Go To THE PUB.

This would be the third or fourth time I've posted this idea, but it bears repeating. Rob Braxman has some good stuff on YouTube about personal security practices online but these simple suggestions from me are abbreviated via the useful acronym PUB:

PASSWORDS. UPDATES. BACKUPS.

For best results in one's electromechanistic life...

1. Change PASSWORDS often. Whether or not password aging is set by you or your organization, don't go around rules and keep the same one for five or ten years. And use passphrases when allowed. And don't store the password on an INSECURE DEVICE.

2. Do UPDATES when needed. Whether or not auto-update settings should be used depends upon whether or not app breakage by an OS change is likely, but in personal use it's less of a risk.

3. Make BACKUPS regularly. If you're the only one with a copy of those photos or procedures, then maybe you should have two, with the other stored offline or otherwise in a safer (non-production, say) location. And test them often, since you're relying upon them in problem situations.

I repeatedly post this approach in order to more effectively associate myself with it. Laying claim in this way, properly, will make me a famous security advocate. Thanks for your assistance in furthering my hopefully positive reputation.

Linux On The Desktop

It didn't happen as fast as we'd liked, but when I was most active in a Linux users' group, we were pushing for either refurb'd desktops increasing Linux use, or for more makers/builders shipping with Linux preinstalled. According to StatCounter (as reported by Web Pro News) the desktop use in the US for any version of Linux has now passed 5%.

(Blogger isn't linking to the article; just go to http://www.webpronews.com and search on "Linux passes 5%".)

This is probably due to home reloads by those capable, but for preinstalls, the list of companies with offerings is pretty long. System76 and Emporer Linux are old stanbys, but RedHat as always can be ordered from Dell. There's also LinuxNow, LinuxCertified.com, Entroware, LAC Portland, Vikings, Purism, ThinkPenguin, ZaReason, Libiquity and Minifree.

Other than the often-cited reasons for this, I think two need to be specially noted. First, the Linux installers of today are much better than those of ten to twenty years ago, being more aware of more hardware platforms. Also, I'm not a gaming expert but I understand that not only is Wine vastly improved but Linux is getting something closer to red carpet treatment by the game designers and hardware engineering folk. Better late than never!!

Bookmark This Post!

I just heard on the car radio a news/commentary mention of a great new development (sarcasm). Some outfit has, after years of diligent testing, completed the design and successful adjustment runs of a driverless tractor trailer rig fleet. Planned to provide over-the-road delivery between Dallas and Houston soon, I seem to recall that it's got a dozen or two huge semi's that have driven themselves (with human observers) along the mapped-out areas enough times to prove the concept.

The radio commentator claimed that there were two sorts of people responding to this: those who were very much in favor and those that were concerned about possible hazards to other vehicles along the way.

Naturally, the commentator forgot a third (probably small) group. There just might be a few persons wondering if anybody put a great deal of effort into securing the devices, applications and networks used by this enterprise.

SECURING THE DEVICES etc. etc...

Anyone feel like a little wager as to how many of the trucks are already hosting a few spam servers? But don't worry. Nothing else could possibly go wrong.

Emerging Trends In Computer Security

There are many articles offering surveys of the cybersecurity landscape. One of the better ones I've seen in recent weeks would be this one. TechJournal.org proposes ten areas to watch. This article surfaced in January of this year and I can't see it as having been disproven yet. Here's a simplified, skeletal restatement of TechJournal's longer investigations of these subjects:

1. Cyber Deception Technologies
You've heard of honeypots and honeynets? Decoy construction is improving as machine learning and AI are being introduced here.

2. Homomorphic Encryption for Secure Data Processing
Suppose data that's encrypted could also be processed in that state, without decryption? It's becoming practical - hopefully without occurring within insecure applications...

3. Behavioral Biometrics In Authentication
Suppose an authentication system could take into account your finger swipe tendencies, or your keyboarding speed? They could be grouped with a passphrase for greater security - assuming the form of storage of those biometrics was also secure.

4. Secure AI Development Frameworks
Since writing AI applications is best done securely, why not use AI-enabled code review programs?

5. Advances In Threat Intelligence Sharing
Using blockchain to create communications channels between defense agents could increase the integrity of intelligence by many multiples.

6. Cybersecurity For Space Systems
From missile targeting and battlefield situational awareness to weather forecasting and logistics tracking, satellite groups are being deployed in increasing numbers. The operation of these units requires continuing improvements in burst approaches, compression/expansion and cryptology.

7. Securing The Internet Of Things
How likely is it that a $20 webcam will be provided with timely updates, updates at all or even an updater at all?

8. Quantum-Resistant Cryptography
Algorithmic resistance to the evident power of quantum computing is becoming a reality, and not a moment too soon.

9. Enhanced Email Encryption Solutions
Certificate strategies and key generation methods need to be constantly improved in order to preserve the practicality of this oldest of computer communication forms.

10. Zero Trust Architecture
Begin device connection with the assumption of compromise.

Drones: Updates & Speculations

The now-not-so-current flurry of drone stories re: activity off Atlantic City or somewhere is still quite pertinent, in that many of us are aware that many questions remain unanswered.

My brash guess is that what really happened (other than an actual peak in drone presences) was a lack of preparation at the public relations departments of the FAA, the White House staff, the Coast Guard and local police agencies. I think it's actually pretty difficult to keep track of hundreds of cheap helicopter toys across the state of NJ between Philadelphia and the coast even in the least stressful of times. And our capabilities to do so are matters we might best keep a lid upon.

But what's a public relations officer to do?

If I were that officer (and I used to have a vaguely similar job somewhere), I'd simply point out that if a foreign navy were capable of sending a cruiser over this way with a Remotely Operated Vehicle hanger near the poop deck, and that the Captain of said vessel sent out the odd $50,000 drone... then might WE BE CAPABLE OF THE SAME THING?? And capable of watching said operations from an either HF wireless or even tethered observation device from an Ohio-class low rider a few hundred feet down or so?

Perhaps.

A New Type Of Spam?

So an insurance salesperson (via a cold call over the phone) conned me into connecting in a Zoom call in which I revealed personal connections and email addresses.

Now, I'm actually NOT a complete idiot. The salesperson (and her higher-pressure sales manager) not only were pretty good at the act (a sort of HR upper managerial style of behavior) but they had an interesting bit of inside information: they worked for an insurance company that was the provider of a free benefit from my current employer, so they were able to pretend to be legit, and to have a need to update information on beneficiaries and so forth. They were just trying to upsell, not to steal. Clever, huh?

I still consider the call a kind of breach, although not the sort we're most fearful of. And the salesgirl was actually what she claimed to be (local), which I determined by her geographical references, slang, dress and accent. The AI that can fake all that stuff has to be two or three years away. Okay, maybe one.

It was my first "insider threat" experience in years. It was fascinating. More of an invasion of privacy than a perimeter breach, but a reminder that, shall we say, rust never sleeps.

Preliminary Post on Drones

There's a bit of a to-do these days about large groups of unidentified drones being reported in New Jersey. Theories abound, from US government tests to foreign powers sending them in from offshore to swarms of domestic drones, some trying to follow others. An interesting aside (underreported) is the group of legal ramifications now being identified. Drone presence is outside a property owner's purview, occuring in FAA-controlled space. Also, it's a crime to damage or destroy any flying vehicle, even a $25 drone. So there seems to be little way to defend against a recalcitrant drone, perhaps even one bearing a grenade. The two thoughts that occur to me regarding defense (other than jamming) would be either to lase various sensors on the drone's frame, or to snare the vehicle with a net or grapple from another drone. Of course, all of the above might be considered illegal interference by the FAA.

As might be the case if one were to hack the control telemetry of the drone, taking over the device and landing it without destruction.

I'm no lawyer, but it looks like there's room for precedent here. Perhaps someone should jam a drone's control communications, hack and land the device and then wait for the owner to file suit. I doubt, after all, that these devices are designed to follow Asimov's Laws Of Robotics, which are as follows (see the story "Runaround" (1942) and later publications like the book "I, Robot"):

(1) A robot may not injure a human being or, through inaction, allow a human being to come to harm
(2) A robot must obey the orders given it by human beings except where such orders would conflict with the First Law
(3) A robot must protect its own existence as long as such protection does not conflict with the First or Second Law
(4 or zeroth) A robot may not harm humanity, or, by inaction, allow humanity to come to harm.

We live in interesting times.