IBM Sells Cybersecurity Group
May 20 2024IBM is selling its QRadar product suite to Palo Alto Networks, for an undisclosed—but probably surprisingly small—sum.
I have a personal connection to this. In 2016, IBM bought...
Read moreMicrosoft and Security Incentives
April 23 2024Former senior White House cyber policy director A. J. Grotto talks about the economic incentives for companies to improve their security—in particular, Microsoft:
Grotto told us Microsoft had to...
Read more
Backdoor in XZ Utils That Almost Happened
April 11 2024Last week, the Internet dodged a major nation-state attack that would have had catastrophic cybersecurity repercussions worldwide. It’s a catastrophe that didn’t happen, so it won’t get much attention—but...
Read moreIn Memoriam: Ross Anderson, 1956–2024
April 10 2024Last week, I posted a short memorial of Ross Anderson. The Communications of the ACM asked me to expand it. Here’s the longer version. EDITED TO ADD (4/11): Two weeks...
Read moreXZ Utils Backdoor
April 3 2024The cybersecurity world got really lucky last week. An intentionally placed backdoor in XZ Utils, an open-source compression utility, was pretty much accidentally discovered by a Microsoft engineer—weeks...
Read moreRoss Anderson
April 1 2024Ross Anderson unexpectedly passed away Thursday night in, I believe, his home in Cambridge.
I can’t remember when I first met Ross. Of course it was before 2008,...
Read moreIt’s pretty devastating:
Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is...
Read more
On Secure Voting Systems
March 26 2024Andrew Appel shepherded a public comment—signed by twenty election cybersecurity experts, including myself—on best practices for ballot marking devices and vote tabulation. It was written for the Pennsylvania...
Read moreImproving C++
March 15 2024C++ guru Herb Sutter writes about how we can improve the programming language for better security.
The immediate problem “is” that it’s Too Easy By Default™ to write security...
Read more
NIST Cybersecurity Framework 2.0
March 1 2024NIST has released version 2.0 of the Cybersecurity Framework:
The CSF 2.0, which supports implementation of the National Cybersecurity Strategy, has an expanded scope that goes beyond protecting...
Read more
Recent Comments