Conversation

Notices

1. Embed this notice
   Ravi Nayyar (ravirockks@infosec.exchange)'s status on Tuesday, 17-Dec-2024 07:48:20 JST Ravi Nayyar

   '[Salt Typhoon] breached at least eight US telecommunications providers ...

   '... we do not believe any have fully removed the Chinese actors from these networks ...'

   We have a number.
   https://edition.cnn.com/2024/12/04/politics/us-telecom-providers-chinese-hack/index.html

   • Embed this notice
     Ravi Nayyar (ravirockks@infosec.exchange)'s status on Tuesday, 17-Dec-2024 07:48:19 JST Ravi Nayyar

     in reply to

     Folks, this guidance on countering Salt Typhoon/Friends is not rocket science to implement if you have budget and a Board which cares about the core business.

     Question is: do you have those two things?
     https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/enhanced-visibility-and-hardening-guidance-communications-infrastructure

   • Embed this notice
     Ravi Nayyar (ravirockks@infosec.exchange)'s status on Tuesday, 17-Dec-2024 07:48:49 JST Ravi Nayyar

     in reply to

     Salt Typhoon breached US telcos because of longstanding, catastrophic cultural—>security failures at said telcos.

     The FCC is quite late.
     https://www.fcc.gov/document/rosenworcel-proposed-requiring-telecom-carriers-secure-their-networks

   • Embed this notice
     Ravi Nayyar (ravirockks@infosec.exchange)'s status on Tuesday, 17-Dec-2024 07:48:49 JST Ravi Nayyar

     in reply to

     People blaming law enforcement’s opposition to E2EE for Salt Typhoon must, in the same breath, blame catastrophic cyber governance at telcos.

     Anyone can be hostile to encrypted apps, but it is the telcos’ Boards that make security decisions at the telcos, not law enforcement.

     Kevin Beaumont repeated this.
   • Embed this notice
     Ravi Nayyar (ravirockks@infosec.exchange)'s status on Tuesday, 17-Dec-2024 07:48:49 JST Ravi Nayyar

     in reply to

     FCC chair acknowledging that the FCC’s leaving of telecom cybersecurity to glorified self-regulation was stupid.

     Not sure how the size of the threat is new, but good to see this official realisation.

     https://www.politico.com/newsletters/weekly-cybersecurity/2024/12/16/the-rocky-road-ahead-for-states-anti-disinfo-efforts-00194434