Nexus

Indispensible Need of National CERT in Pakistan

Read

In this advanced era where science and technology have become quite advanced, it leave not be incorrect to state that technology has become an essential component of our life whether it is about communication, medication, or something else. Information technology has earned a great deal of popularity in every developed country of modern age and it can be witnessed everywhere from traffic signs to power stations, from air ticketing to shopping deals, etc. Hence, it can be said that technology has become a basic ingredient of every facilitation available to the world in this high tech era.
In Pakistan, online sale purchase and other types of online jobs are gaining huge popularity with the passing of time. Now people prefer to do online transactions via using their credit cards and bank accounts online facility. Similarly, the recently announced 3G and 4G technology will also give a boost to the use of information technology.

Nevertheless, it is thus unfortunate that whatever has been discovered that is practised against the humankind in one or other form. The worst is now information technology is also being utilized as a weapon against humanity. Applying information technology as an abysmal weapon, the confidential information of the countries is being stolen, which can be applied.

A long list of evidences related to cyber-attacks is present when it comes to Pakistan. For example, various fiscal, educational, and diplomatic institutions of Pakistan Government and Pakistan Army were attacked by Indian Government Backed Hackers, back in 2010. Apart from this, various attacks were being prepared to steal secret information of the country. Almost 50-100 cyber-attacks are reported on Pakistani sites. The news concerned to these cyber-attacks made by international offices is not veiled from anyone, especially when it arrives to steal information via any virus or American NSA's cyber surveillance.

Modern countries of the current era are focusing extensively on cyber war and establishing cyber security research centers for the ultimate prevention of the cyber-attacks. Apart from this, the establishment of computer emergency response units is also in progress. Both of these cyber security research centers and computer emergency response units are of outstanding importance for their nation. The authorities cannot only keep an eye on their country’s Banking sector, but can also communicate with other countries to inform them about new cyber-attacks via these computer emergency response units. Moreover, these units will also become able to send the information related to cyber-attacks to different institutions of the country, especially to the commercial data center to bring these attacks to an end. This is the reason, which is why the secret information about the government and the banking sector of the countries having their computer emergency response units, is quite safe as compare to others, who do not own such units. Moreover, with these units, the effective and efficient cyber-attacks prevention strategies can also be implemented on time.

Everyone is concerned about the information technology and its security. However, its importance in Pakistan is still quite questionable where no one pays attention to the news related to hacking of seven banks in a week. The story does not end here. As per recent estimates, four government websites are receiving cyber-attacks on a daily basis, but no prevention technique is being adopted to stop these attacks. The authorities must understand that by hacking their official websites, the hackers can access to internal network system by infecting administration with their malware which can steal and forward all the significant files from C&C servers. In case of banking sector, they can get access to important credentials, including bank accounts, email passwords, and credit card details. Thus, being aware of the importance of cyber warfare is quite essential for our government and officials, especially in the current age of advance technology.

To avoid these cyber-attacks, the government of Pakistan must focus on the establishment of a computer emergency response unit of high excellence. It has been estimated that till 2020, Pakistan will go one of the secured high tech countries only if the government will establish computer emergency response unit till 2015. With this approach, Pakistan will not only become eligible to safeguard its industry, but will also become capable of protecting other nations from unauthorized access.

Hence, the essential requirement of this advanced era is to have computer emergency response units to eliminate the menace of cyber warfare and to enjoy cyber security. The expectations from PML-N government is quite high that the way they disseminate the network of optical fiber in the country, they introduced 3G and 4G in Pakistan, they will certainly work on the effective and efficient organization of quality computer emergency response units in the nation.

About The Author

This article has been written by "Mansab Chaudry", Chaudry is the founder of a Security company called Refluxes and the lead author at Whogothacked.com, A news blog covering Ethical hacking and Security news. In his free time he actively contributes to RHA with topics related to Cyber Security.

Read More Add comment

THE ANSWER IS ALWAYS PRIVATIZATION.

By 0x000216

Read

0 Comments

Jonah Goldberg's essay on poor management of VA hospitals is up to his usual standard:

We are constantly told that we could get so many wonderful, super-fantastic things done if only both sides would lay down their ideological blah blah blah blah and work together for yada yada yada. Well, welcome to the VA. How’s that working out for you?

"Work together"? What account of Republicans screwing veterans would you prefer -- the most recent, or some vintage?

It is absolutely true that the VA was plagued with problems before Obama came into office and Republicans who talk a lot about how much they love the military are open to criticism as a result. But Democrats talk about how much they love the government. And everything they need to make the VA work is available to them. And yet, it’s a mess and has been a mess for decades. Why? Maybe it’s a mess because such messes come with the territory when you put bureaucrats in charge. Criminality, as alleged, may not be inevitable (though I’m not so sure). But rationing, incompetence, bloat, waste, rent-seeking and a sort of legal corruption certainly are.

This is a perfect reductio ad wingnut: If a government agency has problems, it's proof that government can't do anything right, including things that governments pretty much have to do, like veterans' services. Who's going to take them over, the guys who run the outsourced prison industry? As I've said before, normal people can easily imagine what a for-profit medical corporation would do with uninsured veterans -- shove their gurneys in the general direction of a county hospital, probably, or secretly grind them down into pet food.

Nobody in their right mind believes veterans' care should be privatized. But cases of government mismanagement are windows of opportunity for conservatives, just as ambulances bring out ambulance chasers, and so here's Goldberg like Paul Newman at the beginning of The Verdict, except less in need of mouthwash than Shreddies, pressing privatization cards into the hands of the bereaved. Though, as I recall it, Newman's character was ashamed of himself.

Read More Add comment

MAPPING: Magna Carta, Carte Blanche and "the mother of all challenges"

By 0x000216

Read

0 Comments

"The mother of all challenges: how to reconcile security with freedom". This was the proposition that opened the final round of discussions on internet governance and surveillance at the MAPPING Extraordinary General Assembly in Rome today. Any Magna Carta for internet use would have to address this, said the first speaker in this session, addressing due process as well as substantive provisions for the benefit of stakeholders -- but would this be sufficiently robust to protect the interests of those who needed protection? A commitment to export control for internet-related technologies was also needed, he added, citing an observation made by a participant at a recent conference that the Chinese Wall which insulated China's populace from the web at large was built with Western bricks.

The second speaker admired the first speaker's statement about reconciling security with freedom, but added that, in his opinion, the mother of all challenges was how to reconcile security not with freedom but with privacy. He then enumerated the elements that any Magna Carta would need. These included all the obvious and usual points, together with user notification (so that an individual can challenge surveillance upon him which he might not otherwise know about), transparency and integrity of security systems (so they should not contain "back doors" through which surveillance might be conducted).

The next speaker addressed reform proposals that had been discussed in the United States which, unsurprisingly, appeared to be having much the same problems as the rest of us. This speaker urged that not only data but metadata should be governed by the law and that distinctions between US and non-US citizens should be abolished since there is no legal or constitutional basis for them. The third party doctrine (that there is no expectation of privacy where data is held by a third person) should be scrapped too, since it's meaningless where we don't hold emails on our own computers but leave them with distant hosts.The National Security Agency (NSA) bulk data-gathering practices should be stopped since there is no evidence that they have brought any positive results. Protection of users' needs should not be left in third party hands either: companies like Google and Verizon have less interest in the protection of individuals' data than do those individuals themselves. Use of market forces was also worth trying: for example, Germany has said that it won't give work to companies that give data to the NSA.

The next speaker spoke of a "flurry of principles" caused by various bodies and organisations expressing their sentiments concerning control of surveillance and freedom of opinion and expression. Hearings have been held, proposals for data protection and routing made, legal proceedings have been commenced and diplomatic action initiated. In the long term there might be a formal agreement, but in the meantime there will be more of a consolidation of principles within the global community. Definitions must replace carte blanche as to what is necessary, what is proportional, what is justifiable.

At this point the Assembly was thrown open for discussion again. A tricky topic raised at this point was how to give people a trusted online identity that will enable people to trust that the person they are dealing with is indeed the person they think it is. The US National Strategy for Trusted Identities in Cyberspace (NSTIC) initiative was a case in point. Another discussant suggested that there were times when identity is crucial, such as where a patient seeks medical help, and times when it may be undesirable, such as when a citizen is seeking information from a government.

Other topics discussed at this point included data retention as a surveillance issue, how to get Parliamentary involvement and the voluntary adoption of internet technical standards, whether the real danger to the internet was provided by organisations like the NSA or giant users like Google and Facebook and whether a piece of paper such as a governance treaty was sufficient when what was truly needed was a "G20".

Read More Add comment

tutorial - HTTP Response Status Code List

By 0x000216

Read

0 Comments

Read More Add comment

MAPPING: the debate continues

By 0x000216

Read

0 Comments

After lunch, MAPPING's programme for its Extraordinary General Assembly was reshuffled a bit in order to accommodate further questions and answers arising out of the morning session. Enforcement and monitoring of the terms of a possible convention, as well as discussion of which convention might be invoked, were among the topics raised. This blogger's impression is that the sentiment of the meeting was very much in favour of the Council of Europe rather than the European Union taking the lead in internet governance issues, notwithstanding the greater homogeneity of the EU.

The notion of parallel internets was also raised. Countries like Turkey and Russia were cited as being among those that might wish to fragment the internet so that it operates the way they'd like it to-- as China and Tunisia in before the Arab Spring have to some extent done -- and no international treaty would deter them from doing so. One speaker from the floor mentioned that there are already parallel internets that exist outside national boundaries: Facebook is de facto a parallel internet.

Another issue raised was that of tackling hypocrisy, where governments criticise each other for trammelling individuals' rights but do the same themselves, and where businesses incorporate infringement of personal rights into their own business plans. This can only be cured by identifying acceptable standards and then promoting them in order to change people's attitudes -- but would this be sufficient? Cultural relativism was also considered. Different cultures and religions (Islam was specifically mentioned here) have divergent standards for what content is acceptable, and one country's censorship is another's protection of treasured values.

The formal part of the afternoon session opened with a panel session at which each panel member [names withheld for Chatham House purposes: Grrrr!] spoke in turn on reform of internet governance of surveillance. The first speaker raised (among other cases) the French Yahoo! litigation, of which many people today seem to have no knowledge, in which a French court ordered Yahoo! to take all available measures to prevent access of French internet users to a website hosted in the US and which sold Nazi memorabilia; a US court then refused to enforce the French court's order but the 9th Circuit Court of Appeals ordered that Yahoo! had to comply with the French order. This was really a conflict of jurisdiction case rather than one decided on the basis of internet law. How would a cybercrime convention have affected cases such as this -- or indeed last week's ruling of the Court of Justice of the European Union in Google Spain? The latter affirms that EU law applies to Google and that individuals can ask search engine companies to remove them from search results even where the information is held on a web page and is not removed from it.

What of due process and the rule of law? Initially an individual has recourse to the internet service provider. If that doesn't work, the formal legal procedure kicks in. We have also made progress in establishing the extent to which human rights translate from the physical world to the internet, the first panellist added. Finally, what is needed is political will on the part of government in order to articulate what human rights and proper principles mean, and what measures of enforcement exist. More is needed than the slow-track mechanism of having to go to the European Court of Human Rights. As for trade in surveillance software and hardware, could the same techniques deployed in relation to dual-use military technologies be used here too?

Further questions and comments were invited at this point, some of which related to discussion of a formal surveillance treaty with both substantive and procedural provisions. Another point, made with some force, was the problem of getting information at European level to trickle down to national legislators and to get them to engage with this subject at all (much the same applied to judges, it was also observed).