On 29 December 2016, the US government entered a new round in its fight against malicious cyber attackers. It released a 13-page report, accompanied by a much more detailed listing of almost 1,000 technical indicators. The goal of the report was to help companies detect, block and eradicate cyber attacks on their networks.
The move followed a rough year where not only the Democratic National Committee suffered a consequential and highly mediatized breach, but also think tanks, universities, critical infrastructure and many more. Fears that further attacks are coming appear well-grounded. The US government’s report is important and relevant for many businesses, also here in Switzerland, for at least three reasons:
Aligned with private companies
Firstly, it confirms what private companies – including PwC – have been saying for a couple of years. The released information is a mixture of yet-unseen declassified technical indicators with a few also coming from the private sector. Private cyber security companies have therefore been doing quite a good job at gaining visibility and tracking what attackers have been up to. The investigative methods of private companies appear to match the ones the US government is using.
Overview on known attacking methods
Secondly, the report strongly highlights current state-of-the-art ways of attacking networks. Attackers send e-mails with malicious content enticing users to click on them. Once in a network they try to gain access to even more protected valuable resources (so-called “lateral movement” aimed at “escalating privileges”). The e-mails need not be precisely targeted: despite the hype over “spear phishing” e-mails, many rather resemble spam being sent to thousands of recipients at a time.
How to tackle threats
And this leads to the third point. The bulk of the US government’s report focuses on how to tackle such threats. And it notes: “These strategies are common sense to many, but DHS continues to see intrusions because organisations fail to use these basic measures”. This aligns very well with PwC’s experience and conclusions. In other words, many organisations, also in Switzerland, have yet to implement strong cyber security measures to ensure that they cannot easily fall victim to such attacks.
The way forward: sharing more data
Technical reports of this kind are very welcome. They lead the way by stressing that the sharing of information is crucial to defending against cyber attacks, and they contribute to normalising such a practice. Until now, indicators of cyber attacks have been very often looked at as sensitive information, thus there has been a notorious reluctance to share them between oft-ashamed victims. PwC supports the idea of sharing: when companies exchange information about experiences they’ve had with cyber attacks, negative experiences included, companies not only bring benefits to other companies, but also to themselves in the long run. They can get feedback on other companies’ experiences and this way improve their own security mechanisms. Reports like the one from the US government may contribute to changing the current mindset.
We’d also suggest adding even more precision and more details to such reports and not merely mention the many different malware names involved. For example: attackers launch their offensives in stages and use different tools and techniques at each of these stages. To protect different areas of their network, it is useful for companies to know exactly which technique is being used and at which stage. And lastly, many of the indicators provided, such as IP addresses (the address of a machine on a network), may have at times been used for legitimate purposes. To be able to differentiate between what is actually a part of the attack and what is not, it is necessary to know the exact time at which the infrastructure was used, this by means of what are commonly referred to as timestamps.
All in all, companies are well-advised to take a close look at the indicators of compromise that the US Government has provided and to use them as much to detect potential current breaches as to prevent future ones. Investigative work means that one must be ready for false-positives and shouldn’t necessarily take the initial result at face value. But, again, sharing with the rest of the community the difficulties and outcomes of these investigations can only help to strengthen the overall state of cyber security.
The above mentioned report and indicators are available under:
Trust in sharing economy businesses is built primarily on peer group usage and ratings. The fact that peers not only reveal their opinions, but a huge amount of information as well, inevitably raises the question of cybersecurity. Providers, users and regulators all share responsibility for providing a satisfactory response.
Consumers making use of conventional business offerings place their trust in a combination of proprietary brand reputation and industry-specific regulation. But the recipe for success in the sharing economy includes another basic ingredient: the trust of the peer group. Peers share ratings and recommendations that are visible everywhere in real time, in personalised form. For example Uber passengers rate their ride and the driver; in turn, drivers get to rate their passengers. This way, depending on the trust they place in the judgement of their peers, new customers can decide whether or not to do business with a particular provider. Monolithic, laws-based regulation thus gives way to a peer-to-peer trust model. This creates enormous opportunities for providers for new, interesting business.
The trust model on which the sharing economy is based can enable companies to respond more quickly and precisely to changing customer needs, market developments or their own weaknesses. It also provides highly relevant information for people with similar interests. Broad-based ratings create transparency – for better or for worse. Because the system can cut both ways: just as a positive rating can help attract new customers, bad marks can destroy the trust of prospective customers before they’ve even been able to try out the offering for themselves.
The main disadvantage of the sharing economy is its vulnerability to manipulation. An aggressive competitor, frustrated customer or disgruntled former employee can easily torpedo a platform’s reputation by posting fake ratings.
The security and data privacy risks of a sharing economy structure shouldn’t be underestimated. A peer-to-peer provider very rapidly gathers, processes and saves a huge mass of personal data, including credit card or user information and consumer profiles. This information is what cybercriminals are after. Just imagine the economic, social and emotional damage that would ensue if someone were to steal and make public the entire bookings made by regular customers of a hotels platform. Unfortunately, the levels of protection defined for data of this type vary from country to country around the world. Each provider is basically free to do what they think is right.
Data security is in large part the responsibility of sharing platform providers. In other words, peer-to-peer providers have to adapt their systems and technologies to the information they gather, and assure appropriate protection. In concrete terms this means a sharing provider should only gather data relevant to their core business, and publish clear, concise terms and conditions governing their use. A layperson must be able to understand and accept these terms in good conscience.
Given the lack of standards and the complexity of the issue, at the moment there are big differences in how conscientiously providers fulfil this duty. And there are also big differences in the rules and regulations governing these matters in different countries and industries. Most digital players capture more data than they need for their core business and have terms and conditions designed to cover them for any eventuality – pages and pages of legal fine print that the average reader will have problems reading through, never mind understanding.
Anyone shifting all or part of their business model to the digital space should start thinking about and incorporating the data privacy issues right from the conceptual phase. New technologies can help bring a market-ready idea to success by delivering it in a contemporary package. But by the same token the rigours of cybersecurity can nip a sharing economy idea in the bud or derail a digital project before it’s reached its goal.
The people who use sharing platforms have only limited tools at their disposal to prevent the data privacy rules from being violated. So if you choose to engage in this type of business you should take responsibility for your own actions. For example you should be careful about what personal information you reveal to what providers. This means that you should pay attention to how the platform’s trustworthiness is rated, read the terms and conditions, and decide for yourself whether you’re prepared to take the described risks. If you want to avoid credit card fraud, for example, you may want to use a prepaid card with a limited amount on it for sharing purchases, or make payments via a separate account which you don’t keep much money in.
Assuring cybersecurity also means protecting your own platform, making sure that your computer, tablet and smartphone are sufficiently shielded from attach from cyberspace. There are already many powerful applications available to do so.
The role of the regulator in the digital economy is to require basic protection of customer data and make sure the legislation keeps pace with the times and technology. Against this backdrop the European Parliament has revised the EU’s General Data Protection Regulation (GDPR), scheduled to come into force at the end of May 2018. The regulations contain important additional rights, provisions to protect users, and substantial penalties for violation.
Also relevant is the PCI DSS, the international credit card standard (Payment Card Industry Data Security Standard). The PCI DSS, formulated in 2006 by a council established by credit card organisations, is designed to ensure a uniform approach to implementing security requirements for credit card transactions.
The data privacy legislation in Switzerland incorporates most of the existing international data protection rules, and is likely to adopt many of the new ones. Although the implications of the revised GDPR on a national and European level aren’t yet clear, we believe the enforcement of the regulation and any penalties that are imposed will prompt companies to tighten their data privacy rules and security controls on their customer data.
Providers, users and regulators all share responsibility for cybersecurity. We can only keep the internet healthy, clean and economically beneficial if everyone involved plays their part. Regulation should create the framework for basic protection and transparency. Users have to act circumspectly to ensure their personal data don’t end up in the wrong hands. And last but not least, peer-to-peer providers have to comply with the data protection requirements.
Modern technologies such as the cloud enable companies to deliver new business models very rapidly. It’s rarely the technical implementation that stands in the way of success, but rather a failure to translate a promising idea into a business model capable of responding to change and the needs of the market. Looked at this way, cybersecurity is no longer an obstacle to success but a welcome springboard.
My overall ambition is to help people and organizations to reach their full potential. I believe that technology is an important aspect for that and I am passionate about security and privacy and how they play a crucial role in determining if and how we can take advantage of the seemingly endless potential of technology. But I also ask myself what the consequences of this technology is. It is visible already today that in the close future we will face a massive change in society. Entire job categories will disappear and robots (mostly software based) will take over many of today’s jobs. Take the transportation industry for example. While Tesla’s “autopilot” clearly still has it’s challenges in a couple of years cars, trucks and buses will be able to drive autonomous. What happens then to all the cab and truck drivers that are on our streets on a daily basis? And that is only the beginning. More and more sophisticated tasks will be done by Artificial Intelligence AI.
What does that mean for people that are studying or thinking about what kind of job should be in their future or where they should develop professionally? Is it physics, chemistry, sport or rather social studies or… How does one choose today a field so that chances are good that robots aren’t replacing you shortly out of university? It is an important subject as not everything that technology will bring will be good for everybody. The answer to this question is not easy as our understanding today is very limited what impact AI robots will have on our lives. But some aspects are in my view clearer than others and might be a start.
The first point where we can differentiate us from bots are morals, values and ethics. Our personalities can make a difference and I see that as a clear advantage over machines or for that matter towards other people as we will not just be competing against bots but against a relatively larger workforce for fewer jobs. While we can program behavior rules I don’t believe (or maybe hope) that we will achieve developing a moral artificial intelligence.
Second, what differentiates us are emotions. To be able and willing to show and feel passion and feeling for other people. Think about it as mentally or physically giving somebody a hug. Not everything happens at an intellectual level and looking ahead I believe that compassion will become again more important. Especially as in many places it seemed to have gotten lost.
The third element is creativity. Bots already today write short stories but creativity is something that I believe (or again maybe hope) is beyond programming. Be able to tell a story will be something that stays human still for a long time.
The fourth aspect is to solve new and hard challenges. I don’t believe that robots will be able to solve the really hard questions in the foreseeable future. To systematically and more important intuitively draw conclusions, to listen to a feeling/intuition and follow it up to find the solution to a hard problem. To have a dream and suddenly things fall into place in a way that one has not foreseen. To run through a massive amount of permutations is what computers do best but to see connections that are not clearly visible and be courageous to try out and find new paths is where humans shine.
And the final thought but maybe the most important is passion in what you do and to challenge, enable and inspire others. If you truly want to make a difference then finding out what you do with a passion is the best way to show that you are making a difference. There are the people that are lucky to already know from very early on where their passion is and what they want to do and then there are the majority where it takes longer to find out. Too many though give up in that process and focus on doing what gets them through the day. But will that be enough in the future? I fear not. And with inspiring and enabling others brings the possibility to act as a multiplier for all aspects above and with that truly solve the important problems together.
So if you make a choice in what to do and in what direction to evolve wherever you are in your career stage – take into account the rapidly changing technology and that robots are advancing. Focus on the things that are hard and that not everybody can do, be passionate about it and don’t forget about empathy and caring about people. Then I am convinced that you are successful also in a world where robots are everywhere.
In favor of simplicity I started to consolidate my blogging onto LinkedIn and will only once a while post something here as well. Please add me at LinkedIn to get more updates on security related topics.
I was invited to participate in a cybersecurity roundtable at the US Embassy in Bern to discuss best practices and experiences in cybersecurity policy. Participants were from private as well as public sector and the special guests were the US Ambassador to NATO, Douglas Lute and his wife Dr. Jane Holl Lute, CEO of the Center for Internet Security. At some point Dr. Jane Lute made a comment that too many IT leaders and executives still use dolphin talk. Not familiar with that language? You actually probably are because it is used quite widely by IT professionals. When “we” speak about a technology topic then the non-technology person understands about as much as when a dolphin is communicating with us.
I liked this comparison as much too often that is the reality and I am working on talking about technology and security in a more easily accessible way. One of the things I discovered in last week’s PwC EMEA Cybersecurity leadership meeting also works on improving that type of conversation. It is the PwC / WSJ Cybersecurity and Privacy Hub that you can find at www.pwc-broaderperspectives.com This hub is sponsored by PwC and is created together with the Wall Street Journal custom studios. I like it especially as the articles aim at looking at cybersecurity and privacy in a broader fashion and use a vocabulary that does not require multiple classes in cryptography or equivalent. Why not check it out and let me know what you think?
This week is pretty packed with security relevant Microsoft announcements and here a quick summary.
Satya Nadella was in the UK yesterday and in Germany today where he announced that Microsoft is expanding the cloud strategy in Europe with two new interesting offerings.
Firstly he disclosed yesterday November 10 the plans to offer commercial cloud services from the UK where Azure and Office 365 will be generally available from local UK-based data centers in late 2016 and Dynamics CRM following shortly thereafter. These services will offer customers data residency in the UK. You can read the blog post with more information here.
Secondly, and maybe more interesting from a Swiss perspective, he announced today November 11 plans to offer cloud services from German datacenters. The main difference between the UK announcement and the German one is that the second is using a trustee model. The services offered will comply with the Microsoft trusted cloud principles on security, privacy, control, compliance and transparency but is combined with a German data trustee model. That means concretely that access to customer data stored in the two new datacenters will be under the control of T-Systems which acts as a data trustee and Microsoft will have no access to this data independently. Cloud services will be made available to customers in the EU and the EFTA and roll-out is planned to begin in 2016. With this Microsoft has a new and unique solution for cuttomers in Germany and the wider Europe that want local control of their data. In my view an important next step in the discussion on data location. You can read more on today’s announcement here.
Independently from the two cloud announcements came the confirmation on Monday November 9 that Microsoft is acquiring Secure Islands. There were lately a few security acquisitions but I am especially excited about this one. I was working often with Secure Islands as their technology to protect customer data using Rights Management technology is second to none and widely adopted especially in the Swiss Financial Services Sector but also with other large customers. Microsoft will now integrate Secure Islands’ technology into Azure Rights Management Service to provide a flexible architecture to meet protetion and compliance requirements. Many of you know that I am a great supporter of Rights Management and this will give new possibilities on-premises, hybrid and cloud. Congratulations to Akie and Yuval Eldar who are the founders of Secure Islands and welcome to the Microsoft Family! You can read the announcement with more information here.
Information on Cybersecurity is becoming almost overwhelming. The series on “this weeks top of the news in Cybersecurity” is a collection of a few articles that I found noteworthy throughout the week. Perfect Friday or weekend reading to catch up on events if you have missed them or have been too preoccuppied or swamped with the Bond Spectre movies review!
It has been a (very) long time since I have used a Blackberry and frankly I am not missing it. I have also not tested the Blackberry Priv and will not do so but I still found the review interesting as I like some of the features that Blackberry built in it. For example I would like to have a notification if an app tries to access something and then bind it back if I don’t like it. But the more interesting and yet also more alarming part is that Blackberry will patch the Android OS on a monthly basis with security updates and in addition hotfixes when things cannot wait a month. More information can be found here but I ask myself if it really needs to be the phone vendor and not the OS vendor that should do that as this way we will never get to a better protected overall mobile phone base.
The Role of Machine Learning in Cyber Security
IT Pro Portal
I believe that machine learning and big data will have a huge impact on cybersecurity and we will see impactful applications especially of machine learning more and more in the close future. With that in mind I found the Q&A with Garry Sidaway (SVP Security Strategy & Alliances at NTT Com Security) interesting. It is fairly short but gives a few ideas on the topic.
False positives are a significant problem at many enterprises and valuable events get burried under large amount of data. It goes so far that I have talked to large companies who invested substantial money into SIEM’s only to then turn them off again as they could not handle the amount of information. This article takes a look at the problem of false positives and how they distract companies from dealing with legitimate security alerts.
As cyberattacks don’t just target typically one country it makes sense to approach the defense against them with a wider view than most of today’s critical infrastructure protection efforts do. The U.S. and UK have scheduled test response scenarios that will take place later this month in an effort to mitigate the consequences of a large-scale cyberattack again their respective financial sectors.
More Companies Form Data Breach Response Plans
Being prepared for a data breach is critical today as realistically your company will be breached or has been breached and you may or may not know about it. A new study by the Ponemon Institute finds that although more companies are launching new data breach response plans (good!), relatively few have confidence in their effectiveness (bad). Talking to many CISO’s and CIO’s it seems to me that most companies just don’t have the resources for this and in my view will have to more and more use managed security services and work with retainers for such events.
From a european perspective this is just plain silly. I have a few credit cards and only my american one does not have a chip and pin. Looking around there seems to be no problem whatsoever to use pins with credit cards on a quite large scale throughout Europe. Now some US retailers are looking to use PINs (personal identification numbers) on their store-branded credit cards that are embedded with computer chips, but are getting resistance from the banking industry. Really?
A new Android app is claimed to securely make phone calls and send messages , which Edward Snowden says he uses “every day.” I found that a bit a special statement and probably would touch that app even less if I would have an Android phone as now the attack motivation just skyrocketed and I have a hard time seeing how Edward Snowden would have the actual technical capabilities to verify the security of such an app.
ACSC Releases 2015 Threat Report
I always like to look through the different threat reports so will include this one here in my recommended reading list. The Australian Cyber Security Centre (ACSC) has released its 2015 Threat Report. It provides information about threats that Australian organizations are facing, such as cyberespionage, cyberattacks, and cybercrime and conclusions towards other geographies are certainly realistic.
And that is it for today and best wishes for the weekend!
Information on Cybersecurity is becoming almost overwhelming. The series on “this weeks top of the news in Cybersecurity” is a collection of a few articles that I found noteworthy throughout the week. Perfect weekend reading to catch up on events if you have missed them!
Another leak of classified documents on the use of America’s unmanned vehicles. It is not the first release of sensitive documents (remember Snowden and Chelsea Manning of course) and most likely it will not be the last. Everybody involved in sensitive topics should have a very hard look into their Cybersecurity investments and also put Information Rights Management on the list.
Law enforcement in the UK, U.S., as well as Interpol, are searching for cyberattackers who have stolen at least £20 million from British bank accounts through the Dridex malware. On the good news side is that with most security products (including Microsoft’s) the malware is detected now and removed.
Additional Information: The United States Computer Emergency Readiness Team (US-CERT) has released an alert to provide further information about the Dridex botnet.
There has been an increase in fraudulent purchases made at Walmart, most of which include charges that are US$50 and under. While this is US centric it serves as a warning to check your credit card statement diligently to detect such fraud activities. No credit card is safe today any more.
Wrong priorities in my view for the financial services institutions. A warning from the US Federal Bureau of Investigation (FBI) on October 8, 2015, was removed the next day. The announcement warned that chip-enabled credit cards should only be used with a PIN (personal identification number). The message was removed after there were complaints from banks that issue the credit cards. I know that many banks are very hesitant to talk about fraud and cyberrisks but if we want to make progress in this we need to be more open for information exchange.
The University of Cambridge reports that 87 percent of Android devices are exposed to at least one known critical vulnerability. I know that it is not always easy or even possible to update Android devices but it is crucial to do it as quickly as possible once an update is available. The latest Android version is called Marshmallow right in time for making smores – yumm!
Kudos to Amazon and Google as they have announced new features to provide security safeguards on their cloud services. One of the areas where Microsoft’s cloud services are heavily investing and in my view market leaders. It is good to see Amazon and Google investing here too significantly.
After 22 years of work, Mozambique was declared as free of land mine peril. During this long timespan over 200’000 land mines from a legacy of wars were one by one removed and destroyed in tedious and dangerous work. I am especially happy about this landmark in the global fight against landmines as I have a personal connection to this and want to use this occasion to look back.
Some of you might know that in an earlier role I was the program manager for the development and integration of the Information Management System for Mine Action IMSMA. Back in 1998, the Swiss Government wanted to support the United Nations Mine Action Service (UNMAS) in the fight against landmines and sponsored the development and integration of what in essence turned out to be a decision support system combined with an enterprise resource planning system that had a uniquely powerful integrated GIS component and was especially developed for supporting humanitarian demining. I had the opportunity to lead that program that found a home at the Center for Security Studies and Conflict Research at the Swiss Federal Institute of Technology where we worked on behalf of the United Nations.
At that time there existed a few databases that supported demining in different countries but nobody had yet attempted to standardize the datasets and create a system that could be used across different theaters of operation. Starting out from a green field, I was lucky to hire Thomas Schürpf and Beat Schoch and the three of us started working on a system that later became the standard application for Mine Action (another broader term for humanitarian demining). With the success in the field my team grew and in addition to software development we added training and integration specialists that helped the local mine action centers setting the system up, consulted them in how to best use and adapt it, and trained other organizations in performing IMSMA trainings. At some point the Swiss Government established the Geneva International Centre for Humanitarian Demining and from there on we developed the system on behalf of that Centre. In the end we had an install base in 41 countries worldwide, the system became the standard system for the United Nations, the European Union, the Organization of American States and we won the ESRI special achievement in GIS award in 2001. And to come back to the introduction – Mozambique was one of the countries that used the IMSMA system and where my team supported the center and Halo trust on-site.
Mozambique is now the second country that has been declared landmine free where IMSMA was used. The first one was Kosovo which was also the testbed for IMSMA and where we spent a lot of time on the ground and learned what it means to clear landmines and where the dangers lay. I will never forget the flight into Prishtina in a British Airforce CH-47 Chinook helicopter escorted by AH-64 Apache attack helicopters and looking out the semi-lowered loading ramp where the helicopter crew was spotting for surface to air missiles as the Kosovo conflict was only just spinning down. As the security situation was still critical, the initial work took place in the Kosovo Force (KFOR) Headquarters overlooking Prishtina without showers, sleeping in tents and working side-by-side with UK Army engineer officers to start the humantiarian demining work. The pictures on the left show a view into our initial set-up and how the landmine situation in Kosovo changed from 1999 to 2001. After the initial period the United Nations took over the mine action work and John Flanagan, the program manager of the United Nations Mission in Kosovo Mine Action Coordination Center, described the use of information and IMSMA the following way: “Information is a vital component of mine action. During the successful clearance operation in Kosovo, IMSMA enabled us to rapidly collate and analyze an enormous amount of data. This in turn helped us to plan and priooritize clearance efforts, and assisted with the integration of other activities such as mine awareness education. Throughout the entire mine action program in Kosovo, IMSMA was constantly used to manage the ongoing operational activities, and without it, our task would have been much more difficult.”
Obviously the main work has been done by the women and men on the ground who were doing the actual mine clearance. I have an enormous amount of respect for these people as I know out of experience that even with protective equipment to walk in mine infected areas is dangerous. Many that were doing that work got hurt, maimed and killed and even after this time I think of their sacrifices and of the impact they had on many lives saved. Thank you everybody that is involved in this line of work.
Thinking back also makes me proud. With my team we were – and after all this time still are as some of our original systems are still being used – part of eradicating landmines and contributed to reducing the amount of landmine victims by giving the tools and training for better awareness and improved priorization of clearance activities. This is probably one of the most meaningful things that I have so far done in my professional life and I am especially proud and grateful of the team that I was being able to build and lead. At this time I would like to thank them all for all their work, late nights and weekends. For their long hours abroad, in planes and in some “not so” comfortable and plain dangerous locations they went. Thank you especially Thomas Schürpf who started this with me and was leading the development, Beat Schoch who joined only a bit later and led the implementation and consulting team and Ralf Hug who led a development team. Also thank you to the the whole team that consisted of Armin Fessler, Christian Schluep, Emanuel Mahler, Maria Schabel, Mark Yarmoshuk, Martin Hochstrasser, Maurizio Bianchi, Nicolas Jene, Nicole Allet, Oliver Muff, Patrick Lombardi, Ralf Hug and Reto Schöning. And thanks to the many people that supported and helped us. We could have never done it without you. You all have my deep respect and gratitude.
Information on Cybersecurity is becoming almost overwhelming. Here you will find a few articles that I found noteworthy during last week. Happy reading!
A bit on what we are doing providing transparency to our customers and partners. Microsoft and NATO (North Atlantic Treaty Organization) have agreed to renew their partnership where NATO receives access to source code for key Microsoft products including Windows and Office, information about Microsoft’s cloud services, and intelligence about cybersecurity threats.
China Tries to Extract Pledge of Compliance from U.S. Tech Firms
The New York Times
A worrysome but not really surprising push. The Chinese government is asking some tech firms to pledge their commitment to policies that could require them to turn over user data and intellectual property.
White House Urged to Support Encryption
I believe encryption is one of the main ways to keep our data secured also in the future. Unfortunately many governments see it more as a threat. US President Obama reportedly is being urged to support encryption and shun legislation that would force companies to unlock customers’ smartphones and apps when presented with a court order. This raises the question what they then do if they actually don’t hold the encryption keys and cannot unlock them?
This was a disapointing article. Vodafone has admitted that it improperly accessed the phone of a reporter — who was writing an article about the online accessibility of personal information of millions of Vodafone customers — in an effort to find the reporter’s source.
As you can see I like Wired a lot. University researchers in 2010 privately disclosed their ability to hack into a car to the US National Highway Traffic and Safety Administration and also shared their exploit code with General Motors. However, the vulnerability was not patched until 2015. Vulnerabilities will continue existing but the key is to address them swiftly once they are discovered. 5 years is NOT swiftly! Google 90 days disclosure policywith exceptions if it is highly complicated.