Active Defense Bill - Cybersecurity

There is a discussion draft of a house bill called the ‘‘Active Cyber Defense Certainty Act’’. This would relieve a victim of "persistent unauthorized intrusion of the individual entity’s computer" from the risk of prosecution for using active defense measures against the intruder. This is an interesting new ground it seems. I think efforts like this, "hacking back" were often considered cowboy moves, discussed on in sotto voce, since it was not an "authorized" strategy.

This article on the proposal discusses the potential hazards of the law and using hacking back as a tool for cyber defense. While it is good to see attention being paid to cybersecurity in law, there needs to be an intelligent debate and a resulting well-crafted law which helps to define sensible boundaries. Think of areas where "hacking back" could simply be used as a defense for what was actually an offensive maneuver for instance.

If you have experience and knowledge applicable, consider putting your words to paper and contacting your representative with your thoughts.

Comments

Let's Not Mess Around with Security on our Personal Systems Either!

Essential Security Practices for Your Personal Systems Ensuring a minimal level of cybersecurity, privacy, and availability on your personal systems means you need to manage the following essential practices. This is a brief overview of recommendations from sources like CISA, NSA, etc., focused on personal laptop, phone, and other systems' security. Anti-virus I've found you'll get the best anti-virus protection and usability from a paid product - I've always had good luck with Norton labeled products. If you are looking for current vendor offerings see: https://www.pcmag.com/picks/the-best-antivirus-protection Regardless of whether you choose to use a commercial product or open-source anti-virus tool, it is absolutely something you need to use. This is the minimally needed level of system security. Once installed, ideally, it should be invisible until there's a security problem it can't prevent or solve. Backups You need to have at least a minimal level of ...

Unit Testing - What to Test

This I wrote to answer a question that came up when we were discussing our software process and I was training developers on how to unit test. It seems a simple enough question, but I kept pondering it and delving deeper until I realized I needed to write this monograph. What unit tests should we write? How do we know what to test? Ideally, unit tests should cover every path through the code. It should be your chance to see every path through your code works as expected and as needed. If you are practicing Test Driven Development then it's implied everything gets a test. In the real world, you might not be allowed to test everything - for instance, if the testing suite ends up taking a week to run, then the world will have changed by the time it finishes and the test results will be obsolete. Unit testing at it's basic is testing an object, a method - the smallest unit of your code that it can test independently. It should test the inputs "goes into" an...

RACI, Cybersecurity and NICE Framework

The NICE framework from a RACI point of view The NICE framework ( NIST SP 800-181 rev. 1) established a standard approach for describing cybersecurity work, in order to help stakeholders share a common language and ideally improve how to identify, recruit, develop and retain talent. It breaks down cybersecurity work role categories into: Oversight and Governance; Design and Development; Implementation and Operation; Protection and Defense; Investigation. Which is very cybersecurity-centric and not related to common tools for project management within companies. Especially smaller enterprises that do not have dedicated people to mange and coordinate cybersecurity needs. A RACI chart is a project management tool used to define and clarify roles and responsibilities within a project team. It stands for Responsible, Accountable, Consulted, and Informed, and visually represents who is responsible for what, who is accountable for the outcome, who needs to be c...

Earnest Engineer

Search This Blog