CyberSecurity Pulse 2016-12-29

CyberSecurity Pulse 2016-12-29

“To see what can be improved, what has been done well and badly, you need a necessary attitude, cold and open mind to analyze things and seek solutions.”
Rafael Nadal

The Trend of the Year

Information Sharing, a Point of Conflict Between Technology Companies and Security Forces

The San Bernardino massacre sparked a legal and media war between a large number of technology companies and FBI after Apple strongly opposed to exchange information of an iPhone owned by an alleged terrorist. However, Apple has not been the only one that has had problems with justice this year. Facebook Vice President, was arrested in Brazil for refusing to share WhatsApp Data with the authorities in a drug trafficking investigation.

cibersecurity_1In this sense, technology companies have tried to take steps to adapt to the needs of new times in terms of privacy. The implementation of end-to-end encryption in Whatsapp or the periodic notification, as Google is doing, of the number of requests about its users performed by Law Enforcement Agencies have been some measures towards transparency. However, in some countries such as Russia, this situation has also led to preassures from the government in favor of the implementation of backdoors by law or, in others such as China, to force "collaboration" on issues considered as national security.

Although sometimes we feel that these incidents are not affecting us directly, there are also cases in Europe. After the Paris bombing, the Ministry of Interior was considering the inclusion of two new actions that were related to cybersecurity like the measures to be taken in future declarations of the state of emergency. Concretely, the ban on the usage of the Tor Network in all the French territory and on the use of public or shared Wi-Fi networks. On his side, the United Kingdom encouraged certain legislative changes calling for ISP to extend the registration of its users to a period of 12 months. Are we really reaching that point in which we prefer to hand that part of our freedom in exchange for a greater perception of security?

Top Trends

Why People Are Interested In Cybersecurity?

cibersecurity_2 Brian Krebs, one of the most important figures linked to security and the editor of the blog KrebsOnSecurity, was silenced this year by a denial-of-service attack after publishing information from the hack of a DDoS-for-hire service known as vDOS whose leaders could have earned about $600,000. However, Twitter, Spotify and Netflix stopped working last november because the company Dyn reported that it was being targeted by a massive DDoS attack to its DNS infrastructure. The theory managed by Dyn with the help of Flashpoint and Akamai, is that such an attack could be originated in IoT devices infected by Mirai, an IoT botnet whose source code has been released in Autumn. In the same way, the day before the US Thanksgiving holiday and for exactly 8.5 hours, a non-stop stream of junk traffic at targets mostly on the US West Coast was identified. Will These incidents accomplish to motivate manufacturers to start working in security by design and security by default like something necessary to deploy?

Could You Ensure That Your Information Is Secured?

cibersecurity_3 October 2013 marked an inflection point in terms of information leaks. According to the report released by ElevenPaths, many sectors have also been targeted in 2016, like health care companies, as well as many other organizations in the entertainment, social networks and government sectors. Since companies like Yahoo, Linkedin, Dropbox or Myspace have already affected by incidents, Facebook’s current CSO, Alex Stamos, stated that his company is buying passwords and credentials in several underground marketplaces with the aim to cross-reference them with encrypted passwords. Sincerely, such a statement is really worrying considering the amount of personal information collected as it would imply being storing credentials and information even linked to users who might not be their customers. Apart from this, Facebook would be contributing to finance the malicious activities of several cybercriminal groups which would be gaining profit by buying and selling data breaches. If we feel that the real problem is password reuse, should we start considering once and for all the implementation of more modern authentication systems to prevent the use of passwords at all?

Other Trends

Infection With Ransomware Is Tripled in 12 Months

The number of ransomware infections suffered by companies continues to increase. The frecuency of infection, with the aim of preventing affected users from accessing their own information has raised to one per 40 seconds. The emergence of so many types of families has led to the occasional identification of not professionally designed but increasingly ingenious samples such as the ransomware Popcorn Time or even others affecting high level targets (hospitals, energy or ransport infrastructures). We must take into account that the fact of paying for the ransom is not a guarantee. There is no way to know in advance whether cybercriminals will do their part of the deal, nor whether the infected computer will show any suspicious activity in the future. If you have been affected, keep reporting it to the corresponding Law Enforcement Agency.

Rivalry Between United Stated and Russia on The Internet. Other Cold War?

After months of allegations about whether Russia had interfered in the U.S. presidential election, the only thing that is known for sure is that the mass media play an important role in shaping the political ideology of the public opinion about the origin of a cyberattack. An example of this was the leakage of information from the World Anti-Doping Agency where it was reported that cyberattack came from Russia, even knowing that some evidence was contradictory. The complexity of the internet makes many prefer to stay in the comfort zone when we have to position ourselves about who our real enemies are. The confrontation in this matter is creating a real need to cross jurisdictional lines that would have remained insurmountable years ago while some countries like the United States are already beginning to anticipate the hacking of computers and systems all over the world as just another part of the criminal investigation process.

Capacity Planning… in the Cibersegurity Sector?

In order to minimize the risks of the misuse of the Internet, United States and United Kingdom have performed changes in their respective legislations to allow the acceleration of the recruitment of specialized staff in cybersecurity. In this sense, changing these procedures to incorporate civilian personnel into military and law enforcement agencies will be a decisive factor to avoid the talent drain of our professionals towards other latitudes. Will Spain adapt their selection processes in public administration to the capacities that they need to adquire justified by the context that we live?

Trends in 2017

Will Security Be Improved Within The World of Cryptocurrencies?

To What Extent Terrorist Groups Will Adopt The Cybercrime Capacity?


Will We Be Able To Rely on Preinstalled Apps on Our Smartphones?