[Newsclips] IETF SYN-ACK Newspack 2023-04-24

David Goldstein <david@goldsteinreport.com> Mon, 24 April 2023 08:53 UTC

Return-Path: <david@goldsteinreport.com>
X-Original-To: newsclips@ietfa.amsl.com
Delivered-To: newsclips@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89149C151B11 for <newsclips@ietfa.amsl.com>; Mon, 24 Apr 2023 01:53:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.084
X-Spam-Level:
X-Spam-Status: No, score=-2.084 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=goldsteinreport.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IdbD-n_4sBE2 for <newsclips@ietfa.amsl.com>; Mon, 24 Apr 2023 01:53:24 -0700 (PDT)
Received: from mars.atomiclayer.com (mars.atomiclayer.com [66.85.142.50]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21EC7C151B12 for <newsclips@ietf.org>; Mon, 24 Apr 2023 01:53:23 -0700 (PDT)
Received: from DavidSurface4Laptop2022 (unknown [101.184.55.74]) by mars.atomiclayer.com (Postfix) with ESMTPSA id 249C7E3569 for <newsclips@ietf.org>; Mon, 24 Apr 2023 04:53:20 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=goldsteinreport.com; s=default; t=1682326402; bh=Mxr4owvX1QptTO2VdcI/tM9NvMtX+hfTvc2nMMCzm4U=; h=From:To:Subject; b=xZGQf24YZZRdUhKaa+G+JU5meo+rK+uB1HjpfCJEbODAauLUk1tNzX7+i0X0JAxm5 kFH9eWKFxd5RjJeihhDWhw7F698LTz76y1VwlqJVSDUC//plEnIPm/qHoz2GCOQt7N nAE1MkUVtx44VzlnzViEWILfmj9mMLWkVFwmh5b4=
Authentication-Results: mars.atomiclayer.com; spf=pass (sender IP is 101.184.55.74) smtp.mailfrom=david@goldsteinreport.com smtp.helo=DavidSurface4Laptop2022
Received-SPF: pass (mars.atomiclayer.com: connection is authenticated)
From: David Goldstein <david@goldsteinreport.com>
To: newsclips@ietf.org
Date: Mon, 24 Apr 2023 18:53:17 +1000
Organization: Goldstein Report
Message-ID: <01f601d9768a$384dfda0$a8e9f8e0$@goldsteinreport.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_01F7_01D976DE.09FB6D30"
X-Mailer: Microsoft Outlook 16.0
Thread-Index: Adl2ijEj71tvmaM1QmyJbamZfcf0rA==
Content-Language: en-au
X-PPP-Message-ID: <168232640249.945511.6717567746240859605@mars.atomiclayer.com>
X-PPP-Vhost: goldsteinreport.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/newsclips/9JA8hTd7lwj7fLxRoVM0fSDcK6Y>
Subject: [Newsclips] IETF SYN-ACK Newspack 2023-04-24
X-BeenThere: newsclips@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: IETF News Clips <newsclips.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/newsclips>, <mailto:newsclips-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/newsclips/>
List-Post: <mailto:newsclips@ietf.org>
List-Help: <mailto:newsclips-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/newsclips>, <mailto:newsclips-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 24 Apr 2023 08:53:29 -0000

The IETF SYN-ACK Newspack collects IETF-related items from a variety of news outlets and other online publications. They do not represent the views of the IETF and are not checked for factual accuracy.

 

**********************

IETF IN THE NEWS

**********************

EU: Artificial Intelligence Act must do more to protect human rights

Ahead of the European Parliament’s vote on the EU Artificial Intelligence Act, ARTICLE 19 reiterates our calls for strengthening the human rights considerations in the Act, with a full ban on the use of remote biometric surveillance and emotion recognition technologies. We also caution against the reliance on standard-setting bodies to guide the implementation of the crucial aspects of the Act. ... Standards developing organisations (SDOs) are not structured to meaningfully engage with the human rights considerations and the implications of these technologies. They are largely composed of individuals and organisations from technical communities that have limited (if any) knowledge of human rights or understanding of the societal implications of technologies. ARTICLE 19 has a long track record of working on embedding human rights considerations in technical standardisation bodies such as the IETF, the Institute for Electrical and Electronics Engineers (IEEE), and the International Telecommunication Union (ITU). Our experience shows that those processes are too often shaped and influenced by technical considerations and corporate lobbying, and rarely by a careful consideration of rights-based approaches.

< <https://www.article19.org/resources/eu-artificial-intelligence-act-must-do-more-to-protect-human-rights/> https://www.article19.org/resources/eu-artificial-intelligence-act-must-do-more-to-protect-human-rights/>

 

Adding ZONEMD Protections to the Root Zone

The DNS root zone will soon be getting a new record type, called ZONEMD, to further ensure the security, stability, and resiliency of the global DNS in the face of emerging new approaches to DNS operation. While this change will be unnoticeable for the vast majority of DNS operators (such as registrars, internet service providers, and organizations), it provides a valuable additional layer of cryptographic security to ensure the reliability of root zone data. ... In 2020, the IETF published RFC 8806, titled “Running a Root Server Local to a Resolver.” Along the same lines, in 2021 the ICANN Office of the Chief Technology Officer published OCTO-027, titled “Hyperlocal Root Zone Technical Analysis.” Both proposals share the idea that recursive name servers can receive and load the entire root zone locally and respond to root zone queries directly.

< <https://blog.verisign.com/security/root-zone-zonemd/> https://blog.verisign.com/security/root-zone-zonemd/>

 

Continuous Innovation in IP Domain to Boost Carriers' New Growth Featured

During the 2023 MPLS SD & AI Net World Congress, Huawei's technology summit themed "Continuous Innovation in IP Domain, Boost New Growth" was successfully held at the Paris Exhibition Center in Paris. This summit discussed the target network architecture, protocol evolution, and automation technologies in the hope of helping carriers build converged IP networks to improve efficiency and introduced digital managed network solutions and architecture, which are intended to help carriers transform from ISPs to MSPs and drive new growth of B2B services. ... In terms of automation, IETF Internet Architecture Board member Wu Qin said that the era of autonomous networks (ANs) has come. AN technologies are developing toward network programmability and openness, service definition-implementation decoupling, network digitalization, intelligent management, and other key directions.

< <https://www.thefastmode.com/expert-opinion/31625-continuous-innovation-in-ip-domain-boost-carrier-s-new-growth> https://www.thefastmode.com/expert-opinion/31625-continuous-innovation-in-ip-domain-boost-carrier-s-new-growth>

 

Die IETF will die neue Endung .alt, aber außerhalb des DNS [The IETF wants the new .alt extension, but outside the DNS]

Die IETF hat das ICANN Board of Directors darüber informiert, dass man die TLD .alt als »Special-Use Domain Name«-Registry einführen will.

< <https://domain-recht.de/domain-registrierung/neue-top-level-domains/ntlds-die-internet-engineering-task-force-will-die-neue-endung-alt-aber-ausserhalb-des-dns-68862.html> https://domain-recht.de/domain-registrierung/neue-top-level-domains/ntlds-die-internet-engineering-task-force-will-die-neue-endung-alt-aber-ausserhalb-des-dns-68862.html>

 

Von ICANN eingesetzter Ausschuß startet Anhörungen für Göran Marby-Nachfolge [ICANN-appointed committee launches hearings for Göran Marby's successor]

... Dieser neue Suchausschuss hat nun eine Reihe von Anhörungen angesetzt, um Stellungnahmen aus der Community und dem breiteren Internet-Ökosystem zu sammeln. Im Einzelnen handelt es sich um die Address Supporting Organization (ASO), das At-Large Advisory Committee (ALAC), die Country Code Names Supporting Organization (ccNSO) Council, die Generic Names Supporting Organization (GNSO) Council, das Governmental Advisory Committee (GAC) und das Root Server System Advisory Committee (RSSAC). Ergänzt wird diese Gruppe um ehemalige ICANN-Vorstandsmitglieder, ehemalige ICANN-Vorstandsvorsitzende sowie Vertreter der Internet Society (ISOC) und der IETF.

< <https://domain-recht.de/domain-registrierung/icann/ceo-suche-von-icann-eingesetzter-ausschuss-startet-anhoerungen-fuer-goeran-marby-nachfolge-68873.html> https://domain-recht.de/domain-registrierung/icann/ceo-suche-von-icann-eingesetzter-ausschuss-startet-anhoerungen-fuer-goeran-marby-nachfolge-68873.html>

 

Lettre d'information XMPP de mars 2023 [XMPP March 2023 Newsletter]

... L'IETF a approuvé la publication de Messaging Layer Security (MLS), une nouvelle norme de sécurité de bout en bout qui permettra aux applications de fournir facilement le plus haut niveau de sécurité à leurs utilisateurs. Le chiffrement de bout en bout est une fonction de sécurité de plus en plus importante dans les applications Internet. Il permet de protéger les informations des utilisateurs même si le service en nuage qu'ils utilisent a été violé.

< <https://linuxfr.org/news/lettre-d-information-xmpp-de-mars-2023> https://linuxfr.org/news/lettre-d-information-xmpp-de-mars-2023>

 

10 meilleurs outils de chiffrement de fichiers et de disques pour Linux [10 Best File and Disk Encryption Tools for Linux]

... 4. GnuPG: GnuPGGenericNamesouvent appelé GPGsignifie Garde de confidentialité GNU et il s’agit d’une collection gratuite et open-source d’outils cryptographiques créés en remplacement de la suite logicielle cryptographique PGP de Symantec. Il est conforme à la IETF spécification standard d’OpenPGP et RFC 4889. Nous avons couvert GnuPGGenericName un peu plus en détail dans notre meilleur article sur les outils Linux Encrypt/Decrypt.

< <https://fr.techtribune.net/linux/10-meilleurs-outils-de-chiffrement-de-fichiers-et-de-disques-pour-linux/663566/> https://fr.techtribune.net/linux/10-meilleurs-outils-de-chiffrement-de-fichiers-et-de-disques-pour-linux/663566/>

 

Innovation continue dans le domaine de l'IP, stimuler la nouvelle croissance des entreprises de télécommunications [Continuous innovation in the field of IP, driving the new growth of telecommunications companies]

... Pour ce qui est de l'automatisation, Wu Qin, membre du conseil d'administration, IETF, architecture Internet, a déclaré que l'ère des réseaux autonomes est arrivée. Les technologies de réseaux autonomes évoluent vers la programmabilité et l'ouverture des réseaux, le découplage de la définition et de la mise en oeuvre des services, la numérisation des réseaux, la gestion intelligente et d'autres orientations clés.

< <https://www.lelezard.com/communique-20864858.html> https://www.lelezard.com/communique-20864858.html>

 

Test de velocidad de internet: estas son las claves para interpretar el resultado [Internet speed test: these are the keys to interpreting the result]

... Internet no tiene una gobernanza centralizada única ni en la implementación tecnológica ni en las políticas de acceso y uso; cada red constituyente establece sus propias políticas. Las definiciones excesivas de los dos espacios de nombres principales en Internet, el Protocolo de Internet (dirección IP) y el Sistema de nombres de dominio (DNS), están dirigidos por una organización mantenedora, la Corporación de Internet para la Asignación de Nombres y Números (ICANN). La base técnica y la estandarización de los protocolos centrales es una actividad del Grupo de Trabajo de Ingeniería de Internet (IETF), una organización internacional sin fines de lucro.

< <https://www.eleconomista.net/tecnologia/Test-de-velocidad-de-internet-estas-son-las-claves-para-interpretar-el-resultado-20230421-0025.html> https://www.eleconomista.net/tecnologia/Test-de-velocidad-de-internet-estas-son-las-claves-para-interpretar-el-resultado-20230421-0025.html>

 

Chat interoperabili entro il 2024: Cambridge studia i nodi da sciogliere [Interoperable chats by 2024: Cambridge studies the knots to be solved]

... La prima soluzione è complessa da attuare. In lizza per diventare il protocollo comune ufficiale ci sarebbero Matrix, Signal e MLS dell’IETF, ma esistono molte (troppe) variazioni nell’implementazione: la standardizzazione sarebbe una sfida nella sfida.

< <https://www.zerounoweb.it/trends/dinamiche-di-mercato/chat-interoperabili-entro-il-2024-cambridge-studia-i-nodi-da-sciogliere/> https://www.zerounoweb.it/trends/dinamiche-di-mercato/chat-interoperabili-entro-il-2024-cambridge-studia-i-nodi-da-sciogliere/>

 

Průběžné inovace v oblasti IP domén, podpora nového růstu operátorů [Continuous innovation in the area of IP domains, support for new growth of operators]

... Pokud jde o automatizaci, člen rady IETF pro architekturu internetu Wu Qin uvedl, že nastala éra autonomních sítí (AN). Technologie AN se vyvíjejí směrem k programovatelnosti a otevřenosti sítě, oddělení definice a implementace služeb, digitalizaci sítě, inteligentnímu řízení a dalším klíčovým směrům. Digitální mapa sítě založená na telemetrii poskytuje vizualizaci sítě z hledisek, jako jsou infrastruktura, sítě, části, trasy, služby a aplikace. Umožňuje také ověření simulace záměru konfigurace a optimalizaci provozu. To pomáhá dopravcům lépe spravovat fyzické sítě skrze digitální možnosti.

< <https://www.metro.cz/prubezne-inovace-v-oblasti-ip-domen-podpora-noveho-rustu-operatoru-11g-/protext.aspx?c=A230421_150400_metro-protext_air> https://www.metro.cz/prubezne-inovace-v-oblasti-ip-domen-podpora-noveho-rustu-operatoru-11g-/protext.aspx?c=A230421_150400_metro-protext_air>

 

Inovasi Berkelanjutan di Domain IP, Tingkatkan Pertumbuhan Baru Operator Seluler [Continuous Innovation in IP Domains, Boosting New Growth of Mobile Operators]

... Dari sisi otomatisasi, anggota IETF Internet Architecture Board Wu Qin memaparkan, era autonomous networks (ANs) telah tiba. Teknologi AN berkembang menuju kemampuan jaringan untuk diprogram dan prinsip keterbukaan, service definition-implementation decoupling, digitalisasi jaringan, intelligent management, dan tren penting lain.

< <https://visi.news/inovasi-berkelanjutan-di-domain-ip-tingkatkan-pertumbuhan-baru-operator-seluler/> https://visi.news/inovasi-berkelanjutan-di-domain-ip-tingkatkan-pertumbuhan-baru-operator-seluler/>

 

六问+一图,读懂《关于推进IPv6技术演进和应用创新发展的实施意见》 [Six questions + one picture, read the "Implementation Opinions on Promoting IPv6 Technology Evolution and Application Innovation and Development"]

... IPv6是国际标准化组织IETF(互联网工作任务组)制定的下一代互联网协议版本,不仅能够提供海量的地址资源,还将为网络能力提升、技术创新、产业升级提供基础支撑,是全球公认的下一代互联网商业应用解决方案。

< <https://www.edu.cn/xxh/ip6/202304/t20230423_2382708.shtml> https://www.edu.cn/xxh/ip6/202304/t20230423_2382708.shtml> 

 

سوپرنت (Supernet) چیست و چگونه کار می‌کند؟ [What is Supernet and how does it work?]

... با راه‌اندازی وب‌سایت‌های جدید، کارگروه مهندسی اینترنت (IETF) در سال 1993 مفهوم سوپرنت را معرفی کرد. موفقیت یک سوپرنت به استفاده از فناوری‌های مختلف در اجرای آن بستگی دارد. این فناوری‌ها از ادغام بسیاری از بلاک چین‌ها در یک سیستم واحد پشتیبانی می‌کنند. درنتیجه تعاملات و ارتباطات بین آن‌ها را ساپورت خواهند کرد.

< <https://factcoins.com/??????-supernet-????-?-?????-???-??????/> https://factcoins.com/سوپرنت-supernet-چیست-و-چگونه-کار-میکند؟/>

 

**********************

SECURITY & PRIVACY

**********************

Five Eye nations release new guidance on smart city cybersecurity

New guidance, Cybersecurity Best Practices for Smart Cities, wants to raise awareness among communities and organizations implementing smart city technologies that these beneficial technologies can also have potential vulnerabilities. A collaboration among the Five Eye nations (Australia, Canada, New Zealand, the UK, and the US), it advises communities considering becoming smart cities to assess and mitigate the cybersecurity risks that comes with the technology.

< <https://www.csoonline.com/article/3694149/five-eye-nations-release-new-guidance-on-smart-city-cybersecurity.html> https://www.csoonline.com/article/3694149/five-eye-nations-release-new-guidance-on-smart-city-cybersecurity.html>

 

us: NSA Part of Coalition Highlighting Cybersecurity Best Practices for Smart Cities

The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigation (FBI) are partnering with international partners’ cybersecurity agencies to publish cybersecurity best practices for smart cities, which integrate public services into a connected environment to increase efficiencies and improve the quality of life in various communities.

< <https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3367808/nsa-part-of-coalition-highlighting-cybersecurity-best-practices-for-smart-cities/> https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3367808/nsa-part-of-coalition-highlighting-cybersecurity-best-practices-for-smart-cities/>

 

nz: Joint Guidance: Cyber security best practices for smart cities

New Zealand’s National Cyber Security Centre (NCSC) has issued a joint guide in partnership with the United States of America's Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), and the cyber security authorities of Australia, Canada, and the United Kingdom. This joint guidance, titled Cybersecurity Best Practices for Smart Cities, acknowledges that communities may seek cost-saving and quality-of-life improvements through digital transformation of infrastructure to create “smart cities”. The guidance provides recommendations to balance efficiency and innovation with cyber security, privacy protections, and national security.

< <https://www.ncsc.govt.nz/news/smart-cities/> https://www.ncsc.govt.nz/news/smart-cities/>

 

Cybersecurity Best Practices for Smart Cities

Summary: This guidance is the result of a collaborative effort from the United States Cybersecurity and Infrastructure Security Agency (CISA), the United States National Security Agency (NSA), the United States Federal Bureau of Investigation (FBI), the United Kingdom National Cyber Security Centre (NCSC-UK), the Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), and the New Zealand National Cyber Security Centre (NCSC-NZ). These cybersecurity authorities—herein referred to as “authoring organizations”—are aware that communities may seek cost-savings and quality-of-life improvements through the digital transformation of infrastructure to create “smart cities.” In this context, the term “smart cities” refers to communities that:

< <https://www.cyber.gov.au/sites/default/files/2023-04/Joint-guidance-cybersecurity-best-practices-for-smart-cities.pdf> https://www.cyber.gov.au/sites/default/files/2023-04/Joint-guidance-cybersecurity-best-practices-for-smart-cities.pdf>

< <https://media.defense.gov/2023/Apr/19/2003203386/-1/-1/0/CYBERSECURITY-BEST-PRACTICES-FOR-SMART-CITIES_508C.PDF> https://media.defense.gov/2023/Apr/19/2003203386/-1/-1/0/CYBERSECURITY-BEST-PRACTICES-FOR-SMART-CITIES_508C.PDF>

 

us: CISA’s Cyber Experts Talk Shop on the Need for Safer Tech

Last week, CISA and 9 U.S. and international cybersecurity agencies released a whitepaper titled "Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and Default." For those of you playing along at home, 10 agencies signing onto a document is a record number for us at CISA. The document argues that we need to significantly reshape the way software is created to prioritize safety as a non-negotiable foundation. That is, we need to bake security into product development. This is directly in line with the vision laid out in the recently-released National Cybersecurity Strategy, which states that “Today, end users bear too great a burden for mitigating cyber risks” and that “we must ask more of the most capable and best-positioned actors.”

< <https://www.cisa.gov/news-events/news/cisas-cyber-experts-talk-shop-need-safer-tech> https://www.cisa.gov/news-events/news/cisas-cyber-experts-talk-shop-need-safer-tech>

 

The status quo for DNS security isn’t working: It’s clear that organizations need a playbook for DoH traffic, and perhaps just generally better DNS security.

The DNS is often referred to as the phone book of the internet. DNS translates web addresses, which people use, into IP addresses, which machines use. But DNS was not designed with security in mind. And even though companies have invested incredible amounts of money into their security stack (and even though they’ve had since the 1980s to figure this out), DNS traffic often goes unmonitored.

< <https://www.csoonline.com/article/3694168/the-status-quo-for-dns-security-isn-t-working.html> https://www.csoonline.com/article/3694168/the-status-quo-for-dns-security-isn-t-working.html>

 

The United States Government Can Take Lead in RPKI Deployment

Since 2019, the use of Resource Public Key Infrastructure (RPKI) has drastically increased across the global Internet. RPKI is a method of cryptographically assuring a network is authorized to originate routes to a specific set of network addresses.

< <https://www.manrs.org/2023/04/the-united-states-government-can-take-lead-in-rpki-deployment/> https://www.manrs.org/2023/04/the-united-states-government-can-take-lead-in-rpki-deployment/>

 

us: Episode 53: Uplifting Neurodiversity in Cybersecurity

In episode 53 of Cybersecurity Where You Are, co-host Tony Sager is joined by Ron Gula, President and Co-Founder of Gula Tech Foundation. Together, they acknowledge Autism and Neurodiversity Awareness Month by discussing the need to create more opportunities in cybersecurity for neurodiverse individuals.

< <https://www.cisecurity.org/insights/podcast/episode-53-uplifting-neurodiversity-in-cybersecurity> https://www.cisecurity.org/insights/podcast/episode-53-uplifting-neurodiversity-in-cybersecurity>

 

Gartner Identifies the Top Cybersecurity Trends for 2023: Security Leaders Must Pivot to a Human-Centric Focus to Establish an Effective Cybersecurity Program [news release]

Security and risk management (SRM) leaders must rethink their balance of investments across technology and human-centric elements when creating and implementing cybersecurity programs in line with nine top industry trends, according to Gartner, Inc.

< <https://www.gartner.com/en/newsroom/press-releases/04-12-2023-gartner-identifies-the-top-cybersecurity-trends-for-2023> https://www.gartner.com/en/newsroom/press-releases/04-12-2023-gartner-identifies-the-top-cybersecurity-trends-for-2023>

 

Businesses detect cyberattacks faster despite increasingly sophisticated adversaries

Global organisations are improving their attack detection capabilities despite facing increasingly sophisticated, persistent, and creative adversaries. The Mandiant M-Trends 2023 report, now in its fourteenth year, revealed that the global median dwell time – calculated as the median number of days an attacker is present in a target’s environment before detection – dropped to 16 days in 2022. This is the shortest median global dwell time from all M-Trends reporting periods.

< <https://www.csoonline.com/article/3693575/businesses-detect-cyberattacks-faster-despite-increasingly-sophisticated-adversaries.html> https://www.csoonline.com/article/3693575/businesses-detect-cyberattacks-faster-despite-increasingly-sophisticated-adversaries.html>

< <https://www.reseller.co.nz/article/706728/businesses-detect-cyberattacks-faster-despite-increasingly-sophisticated-adversaries/> https://www.reseller.co.nz/article/706728/businesses-detect-cyberattacks-faster-despite-increasingly-sophisticated-adversaries/>

 

Cyber: towards stronger EU capabilities for effective operational cooperation, solidarity and resilience

Today, the Commission has adopted a proposal for the EU Cyber Solidarity Act to strengthen cybersecurity capacities in the EU. It will support detection and awareness of cybersecurity threats and incidents, bolster preparedness of critical entities, as well as reinforce solidarity, concerted crisis management and response capabilities across Member States. The Cyber Solidarity Act establishes EU capabilities to make Europe more resilient and reactive in front of cyber threats, while strengthening existing cooperation mechanism. It will contribute to ensuring a safe and secure digital landscape for citizens and businesses and to protecting critical entities and essential services, such as hospitals and public utilities.

< <https://ec.europa.eu/commission/presscorner/detail/en/ip_23_2243> https://ec.europa.eu/commission/presscorner/detail/en/ip_23_2243>

 

Questions and Answers: Cyber: towards stronger EU capabilities for effective operational cooperation, solidarity and resilience

EU Cyber Solidarity Act: What are the objectives of the proposal for a Cyber Solidarity Act? In line with the Council Conclusions on the EU's Cyber Posture of May 2022 and as announced in the Joint Cyber Defence Communication, the Commission has proposed an EU Cyber Solidarity Act.

< <https://ec.europa.eu/commission/presscorner/detail/en/qanda_23_2244> https://ec.europa.eu/commission/presscorner/detail/en/qanda_23_2244>

 

EU launches Cyber Solidarity Act to respond to large-scale attacks

The European Commission has launched its controversial draft Cyber Solidarity Act, putting forward a proposal for boosting EU-wide cooperation in preparation for and response to major cyber attacks.

< <https://www.euractiv.com/section/digital/news/eu-launches-cyber-solidarity-act-to-respond-to-large-scale-attacks/> https://www.euractiv.com/section/digital/news/eu-launches-cyber-solidarity-act-to-respond-to-large-scale-attacks/>

 

Skills shortage puts Europe’s cyber resilience to the test

Regulatory compliance, the disruption of Artificial Intelligence and international competition are just some issues regarding the lack of cyber skills in Europe and beyond.

< <https://www.euractiv.com/section/digital/special_report/skills-shortage-puts-europes-cyber-resilience-to-the-test/> https://www.euractiv.com/section/digital/special_report/skills-shortage-puts-europes-cyber-resilience-to-the-test/>

 

M-Trends 2023: Cybersecurity Insights From the Frontlines

We are excited today to launch M-Trends 2023, our comprehensive report from the frontlines of incident response that provides metrics on the types of attacks we’re seeing, what industries are being targeted, and how defenders are responding; insights into the latest attacker tactics, techniques, and procedures; and guidance and best practices on how everyone in an organization—from senior leaders to practitioners—should be responding to these threats.

< <https://www.mandiant.com/resources/blog/m-trends-2023> https://www.mandiant.com/resources/blog/m-trends-2023>

 

5G Security — A Shared Responsibility

As 5G continues to gain market momentum and more and more enterprises embrace it for their wireless transport, an important question arises which must not be ignored. Who is responsible for making 5G secure? Security for 5G networks does not fall solely in the lap of the 5G radio and packet core vendors, nor does it fall solely in the lap of the enterprises embracing 5G. Rather, 5G security is a shared responsibility, much like the one AWS has made famous for its cloud services.

< <https://www.paloaltonetworks.com/blog/2023/04/5g-security-a-shared-responsibility/> https://www.paloaltonetworks.com/blog/2023/04/5g-security-a-shared-responsibility/>

 

Gemeinsame Umfrage von BSI und KPMG in Deutschland zu „Kryptografie und Quantencomputing“

Die Bedrohung der Informationssicherheit durch Quantencomputer wird unterschätzt. Das ist das Ergebnis einer Befragung, die das Bundesamt für Sicherheit in der Informationstechnik (BSI) und KPMG in Deutschland durchgeführt haben.

< <https://www.bsi.bund.de/DE/Service-Navi/Presse/Alle-Meldungen-News/Meldungen/BSI_KMPG_Quanten_230418.html> https://www.bsi.bund.de/DE/Service-Navi/Presse/Alle-Meldungen-News/Meldungen/BSI_KMPG_Quanten_230418.html>



**********************

NEW TRANSPORT PROTOCOLS

**********************

Taking a slice out of private wireless networks (Reader Forum)

Private wireless is quickly infiltrating enterprise networks everywhere. For the first time, companies now have direct access to new shared cellular spectrum, made available by the FCC and other telecom regulatory bodies around the world, to own and operate their own mobile networks. ... Microslices use the 4G LTE QoS Class Identifier (QCI) and 5G QoS Identifier (5QI) as defined by 3GPP standard to mark various traffic flows for unique traffic management handling.

< <https://www.rcrwireless.com/20230420/reader-forum/taking-a-slice-out-of-private-wireless-networks-reader-forum> https://www.rcrwireless.com/20230420/reader-forum/taking-a-slice-out-of-private-wireless-networks-reader-forum>

 

Internet users have doubled in the past eight years but 2.6 billion people remain unconnected: study

Internet users have doubled in the past eight years with an estimated 67% of the world population using broadband services in 2022, according to space and satellite market consultancy Euroconsult. However, 2.6 billion people remain unconnected, representing an untapped opportunity worth US$74 billion. ... The D2D satellite service landscape is particularly gaining momentum, supported by new regulations – like the FCC rule-making – and new 5G standards (through 3GPP) to integrate satellites into terrestrial networks more seamlessly.

< <https://itwire.com/your-it-news/mobility/internet-users-have-doubled-in-the-past-eight-years-but-2-6-billion-people-remain-unconnected-study.html> https://itwire.com/your-it-news/mobility/internet-users-have-doubled-in-the-past-eight-years-but-2-6-billion-people-remain-unconnected-study.html>

 

2.6 billion remained unconnected to broadband at the end of 2022 – a $74 billion untapped opportunity [news release]

Internet usage has doubled in the past eight years, with an estimated 67% of the world population using broadband services in 2022, according to the world’s leading authority on space and satellite-based applications markets, Euroconsult. From access to public services such as remote health advice to remote working and learning and the ability to communicate opinions and share information, universal connectivity has become an increasing priority for governments across the globe. ... Other opportunities exist for satellite services to expand their addressable market in the coming years. These include vehicles in motion like RVs, such as Starlink Roam service, and the direct-to-device (D2D) market. The D2D satellite service landscape is particularly gaining momentum, supported by new regulations – like the FCC rule-making – and new 5G standards (through 3GPP) to integrate satellites into terrestrial networks more seamlessly.

< <https://www.euroconsult-ec.com/press-release/2-6-billion-remained-unconnected-to-broadband-at-the-end-of-2022-a-74-billion-untapped-opportunity/> https://www.euroconsult-ec.com/press-release/2-6-billion-remained-unconnected-to-broadband-at-the-end-of-2022-a-74-billion-untapped-opportunity/>

 

Netflix es responsable del 14,9% del tráfico mundial de internet

¿Cuál es la aplicación que más tráfico de internet acumuló en el mundo el año pasado? Tal y como recoge Statista con informaciones de The Global Internet Phenomena Report, se trata de Netflix, con un 14,9% del tráfico total. Por detrás se encuentra Youtube, con un 11,6%, y después, con un 5,9%, generic Quic, que es un protocolo de red diseñado para acelerar aplicaciones en línea.

< <https://www.elnacional.cat/oneconomia/es/el-dato/netflix-responsable-14-9-trafico-mundial-internet_1011222_102.html> https://www.elnacional.cat/oneconomia/es/el-dato/netflix-responsable-14-9-trafico-mundial-internet_1011222_102.html>

 

**********************

OTHERWISE NOTEWORTHY

**********************

Remembering Ross Stone, an Influential Leader of IEEE Technical Activities: He developed new strategies for the group’s publication program

W. Ross Stone, an influential IEEE Technical Activities leader, died on 29 March at the age of 75. The Life Fellow received the 2023 IEEE Richard M. Emberson Award “for sustained contributions to and impactful leadership in the IEEE Technical Activities publication enterprise.”

< <https://spectrum.ieee.org/remembering-ross-stone> https://spectrum.ieee.org/remembering-ross-stone>

 

World Wide Web Consortium seeking next CEO

The World Wide Web Consortium (W3C) is working with leading international executive search firm Perrett Laver to find qualified candidates from around the world to be our CEO.

< <https://www.w3.org/blog/news/archives/9891> https://www.w3.org/blog/news/archives/9891>

 

W3C invites implementations of Trace Context Level 2

The Distributed Tracing Working Group invites implementations of the Trace Context Level 2 Candidate Recommendation Snapshot. This specification defines standard HTTP headers and a value format to propagate context information that enables distributed tracing scenarios.

< <https://www.w3.org/blog/news/archives/9885> https://www.w3.org/blog/news/archives/9885>

 

7 countries unite to push for secure-by-design development

Ten agencies from across seven countries have joined forces to create a guide for software developer organizations to ensure their products are both secure by design and by default. The joint guidance, Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default, comes after several recently identified critical vulnerabilities in vendor software.

< <https://www.csoonline.com/article/3693353/7-countries-unite-to-push-for-secure-by-design-development.html> https://www.csoonline.com/article/3693353/7-countries-unite-to-push-for-secure-by-design-development.html>

 

U.S. and International Partners Publish Secure-by-Design and -Default Principles and Approaches

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), and the cybersecurity authorities of Australia, Canada, United Kingdom, Germany, Netherlands, and New Zealand (CERT NZ, NCSC-NZ) published today “Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default.” This joint guidance urges software manufacturers to take urgent steps necessary to ship products that are secure-by-design and -default.  To create a future where technology and associated products are safe for customers, the authoring agencies urge manufacturers to revamp their design and development programs to permit only secure-by-design and -default products to be shipped to customers.

< <https://www.cisa.gov/news-events/news/us-and-international-partners-publish-secure-design-and-default-principles-and-approaches> https://www.cisa.gov/news-events/news/us-and-international-partners-publish-secure-design-and-default-principles-and-approaches>

 

The future of timekeeping

Regardless of how you measure it, time is critical to all our daily activities and the orderly functioning of our societies. Defining time has been and continues to be a preoccupation of scientists around the world. After years of using the rotation of the Earth as the basis for determining the length of a day and for defining time scales, the adoption of Coordinated Universal Time (UTC) in 1971 marked a breakthrough in the definition of time.

< <https://www.itu.int/hub/2023/04/the-future-of-timekeeping/> https://www.itu.int/hub/2023/04/the-future-of-timekeeping/>

 

The Internet twenty-five years later

The Internet is not quite as young and spritely as you might’ve thought. Apple’s iPhone, released in 2007, is now 16 years old, and YouTube is an ageing teenager at 18 after its initial release in 2005.

< <https://www.potaroo.net/ispcol/2023-04/25y.html> https://www.potaroo.net/ispcol/2023-04/25y.html>

< <https://blog.apnic.net/2023/04/21/the-internet-twenty-five-years-later/> https://blog.apnic.net/2023/04/21/the-internet-twenty-five-years-later/>

 

Navigating a BGP zombie outbreak on Juniper routers

Border Gateway Protocol (BGP) routing issues can be a headache for network engineers. However, when those issues start exhibiting zombie-like behaviour, it’s time to take a closer look. This is exactly what I have observed on some Juniper routers in production at AS48635 running as edge routers (responsible for IP transit, Private Network Interconnects (PNIs) and IXP peering). This phenomenon is not only perplexing but can also impact traffic engineering efforts or in some rare cases, cause network disruptions.

< <https://blog.apnic.net/2023/04/13/navigating-a-bgp-zombie-outbreak-on-juniper-routers/> https://blog.apnic.net/2023/04/13/navigating-a-bgp-zombie-outbreak-on-juniper-routers/>

 

Is the public cloud ready for IPv6?

When connecting machines over the public Internet (or over private networks), we use IPv4 addresses. For many years we’ve heard about IPv4 address exhaustion or the fact that sometime in the future we will not able to request new IPv4 addresses to connect over the public Internet. We all heard that IPv6 address space will resolve this problem, but will it?

< <https://blog.apnic.net/2023/04/19/is-the-public-cloud-ready-for-ipv6/> https://blog.apnic.net/2023/04/19/is-the-public-cloud-ready-for-ipv6/>

 

Observations on RIPE Atlas API ‘anti-patterns’

The RIPE Atlas APIs receive millions of requests each day — which is, in general, good news! However, we also see some strange or sub-optimal client behaviour. Read on for a description of some of these cases and our suggestions on how to improve the use of the APIs.

< <https://blog.apnic.net/2023/04/17/observations-on-ripe-atlas-api-anti-patterns/> https://blog.apnic.net/2023/04/17/observations-on-ripe-atlas-api-anti-patterns/>

 

APNIC 56 Call for Papers open now

The APNIC 56 Program Committee (PC) is seeking presentations, panel discussions, lightning talks, and tutorials — particularly content that would suit technical sessions — for the APNIC 56 conference to be held in Kyoto, Japan from 12 to 14 September 2023.

< <https://blog.apnic.net/2023/04/20/apnic-56-call-for-papers-open-now/> https://blog.apnic.net/2023/04/20/apnic-56-call-for-papers-open-now/>

 

The common denominator in broadband standards

With a rise in the number and variety of devices inside the home, demand for greater network capacity is also increasing. In the United States alone, there are as many as 60.4 million households actively using smart home devices in 2023 which is already 3% more than in 2022. As access to fast broadband is now a necessity for all, broadband operators need to provide a solution that enables digital inclusion in the home.

< <https://www.broadband-forum.org/the-common-denominator-in-broadband-standards> https://www.broadband-forum.org/the-common-denominator-in-broadband-standards>

------

David Goldstein

email:  <mailto:david@goldsteinreport.com> david@goldsteinreport.com

web:  <http://goldsteinreport.com/> http://goldsteinreport.com/

Twitter:  <https://twitter.com/goldsteinreport> https://twitter.com/goldsteinreport

phone: +61 418 228 605 - mobile; +61 2 9663 3430 - office/home