Americans split on federal government security, encryption attitudes

In other news:

• A high-level manager at antivirus software maker Kaspersky Lab has reportedly been arrested by Russian authorities and charged with treason. Ruslan Stoyanov, head of Kaspersky's computer incidents investigations unit, was arrested in Russia in December, along with Sergei Mikhailov, a senior Russian FSB intelligence officer, reportedly on the charge of treason. Stoyanov had worked at Kaspersky since 2012, and according to Kaspersky, his arrest was for incidents predating his employment at the firm. "The case against this employee does not involve Kaspersky Lab," according to the firm's statement. "The employee, who is Head of the Computer Incidents Investigation Team, is under investigation for a period predating his employment at Kaspersky Lab. We do not possess details of the investigation. The work of Kaspersky Lab's Computer Incidents Investigation Team is unaffected by these developments."
• A security researcher who participated in the HackerOne program Hack the Army found a way to gain access to an internal U.S. Department of Defense network through a public Army recruitment website. The Hack the Army program received 416 total reports, and 118 of them were valid. But this particular vulnerability was the worst. "A researcher could move from a public-facing website, goarmy.com, and get to and internal DOD website that requires special credentials to access," according to HackerOne's report. "They got there through an open proxy, meaning the routing wasn't shut down the way it should have been, and the researcher, without even knowing it, was able to get to this internal network, because there was a vulnerability with the proxy, and with the actual system. On its own, neither vulnerability is particularly interesting, but when you pair them together, it's actually very serious." HackerOne also said once that bug report was submitted, the Army was able to block further attacks and prevent the vulnerability from being exploited.
• According to a recent Ponemon Institute survey, 48% of respondents said their company paid the ransom when it suffered a ransomware attack. Despite the FBI's guidance not to pay ransoms in these attacks, almost half of the surveyed companies paid out an average of $2,500 to the attackers. The report found the ransoms were paid in bitcoin 33% of the time and cash 25% of the time, while 55% of respondents said the attacker provided the decryption key once the payment was made. Another notable finding in the report was companies that experience a ransomware attack don't report the incident because they don't want the publicity. "Despite the FBI's pleas to report the incident to law enforcement, 49% of respondents say their company did not report the ransomware attack." The report surveyed 618 respondents who were primarily IT contractors, managers and business managers who directly report to a CISO.
• Mozilla Firefox is joining in the fight against unsafe websites. "Starting today in the latest Firefox, web pages that collect passwords, like an email service or bank, but have not been secured with HTTPS will be more clearly highlighted as potential threats," said Mozilla in a blog post. Previously, Firefox would show a green lock on a page when it was secure, but now, it will also show a crossed-out lock with a pop-up box that alerts users when it's not secured with HTTPS. "Keeping users safe online has been a key priority for Mozilla," the blog post read. "And we've long been a vocal proponent for using HTTPS to secure a user's web experience through efforts like Let's Encrypt." Google uses a similar feature in its Chrome browser.