Home Blog Page 79

Market Trends Report on Confidence in Hiring – 2021

Market Trends on Cybersecurity Hiring

The concept of cybersecurity is about solving problems. These can be problems related to sensitive data, financial data, seamless workflow, functions, or simply network-related security issues. However, there is one problem that has been dwarfing the growth of cybersecurity itself— shortage in the skilled workforce.

An industry report estimates there will be more than 4 million unfilled cybersecurity jobs globally by 2021, up from 1 million openings in 2014. Statistics suggest that although employment figures from the U.S. are high (715,000), yet currently there are 314,000 vacant positions that need to be filled up immediately. The most alarming cybersecurity talent shortage though is seen in Europe, where 48% believe finding a perfect match for this role is a rare possibility. Talking about the numbers game, cybersecurity job openings in India have had a huge boost in recent years. But with the high demands of a rapidly growing digital economy, 1 million cybersecurity positions are set to remain void.

Market Trends on cybersecurity hiringThus, with a view of understanding the expectations of the evolving cybersecurity industry and to arm the potential candidates with what it takes to break open their way into this domain, CISO MAG and EC-Council University (ECCU) conducted a “Market Trends Survey on Confidence in Hiring”. The survey which was vetted by industry experts, advocates, and EC-Council University’s world-renowned faculty was conducted among our academic partners, known CISOs, and those responsible for hiring in organizations.

 Some of the key findings from the survey are: 
  • The top three qualities for hiring for cybersecurity roles include problem-solving abilities, technical skills, and knowledge of multiple disciplines.
  • 16% of respondents said engineers and technical personnel find it difficult to settle into leadership roles as they climb the career ladder.
  • Certifications not only validate the knowledge of a candidate but also create confidence in the ability to meet security challenges.
  • 80% CISOs feel Human Resources’ lack of understanding of cybersecurity job descriptions/ job roles is their biggest hiring pain.
Market Trends on cybersecurity hiringKnow more in-depth and valuable insights of how to achieve “Confidence in Hiring” by downloading the complete report here!

 

 

French Regulator Fines Google €220 Mn for Unfair Advertising Practices

French Regulator Fined Google

The enactment of GDPR has had a far-reaching impact on businesses of all kinds across the globe. However, GDPR compliance has made life more challenging for marketers and advertisers to attain consent for processing customer data. And it seems that Google does not get along with its online advertising practices, because users can’t completely comprehend how Google is using their personal data.

In January 2019, the search engine giant was fined €50 million (around $57 million) by the French data regulator CNIL (National Data Protection Commission) for violating the GDPR norms. The fine was levied for Google’s limited information, lack of transparency, and valid consent from its users regarding ad personalization.

Now, more than two years later, Google has been fined again for misusing the online advertising space. According to a report, the French Competition Authority (FCA) fined Google €220 million (approximately $268 million) for abusing its dominant position in the advertising market and favoring its services at the expense of its competitors. The penalty comes after three media groups, News Corp, French daily Le Figaro, and Belgium’s Groupe Rossel, charged Google with an anti-trust lawsuit for misusing its position over ad sales for unfair digital advertising practices.

The regulator claimed that Google gave special treatment to its ad inventory marketplace AdX and the Doubleclick Ad Exchange, a platform that allows clients to choose and sell their ads.

“These very serious practices penalized competition in the emerging online advertising market and allowed Google not only to maintain but also to increase its dominant position. This sanction and these commitments will make it possible to re-establish a level playing field for all players, and the ability for publishers to make the most of their advertising space,” said Isabelle de Silva, president of France’s competition regulator.

No Objections from Google

Google didn’t dispute the allegations and settled the case by agreeing to pay the fine. The company also committed to bring more flexibility and transparency to its Ad Manager services with the third-party ad servers and advertising space sales platform solutions.

In addition to paying the fine, Google committed to introducing certain initiatives. These include:

  • Allowing fair access to information on the auction process for third-party SSPs
  • Preserving the full contractual freedom of third-party SSPs so that they can negotiate special conditions with publishers or make the wished buyers
  • Ensuring that AdX no longer uses the price of its competitors to optimize its bids in a way that is not reproducible by third-party SSPs
  • Offering guarantees of technical stability, both for third-party SSPs and for publishers
  • Making necessary changes to existing configurations that allow publishers using third-party ad servers to access AdX on-demand in real-time

“While we believe we offer valuable services and compete on the merits, we are committed to working proactively with regulators everywhere to make improvements to our products. That’s why, as part of an overall resolution of the FCA’s investigation, we have agreed on a set of commitments to make it easier for publishers to make use of data and use our tools with other ad technologies. We will be testing and developing these changes over the coming months before rolling them out more broadly, including some globally,” Google said.

Since Google has agreed to comply, it will now become easier for its ecosystem partners to provide fair access to information, and yet comply with GDPR regulations.

This is a lesson that other big tech companies (such as Twitter) can learn. For instance, Twitter has just agreed to appoint key officials in India who will address customer grievances and comply with the new IT rules proposed by the Government of India.

What role does AI play in cybersecurity?

Artificial Intelligence, AL and ML

Many believe that cybersecurity is an exciting field to work in, and indeed it is. Yet being responsible for an organization’s IT Security is no easy feat. Attackers always seem to be a few steps ahead of defenders. It often feels like a game of one against many – from petty criminals to nation-states. It would be highly advantageous if our cybersecurity tools could automatically adapt to these threats. The good news is that security vendors are increasingly promising exactly this; machine learning (ML) and artificial intelligence (AI) will supposedly solve all our problems through automatic adaptation.

By Dr. Serge Droz, Chair, Forum of Incident Response and Security Teams (FIRST), and Senior Advisor at ICT4Peace

What is AI?

The term goes back to a workshop at Dartmouth College held in 1956. However, today, roughly speaking, it leverages two mathematical disciplines – statistics methods and neural networks.

A good example of the former is Bayesian email spam filters – the statistical distribution of words in each message is calculated and compared to a number obtained from a corpus of legitimate and spam messages. The filters typically require access to large amounts of data before making meaningful predictions, which can become challenging. This is the reason that large mail providers, with access to millions of messages, have a much higher success of correctly classifying messages when users are also helping to tag spam messages.

Neural networks on the other hand are loosely inspired by the human brain; in a training phase, connections between strands of the network are adjusted to maximize a certain value function. No one understands what exactly happens in such a network, but they are very successful at recognizing patterns.

Access to curated training data is crucial for the proper functioning of these methods. This sounds easier than it is. Not only is a lot of data needed, but it must also be of good quality. Any error, or bias, in the training data will re-emerge in the classification, producing false positives and false negatives. A good example of this is face recognition. Most commercially available products have been trained on collecting images based on where the products are engineered. This has resulted in white males being accurately identified 99.5 % but falls way below 70% for women of color. Obviously, this is a problem when such algorithms are used in consequential decision making such as unlocking a phone or granting access to a secure facility, Examples like these are ample. But image recognition has been stunningly successful in some areas, e.g., medical diagnostics. One of the reasons is that most medical imagery is extremely well classified.

So, what is the reality for cybersecurity?

Traditionally security tools have been based on signatures – clear markers of malicious activity. Let us focus on one example for the moment. A classic example is virus scanners which look for unique characteristics in pieces of code. However, this method is becoming increasingly more difficult with the ever-increasing amount of malware – AV signatures are often updated several times per day. This is similar to the biological world – the flu virus is very adaptable, so the human immune system constantly needs to adapt to new versions of the flu.

So, could AI recognize generic patterns of malware? Indeed, most AV products today seem to contain AI and ML. Unfortunately, many of these algorithms are too naive and perform poorly under real-life conditions due to a bad understanding of the data on one hand and encryption on the other.

Classifying cat pictures by using pictures with cats, rather than pictures of cats will likely fail. It cannot be reiterated enough: training data must be of good quality. In recent years, however, people have begun to train classifiers on components of disassembled malware. And indeed, this seems to be a much more promising approach. It however requires a more detailed look at samples and an understanding of program code. Naively applying AI to blobs of data doesn’t work. This is tied to the second stumbling stone – encryption. Good encryption removes the statistical properties of the original data. Statistical classification will thus fail for exactly this reason. Malware authors today routinely encrypt and pack in the jargon to make the analysis of their malware more difficult.

Other applications

Machine learning (ML) or AI is generally useful when searching for complex patterns in large amounts of data. Typically, security specialists want to find hints of breaches and at the same time reduce the number of false positives. Breaches are, despite all, very rare compared to the many legitimate events making them difficult to spot by statistical methods. People have applied ML techniques to network anomalies, but with little success so far. Another area that seems to be popular is UEBA, User and Entity-based Behavior. This looks at the fact that attackers exhibit different behaviors from regular users. Unfortunately, regular users can behave in an extremely diverse fashion, so an action can only be labeled legitimate by evaluating the context of the action. This information gathering can be automated and runs under the term security orchestration.

A way forward

Today AI has very limited applications in cybersecurity. AI also has dangers, in particular bias.

AI works reasonably well with large amounts of data, but only a few organizations have an adequate volume for AI to be useful. However, the AI field is evolving rapidly, and it is certainly worth keeping an eye on new developments, some of which cannot be anticipated. Research is often not linear – it may well be that new paradigms will help solve some of the intractable problems. But more importantly, it’s too early to say goodbye to traditional signature-based detection methods. The bulk of cyber threats are still recognized using signatures, and new standards such as Yara and Sigma rules have moved the field forward. And interesting projects are trying to combine signature-based detection with AI.

It’s important to understand the underlying methodology when investigating AI solutions for your organization. Vendors need to be more transparent about what their AI solutions do behind the scenes. At the same time organizations need to invest more resources into understanding their data to profit from it, security or otherwise. Just collecting data and hoping a magical algorithm finds the golden needle may work in movies, but rarely works in reality.

About the Author

Serge DrozDr. Serge Droz is a senior IT-Security expert and seasoned incident responder working at Proton Technologies. He studied physics at ETH Zurich and the University of Alberta, Canada, and holds a Ph.D. in theoretical astrophysics. He has worked in private industry and academia in Switzerland and Canada, among others as a Chief Security Officer of Paul Scherrer Institute, as well as in different security roles at the national CERT in Switzerland for more than 15 years. Serge is the chair of the board of directors of FIRST (Forum for Incident Response and Security Teams), the premier organization of recognized global leaders in incident response, and a Senior Advisor to the Swiss-based ICT4Peace foundation. He also served for two years in the ENISA (European Union Agency for Network and Information Security) permanent stakeholder group. Serge is an active speaker and a regular trainer for CSIRT (Computer Security Incident Response Team) courses around the world.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Identity Theft Scams in Australia Increased by 84% in 2020: ACCC Report

Cryptocurrency scams in Australia

Amid evolving cybersecurity threats during the pandemic and the fear of compliance audit failure, a research released in October 2020 by cybersecurity firm Thycotic had highlighted that 66% of organizations in Australia were planning to increase their cybersecurity budgets in the coming 12 months. Although this may still be in the implementation phase, a new report from the Australian Competition and Consumer Commission (ACCC) for the year 2020 has sounded the alarm for immediate recognition of these cybersecurity gaps. It revealed an 84% surge in identity theft scams and 75% in phishing scams, respectively.

The ACCC Scams Report 2020

According to the report, Scamwatch, one of the official reporting mechanisms for any scam, recorded a total of 444,164 scam reports in 2020, costing Australian citizens and businesses a total of AUD 851 million. Out of this, AUD 128 million was lost to business email compromise (BEC) alone. The other significant scams included losses of AUD 8.4 million to remote access scams and AUD 3.1 million to identity theft.

When it came to determining the most common payment method used in these scams, bank transfers topped the list with AUD 97 million losses. However, with blockchain technology been proven effective for secure online transfers and used extensively for cryptocurrency payments, Bitcoin and other cryptocurrency payment methods ranked second on this list with losses amounting to AUD26.5 million.

Another target-specific revelation from the report was that scammers were mainly focused on scamming the elderly people owing to their lesser knowledge of the latest technologies and their corresponding SOPs. Those aged above 65 years reported losses of nearly AUD 37.7 million.

Phishing and Impersonation Scams Spread Faster than Bushfire

In Australia, bushfires are a common phenomenon and take place every year despite concentrated efforts from the government to solve this issue. However, in 2020 the country saw one of the worst bushfire seasons where 33 lives were lost, around 3,094 houses destroyed, and nearly three billion animals impacted by this raging river of fire.

Therefore, to help the people fighting it out on the frontline, many organizations set up online donation gateways on their respective websites. However, scammers took advantage of this situation too. They intruded on the legitimate donation collecting websites and compromised them by inserting MageCart scripts and exfiltrating donors’ payment information. The ACCC’s Scamwatch report confirms these incidents from last year as it also reportedly received over 330 bushfires-related Scamwatch reports through its website.

Compared to 2019, remote access scam-related losses increased to more than 74% to AUD 8.4 million and threat-based scam reported losses increased more than 178% to AUD 11.8 million. The reporting to Scamwatch in 2020 saw 8,691 scam reports attributed to hacking, 3,885 to ransomware and malware, and 44,079 reports of phishing.

Although an increase of 11.3% in phishing scams was recorded during the reporting period, the most impersonated entities in 2020 remained more or less unchanged in 2019: Telstra, NBN Co, government organizations, the big four banks, and package delivery companies like Amazon. Online payment platforms like PayPal and OTT platform Netflix also made to this list.

Related News:

Australia’s Bushfire Donation Website Hit by MageCart

How Australia Plans to Thwart Ransomware Attacks in the Country

U.S. DoJ Gives Ransomware Attacks Same Priority as Terrorist Attacks

paying ransom, Conti Ransomware Attacks

Ransomware attacks have become the talk of the town globally after cybercriminals caused severe damage to the country by disrupting operations of Colonial Pipeline and meat processing giant JBS recently.  The U.S. government is taking necessary precautions on high priority to curb the rising ransomware threats. Recently, the U.S. Department of Justice (DoJ) and the FBI stated that the investigations of ransomware attacks are given utmost concern as terrorist attacks.

The agencies claimed that the data related to ransomware investigations will be centrally coordinated with a newly created task force based in Washington. The information related to ransomware attacks and their field investigations will be centrally coordinated with the task force leaders in Washington.

The list of cybercrime cases that now require central notification includes counter anti-virus services, illicit online forums or marketplaces, cryptocurrency exchanges, bulletproof hosting services, botnets, and online money-laundering services.

The Justice Department’s decision to push ransomware investigations to high priority shows how serious the issue is.

“It’s a specialized process to ensure we track all ransomware cases regardless of where it may be referred in this country, so you can make the connections between actors and work your way up to disrupt the whole chain.

We’ve used this model around terrorism before but never with ransomware. We want to make sure prosecutors and criminal investigators report and are tracking cryptocurrency exchanges, illicit online forums or marketplaces where people are selling hacking tools, network access credentials — going after the botnets that serve multiple purposes,” said John Carlin, the principal associate deputy attorney general at the Justice Department.

DoJ Arrests Trickbot Malware’s Developer

In a recent development, the DoJ charged a Latvian woman – Alla Witte – for her involvement in creating and deploying the infamous banking Trojan – Trickbot. Witte allegedly worked with the Trickbot Group, which distributed the Trickbot malware to various organizations. The Trickbot malware allowed cybercriminals to compromise targeted devices and steal personal and financial information like login credentials, credit card numbers, emails, passwords, dates of birth, social security numbers, and addresses.

“This indictment demonstrates the broad reach of the Department of Justice’s Ransomware and Digital Extortion Task Force. Trickbot infected millions of victim computers worldwide and was used to harvest banking credentials and deliver ransomware. The defendant is accused of working with others in the transnational criminal organization to develop and deploy a digital suite of malware tools used to target businesses and individuals all over the world for theft and ransom. These charges serve as a warning to would-be cybercriminals that the DoJ, through the Ransomware and Digital Extortion Task Force and alongside our partners, will use all the tools at our disposal to disrupt the cybercriminal ecosystem,” said Deputy Attorney General Lisa O. Monaco.

One Attack, Two Disclosures! The Story of Azusa Ransomware Attack

Ransomware Attack on Azusa Police

Unreported cyberattacks usually return with greater risks. Most organizations avoid reporting cyberattacks citing various reasons but eventually encounter severe backlash if not disclosed. Recently, the Azusa Police Department revealed that it suffered a sophisticated ransomware attack that compromised some of its sensitive records. In an official release, the department stated that certain aspects of its computer systems were inaccessible after the hacker intrusion. The authorities immediately reported the issue to the law enforcement authorities and engaged third-party specialists to determine the source of the incident and the extent of the systems affected.

The compromised information included social security numbers, driver’s license numbers, California identification card numbers, passport numbers, military identification numbers, financial account information, medical information, health insurance information, and/or information or data collected through the use or operation of an automated license plate recognition system.

While cybercriminals behind the security incident are unknown, the department clarified that there is no evidence of any misuse of the information. “Azusa Police continues to review its network security policies and take additional steps to further enhance its security, as it takes the privacy and security of all information very seriously. The Department also established a dedicated assistance line to address questions individuals may have and to provide credit monitoring services to potentially impacted individuals,” the Azusa Police said.

While the Azusa Police department claimed that they are not going to pay any ransom to the cybercriminals, the officials now disclosed another ransomware attack that they hid for two years. According to a report, the department, through its cybersecurity insurer, paid $65,000 ransom to an unknown threat actor group to regain access to ten of its data servers in 2018.

The breach apparently occurred through ransomware, which was downloaded and distributed to systems after an employee opened/downloaded a malicious attachment or URL in a phishing email. The authorities cleaned and restored the servers after encrypting them but didn’t reveal it to the outside world.

“We were able to unlock one server after the ransom was paid but immediately after found a free key to unlock all other locked servers. No information was compromised. Our servers were just locked. We verified with forensic experts that no data was compromised. That’s essentially why we did not and were not required to report it (publicly).

These types of attacks are becoming more and more common and, to a certain extent, much more sophisticated. We are again working to ensure we have the best cyber defense. We have also brought in additional resources by contracting with cybersecurity experts to rebuild our entire system from top to bottom, including upgraded servers, software, and anti-virus programs and a more robust backup system,” said Azusa City Manager, Sergio Gonzalez.

Although the reason why the Azusa police department ignored reporting the ransomware attack is unknown, it may receive severe backlash from the cybersecurity community for doing so. 

Related Story: 4 Immediate Measures to Execute After a Cyberattack

“Until now, technology gave you no protection and confidentiality when you shared your data”

There is a critical business challenge when it comes to sharing data between entities, such that any one person or firm should not see another’s information. An example is a bank that operates an electronic market but wants to assure its customers that it does not see their data. Another example is an insurer that needs to share information about fraudulent claims without breaching confidentiality rules.

Traditionally, data is only encrypted at rest and in transit, but not while it is being processed.

In an interview with Brian Pereira, Editor-in-Chief of CISO MAG, Richard Gendal Brown, CTO, R3 explains how his company has overcome this challenge through its confidential computing platform. R3 is a leading authority on distributed ledger systems and architectures. Earlier this year, R3 launched Conclave, a confidential computing platform that secures sensitive business data while it’s being used.

Previously, Brown was the Executive Architect for Banking and Financial Markets industry Innovation at IBM UK. His previous roles with the company, for whom he worked for almost fifteen years, included Lead Account Architect for a global Investment Banking client and a consultant for IBM software products. Brown is a Chartered Engineer, holds an MBA with distinction from Warwick Business School and a first-class degree in Mathematics from Trinity College, Cambridge.

Edited excerpts from the interview follow:

What are the key challenges with data that enterprises across the world are grappling with right now?

If we think about our lives as individuals, when we interact online with companies or your third-party services and through our browsers, we feel like we are secure because we’ve all been taught to look for that padlock to expect the TLS connection to be in place. And that’s a process over the last 10-20 years of consumer education. What I think people have missed or never really thought about here, in the consumer realm is, that security promise is limited. It’s promising you that you really are talking to who you think you are. It says Facebook.com and there’s a padlock, so you know, you really are communicating with Facebook. But what it doesn’t say is anything at all about what they can do with your information when they receive it. You know you’ve sent your information, to that third-party, but the technology gives you no protection at all when it comes to the question of what they can do with your information.

And then, if we move to the corporate realm, where you asked your question, businesses have the same problem as well. If I am a bank, for example, I have an obligation to the government or the regulator to scan my customers’ transactions for signs of fraud or financial crime and money laundering. I have that obligation but, of course, many frauds are committed by sophisticated individuals or criminals, who disguise the fraudulent criminality across multiple banks.

As a bank, if all you have is the view of your own customers’ transactions — you don’t see enough to be able to spot these bad things and to protect your customers. And so, what banks would like to do is share that data with some central processor for the analytics firm, for example, who can absorb that data from multiple firms and then analyze it to spot these patterns that would otherwise be invisible. But, of course, that same problem that I just outlined from the consumer realm applies in the corporate realm as well, in the second that high value critical and sensitive customer data that’s resent from a bank to another firm. They know for sure that it has got to that of the firm; they know it’s safely been transported. But they know nothing about what happened to it at the other end. All they have is contract reputation, maybe GDPR in the European Union.

That is a soft sort of reputational and legal protections, they’re not technological protections.

We see companies sharing data with other firms, either for analytics purposes or maybe because that firm could process it for them or could help them match trades. And in doing so, there’s a risk because they can’t technologically control how that data is used. In some cases, they simply don’t risk sending it in the first place, because the thought of the horror at what might happen if it were lost, is just unthinkably awful.

There are lots of situations where a company really would like to send and share data with legitimate and valuable reasons, with other firms. But until now, there’s been no good way to technologically control what happens to that data once it leaves your premises.

But aren’t regulations like GDPR, which imposes stiff fines like 4% of global turnover, supposed to take care of that problem?

Oh, for sure! The intensity of those regulations is entirely to the benefit of consumers. But if you think about a firm. So, let’s imagine you are a well-run compliance ethical firm that wants to comply with GDPR, and just imagine you’re a banker or an insurer and your firm who has customer data as a legitimate part of your business, you may want to share that information with some of the firms. GDPR rightly imposes legitimate constraints on what you can and can’t do. And you don’t look at the technological toolbox, you have to comply with that, and that toolbox is lacking — there’s nothing there until we get to confidential computing, which we will come to in a moment.

What do you have? You have audit, you have contracts, you have the legal system. But (as a consumer) there is nothing technological you can do; there’s no sort of padlock or sort of box, you could put that data in, to control what happens to it when it arrives at the other firm. And so, it’s really hard to comply with these regulations and even when you are a legitimate and honest ethical firm, and just trying your best to do so.

RELATED STORIES

How Intel’s Homomorphic Encryption Can Process Ciphertext

Federated Learning Can Solve Security and Data Privacy Challenges: Intel Labs

Google Cloud Levels-up Confidential Computing with Latest Updates

How does a Confidential Computing Platform help to solve this challenge?

The microprocessor and cryptography communities have been working to solve this problem for decades. There are software techniques such as zero-knowledge proofs, homomorphic or fully homomorphic encryption, secure MPC. There are various cryptographic techniques that attempt to solve parts of these problems. There’s also an approach based on hardware, known as Confidential Computing. Intel has a variant called Software Guard Extensions (SGX), AMD has a variant, so does ARM and so does IBM on their mainframe systems. They all work slightly differently.

So, what do they offer?

Imagine you are a service provider. Perhaps you designed an algorithm to spot patterns of financial fraud across different transactions for different banks. It would help drive down crime in the market if you were able to process and analyze lots of bank customers’ transactions. It would be a valuable and important service. So, your challenge now, as a service provider, is that you need to persuade the banks to send these transactions to you, and to believe it would be safe to do so.

What confidential computing gives you, as a service provider, is a new capability that you didn’t have before. As a service provider, you can show the blueprint of your algorithm, and you can show the banks your code. They can review it to say that your algorithm looks legitimate, and does what it says it does. It doesn’t steal the customer data and it doesn’t inadvertently leak the information. Their auditors or their chief security officers can validate that the algorithm is legitimate.

Confidential computing allows you to cryptographically prove to those banks that that is the algorithm that is running, and which will process their data and that no other algorithm will be able to access it.

It’s as if you, as a service provider, are giving your customers an X-Ray view into your systems. They can now see what algorithm is running and satisfy themselves that is legitimate and safe. Encrypt their data with a key that only that algorithm knows and sends it to you. Now we have seemingly achieved the impossible. Now you can aggregate data from multiple sources. What each of those data providers is safe in the knowledge that the only thing your system can do is execute the logic that you’ve promised and nothing else — not even you or your employees or your data center operatives can subvert the execution or see what is happening. Part of this is a promise coming from the underlying hardware. It is an offering from the hardware that allows the chip on which this code is running, to remotely convince third parties that this is the algorithm that’s running, and this is the only thing that can see your data.

About the Interviewer

Brian PereiraBrian Pereira is the Editor-in-Chief of CISO MAG. He has been writing on business technology concepts for the past 26 years and has achieved basic certifications in cloud computing (IBM) and cybersecurity (EC-Council).

“My biggest concern is sabotage of the vaccine either through propaganda or manipulation”

Heath Renfrow

Cyberattacks on the health care sector are the ugly reality of today. And the pandemic may have only enhanced it. If the attack on vaccine development from state-sponsored actors was what made major headlines in late 2020, this year it is on the vaccine supply chain. The common denominator here is the vaccine. Several cyber-espionage attempts were also leveled as precisely targeted phishing campaigns against the companies. Even on the dark web, several malicious actors and scammers are often found discussing the vaccine market. In fact, the battle for the vaccine market has already begun, and we can expect espionage around vaccine-related organizations to grow further.

To understand this new threat vector even deeper, Augustin Kurian from CISO MAG caught up with Heath Renfrow, the CISO at Conversant Group. Renfrow was also the former CISO of United States Army Healthcare. He has more than two decades of experience as a high-level information security specialist, much of it as a CISO in the United States Department of Defense, where he addressed some of the nation’s most significant cyber challenges. In 2017, he was named Global CISO of the Year by the ECCouncil. In this brief interview, Renfrow explains the vaccine supply chain attacks, GPS Spoofing, prevention methods organizations can adopt, and some alarming trends.

Edited excerpts from the interview follow:

Hackers have begun targeting the vaccine cold chain – the systems and organizations involved in their necessary sub-zero storage and transport. The transport boxes for the vaccines have been equipped with GPS trackers, which could be vulnerable. What are the necessary steps that need to be adopted to ensure the supply chain is not the weakest link?

GPS Spoofing is not something new, in fact, the Department of Defense (DoD) put heavy emphasis on these flaws back as early as the 2006 timeframe. Today we see threat actors and terrorist organizations using cyberattacks to spoof military drones to merchant ships’ GPS to hijack cargo. In the case of this particular supply chain, I would engage a firm to conduct tests for spoofing. Outside of the cargo in transit, it is imperative that these organizations have dedicated information security personnel, routine penetration testing, the latest EDR technology, incident response plan and playbooks, and cyber insurance as a mitigation control.

Several experts have more confidence in the integrity of the vaccine approval process than in the security of the control systems used for the tracking. How can federal bodies be leveraged more on this front?

I am not sure how confident I am in the security process as a whole around the vaccines, not just the tracking of the vaccines. These vaccines are being produced in operational technology (OT) environments, and the manufacturers of these products are a huge target for threat actors and even cyber terrorism. Cybercriminals will want to steal data, sell it, or even ransom the environment and make a ton of money. Terrorists could look to sabotage the production, or even manipulate the vaccines where they cause harm, not good. The tracking of these vaccines is one thing, but the overall security around these organizations should be a concern and should be heavily ramped up in the age we are living in now (COVID-19). As far as government stepping in, Operation Warp Speed here in the United States is a partnership between private and public sectors, including military logistics and transportation.

Organizations securing the data of patients receiving COVID-19 vaccine shots will be vulnerable and public trust in the vaccine effort is at risk. What are the best practices for cyber-immunity for these organizations? And majorly, what can the public do?

Cybersecurity foundational pieces should be in place no matter the type or size of an organization. The best practice would be to follow a known cybersecurity framework, invest in cyber maturity steps, and have dedicated resources to those efforts. I do not see that COVID-19 has increased the threat of sensitive information being exposed or specific targeting of organizations giving the vaccines. The threat actors would however target those organizations to possibly deploy malware, encrypt (ransom) their environment, and shut down operations. This would have a huge effect on the distribution of vaccines and continue to put the world at risk…To read the full interview, subscribe to CISO MAG.

This interview first appeared in the April 2021 issue of CISO MAG.

Augustin KurianAbout the Interviewer

Augustin Kurian is the Assistant Editor of CISO MAG. He writes interviews and features.

Night Blood: A Global Ransomware Campaign Run by APT Group TA505

Hive Ransomware

The TA505, a Russian-speaking APT group, created a buzz early last year with a devastating ransomware attack on the Maastricht University (UM) in the Netherlands. After considering all possibilities, the University’s management had ended up paying a 30 Bitcoin (equivalent to $220,000 at the time) as ransom to threat actors. However, since then, the group had become submissive as no other major attacks were linked to them. This seems to have changed though in the past couple of weeks as researchers of cybersecurity firm, CYFIRMA, have unearthed a global ransomware campaign of the TA505 APT group dubbed as “Night Blood.”

TA505 Comes Out of Stealth Mode

CYFIRMA’s researchers first observed activity from TA505 on May 22, 2021. The operators of the APT group posted 96 IP addresses on an underground discord forum, which in the preceding days was published on three other dark web forums with additional IP addresses. It is suspected that these IP addresses might act as an entry point for the cybercriminals into the victim networks. As per the conversations recorded on these forums, this gang which offers Ransomware-as-a-Service (RaaS) and works collectively with its affiliates, has adopted a two-fanged approach depending on the target’s background for extorting a ransom:

  1. Gain entry to a publicly accessible web server and then in the case of a simple unsuspecting website visitor, force them to download a malicious plug-in and install the ransomware tool kit.
  2. Gain entry to a publicly accessible web server and then in the case of a larger organization or company, install malware to scan all systems connected on the network using identified weakness and then install the ransomware tool kit.

Apart from this, they have also adopted the double extortion technique, which involves stealing sensitive data of their victims before encrypting their files and folders and leaving a traditional ransomware note on the infected system. This strategy renders leveraging power to the threat actors during negotiation. As per the initial analysis, the signatures of this campaign match another notorious ransomware group – the REvil gang.

Potential Targets

CYFIRMA’s researchers have deemed this as a global ransomware campaign because TA505 is said to be actively targeting countries like Japan, Australia, South Korea, the U.K., the U.S., India, Thailand, Singapore, Germany, and Spain. The industries associated with their targets are widespread and includes manufacturing, food and beverages, financial, real estate, insurance, trading platforms, retail and online stores, electronics and telecommunication, government, etc.

Although the primary motive of this campaign from the TA505 APT group appears to be financial gain, researchers warn that owing to the doping ban on Russian athletes for the next two Olympics, the group can target organizations and institutions associated with these games in any manner. Researchers also suggest that TA505’s “Night Blood” campaign seems to be in the potential reconnaissance phase and organizations around the globe need to keep a close eye on any suspicious activity.

Related News:

Maastricht University Pays 30 Bitcoins as Ransom to TA505 Group

Indian Vaccine Makers and Pharma Companies Attacked This Week: CYFIRMA Research

Singaporean C-suite Leaders Believe Remote Working Led to Increased Cyberattacks

Cybersecurity Singapore

Cybersecurity is continuously evolving and cyberattacks are becoming more frequent, complex, and sophisticated, with hackers leveraging innovative attack approaches. Every minute is critical for CISOs and other security leaders during a cybersecurity incident. Unfortunately, most organizations are losing valuable time while communicating with the security team to make the right decision in the middle of a security incident due to remote working conditions. Due to the new normal or work from home, many organizations have been struggling to process and monitor critical data, making them vulnerable to unauthorized intrusions.

According to Singapore Security Insights 2021, a research report from VMware, over 82% of Singaporean cybersecurity professionals said remote working increased cyberattacks. Nearly 68% of successful breaches are serious enough to require reporting to regulators. And 52% of respondents know that their current IT security is not working efficiently.

The research revealed that security teams are facing new challenges while securing the digital infrastructure remotely. The new working model has created blind spots and a lack of visibility, highlighting the vulnerabilities in legacy security solutions and security strategies.

Key Findings

  • Singapore witnessed the highest average of breaches per year (3.3), compared to Australia (2.3) and Japan (2.5).
  • Most respondents from health care (87%) and manufacturing and engineering (87.5%) noted an increase in attacks connected to home working.
  • Around 86% of respondents from financial services reported an increase in attack sophistication.
  • 83% of respondents who suffered an attack say there was a negative impact on the company’s reputation.
  • Process weakness (22%) and out-of-date security (20%) were the top causes of breaches for
  • Nearly 63% of Singaporean businesses feel the need to view security differently than they did in the past due to an expanded attack surface.
  • 53% agreed their board/senior leadership team feels increasingly worried when they bring new apps/ services to market because of the growing threat and damage data breaches/attacks have.
  • 48% of respondents agree security concerns are holding them back from embracing AI/machine learning (ML)-based apps to improve customer services and digital experiences.
  • 60% of the Singaporean CISOs surveyed fear their organization will experience a material breach in the coming year.

Plan of Actions

  • 99% of respondents are following or planning for a cloud-first security strategy.
  • 51% have updated their security technology to mitigate cybersecurity risks.
  • 50% are building more security into their infrastructure and apps and reducing the number of point solutions.
  • 45% have updated their security policy and approach to mitigate risk.

“The Singaporean attack environment is diverse, with few respondents experiencing the same mix of attack types and no single attack type dominating. This underlines the challenges Singaporean CISOs face; they need to build strategic and tactical responses to an incredibly varied mix of attack vectors and techniques,” the report stated.

The research findings are based on the responses of 250 CIOs, CTOs, and CISOs globally.

1...787980...409Page 79 of 409