The past week was a busy one in IT security, with the annual RSA Conference sharing time in the headlines with a controversial cyber-security bill and other news.
The RSA Conference, held in San Francisco from Feb. 14-18, drew a large crowd of vendors, security researchers and IT professionals. Among the key themes this year were cloud security, advanced persistent threats and cyber-security. Meanwhile, ISC2 used the conference to highlight some of the new demands facing the IT security workforce.
More can be read about the conference here in our RSA roundup.
But the biggest news sharing space with the conference during the week was the reintroduction of a controversial cyber-security bill that included language its sponsors hope will kill the “Internet Kill Switch debate.”
“The so-called ‘Internet kill switch’ debate has eclipsed discussion of actual, substantive provisions in this bill that would significantly improve the security of all Americans by creating a new national center to prevent and respond to cyber-attacks, requiring critical infrastructure owners-for the first time-to shore up cyber-vulnerabilities, and establishing a strategy to secure the federal IT supply chain,” said Sen. Joe Lieberman, I-Conn., in a statement. “I look forward to working with Senator Reid to bring comprehensive cyber-security legislation to the floor early this year.”
The bill states: “Notwithstanding any provision of this Act, an amendment made by this Act, or section 706 of the Communications Act of 1934 (47 U.S.C. 606), neither the President, the Director of the National Center for Cybersecurity and Communications, or any officer or employee of the United States Government shall have the authority to shut down the Internet.”
The debate about the concept of an Internet Kill Switch has been brought into focus by the recent events in Egypt, in which the Egyptian government blocked access to the Internet as civil unrest was spreading. A link to the bill can be found here.
In a speech at George Washington University Feb. 15, U.S. Secretary of State Hillary Clinton outlined a new policy meant to guarantee that dissidents and human rights activists have access to the Internet while justifying recent United States actions on online security and privacy. Naming several countries known to censor the Internet, Clinton said a restricted Internet has economic repercussions on businesses, which may think twice about operating in those areas, as well as effects on what people feel comfortable saying or doing online.
“The freedoms to assemble and associate also apply in cyberspace,” she said.
Meanwhile, Microsoft responded to reports of a Windows zero-day bug after proof-of-concept exploit code was posted on the Web. On Feb. 14-Valentine’s Day-an anonymous researcher going by the name “Cupidon-3005” released proof-of-concept code for a Server Message Block (SMB) vulnerability affecting the CIFS (Common Internet File System) browser service. More specifically, the vulnerability resides in an error-reporting function of the CIFS browser service module, explained Matt Oh of the Microsoft Malware Protection Center Vulnerability Response Team.
“Based on our initial investigation, this vulnerability cannot be leveraged for remote code execution [RCE] on 32-bit platforms,” said Jerry Bryant, group manager of response communications for Microsoft’s Trustworthy Computing Group. “We are still investigating the possibility of code execution on 64-bit platforms, but so far have not found a likely scenario that would result in reliable code execution.”