Seriously Risky Business

Seriously Risky Business is a weekly newsletter focused on significant stories impacting cyber policy. It covers themes including privacy laws, international cyber incidents, cybersecurity strategies, government surveillance, ransomware, and the intersection of technology with national security. The newsletter examines government and corporate responses to cyber threats and legislative developments.

Cybersecurity Policy Privacy and Surveillance International Cybersecurity Incidents Government Cyber Operations Ransomware Attacks Legislation and Regulation Technology and National Security

The hottest Substack posts of Seriously Risky Business

And their main takeaways

Russia's Cyber War Gets Smarter… And Dumber

0 implied HN points • 11 Jan 24
🕹 Technology Cybersecurity Espionage Ransomware Telecommunications
  1. Russia's cyber activities in Ukraine are a mix of smart surveillance techniques and flashy, but counterproductive, destructive operations.
  2. Although a recent cyber attack by Russia on Kyivstar caused widespread disruption, it ultimately resulted in short-lived impact and missed potential intelligence gains.
  3. Israeli cyber operations, like the Predatory Sparrow attacks in Iran, aim to send warnings but may not be effective in the current high-conflict environment.

G-Men Gone Wild

0 implied HN points • 25 May 23
🕹 Technology Cybersecurity Surveillance Malware Ransomware
  1. The FBI's misuse of Section 702 data is causing concerns about its renewal before expiration.
  2. Section 702 allows US intelligence agencies to conduct targeted surveillance of foreigners internationally.
  3. Recent updates by the FBI aim to reduce improper database queries and protect US citizens' privacy.

North Korea Is Ransomware's New Kid on the Block

0 implied HN points • 16 Feb 23
🕹 Technology Cybersecurity Data Privacy Surveillance Cryptocurrency Social media
  1. North Korea has entered the ransomware business, using different tools and posing potential challenges with their cyber activities.
  2. The US and other countries are implementing coordinated sanctions to disrupt ransomware payment ecosystems and deter cybercriminals.
  3. Biden's emphasis on privacy in the State of the Union address could potentially lead to bipartisan support for comprehensive data privacy laws, focusing on enhancing consumer rights, industry standards, and cybersecurity.

Grandpa Biden: Cyber President

0 implied HN points • 09 Mar 23
🕹 Technology Cybersecurity Data Privacy IOT
  1. The US Cyber Security Strategy involves 5 main pillars to defend infrastructure and disrupt threats.
  2. Targeting ransomware and shaping market forces are key components of the strategy to combat cyber threats.
  3. Legislation is being considered to shift liability to software makers for introducing vulnerable products, aiming to improve security.
Get a weekly roundup of the best Substack posts, by hacker news affinity:

Air Force. Navy. Army. Cyber Force?

0 implied HN points • 30 Mar 23
🕹 Technology Cybersecurity Government Hacking Ransomware Cryptocurrency
  1. A proposal for a US Cyber Force as a 7th branch of the armed services is being considered, but there are concerns about the necessity and impact of such a move.
  2. Biden's executive order on spyware aims to restrict commercial spyware use by the US government, formalizing existing practices, and working in conjunction with legislative initiatives.
  3. The UK's NHS released a cyber security strategy focusing on collaboration, risk management, and learning from past cyber incidents, addressing challenges like limited cyber workforce and legacy technology.

Smile! You've Been Sanctioned

0 implied HN points • 25 Jan 24
🕹 Technology Cyber Security Finance Government Hacking Data Privacy
  1. Governments coordinated sanctions against cybercriminals can deter bad behavior and affect cybercrime business prospects.
  2. Microsoft's security breach highlights the need for improved security standards and better practices.
  3. Increased disclosure of non-material cybersecurity incidents to SEC may raise concerns about clutter but could be vital for transparency and awareness.

PRC: Not Stealthy, Just Annoying

0 implied HN points • 18 Jan 24
🕹 Technology Cybersecurity Data Privacy Hacking Legislation
  1. Chinese cyber espionage groups are using techniques that make detection and eviction difficult, targeting end-of-life devices for botnet operations.
  2. The FTC's settlement with a data broker over the sale of sensitive location data highlights the need for stronger data privacy laws in the US.
  3. US cyber security efforts show promise with expectations for more disruption operations, potential removal of degree requirements, and positive reviews for cyber diplomats.

"Putin's Chef" Cooks up Infosec Disaster

0 implied HN points • 23 Mar 23
🕹 Technology Security Software Data Breaches Mobile devices Internet
  1. A group of hackers stole internal documents from businesses controlled by 'Putin's Chef', revealing poor infosec practices.
  2. Security firms report that security and network products have significant vulnerabilities, making them a weak point in cybersecurity.
  3. US demanding a forced sale of TikTok due to concerns about Chinese influence, indicating the complicated relationship between technology, politics, and cybersecurity.

North Korea's "Vibes-Based" Targeting

0 implied HN points • 27 Apr 23
🕹 Technology Cybersecurity Government Privacy Cyberattacks Information Sharing
  1. North Korea has a unique approach to targeting priorities and operations, focusing on 'access begets access' which differs from tightly scoped operations by Five Eyes agencies.
  2. Iran shows a shift in cyber operations policy, engaging in destructive attacks targeting US critical infrastructure potentially as a response to previous cyberattacks on Iran.
  3. Privacy concerns arise regarding governments purchasing netflow data, but Team Cymru's data is selectively ingested for cyber threat analysis and unlikely to contribute to mass surveillance.

The RESTRICT Act Is Not About TikTok

0 implied HN points • 16 Mar 23
🕹 Technology Cyber Security Legislation Reports Malware Incident Response
  1. The RESTRICT Act is bipartisan legislation aimed at enhancing the US government's ability to address threats from foreign technology companies.
  2. Governments like Australia implement laws for cyber incidents, but it can be controversial due to potential overreach.
  3. Global efforts are being made to combat cybersecurity threats, such as the CISA's Ransomware Vulnerability Warning Pilot program.

US Data Dumpster Fire Singes NSA

0 implied HN points • 01 Feb 24
🕹 Technology Cybersecurity Government Data Privacy Hacking Intelligence Agencies
  1. US Senator Ron Wyden is pushing to stop US intelligence agencies from buying Americans' personal data obtained illegally by data brokers.
  2. The NSA does not buy location data from phones or vehicles in the US, focusing on data related to cybersecurity missions.
  3. Election interference tactics continue to evolve, with the PRC using AI avatars, fake documents, and leaked information to influence outcomes.

IC Reform is Great, but Decent Privacy Laws Would Be Even Better

0 implied HN points • 15 Jun 23
🕹 Technology Incident Response Cyber Attacks Internet Security Data Privacy
  1. IC reform is important, but decent privacy laws are even more crucial.
  2. The US Intelligence Community needs better policies to protect citizens' privacy and civil liberties regarding Commercially Available Information (CAI).
  3. The focus on improving IC behavior regarding CAI should also extend to federal data privacy legislation to prevent data misuse by law enforcement and foreign adversaries.

We Cannot Allow a Spy Balloon Gap!

0 implied HN points • 09 Feb 23
  1. There was a spy balloon incident between the US and China, with accusations and diplomatic fallout.
  2. Iran was linked to a cyber attack on French satirical magazine Charlie Hebdo.
  3. A ransomware attack on the Irish national health service showcases its impact and the internal dynamics of the attackers.

Move Over NSO Group, There's a New Internet Villain

0 implied HN points • 23 Feb 23
🕹 Technology Security Social media Ransomware
  1. An undercover investigation revealed the activities of an Israeli election interference-for-hire company called Team Jorge, involving disinformation tactics and interference capabilities.
  2. Team Jorge utilized a social media botnet named AIMS to control 30,000 personas across multiple platforms, alongside other tactics like denial of service attacks and hacking operations.
  3. Google's report on Russian cyber activities during the Ukraine conflict highlighted mixed results in the aggressiveness of Russian government cyber actors, particularly in destructive attacks and intelligence collection efforts.

UK's National Cyber Force: A Bunch of Mindf-ckers

0 implied HN points • 06 Apr 23
🕹 Technology Cybersecurity Malware Hacking Tech industry
  1. The UK's National Cyber Force aims to disrupt adversary behavior by exploiting their reliance on digital technology.
  2. Offensive cyber operations by the NCF focus on cognitive effects and disrupting adversary systems over a period.
  3. The response to the 3CX supply chain attack was quicker compared to past breaches, showing improvement in addressing cyber threats.

After Viasat, Space Systems Get Scrutiny

0 implied HN points • 20 Apr 23
🕹 Technology Cyber Security International cooperation
  1. The US government is considering designating space systems as critical infrastructure due to increasing threats from adversarial nations.
  2. The US State Department is working on a cyber disaster relief program to help allies and partners recover from cyber attacks.
  3. International cyber security authorities are advocating for building products with 'Security-by-Design and Default' to enhance cybersecurity and reduce vulnerabilities.

Iran: Fake It Till You Make It

0 implied HN points • 04 May 23
🕹 Technology Cybersecurity Legislation Data Breaches Tech news
  1. Iran is adopting a 'fake it till you make it' approach by combining cyber and influence operations.
  2. China's influence operations focus on promoting government narratives rather than amplifying cyber operations.
  3. The UK's National Cyber Force takes a more controlled and truthful approach to cyber operations, influencing people's actions through cognitive effects.