Contributed by Tony Cole, Chief Technology Officer, Attivo Networks

When the first automobile was manufactured, it wasn’t very safe.

Many drivers and passengers died because safety simply wasn’t a motivating factor in the design and creation of the automobile. Since then, a parade of features has been added to increase car safety. These initially included brakes and lap belts, then seatbelts, directional  blinkers, headlights, taillights, brake lights, fog lights, and eventually advanced innovations like anti-lock brakes, traction control, airbags, lane keeper assists, auto braking, lidar, backup cameras, and front facing cameras.

Manufacturers didn’t just iterate on the same things. They improved the existing safety features and continued to innovate by adding new systems and features each decade. Why? Because even though cars are much safer, many people still die in car accidents each year. There are plenty of reasons: drivers make mistakes, people don’t obey rules, systems fail, Mother Nature throws us curveballs. When will we stop adding safety features to vehicles? Probably not in the foreseeable future—if ever. Not until we can protect everyone all the time. We will continue to innovate to try and save lives. It’s what humans do.

When the Internet was initially assembled, it was designed for communication and sharing. As with automobiles, safety simply wasn’t a consideration. No one knew that it would grow to what it is today. They couldn’t have predicted that it would become a fabric connecting all of society and a driver of the global economy.

Since no one had foreseen its potential for market penetration and global growth, protecting people and their data on the Internet wasn’t an initial priority. As attackers began to wreak havoc though via webpage compromises, distributed denial of service attacks, system compromises leading to data theft, data destruction and data integrity manipulation, preliminary safeguards were added to make the Internet a less dangerous place for businesses, consumers, and governments.

Unsurprisingly, it didn’t work. Anti-virus software was added to endpoints. Intrusion detection systems, firewalls, intrusion prevention systems, data leakage prevention systems, and much more were added at network perimeters across the enterprise. Yet intrusions continued, escalating in scope, severity, and number.

The reasons for the failure of these early measures are myriad, but one major issue is that most security vendors focused completely on preventative technology to stop breaches from happening rather than on detecting them once the adversary breached the network. We need to do both. The sophistication of attacks continues to grow as needed to accomplish attacker goals. Just as car safety advancements were critical to making our roads less dangerous, innovation must continue in cybersecurity. This means adopting a new perspective on the problem.

Let’s return to our car analogy. Remember all the innovative safety features added to reduce automobile accidents? They have certainly helped a lot, but accidents still happen frequently. Manufacturers understand this and address it by adding systems designed to help accident victims in today’s cars. Why? We know—and unfortunately accept—that they are going to happen, and we prepare for them. Some manufacturers have accident detection systems that close the windows, cinch up the seatbelts, brake the car automatically, deploy airbags on impact, call the authorities, and much more. Many municipalities even help save lives by monitoring high-traffic areas to enable quicker accident response.

In cybersecurity, it’s time to admit that system breaches are inevitable and innovative technologies must be more broadly applied to detect those breaches. If you can’t always stop the attacker (and you can’t), you need to detect them when they bypass preventative tools. Fast and reliable detection will help to ensure they aren’t successful in accomplishing their goals.

Today, deception technology is one of the more innovative tools that can help when the adversary infiltrates the enterprise. It sounds complex, but in reality, it’s a simple tactic to ensure the attacker is quickly detected and unsure of the environment. If we consider our car safety analogy, one innovation—fog lights—allowed drivers to see both the road and each other despite inclement weather. In internet safety, we’re doing the exact opposite: through deception, we’re literally creating a fog of confusion for the attacker to prevent them from understanding (or clearly seeing) the environment they’re wandering through. They have no fog lights. They can’t see, and they inevitably run into things we’ve placed in the network that immediately alert defenders of a breach. What makes it even more fun is that proper deception incorporates gold images as decoys. Even if the attacker had the cyber equivalent of fog lights, they would still hit things that immediately cause an alert. Even with increased visibility on the network around them, they still wouldn’t be able to tell production systems from decoys, real credentials from decoy credentials, real applications from decoy applications, or real data from decoy data.

We have a long road in front of us to make the internet completely safe. The truth is, we may never reach that destination. But by taking advantage of new technology and perspectives to mitigate breach impact and adopting an innovative approach to security, we can continue to make substantial and meaningful progress toward that goal.

The opinions expressed within this article are the personal opinions of the author. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. 

A data breach at Inmediata Health Group, a healthcare billing and administrative service provider, exposed the personal and medical data of Michigan residents, the Detroit News reported.

The Puerto Rico-based healthcare center stated that a technical glitch in the webpage settings permitted search engines to expose internal webpages online, which contained patients’ sensitive information. According to Inmediata, the exposed data included patients’ name, addresses, social security numbers, and other personal health information.

The security officials at Inmediata halted the website temporarily and contacted a digital forensic firm to investigate the incident. The center clarified that there was no discovery of any misuse of the exposed data. The affected patients are suggested to monitor their financial accounts for any fraud transactions.

“We have an opportunity to improve Michigan law by adding the Attorney General’s Office as a required state department to be notified by companies impacted by data breaches. Data breaches can be devastating to the affected individuals. It’s important this office provide affected customers with any and all available resources to help limit the effects of this — or any — breach. And today, we’re doing just that,” said Dana Nessel, the Michigan Attorney General.

“The data security incident that may have involved the limited personal and medical information of some of its customers’ exposed online due to a webpage setting that permitted search engines to index internal webpages that are used for business operations. To date, we have not discovered any evidence to suggest that any information potentially involved in this incident has been subject to actual or attempted misuse,” Nessel added.

A recent report revealed that health care organizations suffered the highest number of data breaches in 2018 across any sector of the U.S. economy. According to Beazley Breach Response, a breach response management and information security insurance solutions provider, the healthcare entities have reported the highest number of data breaches, at 41 percent.

The report, dubbed as Beazley Breach Insights Report, stated that direct hacking, the presence of malware, or due to human error were the causes of data breaches in healthcare organizations. The report also revealed the percentage of breaches in other sectors of the economy. The education sector accounted for 10 percent of security issues, financial institutions reported 20 percent of incidents, and professional services represent 13 percent of cases.

The cybercriminals are attempting to extort cryptocurrency from companies or individuals claiming to have embarrassing evidence of people using adult websites at work, which are related to extortion, the report added.

The Government of Kenya has dispelled the reports surrounding hacking of the National Integrated Identity Management System (NIIMS), also called Huduma Namba, as fake news. In a statement, the Ministry of Interior stated that no incident, whatsoever, has occurred.

“Kindly treat fake news circulating claiming Huduma Namba has been hacked with the contempt they deserve. The exercise is ongoing with 23.5 million people already registered. Report any misleading information you spot,” the ministry told on Twitter.

Over the weekend, social media and local blogs were abuzz with news that Enock, an ICT student from University of Nairobi (UON) had hacked into the Huduma Namba system and deleted data collected from 21 million people.

Interior Ministry spokesperson Wangui Muchiri also concurred on Twitter, “News circulating claiming to have hacked Huduma Namba utterly false. The exercise is going strong with 23.5 million secure registered persons.”

Two years ago, India also was under the spotlight for similar incidents, except they weren’t fake news. From the beginning of 2017, numerous reports had emerged stating a massive amount of data breach. Information of the citizens, like address, Aadhaar number, and other sensitive data like bank details were reportedly published online. This information was gathered by critical departments and ministries sites.

As per reports, the breaches, though many yet to be confirmed, did cost the data of nearly one billion Indian citizens and Aadhaar had become one of the biggest tools that infringed the privacy of nearly every citizen of India. This was until the Supreme Court of India made a landmark judgement stating that Right of Privacy is a Fundamental Right overruling an earlier bench judgment and ordered that Right to Privacy is intrinsic to Right to Life granted under Article 21 of the Constitution of India.