Tag Archive for: proposes

Google Proposes Method for Stopping Multifactor Runaround

/in

Google recognizes that cookie theft poses a significant challenge for users and is actively working on a solution to mitigate it. They propose a mechanism called Device Bound Session Credentials (DBSC), which aims to tie authentication data to a specific device, rendering stolen cookies ineffective.

Cookies remain a common method for websites to store session information locally, enabling users to stay signed in and retain site preferences. However, malicious software can target cookies, extracting them from a user’s device and transmitting them to remote attackers for potential unauthorized access to user data.

Google’s DBSC initiative involves employing cryptographic keys to associate sessions with individual devices. This process involves generating a unique public/private key pair locally on the device, with the private key securely stored by the operating system, possibly leveraging hardware features like Trusted Platform Module (TPM) for enhanced security.

The DBSC API facilitates the association of sessions with the generated public key, allowing periodic refreshment of sessions with cryptographic proof of device binding. This verification occurs separately from regular web traffic and only when the user is actively engaged in the session.

Google emphasizes privacy protection, ensuring that each session is linked to a distinct key and preventing sites from correlating keys across different sessions on the same device. Only the per-session public key is transmitted to the server for proof of key possession.

Initial adoption of DBSC is expected to cover approximately half of desktop users, dependent on hardware capabilities like TPM availability. Google contemplates extending support to software-based keys for broader user coverage and compatibility.

To encourage widespread adoption, Google is collaborating with industry stakeholders, including identity providers and potentially Microsoft for integration into its Edge browser. The project is being developed openly on GitHub with the intention of establishing an open web standard.

DBSC aligns with Google’s strategy of phasing out third-party cookies in Chrome. Early experiments are underway to protect Google Account users in Chrome Beta, with plans to extend the technology to Google Workspace and Google Cloud customers for enhanced account security.

This initiative draws parallels to Intel’s past attempt with Processor Serial Number (PSN) for tracking, which faced backlash and discontinuation due to privacy concerns. However, Google aims to address privacy issues and gain broader industry support for DBSC as a standardized security measure.

 

Sen. Michael Bennet Proposes Commission To Oversee Digital Platforms Including Social Media – CBS Denver

/in


DENVER (CBS4) – In hopes of furthering the trust and security of the general public on the internet, Senator Michael Bennet has proposed legislation that would create a commission to oversee businesses operating on the internet. Bennet, the senior senator from Colorado, said the proposal comes as a way to assure some of the most powerful companies in the world are operating in the best interest of the American people.

(credit: CBS)

As of now, Bennet is the sole sponsor of the bill. He proposed creating a “Digital Platform Commission” which would operate and oversee companies using the internet much like how the Food and Drug Administration oversees the country’s guidelines when it comes to pharmaceuticals.

Bennet told CBS4’s Dillon Thomas the commission would help prioritize and balance free speech, national security and mental health.

“Our advisories are infiltrating social media platforms in the country,” Bennet, a member of the Senate Intelligence Committee, said.

(credit: CBS)

In an interview with CBS4, the senator said the commission would oversee regulations and guardrails for big tech companies, including but not limited to platforms like Facebook, YouTube, Google, Amazon, Twitter and TikTok. While social media companies are behind many of the concerns some Americans have, Bennet said the commission would have oversight of American internet regulations.

Section 230, a law that was created in the 1990s, is one of the most debated federal laws when it comes to the powers given to major websites. The law largely gives immunity to companies for content uploaded by third parties. While Bennet said he believes Section 230 should potentially be revised, he felt the commission was a separate step that could be taken to further protect American interests.

“We have had basically completely unregulated social media platforms. These companies aren’t startups anymore. They are some of the most important and dominant companies in America,” Bennet said.

Bennet hoped the development of a five-person commission, made up of technology experts from differing parties and backgrounds, would help the country take action toward regulating big tech instead of allowing other…

Source…

Transportation Proposes Near $1M Fine for Colonial Pipeline One Year After Hack

/in



The Department of Homeland Security also noted the anniversary of the attack with … but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you …

Source…

SEC Proposes To Expand Cybersecurity Obligations Of Registered Investment Advisers And Registered Funds – Technology

/in


The SEC recently proposed a series of new rules and amendments (the Proposed Rules)
under the Investment Advisers Act of 1940 and the Investment
Company Act of 1940 concerning cybersecurity risk management for
registered investment advisers (registered advisers) as well as
registered investment companies (registered funds). If adopted,
these rules would require registered advisers and registered funds
to implement extensive written cybersecurity policies and
procedures and significantly augment their cybersecurity reporting,
disclosure and recordkeeping obligations. Coming on the heels of
SEC Chair Gary Gensler’s recent vow to improve the
“overall cybersecurity posture and resiliency of the financial
sector,” the Proposed Rules are the latest demonstration of
the SEC’s heightened focus on bolstering regulations to better
prevent and respond to cybersecurity attacks on securities markets.
Issuance of the Proposed Rules is also driven by the SEC’s
expressly stated concern that, notwithstanding observations the SEC
has made in recent risk alerts and enforcement actions, registered
advisers and registered funds have not adopted reasonably designed
cybersecurity programs to sufficiently address an increasingly
sophisticated and volatile cyberthreat landscape.
Comments on the Proposed Rules are due on the later of
April 11, 2022 or 30 days after their publication in the Federal
Register.

Background on Registered Advisers and Registered Funds

The Proposed Rules would impose substantially similar
obligations on registered advisers—such as money managers,
investment consultants and financial planners—and registered
funds—such as mutual funds, exchange-traded funds, registered
closed-end funds, business development companies, and unit
investment trusts—but there are some distinctions,
particularly with respect to reporting and disclosure requirements.
While both registered advisers and registered funds would be
obligated to disclose significant cybersecurity incidents to
clients and investors, only registered advisers would be required
to report such incidents to the SEC. Because registered advisers
would have to report incidents of their fund…

Source…