The latest text in the long-running saga of the draft ePrivacy Regulation contains further reassuring indicators for incident response teams that want to share data to help others. Article 6(1)(b) allows network providers to process electronic communications data (a term that includes both metadata and content) where this is necessary “necessary to maintain or restore […]
Category: Articles
Thoughts on regulatory and ethical issues relating to the use of technology in education and research
Categories
Should we just log everything?
In a world where data storage is almost unlimited and algorithms promise to interrogate data to answer any question, it’s tempting for security teams to simply follow a “log everything, for ever” approach. At this week’s CSIRT Task Force in Malaga, Xavier Mertens suggested that traditional approaches are still preferable. With the speed of modern […]
Categories
Data, Flows and Benefits
[A second post arising out of excellent discussions at the DALTAí project seminar in Dublin this week] We’re all familiar, perhaps too familiar, with how data flows typically work online. We give commercial companies access to data about ourselves; they extract some benefit from it, for example by selling profiled advertising space; they share some […]
The European Data Protection Supervisor has just published an interesting paper on the research provisions in the GDPR. The whole thing is worth reading, but some things particularly caught my eye: Stresses (again) that research-consent is not the same as GDPR-consent, though the former may still be an “appropriate safeguard” when using a legal basis […]
Four years ago, Jisc responded to the Board of European Regulators of Electronic Communications (BEREC) consultation on network neutrality to point out that some security measures cannot just be temporary responses by the victims of attacks, but need to be permanently configured in all networks to prevent them being used for distributed denial of service […]
Monica Whitty’s keynote at the FIRST Conference (recording available on YouTube) used interviews at organisations that had been victims of insider attacks to try to understand these attackers – and possible defences – from a psychological perspective. It turns out that thinking about stereotypical “insider threats” probably doesn’t help. Notably, disgruntled employees were responsible for […]
Categories
The Big Bad Smart Fridge
Leonie Tanczer’s FIRST 2019 keynote (recording now available on YouTube) looked at more than a decade of European discussions of whether/how to regulate the Internet of Things (no, I didn’t realise, either) and how we might do better in future. This is particularly relevant to an incident response conference as – as Mirai and other […]
Merike Kaeo’s keynote “Waking Up the Guards” at the FIRST 2019 conference (recording now available on YouTube) highlighted how attacks on the internet core no longer target a single service (naming, routing, signing) but move between these to achieve their hostile result. Defenders, too, need to consider the consequences of their implementation choices as a […]
Categories
Things that Go Bump in the Night
Apparently Miranda Mowbray had been wanting to do a talk on “Things that Go Bump in the Night” for some time, and it made an excellent closing keynote for the 2019 FIRST conference in Edinburgh (recording now available on YouTube). Although “things” may increasingly need an Internet connection to operate, there are significant differences between […]
Categories
Incident Response for Connected Hardware
An interesting talk from Rockwell at this year’s FIRST conference looked at how to organise incident response in environments containing network-connected hardware devices. Though Rockwell’s focus is on industrial machinery, the same ideas should apply to smart buildings and other places where a security incident can cause physical, not just digital, harm. This is not […]