.

But there is a solution -- at least for the increasingly common user case of cloning the production database: data masking.

Data masking removes the sensitive data and replaces it with realistic looking social security numbers, credit card numbers, etc. Data replacement would be a more accurate term.

If hackers get access to a cloned production database that has been data masked then there is no danger of any sensitive data leaking out because it is not there. It is a 100% secure data protection. You cannot steal something that isn't there. 

Encryption is vulnerable to decryption but data masking is irreversible. 

So why is data masking such a poorly understood security technology? Why were there only four companies out of hundreds at RSA, offering data masking? 

Why isn't data masking more widely used to deal with the security issues caused by the epidemic of proliferating database copies? 

I don't have the answers. One answer is that data masking can be hard and labor intensive.  And you have to do it again and again for each copy. The shortcut quickly becomes: skip it. As a CIO it can be a shortcut to losing your job but the pressure to support key business initiatives is high. 

Data protection is often juxtaposed against business innovation.

Gartner warns,

Is your information security program a roadblock to business progress?...You must protect enterprise data from compromise and drive innovation at the same time.

CIO Magazine's "State of the CIO 2016" states

...you [the CIO] are expected to be the driver of enterprise digital transformations. However... you face a wide range of tactical challenges -- from defending against increasingly sophisticated and potentially damaging cybersecurity threats to managing mass cloud migrations to leading agile development projects. 

Data protection and driving business goals are not in opposition if you choose the right approach.

Mask Once -- Copy Many

By combining data masking with data virtualization you only need to mask one database copy-- then you can create unlimited virtual copies  -- or let the app dev teams do it themselves with the self-service user interface.

That's the unique Delphix approach: mask once - copy as many times as you want while keeping data fresh. It's a true Data as a Service technology - data where it's needed on demand.

By allowing developers to self-service their test environments in minutes compared with hours or days,  application delivery can be accelerated by as much as a factor of ten. Data security with faster app delivery is a killer combination.

Data masking with data virtualization not only saves CIO jobs but also makes them look like IT heroes. 

Secure Islands, a privately held Israeli computer security company, opened its US HQ earlier this year in New York City. The company is confident in repeating the success it has enjoyed in Europe,  here in US enterprise security markets, with its approach to data protection.

Its technology automatically classifies and if required, encrypts sensitive data upon creation, as opposed to when it leaves the organization, which is traditionally how encryption has been managed.

This process, which it calls "Data Immunization," enables organizations to set classification polices which are automatically applied when a file or email is created. If encryption is required, the protection stays with the data wherever it ends up.  This way, if it is stolen, no one can read the data except the intended readers. 

I recently spoke with Aki Eldar, co-founder and CEO of Secure Islands. Here are some of my notes:

- Secure Islands was founded about eight years ago by two brothers. One had skills in sales and marketing in enterprise IT markets, and the other was a software developer.

- The brothers realized that you can't win against cyber criminals because they always have a head start. Breaking into a computer network, or having sensitive files leaked from inside, will continue to happen no matter how good an organization's perimeter security is.  But, if those files are encrypted and can only be opened by specific people, it no longer matters if the data was lost or stolen, as it will be useless to anyone but its intended recipients. 

- Secure Islands product, called the IQProtector Suite,  is a real-time monitoring technology that will detect [it classifies the content and checks if a security policy applies] data that's sensitive -- as it is being created. It will then encrypt the files and assign user access rights, if a policy applies. It also has a services arm where it can help its customers create data security policies appropriate for their business. 

-Secure Islands also has an audit function and once data is tagged, it can track all of the unstructured data of the organization. 

- Unstructured data is a big problem for organizations because as it moves around an organization and onto a variety of mobile devices, and beyond -- there's a loss of control over sensitive company information. 

- Had Sony used Secure Islands products, it could have prevented the embarrassing emails from executives at Sony Pictures from being leaked with a single policy: "Encrypt all of executive management's emails."

- Secure Islands says a big part of its success is that it works transparently across platforms and apps, and does not disrupt existing uses.

-It's important to encrypt the data files at the point of creation, before it gets changed or "tainted."  

- The technology works with Microsoft's Active Directory for ID management and it uses Microsoft's encryption engine, which is the standard in European financial industry.

-The protection is persistent as the data is managed over its life cycle.

- I asked about the need for regulators, lawyers and auditors to be able to access archival business data for a variety of reasons. The company said that because its protection is policy driven, there is no problem complying with all legal and fiduciary data access requirements. 

- Its technology can understand the content and context of the data and index the information. It's too costly to encrypt everything created by an organization, and also unnecessary.

- Secure Islands received an investment of unspecified amount, last year from Credit Suisse, one of its first customers. That investment is helping to fund the company's US HQ and marketing push. 

I recently received this note from Pablo at Secsign Technologies... It looks like an interesting application especially for the enterprise market where security is a never ending battle. 

Sorry for disturbing you, sure you get 1000000 emails per day :-)

We are a small tech company from Nevada that just released the World´s first fingerprint login for Wordpress, using iOS 8 Beta.

It's free for beta developers and we also made a tutorial on how to use it: https://www.secsign.com/fingerprint-validation-as-an-alternative-to-passcodes/

We will really appreciate if you can help us, we are small company trying to fight hard. Your help, for us is like the top of the sky, and we will do literally what ever you ask, to have the chance that you write some lines about us. We don't have budget for a professional PR firm, and our future truly depends on getting a bit of help from you.

- We solved the problem to integrate Apple's Fingerprint with current back-end and IAM systems from corporations, so now any business can use iPhone Touch ID to login in their intranet , etc.

- We also have a secure storage portal solution and a two factor authentication app and free plugins.

The National Security Agency (NSA) has lots of computer power but what it needs the most is brain power. It's not too early to plan ahead. A friend gave me a copy of an activity book for kids published by the NSA. Here's a few pages:

Here’s my notes from a conversation with Anthony James, VP of marketing and product at Cyphort:

- Advanced Threat Detection (ATD)  is based on behaviors rather than signatures because those change all the time.  We can detect malware without needing a signature. By then its too late.

- We use different types of sandboxing to isolate the threats because advanced malware knows how to protect itself from generic sandboxing.

- There is a much higher risk from malware today because of rising use of the cloud, the large number of devices people use in the enterprise, and the increased sophistication of malware developers.

- We are able to classify malware into the serious and the less important. Our customers can focus getting rid of the serious malware first. 

- We also share information with other customers if we find malware and we provide the tools on how to get rid of it. 

- We can tell where the malware is within its life cycle. 

- We ran some tests and we would have been able to have detected the malware used in the Target data theft, and its variants.

I attended a dinner organized by Eastwick Communications that featured several of their security clients and a security industry analyst. The discussion grew ever more interesting as the wine glasses emptied and refilled. Here’s my notes from the evening:

- List of participants is below. Each of the security companies is working in important areas and focused on helping enterprises deal with the many risks.

- One of the companies said that security used to be difficult for startups to get funding but these days, it’s a very good sector and VCs love security companies. There’s also lots of revenue potential because of the complexity of enterprise security.

- The complexity of the security risks facing companies was repeated time and again by each of the companies.

- Deborah Gage from the Wall Street Journal asked a good question: Can private industry deal with the security issues or does it need government involvement? She didn’t receive a good answer beyond the usual response that government involvement isn’t necessary .

- We were reminded of the “fiduciary duties” that executives have towards making sure their business is protected from security risks.

- I asked what exactly are those fiduciary duties when it comes to security risks? How much is enough security? Is there a standard set?

- Private Core has an interesting approach to it’s goal of making cloud IT services as secure as your own data center. It encrypts the entire computation of an app from within the cache memory of microprocessors. It’s a much smaller attack surface. 

- NSA revelations haven’t caused much concern among US enterprises but in Europe it is having a very large effect on enterprises. 

- Enterprises often don’t know what devices they have connected to their networks. There are typically 5,ooo applications used by staff in a large organization.

- Apps such as Dropbox are a problem because they have APIs and their contents are shareable by many other applications, greatly magnifying risks.

- “Free” apps on phones and tablets are a worry because they are making money by sharing data on their enterprise users — it’s one of the problems with the bring-your-own-device trend.

- Security is a very good business because it is one of the few things that will get a CEO out of bed at night. 

 Jon Oltsik, senior analyst at the Enterprise Strategy Group, said security risks have increased because of the use of mobile, the increase in malware, and the problem that no one talks about: a big shortage of people with cyber security skills.

- I mentioned that people were still the biggest security risk and that people such as Edward Snowden were motivated by ethics and not money. It’s difficult to guard against ethical hackers  — at least with money theft there’s a silver trail to follow. And I’m surprised we’ve only had one Edward Snowden.

- There was some discussion that Millennials might be a security threat because they are upset with large college debts and poor salaries. I disagree, they are much more likely to be motivated by ethics — doing the right thing — than by money.

- Security analyst Jan Oltsik ended the evening with a bang. (Despite all the security companies at the table, and the many more in the industry), he said that the enterprise security situation is bad and will worsen further unless there is a radical new approach/technology developed. But what is that radical new technology? No one had an answer. 

Foremski’s Take: The security industry is constantly warning of ever greater risks to enterprises — the sky is always falling. When has a business bought enough security?

The answer seems to be that there is never enough security that you can buy. You can never have enough security is great for vendors but it’s very bad for enterprises because it leads to indecision. 

The complexity of the security risks is another issue. Some of the exploits are extremely sophisticated and can only be understood by experts in their fields. To expect CIO’s to be able to asses the risks of exotic malware and other new exploits, and then take appropriate steps is not realistic. It’s overwhelming.

The complexity needs to be outsourced in some way, even though the legal liabilities can’t be outsourced easily. Enterprises need specialist service providers that stay up to date on threats and can quickly implement protective measures and policies. Otherwise, the security situation will get worse.

Also, I wonder about the competitions that companies are advertising to find bugs and flaws in their software. Only a few people are rewarded but many others become familiar with the software and better able to discover and exploit additional weaknesses. Are the bug competitions training grounds for a new generation of hackers?

What was clear from the evening’s discussion is that security is a shimmering mirage that can never be reached, and can never quench your thirst for more. It’s a very good business to be in. Between the money lost to criminals and the money spent to prevent that loss, it’s a costly tax on doing business. And it does absolutely nothing to enable commerce or improve productivity. 

- - -

Participants:

Lasse Andresen, CEO, ForgeRock
ForgeRock is the only unified open source identity stack to protect enterprise, cloud, social and mobile applications at Internet scale.

Patrick Peterson, CEO, Agari
Agari provides global brands with the experience, tools, and analytics they need to eliminate email threats, protect customers and their personal data, and proactively guard brand reputation.

Arvind Purushotham, Citi Ventures
Citi Ventures is Citi's global corporate venturing arm, chartered to collaborate with internal and external partners to conceive, partner, launch, and scale new ventures that have the potential to disrupt and transform the financial services industry, drive client success, and generate new value for Citi.

Peter Long, CEO, Lockbox
Lockbox is an end-to-end, client-side encryption platform that allows users to generate and maintain encryption keys for secure and private file sharing and storage in the cloud.

Paul Stich, CEO, Appthority
Appthority provides the industry’s first all-in-one App Risk Management service that employs static, dynamic and behavioral analysis to immediately discover the hidden actions of apps and empower organizations to apply custom policies to prevent unwanted app behaviors.

Rob Rachwald, Senior Director, FireEye
FireEye is the leader in next generation threat protection, stopping advanced malware, zero-day, and targeted APT attacks that bypass traditional defenses.

Steve Weis, CTO, Private Core
Private Core is a venture-backed company delivering an industry first: the ability to protect enterprise data in use by encrypting memory.

Scott Gordon, CMO, ForeScout
ForeScout delivers pervasive network security by allowing organizations to continuously monitor and mitigate security exposures and cyber attacks.

Daniel Ellsberg (above), famed whistle-blower of "Pentagon Papers" spoke at a recent protest to NSA spying at "Restore the Fourth" in San Francisco.

Google has begun to encrypt all searches made by users even if they aren't signed in to Google but it reveals the searches to its advertising customers. The search giant appears to be taking advantage of the NSA spying scandal to increase the number of its advertisers.

Danny Sullivan reports:Post-PRISM, Google Confirms Quietly Moving To Make All Searches Secure, Except For Ad Clicks

Google says this has been done to provide “extra protection” for searchers, and the company may be aiming to block NSA spying activity. Possibly, it’s a move to increase ad sales. Or both. 

…what prompted Google to make such a change out of the blue. And it was sudden.

Google used to allow users of its Google Analytics tool to view the search terms that brought people to their sites. Then it began hiding those terms for users that were signed in. And then it stopped provided search terms for users of other browsers, even when not signed into Google.

Since September 4th, there has been a dramatic spike according to a site called Not Provided Count, with an increase of nearly 50% of search terms not provided to around 74% of all Google searches.

However, if you are a Google advertiser on its Adwords network you still get the search terms. If it were designed to thwart NSA then there is a big hole in that intent.

It also means that publishers don't know what brought users to their site but the advertisers do. It's an asymmetric distribution of information that favors Google's paying customers.  Yet the Google tool is designed to help webmasters create content that people want.

Danny Sullivan concludes:  "Increased privacy to thwart the NSA? Or a handy excuse to do that and increase potential ad sales?"

It seems the latter given that paying customers get the data.

Please see:

US Spy And Law Enforcement Agencies Should Buy 'Big Data' Like Everyone Else -SVW

Spies In Disguise: NSA Pretends To Be Google -SVW

It is a very bold claim but one that Versafe is comfortable in supporting because of its unique technology. It is also the prime reason that F5 said it acquired the company.

I recently spoke with Jens Hinrichsen VP, Marketing & Business Development at Versafe. Here are my notes:

- The company was co-founded by Eyal Gruner who made a name for himself when he was just 20 years old discovering a vulnerability in ATM machines. He also co-founded BugSec, which tests the security of banking systems.

- The TotALL suite is designed to protect financial systems no matter the architecture of client devices. It consists of two components, Websafe and MobileSafe.

- WebSafe claims to protect all users across all devices from threats such as zero-day attacks, man in the middle, etc., It also prevents personal information and login details from being stolen by third-parties. And it stops automated attacks intended to steal money from user accounts. Plus it stops phishing attacks in which fake web sites are used to fool bank customers.

- MobileSafe can detect if a mobile device has been jail broken, and it also can match the devices ID against behavioral information to spot suspicious behavior.

- Versafe assumes that all customers of financial institution are infected by some type of malware.

- There is no good reason to develop client based security software because it requires users to keep software updated.  And there are many changes in architecture that can easily open up new vulnerabilities. This relieves financial institutions from trying to secure a large range of mobile devices and have to update those security measures as those platforms change.

- Versafe installs its protection at the application level. By assuming every user is potentially infected with malware, the security system monitors the application and block any behaviors that are a security risk.

- The goal is to protect the financial applications from becoming modified by any malware by using polymorphic protection.

- Versafe says the security suite can quickly be integrated with customer's IT systems in as little as one day.

- The key benefit is that there is no need to install new software on client devices, the entire protection is transparent to users, requiring no additional steps. 

- The Versafe solution works with any browser -- another key advantage. Since the architecture of smartphones and browsers is in constant flux the best place for security is at the server level.

- The way TotALL works is confidential, to stop hackers from figuring out a way around the security. Part of the solution involves using one-time public keys on the server.

- F5 was a partner of Versafe and says it was this ability to work with any mobile device and any browser that led to its decision to acquire the company for an undisclosed amount.

Above from Mother Jones.

The NSA Edward Snowden revelations are getting worse and worse for the reputation of leading Silicon Valley companies as the latest information shows that the US spy agency has masqueraded as Google to collect information on users.

 Josh Harkinson reports in Mother Jones: Report: NSA Mimics Google to Monitor "Target" Web Users | Mother Jones

The NSA has impersonated Google and possibly other major internet sites in order to intercept, store, and read supposedly secure online communications. The spy agency accomplishes this using what's known as a "man-in-the-middle (MITM) attack," a fairly well-known exploit used by elite hackers. 

This can't be good for business. 

Google's Chrome browser offers some protection from MITM attacks.

Google Chrome maintains its own list of the public keys for Google webpages; the browser sends an alarm to Google headquarters if it detects any attempts to forge those sites.

However, it's not known if the NSA has demanded Google's keys so it can perform such surveillance without triggering any alarms. If this is the case, Google will face a hailstorm of criticism.

If the NSA is doing this for Google, it could disguise itself as other popular sites such as Facebook, and Twitter.

The leaked documents also show that the NSA has used MITM methods to spy on Brazilian oil company Petrobas indicating that it is harvesting information that might better be classified as industrial espionage, than terrorist tracking.

This could significantly harm business prospects for US cloud companies in foreign markets if they can't protect their systems from industrial espionage.

It could also set back by years the transition of IT systems to cloud-based hosts just as the cloud infrastructure is becoming better understood among businesses. 

Find out what it is and how to disable it:

David Michaelis at A New Domain explains what Facebook has done and how it plans top profit from tagging your face:

Protect Your Face-Face Book New Rules- Inside Facebook and Social Engineering

Last week, Facebook updated its privacy policy again. It reads in part: “We are able to suggest that your friend tag you in a picture by scanning and comparing your friend’s pictures to information we’ve put together from your profile pictures and the other photos in which you’ve been tagged.”

"The very word "secrecy" is repugnant in a free and open society;

and we are as a people inherently and historically opposed to secret societies,

to secret oaths and secret proceedings..."

- - -

"…there is very grave danger that an announced need for increased security will be seized upon those anxious to expand its meaning to the very limits of official censorship and concealment.

That I do not intend to permit to the extent that it is in my control."

- - -

"…that is why our press was protected by the First Amendment-- the only business in America specifically protected by the Constitution

-- not primarily to amuse and entertain,

not to emphasize the trivial and sentimental,

not to simply "give the public what it wants"

--but to inform, to arouse, to reflect,

to state our dangers and our opportunities,

to indicate our crises and our choices, to lead, mold educate

and sometimes even anger public opinion."

http://www.youtube.com/watch?v=Em8cuv_a0gU

(Thanks to Donovan Seow.)

Please listen to President John F. Kennedy's speech on secrecy and a free and democratic society. It's short and incredibly relevant.

Here is the transcript: 

"The very word "secrecy" is repugnant in a free and open society; and we are as a people inherently and historically opposed to secret societies, to secret oaths and secret proceedings.

We decided long ago that the dangers of excessive and unwarranted concealment of pertinent facts far outweighed the dangers which are cited to justify it. Even today, there is little value in opposing the threat of a closed society by imitating its arbitrary restrictions.

Even today, there is little value in insuring the survival of our nation if our traditions do not survive with it. And there is very grave danger that an announced need for increased security will be seized upon those anxious to expand its meaning to the very limits of official censorship and concealment.

That I do not intend to permit to the extent that it is in my control.

And no official of my Administration, whether his rank is high or low, civilian or military, should interpret my words here tonight as an excuse to censor the news, to stifle dissent, to cover up our mistakes or to withhold from the press and the public the facts they deserve to know."

For we are opposed around the world by a monolithic and ruthless conspiracy that relies on covert means for expanding its sphere of influence--on infiltration instead of invasion, on subversion instead of elections, on intimidation instead of free choice, on guerrillas by night instead of armies by day.

It is a system which has conscripted vast human and material resources into the building of a tightly knit, highly efficient machine that combines military, diplomatic, intelligence, economic, scientific and political operations.

Its preparations are concealed, not published. Its mistakes are buried not headlined. Its dissenters are silenced, not praised. No expenditure is questioned, no rumor is printed, no secret is revealed."

"No President should fear public scrutiny of his program. For from that scrutiny comes understanding; and from that understanding comes support or opposition. And both are necessary.

I am not asking your newspapers to support the Administration, but I am asking your help in the tremendous task of informing and alerting the American people. For I have complete confidence in the response and dedication of our citizens whenever they are fully informed.

I not only could not stifle controversy among your readers-- I welcome it.

This Administration intends to be candid about its errors; for as a wise man once said: "An error does not become a mistake until you refuse to correct it." We intend to accept full responsibility for our errors; and we expect you to point them out when we miss them.

Without debate, without criticism, no Administration and no country can succeed-- and no republic can survive.

That is why the Athenian lawmaker Solon decreed it a crime for any citizen to shrink from controversy.

And that is why our press was protected by the First (emphasized) Amendment-- the only business in America specifically protected by the Constitution-- not primarily to amuse and entertain, not to emphasize the trivial and sentimental, not to simply "give the public what it wants"--but to inform, to arouse, to reflect, to state our dangers and our opportunities, to indicate our crises and our choices, to lead, mold educate and sometimes even anger public opinion.

This means greater coverage and analysis of international news-- for it is no longer far away and foreign but close at hand and local. It means greater attention to improved understanding of the news as well as improved transmission. And it means, finally, that government at all levels, must meet its obligation to provide you with the fullest possible information outside the narrowest limits of national security...

And so it is to the printing press--to the recorder of mans deeds, the keeper of his conscience, the courier of his news-- that we look for strength and assistance, confident that with your help man will
be what he was born to be: free and independent."

("Restore the Fourth" rally in San Francisco protesting NSA surveillance of US citizens.)

Declan McCullagh, the Washington correspondent for CNET, reports that the NSA and other agencies can force tech firms to comply with demands for real-time data on their users because the Foreign Intelligence Surveillance Act provides them with legal rights to install their own gear inside their data centers.

How the U.S. is forcing Internet firms' hands on surveillance | Politics and Law - CNET News

Those devices, the companies fear, could disrupt operations, introduce security vulnerabilities, or intercept more than is legally permitted.

"Nobody wants it on-premises," said a representative of a large Internet company who has negotiated surveillance requests with government officials. "Nobody wants a box in their network... [Companies often] find ways to give tools to minimize disclosures, to protect users, to keep the government off the premises, and to come to some reasonable compromise on the capabilities."

It's tough to fight such demands because there are several legal precedents, such as when ISP Earthlink lost a legal battle to stop the FBI from installing its "Carnivore" surveillance system within its networks. 

Foremski's Take: 

US tech giants have been surveilling their users for years. That's what they mean by "Big Data" and it feeds a huge industry where that data is sold and used in real-time. That's how ad networks know what ads to serve to you in the milliseconds it takes to load a page.

It's commonly known as "contextual advertising."  But the "context" isn't the content of a page, the context is "who."

I'm sure you've noticed those sticky ads, the ones that follow you around the Internet. For example, I was seeing adverts for Tai Chi DVDs and books on numerous web sites for weeks because I had visited a Tai Chi site and clicked around for a bit. 

Advertising networks detect when and where you are online and your physical location.  In the instant it takes to load a page they analyze all the data they have about you and serve up an appropriate ad. They log the event and update their personalized dossier with any additional information they collect. 

In that regard, spy agencies and advertisers are essentially the same. They are both interested in real-time data about a specific person. It doesn't matter that one is trying to sell you a watch, while the other one just wants to watch -- the process is the same. 

Imagine if the NSA built an advertising network as a cover and bought access to the same real-time data that advertising networks use. It would be able to collect a lot of valuable data without needing to argue its case in secret courts.

It would have real-time login and other information, it could also drop a super-cookie or key-logger onto a target's computer.

It could even serve up contextual adverts: where to find hard-to-get combustible materials; or difficult to source equipment such as high-speed centrifuges. It would be perfect for sting operations.

But the government agencies should buy the data instead of demanding the right to take it. It's not that expensive and the suppliers will sort it and package it – saving them from having to filter and process the firehose of data from their own equipment installed on-site. 

Its substantial computing platform and its superior security knowledge could jumpstart new jobs and businesses if the agency had a commercial arm.

The NSA is interested in the tiniest fraction of the data it collects, the bits about finding terrorists. The rest of the data is useless to it but it keeps it anyway. It's a highly valuable resource to others. 

Here are some business ideas:

- A Web Services Suite for consumers that includes, virus protection, data backup services of all client computers and devices and online data lockers; unlimited dropbox-like data storage in the cloud; free banking software; unlimited email accounts; unlimited VOIP calls; and a personalized VPN protecting users from snoopers, would be a killer package. The NSA Security suite could get away with charging a premium monthly fee for the service because of its stellar pedigree. 

There are other services it could offer:

- Host IT services. It clearly has all the APIs needed to link up with hundreds of thousands of businesses and financial institutions and is able process mountains of Internet data in real-time. There is no business in existence today that can do that.

- It could sell incredibly detailed analytics reports on the planet's commerce, what the billions are buying and thinking. And economic data to help governments keep their countries healthy.

- There might be legal protection for NSA customers from private lawsuits and police investigations. Since NSA cannot secretly collect information on US citizens therefore any court orders to search through its databases and collect information on citizens would require breaking the law and impossible to fulfill.

The NSA wouldn't need to spy on its own consumer or business clients since anyone with something to hide would never buy or use any NSA services, even if they were free or saved them a bunch of money. The agency could focus its resources on other people and thus help fulfill its mission faster.

- Also, the NSA archives are undoubtably the single largest collection of archeological data that anyone has ever collected. It documents in raw form our collision with the Internet Age, a media age extraordinaire.

The data  would offer a tremendous insight into our collective nature, an aggregation of how people behave, and how they change, across an enormous scale.  It must be incredible treasure trove of data, and it would allow sociologists and anthropologists to draw a far more accurate picture of humanity than we have today.

That mass of data hides a map of our social genome, those long double-twisted chains of memes and stories that shape each of us as distinctly as our DNA gives us form.

It might even reveal a key code that governs our nature and can help unlock new abilities. Yet the NSA just sifts for a very narrow range of human behaviors – all negative.

Here are some marketing slogans for the NSA, which could be used sell services or perk up its image:

"We've got your back."

"You're welcome."

"We're always watching out for you."

"We know what you did last summer."

"Speak freely -- it's your right."

"Free speech is nothing if no one listens."

"$19 a year for unlimited data storage, emails, and phone calls."

The venture will allow retail investors to invest in Bitcoins by trading shares in the Trust. This is similar to a gold fund and lets investors own fractions of "Digital Math Based Assets such as Bitcoins." This will likely increase volatility in the value of Bitcoins because speculators can play the market without needing to buy and sell them directly.

The Winklevoss twins have accumulated a large number of Bitcoins so this could allow them to earn money on a substantial amount of locked-up capital via the Trust's monthly fees and  transaction services.

The risk factors in the SEC filing includes warnings that a malicious botnet on the Bitcoin Network could stop the Trust operating; or the Trust could lose its encryption keys.

There's an astounding 18 pages of risk factors. However, I did not see listed the most obvious risk factor of them all:  the Winklevoss name.  The twins are rich, good-looking, and Facebook famous, which attracts a lot of mean-spirited trolls. Hacker groups will relish an opportunity to school these Harvard grads. 

Bitcoin exchanges have been attacked by hackers and the largest knocked offline and out of business.

Clearly, the Trust must be highly-confident that it has rock-solid security to use the Winklevoss name so prominently, and not include it as a risk factor. 

Many are concerned about the National Security Agency (NSA) collection of data on US companies and individuals and the very real possibility that it has a way of directly accessing the servers of the world's largest computing platforms: Google, Facebook, Microsoft, etc.

It's certainly a situation that deserves attention and concern. But what's missing in this discussion is this: how secure is the NSA's spying system? 

If a foreign entity wanted to spy on US companies or individuals, would it try to tackle the problem directly by targeting the specific company or individual in its electronic spying attempts? It might, but that's a lot of work for an uncertain payoff.

A much more efficient approach would be to hack into a surveillance system that already has access to the information. Far better to hack into the NSA spying system at Google, or at Facebook, or at Microsoft (if such an NSA system exists, of course).

In early 2010 Google discovered that Chinese hackers had gotten into its systems. Who did it call to help deal with this problem? The NSA. [Google to enlist NSA to help it ward off cyberattacks.]

This puzzled me tremendously, why would Google, with its enormous brain trust of the world's top computer experts call on the NSA? Why didn't Google have the means, the expertise, to deal with this problem directly and solely?

It makes sense if it was the NSA's spying system that got hacked within Google.

The search giant knows its own systems and how they can be protected but it does't know the NSA's computer systems and how they protect themselves. It makes perfect sense to call in the NSA to help plug this hole because it's a hole created for the NSA which the NSA might have left vulnerable in some way.

The NSA also employs the world's top computer experts but it's not infallible. Everyone knows that there's no such thing as a completely secure system. The greater danger in the NSA's spying activities is not from the NSA itself, but from the many nefarious foreign national, and international criminal enterprises, that find a way to exploit the existing spy systems so thoroughly crafted, and so thoroughly extensive, that have been built by the NSA.

The danger from allowing the NSA to have deep access into the data systems of US companies is that that very system creates an enormous vulnerability that would not have existed. Hack into part of the NSA spy network and you have access to a mass of private data that would be near impossible to collect in any other way.

It's ironic that the NSA's activities to improve the security of the US have created the nation's largest security risk of them all. 

- - -

Please see: 

Google's internal spy system was Chinese hacker target

GOOG v China highlights security risks in wiretapping systems

Tufin is interesting because it is rethinking the way firewalls should be managed. It's because of rise in the number of applications being produced by enterprises.

Firewall administrators are spending more of their time dealing with application related change requests. Yet the app developers know little about firewalls and potential conflicts, or security holes. Earlier this year, Tufin launched SecureApp, a suite of admin tools to help manage this important security relationship between apps and firewalls.

This application centric approach to enterprise security is a different way of thinking about security. Here are some notes from our conversation:

- Our latest survey shows that nearly half of all firewall changes are related to application connectivity. And most companies report that they don't have confidence in their IT staff being able to fully address the compliance and security risks that arise when managing application connectivity.

- We realized that the best approach is to address security through the app layer first, to document the resources an app needs and how it behaves, and then to communicate what's needed in the firewalls. Our new product helps to automate this process. And it's integrated with our two other firewall products, SecureTrack and SecureChange.

- It's a paradigm shift and it might take some time for this to be understood but you have to tackle security first through the app layer not the network.

- Here's why: Large enterprises have a high degree of complexity because of multiple locations, multiple IT systems and hundreds of firewalls to manage with multitudes of rules. Developing new applications is tough because they must work across all of a corporations firewalls.

- The situation becomes more complex when changes are made to an application and those changes have to be communicated to hundreds of firewalls.

- If firewalls aren't configured right, apps will fail. But the apps developers have to be better at communication, and documenting, how their apps behave, so that the right changes can be made by the network security teams.

- Anytime you change the configuration of firewalls, other things can break. A key feature of SecureApp is that you can simulate the entire network and test changes safely.

- CIOs want to deploy apps faster but this can compromise security if there is little communication between the app developers and the security teams.

- There's often a cultural problem within large corporations in that the apps developers don't understand the security issues and the security people don't understand the apps.

-There is often little or no documentation, and when people leave a company, a lot of knowledge about an app leaves too. SecureApp makes sure that there is documentation and that knowledge isn't lost when people leave.

Foremski's Take: Tufin's application centric approach to improving enterprise security makes sense and it won't take corporations long to realize its the right approach.

What will take longer is the internal shift in culture, in the app developer teams, which traditionally have not been very security minded.

It's a leadership move by Tufin and one that's well timed. The explosion of apps in the consumer web is driving a tremendous amount of app development in the enterprise. Firewalls can quickly become brick walls or leave security holes open because of badly designed apps.

Managing hundreds of firewalls while trying to support a deluge of apps will quickly turn into a nightmare unless the whole process of application development can be mapped against an organization's firewalls. The app and the firewall have to be in sync and that requires new sets of tools.

Tools such as Tufin's not only provide an easy interface for managing security policies and compliance but they can also be used as an agent of cultural change within organizations because they offer a common ground for the apps and security teams. It helps them communicate with each other, which should lead to better apps.