March 2020 - nexa - server-nexa.polito.it

La Ministra Pisano, il covid-19 e la Privacy

by Matteo G.P. Flora

Carissimi, giusto una breve per rimandarvi alla chiacchierata che sono riuscito a fare con la Ministra dell'Innovazione, Paola Pisano. <https://youtu.be/1TuzLUYMry0> Oltre al racconto del progetto #SolidaritàDigitale del Ministero, la chiacchierata si concentra su altri tre temi secondo me importanti: il "post-covid", le necessità strutturali ancora inevase dalla politica e soprattutto la parte di Privacy, soprattutto in concomitanza con l'avvento delle famigerate "app di tracciamento". La posizione della Ministra è davvero limpida: "non si fa niente senza prima autorizzazione delle Autorità preposte". E nella sua "semplicità" credo che sia un messaggio davvero forte. Niente di "groundbraking", ma come spesso accade nelle chiacchierate con "tecnici" che faccio in trasmissione da tre anni a questa parte, potete trovare una mezz'oretta in cui si parla "da tecnici a tecnici" senza molti dei fronzoli per il grande pubblico :) Qui: <https://youtu.be/1TuzLUYMry0> M. P.S. Se avete storie interessanti da raccontare ad un centinaio di migliaia di professionisti del Digitale in tutta Italia, prevalentemente in ruoli direzionali, parliamone. Sono sempre alla ricerca delle chiacchierate interessanti. :) -- [image: photo] *Matteo G.P. Flora* Founder and CEO, TF Group srl +39.347.9676430 | mf(a)thefool.it http://thefool.it Via Vitruvio, 1, Milano (MI), Italy <http://us.linkedin.com/in/matteoflora> <http://facebook.com/lastknight> <http://youtube.com/user/mgpfvideo> <http://twitter.com/lastknight> -- [image: photo] *Matteo G.P. Flora* Founder and CEO, TF Group srl +39.347.9676430 | mf(a)thefool.it http://thefool.it Via Vitruvio, 1, Milano (MI), Italy <http://us.linkedin.com/in/matteoflora> <http://facebook.com/lastknight> <http://youtube.com/user/mgpfvideo> <http://twitter.com/lastknight>

March 22, 2020

Fwd: [RISKS] Risks Digest 31.62

by Diego.Latella

Cari, Seguono stralci dalla RISKS-LIST 31(62) Buona lettura Diego RISKS-LIST: Risks-Forum Digest Saturday 21 March 2020 Volume 31 : Issue 62 ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, founder and still moderator ***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as <http://catless.ncl.ac.uk/Risks/31.62> The current issue can also be found at <http://www.csl.sri.com/users/risko/risks.txt> Contents: [Cleaning up part of the backlog; more to come] Many to blame in fatal crash of a Tesla (Tom Krisher via PGN) [ ... OMISSIS ...] Boeing Culture Concealment 747 Max report (The Guardian) [ ... OMISSIS ...] Live Coronavirus Map Used to Spread Malware (Krebs) [ ... OMISSIS ...] Crimea, Kashmir, Korea -- Google redraws disputed borders, depending on who's looking (WashPost) [ ... OMISSIS ...] Abridged info on RISKS (comp.risks) ---------------------------------------------------------------------- Date: Sat, 21 Mar 2020 12:33:06 PDT From: "Peter G. Neumann" <neumann(a)csl.sri.com> Subject: Many to blame in fatal crash of a Tesla (Tom Krisher via PGN) Tom Krisher, SFChronicle.com (which as usual ignores the existence of the Science Fiction Chronicle), front page of the Chron's Business Report, 21 Mar 2020, PGN-ed As we have noted in many cases (including Deepwater Horizon RISKS-29.49, the Boeing 737 Max, and many others), attempts to place blame are often frustrated by reality: blame may be widely distributed. The cited article by Tom Krisher notes the National Transportation Safety Board (NTSB) report released on 19 Mar 2020 on the Tesla crash on 1 March 2019 in Delray Beach, Florida. The Tesla was under Autopilot driving at 69 mph when the Autopilot neither braked or otherwise attempted to avoid a tractor-trailer that crossed in its path. The report noted that all of the following factors were relevant: * The driver of the Tesla for not paying attention. He had turned the Autopilot on just 12.3 seconds before impact. Autosteer (which keeps the car centered in its lane) turned on 2.4 seconds later. * The driver (who was not injured) of the tractor-trailer, which sheared off the roof of the Tesla * Tesla, because it allowed the driver to avoid paying attention to the Autopilot, and to limit where it was safe to use the Autopilot, activating it in conditions for which it was not designed. (However, Tesla told the NTSB investigators that ``forward collision warning and automatic emergency braking systems on Model 3 in the Delray cash weren't designed to activate for crossing traffic or to prevent crashes at high speeds.'' Tesla also had noted that the driver wasn't warned about not having his hands on the wheel ``because the approximate 6-second duration was too short to trigger a warning under the circumstances.'' However, Tesla also claims that ``the Autopilot is a driver-assist system, and that drivers must be ready to intervene at all times.'' * The National Highway Traffic Safety Administration (NHTSA) for its lax regulations, and failing to put limits on the use of automated driving systems to just those cases in which they were designed to work A statement for the NTSB chairman Robert Sumwalt noted this was the ``third fatal vehicle crash we have investigated where a driver's overreliance on Tesla's Autopilot and the operational design of the Tesla's Autopilot have led to tragic consequences.'' Krisher notes that the Delray Beach crash was remarkably similar to one in Williston FL in 2016, which also killed the driver of a Tesla. ------------------------------ [ ... OMISSIS ...] ------------------------------ Date: Sat, 7 Mar 2020 12:47:02 PST From: "Peter G. Neumann" <neumann(a)csl.sri.com> Subject: Boeing Culture Concealment 747 Max report (The Guardian) https://www.theguardian.com/business/2020/mar/06/boeing-culture-concealment… https://transportation.house.gov/imo/media/doc/TI%20Preliminary%20Investiga… ------------------------------ [ ... OMISSIS ...] ------------------------------ Date: Sun, 15 Mar 2020 16:24:01 -0400 From: Monty Solomon <monty(a)roscom.com> Subject: Live Coronavirus Map Used to Spread Malware https://krebsonsecurity.com/2020/03/live-coronavirus-map-used-to-spread-mal… ------------------------------ [ ... OMISSIS ...] ------------------------------ Date: Sun, 8 Mar 2020 14:53:02 -0400 From: Gabe Goldberg <gabe(a)gabegold.com> Subject: Crimea, Kashmir, Korea -- Google redraws disputed borders, depending on who's looking (WashPost) The Silicon Valley firm alters maps under political pressure and the inscrutable whims of tech executives https://www.washingtonpost.com/technology/2020/02/14/google-maps-political-… The risk? War... ------------------------------ [ ... OMISSIS ...] ------------------------------ Date: Mon, 14 Jan 2019 11:11:11 -0800 From: RISKS-request(a)csl.sri.com Subject: Abridged info on RISKS (comp.risks) The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is comp.risks, the feed for which is donated by panix.com as of June 2011. => SUBSCRIPTIONS: The mailman Web interface can be used directly to subscribe and unsubscribe: http://mls.csl.sri.com/mailman/listinfo/risks => SUBMISSIONS: to risks(a)CSL.sri.com with meaningful SUBJECT: line that includes the string `notsp'. Otherwise your message may not be read. *** This attention-string has never changed, but might if spammers use it. => SPAM challenge-responses will not be honored. Instead, use an alternative address from which you never send mail where the address becomes public! => The complete INFO file (submissions, default disclaimers, archive sites, copyright policy, etc.) is online. <http://www.CSL.sri.com/risksinfo.html> *** Contributors are assumed to have read the full info file for guidelines! => OFFICIAL ARCHIVES: http://www.risks.org takes you to Lindsay Marshall's searchable html archive at newcastle: http://catless.ncl.ac.uk/Risks/VL.IS --> VoLume, ISsue. Also, ftp://ftp.sri.com/risks for the current volume or ftp://ftp.sri.com/VL/risks-VL.IS for previous VoLume If none of those work for you, the most recent issue is always at http://www.csl.sri.com/users/risko/risks.txt, and index at /risks-31.00 Lindsay has also added to the Newcastle catless site a palmtop version of the most recent RISKS issue and a WAP version that works for many but not all telephones: http://catless.ncl.ac.uk/w/r ALTERNATIVE ARCHIVES: http://seclists.org/risks/ (only since mid-2001) *** NOTE: If a cited URL fails, we do not try to update them. Try browsing on the keywords in the subject line or cited article leads. Apologies for what Office365 and SafeLinks may have done to URLs. ==> Special Offer to Join ACM for readers of the ACM RISKS Forum: <http://www.acm.org/joinacm1> ------------------------------ End of RISKS-FORUM Digest 31.62 ************************ -- Dott. Diego Latella - Senior Researcher - CNR/ISTI, Via Moruzzi 1, 56124 Pisa, IT (http:www.isti.cnr.it [1]); FM&&T Laboratory (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - phone: +39 0503152982 - mob: +39 348 8283101 - fax +39 0503152040 Links: ------ [1] http://www.isti.cnr.it

March 22, 2020

Tim Wu recensisce Zuboff (NYRB)

by J.C. DE MARTIN

Una delle migliori recensioni del libro di Zuboff. L'unico neo di un certo rilievo è che ignora che il "dossieraggio" aveva un cospicuo valore economico già a partire dagli anni '60 nell'ambito del "credit scoring" (v. Frank Pasquale) e forse anche in altri ambiti. jc https://www.nybooks.com/articles/2020/04/09/bigger-brother-surveillance-cap… Bigger Brother Tim Wu <https://www.nybooks.com/contributors/tim-wu/> April 9, 2020 Issue <https://www.nybooks.com/issues/2020/04/09/> The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power <https://www.amazon.com/gp/product/1541758005?ie=UTF8&tag=thneyoreofbo-20&li…> by Shoshana Zuboff PublicAffairs, 691 pp., $38.00 In the 1970s, when Shoshana Zuboff was a graduate student in Harvard’s psychology department, she met the behavioral psychologist B.F. Skinner. Skinner, who had perhaps the largest forehead you’ll ever see on an adult, is best remembered for putting pigeons in boxes (so-called Skinner boxes) and inducing them to peck at buttons for rewards. Less well remembered is the fact that he constructed a larger box, with a glass window, for his infant daughter, though this was revealing of his broader ambitions. Zuboff writes in /The Age of Surveillance Capitalism/ that her conversations with Skinner “left me with an indelible sense of fascination with a way of construing human life that was—and is—fundamentally different from my own.” Skinner believed that humans could be conditioned like any other animal, and that behavioral psychology could and should be used to build a technological utopia where citizens were trained from birth to be altruistic and community-oriented. He published a novel, /Walden Two/ (1948), that depicted what just such a society would look like—a kind of /Brave New World /played straight. […] Continua qui: https://www.nybooks.com/articles/2020/04/09/bigger-brother-surveillance-cap…

March 21, 2020

Russia Has New Tool For Massive Internet Shutdown Attack, Leaked Documents Claim - Defense One

by Alberto Cammozzo

<https://www.defenseone.com/technology/2020/03/russia-has-new-tool-massive-i…> As the world hunkers down in coronavirus isolation and relies on the internet more than ever, a group of dissidents has revealed that Russia has new tools to shut down internet services by tapping internet-connected cameras and similar smart devices. It’s a new version of an old weapon — a creator of botnets that can drive an internet service offline with floods of fake data — that puts to use a previously untapped source of computing power: the ever-growing “internet of things.” The new botnet tool was revealed in documents that give instructions for using a suite of hacking apps called Fronton, Fonton-3D, and Fonton-18. That doesn’t mean the Russian FSB security service will soon be peering through Americans’ cell phones and laptops or internet-connected doorbells. Instead, it means that the Russian government has a new tool for creating a DDoS-capable botnet. These botnets harness the computing power of millions of internet-connected things, direct them to spew random data at specific computers, and overwhelm vital services into uselessness. With millions of Americans newly teleworking during the COVID-19 pandemic, the United States has never been more dependent on the internet. The internet of things, or IoT, is a term-of-art for the vast array of electronic products that connect to the internet, from refrigerators to medical equipment to automobiles. IoT vulnerabilities have long worried national security experts who say adversaries could exploit them to shut down entire sectors of digital capabilities and infrastructure. The documents say “An attack on national DNS servers can make the Internet inaccessible for several hours in a small country.” On Wednesday, the group Digital Revolution claimed to have obtained technical documents that detail a suite of hacking tools — Fronton, Fonton-3D, and Fonton-18 — and offer advice for tapping into smart devices, including security cameras. Created in 2017 and 2018 by Russia’s FSB Information Security Center, the documents explain how to use the tools to make large botnet attacks on critical national services. [...]

March 21, 2020

Il decreto legge "Cura Italia" - La norma sugli appalti

by Maurizio Mensi

Buongiorno, mi permetto di condividere alcune considerazioni sull'art. 75 del decreto legge "Cura Italia". https://formiche.net/2020/03/cloud-golden-power-sicurezza-mensi/ Maurizio ________ Maurizio Mensi maurizio.mensi(a)gmail.com

March 21, 2020

Re: [nexa] Iniziamo le riflessioni per il dopo

by M. Fioretti

On Sat, Mar 21, 2020 19:36:39 PM +0100, monica.palmirani wrote: > Nel tempo che ci è dato in questo momento di smart working e di isolamento > dovremmo iniziare a pensare seriamente al dopo perché un dopo ci sarà e a > come vogliamo che sia. Con ovvia preghiera di commento e massima diffusione, e non che sia una gara ovviamente... Io ho iniziato venti giorni fa con questo http://stop.zona-m.net/2020/03/how-to-take-advantage-of-coronavirus/ e continuo con questa serie: http://stop.zona-m.net/tag/coronavirus/ Marco -- M. Fioretti http://mfioretti.com http://stop.zona-m.net Your own civil rights and the quality of your life heavily depend on how software is used *around* you

March 21, 2020

Iniziamo le riflessioni per il dopo

by monica.palmirani

Nel tempo che ci è dato in questo momento di smart working e di isolamento dovremmo iniziare a pensare seriamente al dopo perché un dopo ci sarà e a come vogliamo che sia. Diritto, economia, società, tecnologia, scienza, etica e le relazioni fra questi domini non saranno più uguali a prima. Cogliamo l'occasione per iniziare riflessioni strutturate da portale alla politica, all'industria, alla società civile, all'Europa, al mondo. https://www.corriere.it/cronache/20_marzo_20/virus-dopo-ecco-mia-lista-cose… =========================================== Full professor of Legal Informatics School of Law Coordinator of MSCA-ITN EJD LAST-JD-RIoE Scientific Director of Legal Blockchain Lab Director of the Summer School LEX Alma Mater Studiorum Università di Bologna C.I.R.S.F.I.D.http://www.cirsfid.unibo.it/ Palazzo Dal Monte Gaudenzi - Via Galliera, 3 I - 40121 BOLOGNA (ITALY) Tel +39 051 277217 Fax +39 051 260782 E-mailmonica.palmirani(a)unibo.it

March 21, 2020

In the battle against coronavirus, personal privacy is at risk - CNN

by Alberto Cammozzo

<https://edition.cnn.com/2020/03/20/tech/quarantine-privacy-coronavirus/inde…> San Francisco (CNN Business)When Declan Chan arrived in Hong Kong from Zurich on March 17 after six weeks overseas, city officials made him put on a plain-looking white wristband and download an app called StayHomeSafe before he exited the airport. He was told to register on the app once he got home, which would start a 14-day countdown, and walk to all four corners of his apartment so it could capture the location and confines of his home. As countries around the world fight the spread of the coronavirus, several governments are using technology to monitor quarantines — particularly of people coming in from overseas. Israel this week approved the use of cellphone tracking technology to monitor suspected coronavirus patients — an option normally used only for counterterrorism. Thailand is reportedly giving all new arrivals at its airports a free SIM card and making them download an app that tracks their location for 14 days. But there are concerns that tracking measures to contain the pandemic could pave the way for greater government surveillance. In Israel, for example, Opposition politicians and constitutional experts criticized the tracking measures, not only for their invasion of privacy but also for the lack of parliamentary oversight in pushing them through. The urgency to fight the coronavirus could open up a new front in the long-running global debate between privacy and security. Over the years, some governments have relied on controversial practices such as using facial recognition and phone data collection to protect citizens, potentially at the expense of their personal privacy. "I think the question might be whether the means justify the ends," Jennifer King, director of privacy at Stanford University's Center for Internet and Society, told CNN Business. "I'd want to hear a clear justification as to why some of the requests for personal data are being made, and why other methods might not work as well or reasonably well without the privacy impact." Before he left the airport, Chan was made to put on a wristband connected to a smartphone app. Chan's wristband is one of 60,000 that Hong Kong is deploying to enforce quarantines and prevent the spread of the coronavirus. The wristband and the app were developed in collaboration with a local startup "to ascertain people under quarantine are staying at their dwelling places," according to a government statement. Chan, 36, said he wasn't explicitly told what would happen if he took off the wristband or disconnected the app. A form he was given -- a photo of which he shared with CNN Business -- says that anyone who "contravenes or knowingly gives false information to [the] Department of Health" is liable to face a 5000 HKD ($644) fine and six months in prison. "Should the app be deleted during quarantine period, the Department of Health and the police will be alerted to take follow-up action," a Hong Kong government spokesperson told CNN Business. The spokesperson said users are free to delete the app after 14 days. The coronavirus is stretching Facebook to its limits The governments have painted the quarantine tracking and monitoring as necessary steps to curb the virus, while also insisting they are committed to protecting privacy. "The [Hong Kong government] attaches great importance to privacy protection," the spokesperson said, adding that its tracking app does not collect any additional data from the users' smartphone. "The collection of personal data is minimal in accordance with the provision of the quarantine order." The Hong Kong government's wristband is connected to an app that has a 14-day countdown clock. The Hong Kong government's wristband is connected to an app that has a 14-day countdown clock. Israel's deputy attorney general, Raz Nizri, said tracking people is "essential" to save lives. "The aim was to find the optimal solution that will minimize the infringement of privacy," he told Kan Reshen Bet radio. Thai authorities will delete user data collected by their tracking app within 14 days, an official at the country's telecommunications authority told the Bangkok Post newspaper. Experts say that while some amount of tracking may be necessary to contain the virus, users need to be protected from it being turned into a broader surveillance tool. "Mandatory orders or those with no explicit restrictions on the collection and use of the data would be very worrisome," said King. There is also the risk that measures seemingly justified by the current pandemic could be retained or expanded even after they are no longer necessary. "I think we have to be on the lookout for 'scope creep' — contexts where we demand emergency powers that risk privacy and then fail to walk back after the emergency passes," she said. Trump administration wants to use Americans' location data to track the coronavirus Trump administration wants to use Americans' location data to track the coronavirus The US government is also in discussions with the tech industry to use Americans' location data to track the spread of the coronavirus, with Google (GOOGL) and Facebook (FB) confirming they are exploring ways to share aggregated, anonymized data rather than location data of specific users, a point they took great pains to emphasize. But larger Western democracies will likely face bigger challenges and greater pushback in trying to institute some of the tracking measures other countries have. "Every country is different, and I think that the incentive to engage in this sort of tracking is higher for smaller countries that have dense populations and the political will and technology necessary to make this happen — like Israel and Hong Kong," said Dipayan Ghosh, a former Facebook and Obama administration official who is now a fellow at Harvard University's Kennedy School of Government. "It is difficult to imagine these policies extending to Western democratic countries at this time." Chan said he preferred being forced to quarantine at home rather than being placed in a government facility. "I kind of feel weird that there's no other option, other than the bracelets. I do feel a bit weird," he said. "But it's the lesser of the two evils, if I have to choose between this and a quarantine camp... at least home is a safer environment."

March 21, 2020

Re: [nexa] Tribunale, rivoluzione digitale: udienze e interrogatori online

by costanza matteuzzi

Buongiorno, la ringrazio per la Sua segnalazione, e volevo solo fare una precisazione.Effettivamente alcuni Colleghi hanno posto il problema della compromissione del diritto alla difesa e non hanno accolto in maniera favorevole l'uso della videoconferenza. Faccio presente che, comunque, il testo ancora in lavorazione del Secondo Protocollo Addizionale alla Convenzione di Budapest, proprio in ambito di escussione testi, ad esempio, ( ma non solo) prevede l'utilizzo del sistema della videoconferenza a certe condizioni e con specifiche garanzie a presidio di tutti i soggetti in gioco. Le norme in questione bilanciano principi ed esigenze rilevanti dalle quali è possibile prendere spunto. Mi permetto di allegare alcune mie riflessioni che ho scritto in un articolo che, di certo, non è esaustivo, ma può tornare utile. Grazie. Avv. Costanza Matteuzzi *Avvertenze ai sensi del Regolamento Generale UE 679/2016 (Regolamento Privacy)* Il presente messaggio, corredato dei relativi allegati, potrebbe contenere informazioni strettamente riservate o confidenziali ed è riferito esclusivamente al destinatario sopra indicato. Quest’ultimo è l'unico autorizzato ad usarlo, copiarlo e, sotto la propria responsabilità a diffonderlo. Chiunque ricevesse questo messaggio per errore o lo leggesse senza esserne legittimato è avvisato che trattenerlo, copiarlo, divulgarlo, distribuirlo a persone diverse dal destinatario è severamente proibito ed è pregato di rinviarlo immediatamente al mittente distruggendo l'originale. Grazie. This message, together with its annexes, may contain information strictly confidential or privileged and is intended only for the addressee(s) identified above, who only may use, copy and, under his/their responsibility, further disseminate it. If you are not the intended recipient or have read it without entitlement, please be aware that keeping, copying, disseminating or distributing this message to persons other than the addressee(s) is strictly forbidden and transmit it immediately back to the sender, deleting the original message received. Thank you. Il giorno ven 20 mar 2020 alle ore 11:19 don Luca Peyron < dluca.universitari(a)gmail.com> ha scritto: > Non a caso, in uno degli allegati al procotollo gli avvocati ribadiscono > di ritenere che il processo a distanza "determini il grave pericolo di > compromissione dei diritti costituzionali e in particolare del diritto di > difesa". Poi però le toghe prendono atto della "drammatica eccezionalità > delle condizioni sanitarie determinate dalla pandemia" e convengono sulla > necessità di "prevede modalità di celebrazione delle udienze con detenuti, > arrestati o in stato di custodia cautelare, mediante videoconferenza con i > collegamenti con remoto". A patto, aggiungono, che si tratti di soluzioni > "di natura eccezionale e rigorosamente temporanea per il periodo di vigenza > della legislazione di emergenza", dunque fino al 15 aprile a meno di > ulteriori proroghe. > > L'irreversibilità della tecnologia dell'emergenza dove ci porterà? > Permettetemi di usa lo slogan della pastorale universitaria: urge > #pensareconlode > > Buona lettura, > > dl > > > https://napoli.repubblica.it/cronaca/2020/03/20/news/tribunale_rivoluzione_… > > _________________________ > www.universitari.to.it > via XX settembre 83, Torino > tel. 011 5156239 > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa >

March 21, 2020

Top Tips for Cybersecurity when Working Remotely — ENISA

by Alberto Cammozzo

<https://www.enisa.europa.eu/news/executive-news/top-tips-for-cybersecurity-…> One of the key preventative measures for the spread of Covid-19 is social distancing. Luckily, in this increasingly connected world we can continue our professional and private lives virtually. However, with huge increases in the number of people working remotely, it is vital that we also take care of our cyber hygiene. Awareness and preparedness are both vital - use the CERT-EU News Monitor to stay updated on the latest threats and check the following basics: Secure wifi connection. Most wifi systems at home these days are correctly secured, but some older installations might not be. With an insecure connection, people in the near vicinity can snoop your traffic. Fully updated anti-virus system in place. Up to date security software. Security tools such as privacy tools, add-ons for browsers etc need to be up to date. Patch levels should be regularly checked. Remember to back up periodically. All important files should be backed up regularly. In a worst case scenario, staff could fall foul of ransomware for instance. Then all is lost without a backup. Lock your screen if you work in a shared space. (you should really avoid co-working or shared spaces at this moment. Remember, social distancing is extremely important to slow down the spread of the virus). Make sure you are using a secure connection to your work environment. Check if you have encryption tools installed. Things employers can do: Provide initial and then regular feedback to staff on how to react in case of problems. Who to call, hours of service, emergency procedures and how they evolve. Give suitable priority to the support of remote access solutions. Employers should provide at least authentication and secure session capabilities (essentially encryption). Provide virtual solutions. At the EU Agency for Cybersecurity, we use electronic signatures and virtual approval workflows to ensure continuous functionality. Ensure adequate support in case of problems. This may require setting up special rotas for staff. Define a clear procedure to follow in case of a security incident. Consider restricting access to sensitive systems where it makes sense. Covid-19 Phishing Attacks It is important to step up awareness of digital security during this time as we have already seen an increase in phishing attacks. We recommend, as far as possible, to not mix work and leisure activities on the same device and be particularly careful with any mails referencing the corona-virus. Attackers are exploiting the situation, so look out for phishing emails and scams. In the current situation, one should be suspicious of any e-mails asking to check or renew your credentials even if it seems to comes from a trusted source. Please try to verify the authenticity of the request through other means, do not click on suspicious links or open any suspicious attachments. Be very suspicious of mails from people you don't know- especially if they ask to connect to links or open files (if in doubt phone your security officer). Mails that create an image of urgency or severe consequences are key candidates for phishing - in these cases always verify via an external channel before complying. Mails sent from people you know, but asking for unusual things are also suspect - verify by phone if possible.

March 21, 2020