Bruce Schneier

Harvard Faculty, Fellows, Staff, and Students An AI Cyber Lunch with Bruce Schneier. AI is a lot of things, but it's fundamentally a power-enhancing technology.

Regulators have largely taken a hands-off approach to AI during campaign season—and the consequences may be severe.

Harvard Faculty, Fellows, Staff, and Students An AI Cyber Lunch featuring data scientist Nathan Sanders.

Harvard Faculty, Fellows, Staff, and Students An AI Cyber Lunch with technology critic and industry analyst Sara M. Watson.

I am a public-interest technologist, working at the intersection of security, technology, and people. I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998. I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc. This personal website expresses the opinions of none of those organizations.

Harvard Faculty, Fellows, Staff, and Students An AI Cyber Lunch featuring Mikko Hypponen, Chief Research Officer at WithSecure.

The malware has been circulating since at least 2021. It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua Security said. It can also exploit CVE-2023-33246, a vulnerability with a severity rating of 10 out of 10 that was patched last year in Apache RocketMQ, a messaging and streaming platform that's found on many Linux machines.

Bruce Schneier and Nathan Sanders warn that AI will complicate the SEC's financially cutting in whistleblowers. "While AI automation will also help SEC staff process tips more efficiently, it could exponentially increase the number of tips the agency has to deal with, further decreasing the efficiency of the program."

When I create a virtual machine server in the Amazon cloud, I am prompted for an RSA public key that will be used to control access to the machine. Typically, I create the public and private keypair on my laptop and upload the public key to Amazon, which bakes my public key into the server's administrator account. My laptop and that remove server are thus entangled, in that the only way to log into the server is using the key on my laptop. And because that administrator account can do anything to that server—read the sensitivity data, hack the web server to install malware on people who visit its web pages, or anything else I might care to do—the private key on my laptop represents a security risk for that server.

Part of the problem is that we are constantly handed lists…list of required controls…list of things we are being asked to fix or improve…lists of new projects…lists of threats, and so on, that are not ranked for risks. For example, we are often given a cybersecurity guideline (e.g., PCI-DSS, HIPAA, SOX, NIST, etc.) with hundreds of recommendations. They are all great recommendations, which if followed, will reduce risk in your environment.