Brit cybercops issue tender to rip and replace their formerly flaw-ridden CyberAlarm tool

Police have issued a tender to replace their CyberAlarm tool following reporting by The Register and infosec researchers revealing security flaws in the logging software. A public tender notice revealed that the National Police Chiefs' Council (NPCC) is seeking a new supplier for what it described as the "next iteration" of …

[Mike 137]

"a secondary function being to tell businesses who deploy the tool that they're under attack"

Businesses that take security seriously should be able to recognise for themselves that they're under attack. Practically none can though. I can't count the number of monitoring appliances I've encountered, generating logs that never get examined until after a data breach is all over.

Monitoring should be a continuous activity, referenced to an established pattern of normal activity (and not just left to unsupervised "tools"). I've rarely succeeded in persuading clients to perform the necessary baselining to recognise normality. Consequently they fail to identify departures from it when under attack (supposing they're even looking anyway).

[Dr Scrum Master]

Significant and Irreparable Damage

I always find it amusing when organisations claim that someone else is causing "significant and irreparable damage" to them or their brand, as it's invariably the brand owner who has an already tainted reputation or is the one actually damaging its reputation all by itself.

[sbt]

Re: already tainted reputation

Not helped by the branding shenanigans, but have they even heard of Barbara Streisand?

Need a BS icon, El Reg! ---->

[Anonymous Coward]

Re: already tainted reputation

No. Did you mean Barbra Streisand?

(Sorry. Couldn't resist.)

[RegGuy1]

Re: already tainted reputation

No he meant brexit.

(ducks) sorry!

[sbt]

re: Did you mean Barbra

Agh, all these different name spellings are enough to drive ma yentl.

[Chris Hills]

My response

If facts are damaging to your brand then I suggest you consider your actions.

[TimMaher]

Nominet

Is CyberAlarm one if their shitty efforts to get into security? Their behaviour pattern seems similar when confronted by a truth.

[John Brown (no body)]

cyberalarm.org --- cyberalarm.org.uk

Such a rookie mistake when looking for a new domain name. Although in this case I suspect they had already committee'd and focus grouped the name and there was no turning back so they just took the name with whatever TLD was available.

[h3nb45h3r]

Zero Trust

Not talking about the security policy this uses, by my feelings towards it.

Shan't be recommending, using or touching this thing with a barge pole, or any suitable similar replacement (barge poles are hard to get hold of these days...)

[Anonymous Coward]

An impressive feat

"Its stated intention is to provide cybercops with an instant overview of current network attacks facing UK SMEs"

My little company (20 employees) has six internets. A 1Gbs-1, a 100Mbs-1 and four 80/20Mbs-1 links. The netflows alone for that lot is quite a lot of data. OK so we are not normal as such but you would need an insane amount of gear to gather, analyse and process netflows for the entire country or any country for that matter.

I don't know what a cybercop is supposed to be but it sounds a bit wanky. Even if something like that existed they will never be able to look after me at the moment as things stand. I'm not sure what the fix is but I'm pretty sure the problem has not even been begun to be described.