Month: April 2016

Microsoft is buying ten million strands of DNA from biology startup Twist Bioscience to investigate the use of genetic material to store data.

The data density of DNA is orders of magnitude higher than conventional storage systems, with 1 gram of DNA able to represent close to 1 billion terabytes (1 zettabyte) of data. DNA is also remarkably robust; DNA fragments thousands of years old have been successfully sequenced.

These properties make it an intriguing option for long-term data archival. Binary data has already been successfully stored as DNA base pairs, with estimates in 2013 suggesting that it would be economically viable for storage of 500 years or more.

This breach was likely not caused by a default password. But too many data breaches in 2015 were. (credit: Jim Barton)

The number of reported breaches of organizations' data has been growing hyperbolically over the past few years, based on data in Verizon's 2016 Data Breach Investigations Report (DBIR). And a major reason for that is that many organizations are still doing security like they were decades ago. The leading cause of reported data breaches, as documented by Verizon, is "miscellaneous errors"—mistakes made by employees—that open the door to attackers.

For those who've followed the recent chain of crypto-ransomware attacks at hospitals around the country, this finding will come as no surprise. Issues such as system misconfiguration, end users sending sensitive data out of the network by mistake, or users clicking on stuff they shouldn't be clicking on were among the errors made by organizations that led to about 18 percent of the data breaches documented in 2015—and were likely the leading contributor to the many incidents that went unreported.

In 63 percent of "confirmed" breaches, attackers took advantage of weak password credentials, default passwords left in place, or passwords that were stolen through phishing attacks or other means. In other words, if organizations were using something other than just usernames and passwords as credentials to gain access to systems, more than half of the data breaches that happened in 2015 would not have occurred.

(credit: Dennis Skley)

The US House unanimously approved legislation Wednesday requiring the authorities to obtain a court warrant to acquire e-mail and stored cloud data.

The Email Privacy Act unwinds a President Ronald Reagan-era law that allows the authorities to access e-mail and data from service providers without a warrant if the message or data is at least 180 days old. The 1986 e-mail privacy law, adopted when CompuServe was king, considered cloud-stored e-mail and other documents older than six months to be abandoned and ripe for the taking.

The measure now goes to the Senate, where its passage is unknown. The Senate Judiciary Committee for years has debated, and even passed similar legislation, which has gone nowhere. President Obama must also sign the bill, and it's unlikely yet hopeful it would reach his desk before his term expires in January.