Category Archives: Cyberdefense and Information Assurance

cloud computing, Cyberdefense and Information Assurance, tech

Amazon’s EC2 outage may be related to cyber-attack

At the moment, I’m waiting for some sort of confirmation. But this is what I know:

Since Monday, Change.org — a site that hosts petitions and other social action efforts for others–has been the subject of a DDOS attack from China, according to Ben Rattray,  Change.org‘s founder.  They’ve been working with their hosting company and with cyber experts to help screen out the attack as much as possible, but the site was down much of yesterday.  And it’s down today, intermittently.

Interesting fact: Change.org is hosted on Amazon Web Services.

Interesting fact: AWS’ Elastic Compute Cloud data center in Northern Virginia is experiencing an outage of various services, affecting Quora, HootSuite, and other social media companies hosted on it.  That would be the same site that Change.org is hosted at primarily, since the NoVA data center is the US East region cloud.

The Chinese have been varying their attack.  Is it possible they’ve exploited Amazon’s EC2 APIs to attack now?

I haven’t heard back from Amazon.

Standard
Cyberdefense and Information Assurance

Worst Practices: Learning the Wrong Lessons from WikiLeaks « Unisys Security Blog

This post can be read in its entirety over at the  Unisys Security Blog, where it was contributed as a guest blog.

 

The dark cloud of the WikiLeaks debacle should have a bright silver lining. The exposure of classified Department of Defense and State Department data by WikiLeaks gives us a teachable moment on information security — not just for government agencies, but for any organization that stores, handles, and processes sensitive information.

The vast amount of classified data — over 75,000 Defense Department incident reports and more than 115,000 classified diplomatic cables — and the damage caused by their exposure reveals common flaws in how organizations typically handle sensitive information. But as with past data breaches, many organizations will learn the wrong lessons. And the actions they take as a result will make their organizations less productive and, perhaps, even less secure.

Read the rest here.

 

Standard