• “Facebook disrupts cryptocurrency-mining bonnet Lecpetex”, SC Magazine, 09 July 2014. Facebook teamed up with law enforcement to disrupt the crypto-currency mining botnet “Lecpetex”. The botnet had used Facebook spam messages to deliver malicious files to the victim’s computer, which used the victim’s computer to mine cryptocurrency and the victim’s account to further propagate the malware via spam. (ID#: 14-50000) See http://www.scmagazine.com/facebook-disrupts-cryptocurrency-mining-botnet-lecpetex/article/360154/

• “Gmail iOS app vulnerable to MitM attack, emails and credentials at risk”, SC Magazine, 10 July 2014. Lacoon researchers discovered a vulnerability in the iOS Gmail app that could allow man-in-the-middle style attacks to view emails and steal personal information. Google confirmed the issue, but has yet to fix the flaw. (ID#: 14-50001) See http://www.scmagazine.com/gmail-ios-app-vulnerable-to-mitm-attack-emails-and-credentials-at-risk/article/360346/

• “How Advancing Threat Intelligence Can Combat Cyber Attacks”, Security Magazine, 8 July 2014. A detailed examination of the methodology and different stages of a cyberattack and preventative measures for each of those stages. (ID#: 14-50002) See http://www.securitymagazine.com/articles/85641-how-advancing-threat-intelligence-can-combat-cyber-attacks

• “95% of Successful Security Attacks are the Result of Human Error”, Security Magazine, 19 June 2014. A vast majority of cyber attacks are caused by human error, according to researchers with IBM and the Cyber Security Intelligence Index. (ID#: 14-50003) See http://www.securitymagazine.com/articles/85601-of-successful-security-attacks-are-the-result-of-human-error

• “Survey says Shortage Of Cybersecurity Professionals Poses Risk To National Security”, Security Magazine, 19 June 2014. According to a study by the RAND Corporation, the national shortage of cybersecurity professionals, particularly in the government, poses a national security risk. The dramatic rise in cyberattacks has created a much greater demand for cybersecurity professionals. (ID#: 14-50004) See http://www.securitymagazine.com/articles/85600-survey-says-shortage-of-cybersecurity-professionals-poses-risk-to-national-security

• “CISCO Warns on Combined Spear Phishing and Exploit Attacks”, Cyber Defense Magazine, 10 July 2014. Several high-profile European companies were recently targeted by hackers who used phishing emails, “typosquatting”, cloud storage, and other tools to attempt to distribute malware. (ID#: 14-50005) See http://www.cyberdefensemagazine.com/cisco-warns-on-combined-spear-phishing-and-exploit-attacks/

• “Cyber Information Sharing Act Draws Uncertainty and Criticism”, Infosecurity Magazine, 11 July 2014. Controversy over privacy concerns has threatened to kill the Cyber Information Sharing Act (CISA), which was just approved by a Senate Committee. The bill aims to improve response to and prevention of cyberattacks by setting up information sharing between companies and the government. (ID#: 14-50006) See http://www.infosecurity-magazine.com/view/39259/cyber-information-sharing-act-draws-uncertainty-and-criticism/

• “Stop Worrying about Data Breach Prevention, says SafeNet VP”, Infosecurity Magazine, 11 July 2014. According to SafeNet Vice President Jason Hart, “Organizations should stop thinking about breach prevention, accept their going to be breached, change their mindset, and think about how they will protect and store their data.” (ID#: 14-50007) See http://www.infosecurity-magazine.com/view/39263/stop-worrying-about-data-breach-prevention-says-safenet-vp/

• “A Third of Infosec Professionals Don’t Bother with Encryption”, Infosecurity Magazine, 11 July 2014. According to a Voltage Security survey, 36% of IT security professionals admitted to failing to use encryption while sending sensitive data from their organization. Additionally, “almost half indicated that they are not de-identifying any data within their organizations.” (ID#: 14-50008) See http://www.infosecurity-magazine.com/view/39258/a-third-of-infosec-professionals-dont-bother-with-encryption/

• “McAfee Plots Security Framework for Internet of Things”, Infosecurity Magazine, 09 July 2014. McAfee has joined the Open Interconnect Consortium — a project to “define and deliver device-to-device connectivity requirements for the internet of things (IoT)” — to help improve security standards for the IoT. The sheer number and variety of devices to be on the IoT makes it a prime security risk. (ID#: 14-50009) See http://www.infosecurity-magazine.com/view/39236/mcafee-plots-security-framework-for-internet-of-things/

• “IEEE Launches Two Anti-malware Services”, Infosecurity Magazine, 09 July 2014. IEEE has launched two of its own anti-malware services as part of a new Anti-Malware Support Service (AMSS) project to “provide a place for collaboration on new technologies and standards-related offerings.” Additional services are planned to be released in the future. (ID#: 14-50010) See http://www.infosecurity-magazine.com/view/39214/ieee-launches-two-antimalware-services/

• “Microsoft Error Plunged Np-IP Punters Into Darkness”, Infosecurity Magazine, 03 July 2014. Despite warnings from the cybersecuriy community about abuse of No-IP services for malicious purposes, Microsoft has been criticized for lack of response to the issue. In a recent attempt to snuff out a botnet, Microsoft’s Digital Crimes Unit (DCU) ended up blocking No-IP services from legitimate users. (ID#: 14-50011) See http://www.infosecurity-magazine.com/view/39149/microsoft-error-plunged-noip-punters-into-darkness/

• “US Calls For Restart of China Cybersecurity Working Group”, Infosecurity Magazine, 01 July 2014. The U.S. will invite China to re-start a bilateral cybersecurity working group, in an attempt to improve the cyber relationship between the two nations. The working group was initiated just last year, but China pulled out of the effort in May after the indictment of five PLA officers by Washington. (ID#: 14-50012) See http://www.infosecurity-magazine.com/view/39110/us-calls-for-restart-of-china-cybersecurity-working-group/

• “Encrypted instant messaging project seeks to obscure metadata”, Computerworld, 07 July 2014. Though encryption can be used to effectively hide conversations, metadata can still be used to determine information like time and identities. To combat this, researchers are working on a prototype instant massaging service, Invisible.im, which will hide metadata. (ID#: 14-50013) See http://www.computerworld.com/s/article/9249568/Encrypted_instant_messaging_project_seeks_to_obscure_metadata

• “The Gameover Trojan program is back”, Computerworld, 11 July 2014. In the beginning of June, law enforcement was able to take down a highly complex and powerful trojan known as Gameover Zeus. However, hackers are currently creating a new botnet based on what is suspected to be a modified version of Gameover Zeus. (ID#: 14-50014) See http://www.computerworld.com/s/article/9249678/The_Gameover_Trojan_program_is_back?taxonomyId=17

• “CyberRX preps health care community for cyberattack”, GCN, 01 July 2014. The Department of Health and Human Services and Health Information Trust Alliance (HITRUST) teamed up with ten private sector organizations to test the ability of healthcare providers to respond to and prevent cyber attack. The real-life nature of the exercises are invaluable for determining the state of healthcare security. (ID#: 14-50015) See http://gcn.com/articles/2014/07/01/cyberrx.aspx?admgarea=TC_SecCybersSec

• “Isolate and conquer: Getting past a reliance of layered security”, FCW, 09 July 2014. Most organizations rely on costly layers of protective measures to defend against cyber attack, but vulnerabilities deep within devices — such as an operating system kernel — can be used to simultaneously defeat these stacks of layered security. Over 80 Windows kernel vulnerabilities were discovered in 2013 alone. (ID#: 14-50016) See http://fcw.com/articles/2014/07/09/crosby--micro-virtualization.aspx

• “DOT CIO on cyber, shared services and ‘technology that is changing constantly’”, FCW, 08 July 2014. Interview with DOT CIO R. McKinney. In his first year as the DOT CIO, Richard McKinney has adopted a strong focus on cybersecurity, recognizing it as an integral part of keeping America’s infrastructure safe. (ID#: 14-50017) See http://fcw.com/articles/2014/07/08/dot-mckinney-qanda.aspx

• “NIST goes global with cyber framework”, FCW, 03 July 2014. In the interest of promoting international dialogue on cybersecurity, the NIST has been taking its new cyber framework, which is between critical infrastructure firms and government, overseas. The focus is not on showing off the framework itself, but the process by which it was developed, in the hopes that other nations can learn from it and produce their own versions. (ID#: 14-50018) See http://fcw.com/articles/2014/07/03/nist-global-cyber-framework.aspx

• “In A Battle For Web Traffic, Bad Bots Are Going After Grandma”, NPR, 03 July 2014. The web is full of bots, about half of which are “bad”. One might think of bots as thieves of sensitive information, but in reality bots are going after the digital identities of individual users. They use this to produce false web traffic to certain websites, thereby making a specific website more valuable to advertisers. (ID#: 14-50019) See http://www.npr.org/blogs/alltechconsidered/2014/07/03/328196199/in-a-battle-for-web-traffic-bad-bots-are-going-after-grandma

• “Teaming up to train, recruit cyber specialists”, FCW, 18 July 2014. Lawrence Livermore National Laboratory announced that it will be joining up with Betchel BNI and Los Alamos National Laboratory in their effort to train a new generation of cyber defense professionals to protect critical infrastructure. The program will prepare trainees to guard against cyber threats in government and private sector environments. (ID#: 14-50021) See http://fcw.com/articles/2014/07/18/national-labs-cyber-training.aspx

• “Treasury Secretary warns of cyber threat to financial sector”, FCW, 16 July 2014. In a recent speech in New York City, Treasury Secretary Jacob Lew highlighted the seriousness of the cyber risk to the financial sector. According to Lew, cyber crime “undercuts America’s businesses and undermines U.S. competitiveness” and can “pose a threat to financial stability”. (ID#: 14-50022) See http://fcw.com/articles/2014/07/16/treasury-warning-on-cyber.aspx

• “Diluting data profiles with obfuscation, a hot topic at HOPE X hacker conference”, SC Magazine, 18 July 2014. With growing concerns over data collection and privacy, interest in obfuscation — the practice of leaving misleading and ambiguous data — is growing. The subject was a hot topic at hacker conference HOPE X, but skeptics claim that countermeasures can be created to filter out false information. (ID#: 14-50024) See http://www.scmagazine.com/diluting-data-profiles-with-obfuscation-a-hot-topic-at-hope-x-hacker-conference/article/361714/

• “Report: Old bugs in Microsoft XML still haunt users, program ‘most exposed’”, SC Magazine, 18 July 2014. A quarterly report by vulnerability management firm Secunia found Microsoft XML Core Services 4 to be the biggest security risk for PC users, based on the sheer number of people using versions with unpatched vulnerabilities. (ID#: 14-50025) See http://www.scmagazine.com/report-old-bugs-in-microsoft-xml-still-haunt-users-program-most-exposed/article/361675/

• “Cisco Wireless Residential Gateway Remote Code Execution flaw”, Cyber Defense Magazine, 18 July 2014. A security flaw that could be exploited by a remote hacker put numerous Cisco wireless residential Gateway products at risk. A hacker could use this flaw to perform a “remote-code execution” attack, making the flaw very serious. (ID#: 14-50026) See http://www.cyberdefensemagazine.com/cisco-wireless-residential-gateway-remote-code-execution-flaw/

• “Critroni Ransomware Makes Its Way into the Wild”, Infosecurity Magazine, 20 July 2014. Ransomware “CryptoLocker” made its rounds in 2013, but a new piece of malware, Critroni, aims to live up to the reputation of its predecessor and is making its way into the wild. Critroni is unique in its sophistication, and use of C2 in the Tor network. (ID#: 14-50027) See http://www.infosecurity-magazine.com/view/39389/critroni-ransomware-makes-its-way-into-the-wild/

• “Invisible, Government-authored Malware Makes its Way to Underground Forums”, Infosecurity Magazine, 18 July 2014. Gyges, a sophisticated piece of espionage malware that appears to have been initially state-sponsored, was found to have made its way into the cybercriminal underground. Gyges uses a smorgasbord of advanced techniques to remain undetected and spy on its victim. (ID#: 14-50028) See http://www.infosecurity-magazine.com/view/39387/invisible-governmentauthored-malware-makes-its-way-to-underground-forums/

• “Net neutrality becomes a key battleground in encryption fight”, Computerworld, 18 July 2014. The debate over Net neutrality and a controversial FCC proposal has been a huge topic in recent months. Net neutrality is important for more than just a free internet, some argue; cryptography relies on anonymity and prioritizing internet traffic could partially undermine encryption. (ID#: 14-50029) See http://www.computerworld.com/s/article/9249836/Net_neutrality_becomes_a_key_battleground_in_encryption_fight?taxonomyId=17

• “Data breach epidemic shines spotlight on shared secrets”, GCN, 17 July 2014. No matter how good security measures may be, passwords are merely shared secrets that rely on both the end user and authenticating party. Human error and hardware/software vulnerabilities are always possible and can compromise even the most secure systems. Data breaches that reveal user’s passwords have become a serious issue. (ID#: 14-50030) See http://gcn.com/articles/2014/07/17/isc2-shared-secrets-security.aspx?admgarea=TC_SecCybersSec

• “Follow malware’s tracks to thwart cyber attacks”, GCN, 09 July 2014. Threat detection and analysis of past cyber attacks can help government agencies know how to defend against future attacks. Finding out how cybercriminals infiltrated and explored a network can be difficult, however, because some attackers employ tactics to cover their tracks. (ID#: 14-50031) See http://gcn.com/articles/2014/07/09/malware-detection-remediation.aspx?admgarea=TC_SecCybersSec

• “New proactive approach unveiled to detect malicious software in networked computers and data”, Virginia Tech News, 04 June 2014. Researchers at Virginia Tech have announced new research that helped develop use of causal relations and semantic reasoning to detect illegitimate network activities. This new method is proactive, as opposed to reactive, making it a powerful tool for preventing malware. (ID#:14-1893) See http://www.vtnews.vt.edu/articles/2014/06/060414-engineering-malware.html

• “Computer scientists develop tool to make the Internet of Things safer”, UCSD Jacobs School of Engineering, 02 June 2014. Computer Scientists at UCSD developed a tool to test the security of hardware, based on Gate-level Information Flow Tracking (GLIFT) technology. This will help the “Internet of Things” — a proposed network of smart devices such as cars, cell phones and medical devices — stay secure. (ID#:14-1894) See http://www.jacobsschool.ucsd.edu/news/news_releases/release.sfe?id=152

• “Navy puzzle challenge blends social media, cryptography”, GCN, 02 June 2014. The winners of the Navy’s “Project Architeuthis”, a cryptography puzzle game, were announced. Players had to solve “complex, story-like” puzzles based on clues posted to Facebook. By interacting with “people who enjoy complicated, story base puzzle solving”, the Navy hopes to attract the interest of bright minds into their Information Dominance Corps. (ID#:14-1895) See http://gcn.com/articles/2014/06/02/project-architeuthis.aspx

• “University researchers test cyber-defense for nation’s power grid”, CSO, 30 May 2014. Predicted vulnerabilities in the nation’s power grid have led researchers at NCSU and UNC Chapel Hill to research the use of a distributed computing system to mitigate the effects of a cyber-attack. By coordinating activity between the computer systems and control centers, chain-reactions of blackouts could be prevented. (ID#:14-1896) See http://www.csoonline.com/article/2307167/disaster-recovery/university-researchers-test-cyber-defense-for-nations-power-grid.html

• “Automating Cybersecurity”, The New York Times, 04 June 2014. A competition held by DARPA is offering a $2-million prize to a programming team that is able to build software to automatically detect intruders, detect the security flaws that allow breaches, and fix those flaws automatically. The challenge is excepted to bring together hackers and academics to help automate cyber defense. (ID#:14-1897) See http://cacm.acm.org/news/175515-automating-cybersecurity/fulltext

• “American Businesses in Chine Feel Heat of a Cyberdispute”, The New York Times, 31 May 2014. Amid rising tensions between the U.S. and Chinese governments over cyber-espionage allegations, American companies are facing serious consequences. IBM and Microsoft are amongst the hardest hit, as Chinese companies attempt to push IBM from the Chinese server market, and the Chinese government bans the use of Windows 8 in government offices. (ID#:14-1898) See http://www.nytimes.com/2014/06/01/world/asia/american-businesses-in-china-feel-heat-of-a-cyberdispute.html?hp&_r=0

• “Exclusive: U.S. companies seek cyber experts for top jobs, board seats”, Reuters, 30 May 2014. Following an increase in high-profile security breaches, many large U.S. companies are seeking to increase the strength of their cyber defenses by hiring more cyber experts. Demand for chief information security officers (CISOs) and other security experts is increasing; those positions are being elevated in management hierarchies. (ID#:14-1899)See http://www.reuters.com/article/2014/05/30/us-usa-companies-cybersecurity-exclusive-idUSKBN0EA0BX20140530

• “Quantum Cryptography with ordinary equipment”, IEEE Spectrum, 30 May 2014. Japanese researchers revealed a unique approach to quantum cryptography which incorporates phase shifting of optical signals in fiber-optic cable to transmit cipher keys. This easy-to-implement method does not require the same transmission measurements that are used by conventional quantum systems to detect key tampering. (ID#:14-1900) See http://cacm.acm.org/news/175390-quantum-cryptography-with-ordinary-equipment/fulltext

• “Md. launches cybersecurity industry forum”, Associated Press, 29 May 2014. An industry-led cybersecurity group, with representatives from various civilian, military, and government entities, ran its first meeting May 29th. The meetings, which are open to the public and will be held regularly, are intended to help expand Maryland’s cybersecurity industry. (ID#:14-1901) See http://www.washingtonpost.com/local/md-launches-cybersecurity-industry-forum/2014/05/29/249edbbe-e6f9-11e3-a70e-ea1863229397_story.html

• “Iranian hackers are targeting U.S. officials, through social networks, report says”, The Washington Post, 29 May 2014. Through the use of social networks and a fake news site, Iranian hackers have allegedly targeted U.S. military officials in an attempt to acquire U.S. military intelligence. (ID#:14-1902) See http://www.washingtonpost.com/world/national-security/iranian-hackers-are-targeting-us-officials-through-social-networks-report-says/2014/05/28/7cb86672-e6ad-11e3-8f90-73e071f3d637_story.html

• “Microsoft Ventures opens new cybersecurity accelerator in Israel”, The Washington Post, 29 May 2014. Microsoft Ventures is running a new cybersecurity “accelerator” in Israel. The program aims to help small cybersecurity related businesses grow by providing access to Microsoft software and mentorship. (ID#:14-1903) See http://www.washingtonpost.com/business/on-it/microsoft-ventures-opens-new-cybersecurity-accelerator-in-israel/2014/05/29/f11ac4ae-e687-11e3-8f90-73e071f3d637_story.html

• “Cyber attacks present a greater risk to firms as they collect more data about customers”, The Washington Post, 11 May 2014. As companies gather more and more data on their customers, the rising risks of cyber breaches have prompted a demand for better security practices. (ID#:14-1904) See http://www.washingtonpost.com/business/capitalbusiness/cyber-attacks-present-a-greater-risk-to-firms-as-they-collect-more-data-about-customers/2014/05/11/ee861a90-d494-11e3-95d3-3bcd77cd4e11_story.html

• “MINT Program Helps Pinpoint Threats Contained in Intelligence Data”, Georgia Tech News Center, 28 May 2014. MINT, a system that looks for threats in incoming intelligence data, is being improved by researchers at the the Georgia Tech Research institute. By “bringing actionable intelligence to the attention of human analysts as quickly as possible”, MINT will be able to help find high-priority items quicker. (ID#:14-1905) See http://cacm.acm.org/news/175323-mint-program-helps-pinpoint-threats-contained-in-intelligence-data/fulltext

• “Test to leverage cloud expansion”, Evaluation Engineering, June 2014. Cisco Systems recently announced plans to, with its partners, invest over $1 billion toward expanding cloud technology to create an “intercloud”, or network of clouds. Cloud computing and the “Internet of Everything” has been growing steadily in recent years and is excepted to provide an $19 trillion economic opportunity in the next decade, according to Cisco. (ID#:14-1906) See http://www.evaluationengineering.com/articles/201406/test-to-leverage-cloud-expansion.php

• “16-Year-Old OpenSSL Bug Detected”, PC Magazine, 06 June 2014. A recently-discovered flaw, which took took 16 years to find due to insufficient code reviews, can be exploited to "eavesdrop and make falsifications on your communication when both a server and a client are vulnerable." OpenSSL server versions1.0.1h, 1.0.0m, and 0.9.8.za are unaffected. (ID#:14-1907) See http://www.pcmag.com/article2/0,2817,2459073,00.asp

• “Personal Privacy Versus Business Security”, PC Magazine, 05 June 2014. Though allowing employees to bring their own phones, as opposed to company phones, to work is cheaper and easier, it comes at the cost of a much higher risk of data breaches. Stolen personal phones, and accessing of company documents with personal phones are both highly risky. (ID#:14-1908) Seehttp://securitywatch.pcmag.com/security-software/324252-personal-privacy-versus-business-security

• “Mobile Malware Not The Only Threat; Unwanted Apps Bad, Too”, PC Magazine, 19 May 2014. Potentially unwanted applications, or PUAs, often disguise themselves as variants of popular games, tools, or entertainment apps. These PUAs, though not malware, may be invasive and annoying. (ID#:14-1909) http://securitywatch.pcmag.com/mobile-apps/323737-mobile-malware-not-the-only-threat-unwanted-apps-bad-too

• “Domain Fluxing Helps Data Breaches Stay Hidden”, PC Magazine, 14 May 2014. By using a pseudo-random Domain Generation Algorithms, hackers are able to dynamically change the addresses of servers that are used to communicate with infected devices, making the process of fixing data breaches harder. (ID#:14-1910) See http://securitywatch.pcmag.com/hacking/323574-domain-fluxing-helps-data-breaches-stay-hidden

• “Why OpenSSL Being Patched Again Is Good News”, PC Magazine, 06 June 2014. With the security patches of OpenSSL after another recent vulnerability surfaced, more and more people are scrutinizing the code of OpenSSL, leading to a greater chance of bugs being found and fixed. (ID#:14-1911) See http://securitywatch.pcmag.com/hacking/324359-why-openssl-being-patched-again-is-good-news

• “Patch All The Things! New ‘Cupid’ Technique Exploits Heartbleed Bug”, PC Magazine, 04 June 2014. SysValue researcher Luis Grangeia has created two code libraries that he calls “Cupid”, to show how the Heartbleed bug can be used to exploit Linux and Android devices, not just servers. (ID#:14-1912) See http://securitywatch.pcmag.com/hacking/324238-patch-all-the-things-new-cupid-technique-exploits-heartbleed-bug

• “Some Antivirus Tools Wildly Effective Against Zero-Day Malware”, PC Magazine, 28 May 2014. Recent testing of numerous anti-virus programs show that while some displayed discouraging performance, a large number scored exceptionally well. (ID#:14-1913) See http://securitywatch.pcmag.com/security-software/323990-some-antivirus-tools-wildly-effective-against-zero-day-malware

• “Microsoft preps seven fixes, two critical, for Patch Tuesday release”, SC Magazine, 06 June 2014. Seven patches for Microsoft software, two of which are critical, one being a “seldom-seen ‘tampering’ type”, are being released in a monthly security update. Vulnerabilities that allow tampering are noted as being rare.(ID#:14-1914) See http://www.scmagazine.com/microsoft-preps-seven-fixes-two-critical-for-patch-tuesday-release/article/351559/

• “Mozilla pushes internet security reform through study”, SC Magazine, 06 June 2014. Mozilla is awaiting the results of the Cyber Security Delphi research and recommendation initiative’s effort to create a “concrete agenda” to help address threats to online security. Mozilla has already put together its own advisory board with experts from prestigious universities and the ACLU. (ID#:14-1915) See http://www.scmagazine.com/mozilla-pushes-internet-security-reform-through-study/article/351445/

• “Report: Attackers hide in plain sight using data-sharing apps”, SC Magazine, 05 June 2014. In a recent report, Palo Alto Networks found that attackers are using old exploits and data-sharing apps to remain undetected. They often gain access through applications like Email, but then use different methods to control the malware and steal data. (ID#:14-1915) http://www.scmagazine.com/report-attackers-hide-in-plain-sight-using-data-sharing-apps/article/351314/

• “Life For Hackers as UK Government Gets Tough on Computer Crime”, Infosecurity Magazine, 06 June 2014. The UK Government revealed plans to increase the severity of penalties for cyber crimes, to “ensure sentences for attacks on computer systems fully reflect the damage they cause”. Cyber criminals might even face life behind bars for crimes that are deemed to have put lives and national security at risk. (ID#:14-1916) See http://www.infosecurity-magazine.com/view/38737/life-for-hackers-as-uk-government-gets-tough-on-computer-crime/

• “Senior White House official talks cyber goals, legislative outlook”, FCW, 09 June 2014. Interview with senior director for cybersecurity at the White House, Ari Schwartz, on cybersecurity policy and congressional action on cyber issues. (ID#:14-1917) See http://fcw.com/articles/2014/06/09/white-house-official-talks-workforce-and-heartbleed.aspx

• “Cybersecurity a top priority in Senate appropriations bill”, FCW, 09 June 2014. A 2015 Senate appropriations bill is giving cybersecurity provisions high priority. The bill will provide more funding to entities like the FBI’s National Cyber Investigate Task Force, the NIST’s planned national Cybersecurity Center of Excellence, and others. (ID#:14-1918) See http://fcw.com/articles/2014/06/09/cybersecurity-in-senate-cjs-bill.aspx

• “China making steady gains in cyber, military IT”, FCW, 06 June 2014. On June 5th the Pentagon charged China with stealing U.S. intellectual property, amid rising tensions between China and the U.S. over Information Security and cyber-espionage. (ID#:14-1919) See http://fcw.com/articles/2014/06/06/china-cyber-report.aspx

• “NIST updates monitoring authorization process”, FCW, 06 June 2014. The NIST sent out new guidance to federal agencies, proposing an information system continuous monitoring (ISCM) program to help make information system security authorization more secure. (ID#:14-1920) See http://fcw.com/articles/2014/06/06/nist-cdm-guidelines.aspx

• “White House looking to Capitol Hill on cyber”, FCW, 05 June 2014. Though the executive branch has passed several executive orders to help bolster U.S. cybersecurity, the White House is looking to Congress to act on one of the few bipartisan issues left, namely, cybersecurity. With recent shortcomings in action by the Senate on cybersecurity due to a all-in-one approach to cyber issues, a “piecemeal” approach might be required to yield results. (ID#:14-1921) See http://fcw.com/articles/2014/06/05/cybersecurity-legislation.aspx

• “New Testing Framework Set to Boost Banks’ Cyber Defenses”, Infosecurity Magazine, 10 June 2014. In an effort to protect banks from cuber threats, info security assurance organization CREST and UK authorities have provided the CBEST initiative to provide a framework for simulating cyber-attacks and testing the resilience of financial security systems. (ID#:14-1922) See http://www.infosecurity-magazine.com/view/38789/new-testing-framework-set-to-boost-banks-cyber-defences/

• “Second Chinese PLA Hacking Unit Unmasked in ‘Putter Panda’ Report”, Infosecurity Magazine, 10 June 2014. Evidence revealed by CrowdStrike points to another Chinese “hacking unit” which targeted satellite, aerospace, and communication industries. The group, Unit 61486, sought to snatch corporate trade secrets via phishing emails. (ID#:14-1923) See http://www.infosecurity-magazine.com/view/38785/second-chinese-pla-hacking-unit-unmasked-in-putter-panda-report/

• “Wordpress to Implement End-to-End SSL Encryption”, Infosecurity Magazine, 09 June 2014. Following accusations of government surveillance, content management system (CMS) giant Wordpress announced that it plans to use end-to-end SSL encryption on all of the subdomains of wordpress.com by the end of the year. (ID#:14-1924) See http://www.infosecurity-magazine.com/view/38775/wordpress-to-implement-endtoend-ssl-encryption-/

• “IEEE CEO Loeb Named ISACA CEO”, Infosecurity Magazine, 06 June 2014. Matthew Loeb, a former IEEE CEO, will assume his role as the new CEO of Information Systems Audit and Control Association (ISACA) on Nov. 1st. Leob plans to increase ISACA’s cybersecurity capabilities and raise awareness of the need for cybersecurity in businesses. (ID#:14-1925) See http://www.infosecurity-magazine.com/view/38748/ieee-ceo-loeb-named-isaca-ceo/

• “A Third of IT Admins say Spend Will Increase Due to Internet of Things”, Infosecurity Magazine, 06 June 2014. As the number of devices on the new “Internet of Things” grows dramatically, the potential for security threats and their consequences grows too. This increased risk means an increased cost for small to medium-sized businesses that wish to maintain security. (ID#:14-1926) See http://www.infosecurity-magazine.com/view/38749/a-third-of-it-admins-say-spend-will-increase-due-to-internet-of-things-/

• “Databases of personnel at US command In S Korea hacked”, Cyber Defense Magazine, 09 June 2014. A cyber attack on United States intelligence has led to a data breach that compromised the personal information of around 16,000 American-employed workers and former workers in South Korea. The stolen details about U.S. activities in the area could be used for malicious purposes. (ID#:14-1928) See http://www.cyberdefensemagazine.com/databases-of-personnel-at-us-command-in-s-korea-hacked/

• “Cyber Crime Costs Global Economy $445 Billion a year”, Security Magazine, 09 June 2014. A CSIS report sponsored by McAfee indicates that cybercrime costs global business over $400 billion every year, and impacts hundreds of thousands of jobs in the U.S. and EU. Businesses that produce and rely on intellectual property have been particularly hard-hit. (ID#:14-1930) See http://www.securitymagazine.com/articles/85586-cyber-crime-costs-global-economy-445-billion-a-year

• “FBI is officially looking for malware development”, Cyber Defense Magazine, 21 May 2014. An FBI request for malware development confirms the use of malicious code by the FBI. Experts warn of the risk of proliferating dangerous malware, which could be used to violate internet user’s privacy rights. (ID#:14-1931) See http://www.cyberdefensemagazine.com/fbi-is-officially-looking-for-malware-development/

• “Remote code injection in Microsoft, Yahoo, and Orange subdomains”, Cyber Defense Magazine, 20 May 2014. A vulnerability that allows hackers to “inject” code into vulnerable servers has been discovered by a participant in the Yahoo Bug Bounty Program. The injected code could be used to run system commands to edit and read data from affected servers. (ID#:14-1932) See http://www.cyberdefensemagazine.com/remote-code-injection-in-microsoft-yahoo-and-orange-subdomains/

• “Security Software Takes Selfies in Phone Thefts Cases”, Security Magazine, 05 June 2014. A security service provided by Lookout Mobile can take pictures of thieves, wipe data, and show the location a phone after the software detects actions that indicate the phone has been stolen. (ID#:14-1933) See http://www.securitymagazine.com/articles/85583-security-software-takes-selfies-in-phone-thefts-cases

• “Possibly 350K ransom ware infections, $70K earned, in Dropbox phishing scheme”, SC Magazine, 09 June 2014. “CryptoWall” ransom ware has made its way onto nearly 350,000 devices, and has made over $70,000 from Bitcoin ransoms. The attackers used a base-36 number scheme, which enables them to track over 1.7 million hosts with only 4 digits. (ID#:14-1934) http://www.scmagazine.com/possibly-350k-ransomware-infections-70k-earned-in-dropbox-phishing-scheme/article/353559/

• “DDoS Attacks Growing in Volume and Complexity”, Infosecurity Magazine, 05 June 2014. A recent report indicates that the frequency and size of DDoS attacks has risen dramatically. As these attacks adapt and evolve, many organizations will be at an increased risk. (ID#:14-1935) See http://www.infosecurity-magazine.com/view/38724/ddos-attacks-growing-in-volume-and-complexity/

• “Guarding against ‘Carmageddon’ cyberattacks”, Vanderbilt News, 11 June 2014. As automated “smart transportation systems” — a network of sensors, computers, and signals — provide increasing potential for safer and more efficient transportation, the risk of those systems becoming victim to cyber attacks increases. Developing the ability to deter, detect, and respond to these attacks is a top priority for academic and government researchers. (ID#:14-1936) See http://news.vanderbilt.edu/2014/06/carmageddon-cyberattacks/

• “Making a covert channel on the Internet”, Cornell Chronicle, 03 June 2014. Researchers have discovered a new way to transmit data covertly over the internet through a method named “Chupja”. In this technique, Binary data is represented by modulating the duration of idle characters in between packets of data by mere picoseconds, which is makes detection by monitoring software difficult. (ID#:14-1937) See http://www.news.cornell.edu/stories/2014/06/making-covert-channel-internet

• “TSA looks to cloud providers for disaster recovery”, FCW, 11 June 2014. The TSA is asking for advice from cloud service providers on how they can help back up the TSA’s Technology Infrastructure Modernization (TIM) division in the case of emergencies. The TIM helps the TSA communicate with other homeland security-related entities to help recover from disasters. (ID#:14-1938) See http://fcw.com/articles/2014/06/11/tsa-cloud-rfi.aspx

• “The Internet of government things”, FCW, 11 June 2014. As the government is recognizing the capability of the Internet of Things (IoT) to provide social-economic benefits, organizations like the GSA and NIST are promoting development of IoT systems through programs like the SmartAmerica Challenge. The cyber-physical systems that the IoT is comprised of show promise for improving numerous facets of life, including transportation, security, and healthcare. (ID#:14-1939) See http://fcw.com/articles/2014/06/11/internet-of-things-expo.aspx

• “Cyber Currencies Get Boost from High-Profile Endorsements”, 06 June 2014. Bitcoin, despite facing serious trouble in early 2014, is having better luck as big names like TV provider Dish Network and rapper 50 Cent are set to start accepting the cyber currency. More importantly, the Apple Store, which has avoided any involvement with digital currencies in the past, is now preparing to allow iOS developers to support certain cyber currencies. (ID#:14-1940) See http://www.scientificamerican.com/podcast/episode/cyber-currencies-get-boost-from-high-profile-endorsements1/

• “FCC unveils ‘new regulatory paradigm’ for defeating hackers”, The Washington Post, 12 June 2014. The FCC has revealed a new rule making process that will help communications industry companies collaborate to thwart hackers. Under the plan, large telecom providers like AT&T and Verizon will be asked to develop a system to build up cyber defenses and ensure that work is done on schedule. (ID#:14-1941) See http://www.washingtonpost.com/blogs/the-switch/wp/2014/06/12/fcc-chair-telecom-companies-must-do-more-to-defend-against-hackers/

• “PLXsert warns Fortune 500 companies of evolving Zeus threat”, SC Magazine, 12 June 2014. The high-risk crimeware kit “Zeus”, which was initially used to harvest data, has evolved to provide new malicious functions, such as DDoS attack capability and spam delivery. Despite the recent disruption of Gameover Zeus, a variant of Zeus, the notorious trojan remains a serious threat. (ID#:14-1942) See http://www.scmagazine.com/plxsert-warns-fortune-500-companies-of-evolving-zeus-threat/article/355543/

• “Small businesses running cloud-based POS software hit with unique ‘POSCLOUD’ malware”, SC Magazine, 11 June 2014. POSCLOUD, a new instance of malware that uses screenshot grabbing techniques and key logging to steal credentials, has infected POS devices within cloud-based environments of small businesses. (ID#:14-1943) See http://www.scmagazine.com/small-businesses-running-cloud-based-pos-software-hit-with-unique-poscloud-malware/article/355301/

• “Expensive new trojan, Pandemiya, based on 25k original lines of C code”, SC Magazine, 10 June 2014. An original trojan known as Pandemiya, which is characterized by URI-randomization and an unusual lack of source code from the Zeus trojan, has been observed. Despite employing unique tactics that could make it hard to track, Pandemiya is easier to remove when found because it is not a rootkit. (ID#:14-1944) See http://www.scmagazine.com/expensive-new-trojan-pandemiya-based-on-25k-original-lines-of-c-code/article/355064/

• “Online gambling site hit by five-vector DDoS attack peaking at 100Gbps”, SC Magazine, 10 June 2014. Cloud-based security services provider Incapsula reported that it fought off a large 100Gbps, five-vector DDoS attack on an unnamed online gambling site. Though most DDoS attacks are multi-vector, less than 1 in 10 employ 4 or 5 vectors. This number of multi-vector attacks is becoming more common. (ID#:14-1945) See http://www.scmagazine.com/online-gambling-site-hit-by-five-vector-ddos-attack-peaking-at-100gbps/article/355020/

• “Identity Surveillance Schemes Could Return to Haunt West, Warns Privacy Group”, Infosecurity Magazine, 13 June 2014. Outdated, vulnerable identity surveillance schemes that have been prospering in developing nations could promote discrimination and social inequality, and have already created dependancies on developed nations. (ID#:14-1946) See http://www.infosecurity-magazine.com/view/38839/identity-surveillance-schemes-could-return-to-haunt-west-warns-privacy-group/

• “Plan Now For Europe’s NIS Cyber Security Directive, Firms Warned”, Infosecurity Magazine, 12 June 2014. Despite ambiguity and uncertainty over details of the upcoming European Network and Information Security (NIS) directive, IT leaders and businesses are being advised to prepare for its implementation. The directive aims to improve cybersecurity in the EU while ensuring consistency across the EU. (ID#:14-1947) See http://www.infosecurity-magazine.com/view/38834/plan-now-for-europes-nis-cyber-security-directive-firms-warned/

• “ICS_CERT: Federal Highway Signs Are Easily Hackable”, Infosecurity Magazine, 11 June 2014. In the wake of numerous pranks on digital highway signs, the ICS-CERT is recommending mitigating their notorious lack of security through VPN’s and better password management. The signs, upon which commuters rely for information, are important for the safety and efficiency of highways. (ID#:14-1948) See http://www.infosecurity-magazine.com/view/38794/icscert-federal-highway-signs-are-easily-hackable/

• “Information Risk Gaps Costing Firms Dear, Warns Iron Mountain”, Infosecurity Magazine, 11 June 2014. A study has found that, despite a high interest in data security, businesses are not performing nearly enough actual action to protect their data. The study also found that businesses often have a simplistic view of information security issues, thereby increasing security risks. (ID#:14-1949) See http://www.infosecurity-magazine.com/view/38802/information-risk-gaps-costing-firms-dear-warns-iron-mountain/

• “Smart TVs Represent a Massive and Vulnerable Attack Surface”, Infosecurity Magazine, 10 June 2014. According to researchers at Columbia University, the popular Hybrid Broadcast Broadband TV (HbbTV) standard, which allows TVs to include content from the internet, has several security flaws. These flaws could be exploited by hackers to launch any one of a host of traditional “man-in-the-middle”-style attacks.(ID#:14-1950) See http://www.infosecurity-magazine.com/view/38793/smart-tvs-represent-a-massive-and-vulnerable-attack-surface-/

• “Still (Heart)bleeding: New OpenSSl MiTM Vulnerability Surfaces”, Infosecurity Magazine, 10 June 2014. Because of the constant scrutiny of the open-source OpenSSL code, new security flaws are constantly being unearthed and patched. For some, this system of disclosure and repair is evidence that the open-source collaboration model works, though others will point to the endless trickle of vulnerabilities as an indication that the code might never be perfected. (ID#:14-1951) See http://www.infosecurity-magazine.com/view/38727/still-heartbleeding-new-openssl-mitm-vulnerability-surfaces/

• “Ex-Microsoft employee who leaked Windows secrets to be deported to Russia”, Computerworld, 13 June 2014. A former Microsoft employee will be deported to Russia after being found guilty of leaking software updates for a Windows tablet operating system, as well as an Activation Server SDK, which is used by Microsoft to create anti-piracy measures. ((ID#:14-19552) See http://www.computerworld.com/s/article/9249078/Ex_Microsoft_employee_who_leaked_Windows_secrets_to_be_deported_to_Russia

• “Last call for comments on Keccak encryption”, GCN, 13 June 2014. Before implementing its new Keccak family of hashing algorithms to improve from the long-lived SHA-2 federal standard, the NIST is giving the public a three-month period to voice their thoughts. This will allowing concerns about patent infringement and other issues to be brought up. (ID#:14-1953) See http://gcn.com/blogs/cybereye/2014/06/keccak-comments.aspx?admgarea=TC_SecCybersSec

• “House Intel chairman upbeat on cyber legislation”, FCW, 12 June 2014. Following the success of the House of Representatives’ cybersecurity bill, the Senate is expected to pass its own information-sharing bill this year. The success of cyber legislation in the recent past is credited to cyber officials who have educated lawmakers on the importance of cybersecurity issues. (ID#:14-1954) See http://fcw.com/articles/2014/06/12/intelligence-chairman-optimistic-on-cyber.aspx

• “GCHQ Set to Share Threat Intelligence With CNI Firms”, Infosecurity Magazine, 17 June 2014. The UK spy agency GCHQ is slated to start sharing intelligence with government CSPs and eventually CNI firms, which is intended to help protect the UK’s cyber infrastructure. This move is seen as a result of the new CISP (Cyber Security Information Sharing Partnership) that was launched last year. (ID#:14-1955) See http://www.infosecurity-magazine.com/view/38896/gchq-set-to-share-threat-intelligence-with-cni-firms/

• “Watch Out for Sneaky Cyber Attacks, M&A Firms Warned”, Infosecurity Magazine, 14 June 2014. As the Mergers and Acquisition business continues to boom, M&A firms are facing a growing cyber threat. Attackers generally seek out sensitive data, which could give a particular side of an acquisition or merger a competitive advantage. (ID#:14-1956) See http://www.infosecurity-magazine.com/view/38842/watch-out-for-sneaky-cyber-attacks-ma-firms-warned/

• “Study: Business Fraud, Cybercrime On the Rise; C-Suite Unprepared”, Secuity Magazine, 11 June 2014. According to a survey, fraud and cybercrime are on the rise, though the lack of implementation of preventative measures and awareness of its danger and is not promising. Many survey respondents also reported a high rate of corruption and bribery. (ID#:14-1957) See http://www.securitymagazine.com/articles/85592-study-business-fraud-cybercrime-on-the-rise-c-suite-unprepared

• “‘Human error’ contributes to nearly all cyber incidents, study finds”, SC Magazine, 16 June 2014. According to a new IBM report, 95 percent of all security incidents at internation clients of IBM’s security services were caused by human error. Malicious links in phishing messages were found to be the most common source of threats. (ID#:14-1958) See http://www.scmagazine.com/human-error-contributes-to-nearly-all-cyber-incidents-study-finds/article/356015/

• “IBM CISO: Company boards need big picture threat data”, SC Magazine, 17 June 2014. According to IBM’s CISO Joanne Martin, top-level employees and boards of directors need to be better informed on the details and context of information security to be able to better respond to cyber security issues. It is the responsibility of IT professionals, said Martin, to educate these business leaders. (ID#:14-1959) Seehttp://www.scmagazine.com/ibm-ciso-company-boards-need-big-picture-threat-data/article/356265/

• “Domino’s extortion breach highlights rise in ransom-based attacks”, SC Magazine, 16 June 2014. A recent attempt to force Domino’s to give up 30,000 euros, though unsuccessful, is indicative of the upsurge of ransom-based attacks. Organizations that find themselves victims of such an attack are advised to pay the ransom to attackers — this sets a dangerous precedent. (ID#:14-1960) See http://www.scmagazine.com/dominos-extortion-breach-highlights-rise-in-ransom-based-attacks/article/355997/

• “Hacker mines $620K in crypto currency under victims’ noses”, Computerworld, 17 June 2014. Though stealing digital currency is nothing new in the world of hacking, a unique piece of specialized malware has actually been able to use the processing power of victims’ computers to mine, or produce, over $620,000 in the crypto-currency “Dogecoin”. (ID#:14-1961) See http://www.computerworld.com/s/article/9249169/Hacker_mines_620K_in_cryptocurrency_under_victims_noses?taxonomyId=17

• “Powerful Dyreza banking malware emerges”, Computerworld, 17 June 2014. According to researchers, the newly discovered “Dyreza” malware rivals the capabilities of the popular Zeus Malware. Though it shares many similarities with Zeus, it appears to not be based on Zeus’s source code. (ID#:14-1962) See http://www.computerworld.com/s/article/9249153/Powerful_Dyreza_banking_malware_emerges?taxonomyId=17

• “Better messaging means security can grow with IoT”, Computerworld, 17 June 2014. For the Internet of Things, security will be a top priority. Often times, security can come at the cost of speed — both of which are important to the IoT. However, some developers are beginning to implement a new specification called DDS Security, which promises both speed and security for a networks of devices. (ID#:14-1963) See http://www.computerworld.com/s/article/9249151/Better_messaging_means_security_can_grow_with_IoT?taxonomyId=17

• “FCC to push network providers on cybersecurity”, Computerworld, 12 June 2014. Amongst the debate over the FCC’s role in net neutrality, FCC Chairman Tom Wheeler is pushing network providers to focus more on cybersecurity through practices developed by the National Institute of Standards and Technology (NIST) and the FCC’s own Communications, Security, Reliability and Interoperability Committee (CSRIC). (ID#:14-1964) See http://www.computerworld.com/s/article/9249061/FCC_to_push_network_providers_on_cybersecurity?taxonomyId=17

• “Mobile forensics tools hammer out evidence”, GCN, 17 June 2014. Despite facing the challenging task of keeping up with a rapidly changing market, companies that deal in mobile forensics technology have seen success with tools that can beat encryption and other barriers that stand in the way of data extraction. (ID#:14-1965) See http://gcn.com/Articles/2014/06/17/Mobile-forensics-tools.aspx?admgarea=TC_SecCybersSec&Page=1

• “Can digital forensics keep up with smartphone tech?”, GCN, 16 June 2014. The explosive growth in the capabilities of smart phones has forced digital forensics technologies to constantly evolve and adapt to the growingly sophisticated world of mobile devices. (ID#:14-1966) See http://gcn.com/articles/2014/06/16/forensics-technology-race.aspx?admgarea=TC_SecCybersSec

• “Agencies work to close mobile security, connectivity gaps”, GCN, 16 June 2014. Though many workers like to bring their own mobile phones to work, doing so can create a security risk if proper security measures are not in place. New technologies are being researched to create a safer environment for mobile devices and mobile networks in the workplace. (ID#:14-1967) See http://gcn.com/articles/2014/06/16/byod-connectivity.aspx?admgarea=TC_SecCybersSec\

• “DDoS Attack Puts Code Spaces Out of Business”, PC Magazine, 19 June 2014. Code hosting service Code Space was forced to shut down after a DDoS attack and unauthorized access to Code Spaces’s Amazon EC2 control panel caused the company to lose most of its data and backups. With the cost of recovery estimated to be too great, Code Spaces stated that they “will not be able to operate beyond this point”. (ID#:14-1968) See http://www.pcmag.com/article2/0,2817,2459765,00.asp

• “Ancestry.com Hit by 3-Day DDoS Attack”, PC Magazine, 19 June 2014. After being forced offline by a three-day long DDoS attack, Ancestry.com is back up and running. According to Ancestry.com’s CTO Scott Sorensen, no costumer data was stolen by the attackers. (ID#:14-1969) See http://www.pcmag.com/article2/0,2817,2459760,00.asp

• “Tools to tighten the Internet of Things”, GCN, 20 June 2014. The Internet of Things promises to be a reliable way for technology to increase the productivity, connectivity, and well-being of society, but as the IoT grows, so do concerns over its security. It will be the job of the security industry, both civilian and government, to develop software and other methods for keeping it secure. (ID#:14-1970 ) See http://gcn.com/blogs/cybereye/2014/06/internet-of-things.aspx?admgarea=TC_SecCybersSec

• “New NIST guidance planned as part of federal info policy”, FCW, 12 June 2014. In order to standardize the management of information that is deemed sensitive, but not yet classified, the National Archives and Records Administration (NARA) and the NIST are taking steps towards normalizing handling of controlled unclassified information (CUI). (ID#:14-1971) See http://fcw.com/articles/2014/06/12/nist-guidance-as-federal-policy.aspx?admgarea=TC_Policy

• “Governments Bear the Brunt as Targeted Attacks Rise”, Infosecurity Magazine, 23 june 2014. A report by Russian Internet security firm Kaspersky indicates that targeted attacks are on the rise, with 12% of organizations experiencing at least one attack in 2013, up from 9% in previous years; government and defense organizations specifically saw an even higher rate of 18 percent. (ID#:14-1973) See http://www.infosecurity-magazine.com/view/38978/governments-bear-the-brunt-as-targeted-attacks-rise/

• “Infosec Professionals Don’t Trust Endpoint Security”, Infosecurity Magazine, 21 June 2014. Trust in endpoint security and the traditional methods that it utilizes, such as antivirus, is very low among security professionals. When infected, endpoints can be used to penetrate deeper into sensitive systems. (ID#:14-1974) See http://www.infosecurity-magazine.com/view/38938/infosec-professionals-dont-trust-endpoint-security/

• “Cybersecurity Skills Shortage Carries Big National Security Risk”, Infosecurity Magazine, 20 June 2014. With the increase in occurrence and potency of cyber threats, the high demand for cybersecurity professionals has created a shortage of professionals who are able to help protect organizations from vulnerabilities. Because private sector jobs often pay more, the shortage is particularly bad in the federal government. (ID#:14-1975) See http://www.infosecurity-magazine.com/view/38967/cybersecurity-skills-shortage-carries-big-national-security-risk/

• “FBI, NYPD, and MTA Team on Cybersecurity Task Force”, Infosecurity Magazine, 20 June 2014. The FBI, NYPD, and MTA are pooling their resources and capabilities in the new Financial Cyber Crimes Task Force, a joint effort to fight cyber attacks. The collaboration is based on a model that has been used successfully in the past for fighting terrorism and bank robbery, according to FBI assistant director George Venizelos. (ID#:14-1976) See http://www.infosecurity-magazine.com/view/38968/fbi-nypd-and-mta-team-on-cybersecurity-task-force/

• “Impact of Windows XP End of Life on Critical Infrastructure”, Cyber Defense Magazine, 23 June 2014. Despite the discontinuation of updates for Windows XP, many critical infrastructure systems, such as ATM machines, still employ the legacy operating system, making them more susceptible to cyber attack. (ID#:14-1977) See http://www.cyberdefensemagazine.com/impact-of-windows-xp-end-of-life-on-critical-infrastructure/

• “Taboola hack allows SEA to redirect Reuters site visitors”, SC Magazine, 23 June 2014. After using a phishing attack to infiltrate the ad network Taboola, attackers from the Syrian Electronic Army (SEA) were able to edit a widget on Rutgers, causing it to redirect visitors to a malicious URL. (ID#:14-1978) See http://www.scmagazine.com/taboola-hack-allows-sea-to-redirect-reuters-site-visitors/article/357375/

• ers petition, retail group complaint, raise specter of who pays for breach”, SC Magazine, 20 June 2014. Amongst a dramatic increase in corporate data breaches, the question of who pays for damages caused by a data breach is up for debate. Data breaches are estimated to cost around $3.5 million on average, per incident. (ID#:14-1979) See http://www.scmagazine.com/insurers-petition-retail-group-complaint-raise-specter-of-who-pays-for-breach/article/357032/

• “Talk stresses IoT concerns as today’s problems”, SC Magazine, 19 June 2014. The number of devices on the internet, which surpassed the number of humans on the planet in 2008 and is expected to reach 50 billion by 2020, is cause for concern from a cybersecurity standpoint. To protect this network of devices, including those on the upcoming IoT, new technologies like IPv6 will have to be implemented. (ID#:14-1980) See http://www.scmagazine.com/talk-stresses-iot-concerns-as-todays-problems/article/356777/

• “House committee says ’inaccurate’ info prompted FTC’s LabMD complaint”, SC Magazine, 19 June 2014. In 2009, the FTC began scrutinizing medical testing laboratory LabMD after a breach allegedly compromised personal information on about 9,000 LabMD customers; however, the House Committee on Oversight and Government Reform is questioning the validity of the FTC’s investigation and legal offense. (ID#:14-1981) See http://www.scmagazine.com/house-committee-says-inaccurate-info-prompted-ftcs-labmd-complaint/article/356762/

• “New Havex malware variants target industrial control system, SCADA users”, Computerworld, 24 June 2014. A new piece of malware called Havex is attacking industrial control systems and SCADA users. After using an innovative distribution technique, the malware was used to gather data on ICS’s. (ID#:14-1982) See http://www.computerworld.com/s/article/9249327/New_Havex_malware_variants_target_industrial_control_system_SCADA_users

• “Encrypted Web traffic can reveal highly sensitive information”, Computerworld, 24 June 2014. Though the widely used SSL/TLS uses encryption to make data sent between computers and servers unreadable, researchers have found that, via traffic analysis attacks, they can see what web pages a person has browsed to a high degree of accuracy. (ID#:14-1983) See http://www.computerworld.com/s/article/9249321/Encrypted_Web_traffic_can_reveal_highly_sensitive_information

• “Google develops a ‘boring’ version of OpenSSL”, Computerworld, 23 June 2014. Google has been producing it’s own custom OpenSSL patches for some time now, but are now creating their own version of OpenSSl, called “BoringSSL”, to mitigate the need to deal with compatibility of custom OpenSSL patches. (ID#:14-1984) See http://www.computerworld.com/s/article/9249289/Google_develops_a_boring_version_of_OpenSSL

• “USENIX: Unstable code can lead to security vulnerabilities”, Computerworld, 19 June 2014. Even when a program is written perfectly, a compiler might remove chunks of code that it does not understand, in an attempt to optimize the program. These chunks of code could be potentially critical to security, meaning that programs that are considered secure might have hidden vulnerabilities. (ID#:14-1985) See http://www.computerworld.com/s/article/9249246/USENIX_Unstable_code_can_lead_to_security_vulnerabilities

• “Hackers reverse-engineer NSA’s leaked bugging devices”, NewScientist, 18 June 2014. By utilizing the leaked Snowden documents, hackers have been able to recreate surveillance devices created by the NSA. The devices can monitor cell phone calls, record keyboard strokes, and transmit data from a computer via radio, among other things. (ID#:14-1986) See http://www.newscientist.com/article/mg22229744.000-hackers-reverseengineer-nsas-leaked-bugging-devices.html#.U6mSjRaaJFx

• “SAIC looks to make cyber services easier to buy”, FCW, 23 June 2014. The SAIC is rolling out with a new program to streamline the process of purchasing security services for government customers, which will allow government entities on tight budgets to purchase these services without the complicated, drawn-out process that they often must endure. (ID#:14-1987) See http://fcw.com/articles/2014/06/23/saic-cyber-services.aspx

• “Google focused on big data, real-time analysis in the cloud”, Computerworld, 26 June 2014. With businesses facing an increasing number of problems with big data, Google has released a new tool, Google Cloud Dataflow, to help businesses manage, develop, and process data. (ID#:14-1988) See http://www.computerworld.com/s/article/9249406/Google_focused_on_big_data_real_time_analysis_in_the_cloud

• “Police turning to mobile malware for monitoring”, Computerworld, 25 June 2014. Italian company Hacking Team is one of a few groups that makes malware for governments and law enforcement to intercept data and track internet users. The falling cost of these tools means that they can become more widespread, and may be used by the governments of developing nations to violate their citizens’ rights. (ID#:14-1989) See http://www.computerworld.com/s/article/9249352/Police_turning_to_mobile_malware_for_monitoring

• “Montana data breach exposes 1.3 million personal records”, Computerworld, 25 June 2014. Following the breach of a server at Montana’s public health department in May that compromised as many as 1.3 million records, including health care and bank account information, Montana has upgraded its insurance policy and added more security software. (ID#:14-1990) See http://www.computerworld.com/s/article/9249353/Montana_data_breach_exposes_1.3_million_personal_records

• “Can telework improve cybersecurity?”, GCN, 27 June 2014. At a time when cybersecurity professionals are needed most by the government, studies find that there is a potentially dangerous shortage. With cybersecurity experts generally making more money in the private sector, the government will have to make the jobs it offers appealing, and offering teleworking could be a crucial part of that effort. (ID#:14-1991) See http://gcn.com/blogs/cybereye/2014/06/telework.aspx?admgarea=TC_SecCybersSec

• “Science DMZ: faster, more secure high-performance computing”, GCN, 24 June 2014. A growing number of government and scientific agencies are turning to DMZ networks to be able to safely and reliably transmit large amounts of data, and “create an environment to facilitate such compute-intensive work”. (ID#:14-1992) See http://gcn.com/Articles/2014/06/24/Science-DMZ.aspx?admgarea=TC_SecCybersSec&Page=1

• “NSA’s Rogers: JIE crucial to cyber defense”, FCW, 24 June 2014. NSA director Michael Rogers expresses his eagerness for the DoD’s move towards a Joint Information Environment (JIE), which is set to replace the current network structure. According to Rogers, the old “service-centric approach to networks” has been costly to the DoD. (ID#:14-1993) See http://fcw.com/articles/2014/06/24/nsa-rogers-speech.aspx

• “Four to six teams expected to bid on Defense health record effort”, FCW, 25 June 2014. Several teams are expected to compete for a DoD contract to provide a “commercial, off-the-shelf electronic records product” for the military. The project, which will cost around $11 billion, will improve integrate military health services. (ID#:14-1994) See http://fcw.com/articles/2014/06/25/defense-health-record-effort.aspx

• “DHS plans for cybersecurity in interconnected world”, FCW, 27 June 2014. The Department of Homeland Security, which has just released its new Quadrennial Homeland Security Review (QHSR), is expressing increasing concern over the security of interconnected devices. This growing vulnerability of these devices is part of the dramatic change in cybersecurity threats that has occurred since the DHS last published a QHSR. (ID#: 14-1994b) See http://fcw.com/articles/2014/06/27/dhs-qhsr.aspx

• “Next Generation Internet Will Arrive Without Fanfare, Says UMass Amherst Network Architect”, University of Massachusetts Amherst, 24 June 2014. According to a UMass researcher, the next-generation internet — one with “far better security, greater mobility and many other improved features” — is not far away, but the transition will be gradual, seamless, and not noticeable to most internet users. (ID#:14-1995) See http://www.umass.edu/newsoffice/article/next-generation-internet-will-arrive

• “Cracks emerge in the cloud”, A*STAR Research, 18 June 2014. A Singapore-based research team has found numerous vulnerabilities in cloud service providers Dropbox, Google Drive, and Microsoft SkyDrive. Insecure URL storage, URL shortening, and other practices can leave a user’s private data vulnerable. (ID#:14-1996) See http://www.research.a-star.edu.sg/research/6983

• “Are Social Media Networks The Next Cyberattack Victims?”, PC Magazine, 27 June 2014. Through the use of botnets and various phishing and malware tactics, cyber criminals have been able to use social media for nefarious purposes. According to social risk management company ZeroFox, the potential of compromised social networks pose a very real and serious threat. (ID#:14-1997) See http://securitywatch.pcmag.com/security/325048-are-social-media-networks-the-next-cyberattack-victims

• “Rogue Ad Network Double-dips on Revenue by Serving Malware”, Infosecurity Magazine, 30 June 2014. An ad network has used its own Adobe-Flash based advertisements as a vehicle for downloading malware onto victims’ computers. Researchers suspect that the ad network is controlled by Russian cybercriminals. (ID#:14-1998) See http://www.infosecurity-magazine.com/view/39073/rogue-ad-network-doubledips-on-revenue-by-serving-malware/

• “Long distance Glasshole Snoopers Can Spot User PINs”, Infosecurity Magazine, 27 June 2014. Researchers at the University of Massachusetts, Lowell have created software that uses mobile camera devices — such as the new Google Glass — to detect pass codes as they are being typed. Though watching people type is nothing new, this kind of software could allow criminals to far exceed the capabilities of the human eye. (ID#:14-1999) See http://www.infosecurity-magazine.com/view/39052/long-distance-glasshole-snoopers-can-spot-user-pins/

• “Rootkit Levels Are Down, But That Won’t Last Long”, Infosecurity Magazine, 26 June 2014. With the rise of 64-bit microprocessors and the security improvements that they bring, rootkit development has become more difficult and time consuming. Despite the decline in the use of rootkits, hackers are slowly developing new ways to get around 64-bit defenses. (ID#:14-2000) See http://www.infosecurity-magazine.com/view/39045/rootkit-levels-are-down-but-that-wont-last-for-long/

• “Half of All Network Devices Are Outdated — And Vulnerable”, Infosecurity Magazine, 26 June 2014. As computers and hardware age, the software it runs can grow old and suffer from reduced support. The alarming increase in vulnerable, outdated devices and software could have serious ramifications for businesses and individuals. (ID#:14-2001) See http://www.infosecurity-magazine.com/view/39039/half-of-all-network-devices-are-outdated-and-vulnerable/

• “US Oil & Gas Industry Establishes Information Sharing Center”, Infosecurity Magazine, 26 June 2014. The vital nature of critical infrastructure, especially energy, makes the energy industry a prime target for cyber attack. To combat this, the energy companies are launching the the Oil and Natural Gas Information Sharing and Analysis Center (ONG-ISAC), which will help reduce the impact of cyber attacks. (ID#:14-2002) See http://www.infosecurity-magazine.com/view/39024/us-oil-gas-industry-establishes-information-sharing-center/

• “Insider Threats Top Infosecurity Europe Attendees’ Cyber fears”, Infosecurity Magazine, 26 June 2014. Concern over insider threats and APTs has risen dramatically, according to an survey of attendees of the Infosecurity Europe event, which was held in London. Many cybersecurity professionals would like for more to be done to combat insider threats. (ID#:14-2003) See http://www.infosecurity-magazine.com/view/39035/insider-threats-top-infosecurity-europe-attendees-cyber-fears/

• “Cisco Open-sources Experimental Cipher”, 24 June 2014. Though traditional block ciphers work very well on large blocks of data (128, 192, 256-bit), use of these encryption tools on smaller objects can lead to an enormous inflation of the size of the data. Cisco is working on a new encryption scheme to more efficiently manage these smaller objects. (ID#:14-2004) See http://www.infosecurity-magazine.com/view/38983/cisco-opensources-experimental-cipher/

• “EMOTET the banking malware which uses network sniffing”, Cyber Defense Magazine, 30 June 2014. Malware that targets the banking industry is on the rise, and becoming more complex. EMOTET, which was spread using email spam, uses a unique “network sniffing” technique to steal sensitive information. (ID#:14-2005) See http://www.cyberdefensemagazine.com/emotet-the-banking-malware-which-uses-network-sniffing/

• “Most health care vendors earn ‘D’ in data protection, study finds”, SC Magazine, 27 June 2014. According to a report by Corl Technologies, 58 percent of health care vendors scored a “D” in data protection. Healthcare vendors have been slow to implement security measures required by the HITECH Act and the HIPAA Omnibus Rule, which were created to improve healthcare security. (ID#:14-2006) See http://www.scmagazine.com/most-health-care-vendors-earn-d-in-data-protection-study-finds/article/358280/

• “Pony Loader 2.0 now steals cryptocurrency wallets, still spreads other malware”, SC Magazine, 27 June 2014. The Pony Loader Trojan has been used for years to steal information and deliver other trojans, but a new version, dubbed Pony Loader 2.0, has the added ability to steal a variety of cryptocurrencies from digital wallets. (ID#:14-2007) See http://www.scmagazine.com/pony-loader-20-now-steals-cryptocurrency-wallets-still-spreads-other-malware/article/358270/

• “RCE vulnerability in TimThumb’s WebShot feature puts WordPress users at risk”, SC Magazine, 26 June 2014. A vulnerability in a simple PHP script called “TimThumb” has put users of the blogging site WordPress at risk. The flaw could enable a hacker to execute commands on websites that use TimThumb. (ID#:14-2008) See http://www.scmagazine.com/rce-vulnerability-in-timthumbs-webshot-feature-puts-wordpress-users-at-risk/article/358095/

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to SoS.Project (at) SecureDataBank.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.