ISIS & media (catch all)

**Bill Moore** · 04-09-2015

It was only a matter of time until something of this scale happened, and I suspect it will only get worse. It will also only be a matter of time until they employ advanced conventional weapons and unconventional weapons in the West.

**davidbfpo** · 04-10-2015

Once this "genie is out of the bottle" then this tactic can be used. Nor should we overlook the widely reported suspicion that the nation-state - a broad label - have used it too, Stuxnet comes to mind.

**Bill Moore** · 04-10-2015

and the attack on Sony allegedly by North Korea.

A few more examples in this article:

http://www.reuters.com/article/2015/...0MY06Z20150407

At security company Trend Micro Inc. , which compiled the report for the OAS, Chief Cybersecurity Officer Tom Kellermann said additional destructive or physical attacks came from political activists and organized crime groups.

“We are facing a clear and present danger where we have non-state actors willing to destroy things,” he said. “This is going to be the year we suffer a catastrophe in the hemisphere, and when you will see kinetic response to a threat actor.”

Those thinking about cyber defense are considering taking the offensive, since defensive tactics and technology have proved inadequate. The following article includes the rare occurrence of a British citizen complementing the U.S. :-).

http://www.tripwire.com/state-of-sec...sive-security/

The fact of the matter simply put are, we are seeing far too many successful attacks take place against organisations who are actually spending small fortunes on their security defences and capabilities, which at the same time are still leaving them insecure post the granting of a valued ‘tick’, which leave the assessed organisation still exposed to the nightmare of their unknown unknowns – enter Offensive Security.

When we refer to the subject of Offensive Security, we look beyond what is seen as red-team testing, and embrace an activity which encompasses the dark-arts of our adversaries, which goes well before the world of penetration testing, and over focuses on what we already know, or think we need – to subject it to a programme of security testing. In fact, here when representing a client, I asked the assigned penetration tester what they felt the client should include in the testing schedules, and they responded: “Just tell us the IP range, and we will run this testing based on that input.”