Cyber Connections News Roundup: July 30

Get the latest cybersecurity news from leading companies, news outlets and blogs.

Cyber Connections News Roundup is a bi-weekly brief of online links to news stories and commentary of interest to the cybersecurity community, delivered on the second and fourth Tuesday of each month. Articles are selected for their newsworthiness, timeliness, potential impact, and reach.

July 30, 2019

New Orleans Governor Issues First Ever Statewide Cybersecurity Emergency

Governor John Bel Edwards has issued a statewide emergency declaration following a cybersecurity attack on several school systems in North Louisiana, according to a recent report on wwl.radio.com. This is the first activation of Louisiana’s emergency support function relating to cybersecurity. Kenneth Donnelly, senior coordinating official for the Louisiana Cybersecurity Commission, said the state was first made aware of a malware attack on July 23. The New Orleans Office of Homeland Security and Emergency Preparedness, along with Information Technology and Innovation, is monitoring the situation and is in close contact with the Governor’s Office of Homeland Security and Emergency Preparedness and law enforcement partners at the local, state and federal level. Read more.

NSA Creates New Cybersecurity Arm to Combat Foreign Threats

According to a report on www.nextgov.com, the National Security Agency (NSA) will create a new cybersecurity “directorate” to unify NSA’s foreign intelligence and cyber defense missions, and prevent and eradicate threats to national security systems and the defense industrial base. Anne Neuberger, who has been leading the NSA’s Russia Small Group, has been tapped to lead the new directorate, which will become operational on Oct. 1. Neuberger led the NSA’s election security efforts for the 2018 midterms, having served as the NSA’s first chief risk officer. Read more.

IoT Cybersecurity Improvement Act Calls for Deployment Standards

The IoT Cybersecurity Improvement Act of 2019, co-sponsored by Reps. Robin Kelly (D-Ill.) and Will Hurd (R-Texas), would require the National Institute of Standards and Technology (NIST) to issue guidelines for the secure development, configuration and management of IoT devices, according to a recent article on www.techtarget.com. It would also require the federal government to comply with these NIST standards. Balakrishnan Dasarathy, collegiate professor and program chair for Information Assurance at the Graduate School at the University of Maryland University College, was quoted in the article in support of the bill. “We need government intervention,” he said. Dasarathy said that the bill would provide appropriate IoT security guidance to chief information security officers (CISOs) and other organizational executives. “Right now many CISOs struggle to determine adequate security,” he said. Read more.

Industrial Cybersecurity Emerging as Frontline of Cyber Attacks

According to a report on www.businesswire.com, the number of cybersecurity-related incidents occurring around industrial systems and operational technology is on the rise. Industrial cybersecurity is therefore emerging as the frontline defense to address such threats. Urmez Daver, vice president and global head of Industrial Cybersecurity, TÜV Rheinland Group, speaking at the recent Secure Summit APAC 2019 in Hong Kong on July 11, said that emerging cybersecurity standards will provide the right level of guidance to enterprises to manage cyber risk, which is often best achieved when safety, security and privacy are engineered by design. Read more.

Israel to Provide Cybersecurity Training to Students with Autism

A first of its kind cybersecurity training course for people with disabilities has opened in Israel, led and financed by the National Cyber Directorate and the Welfare and Social Services Ministry, according to a report on www.timesofisrael.com. In an effort to expand the pool of talent in the industry, Ram Levy, CEO of cybersecurity company Konfidas, initiated the training to enable people with disabilities to integrate into the cybersecurity field. The first cohort of the course will include 16 students on the autism spectrum, aged 21 and up. Read more.

 

 

Cyber Connections News Roundup: July 16

Get the latest cybersecurity news from leading companies, news outlets and blogs.

Cyber Connections News Roundup is a bi-weekly brief of online links to news stories and commentary of interest to the cybersecurity community, delivered on the second and fourth Tuesday of each month. Articles are selected for their newsworthiness, timeliness, potential impact, and reach.

July 16, 2019

New ISA Cybersecurity Alliance Established to Accelerate Education, Readiness, and Knowledge Sharing

The International Society of Automation (ISA) has created an open, collaborative forum to advance cybersecurity awareness, readiness, and knowledge sharing. According to a recent report on Yahoo Finance, the ISA Global Cybersecurity Alliance will bring together a global group of stakeholders from end-user companies, control system vendors, IT and OT infrastructure providers, system integrators, and others affiliated with global industry to benefit everyone, especially the communities in which we operate and serve. Read more.

Artificial Intelligence in Cybersecurity Expected to Surpass $38 Billion

A recent report from Markets and Markets predicts that the artificial intelligence (AI) in cybersecurity market will reach USD 38.2 billion by 2026 from USD 8.8 billion in 2019, at the highest CAGR of 23.3%. Major drivers for the market’s growth include: the growing adoption of IoT and increasing number of connected devices; rising instances of cyber threats; growing concerns of data privacy; and an increasing vulnerability of Wi-Fi networks to security threats. Read more.

New Indiana University Cyber Clinic to Serve as Mid-West Hub for Training

According to an article on https://meritalkslg.com/, Indiana University (IU) will establish the IU Cybersecurity Clinic to address cyber threats on the state and local level. IU said the clinic would serve as a Midwest hub for cyber training. Funding for the new clinic comes from a $340,000 grant from the William and Flora Hewlett Foundation and matching funds up to $225,000 from the Indiana Economic Development Corp. Read more.

U.S. Coast Responds to Recent Safety Alert With Cybersecurity Recommendations

On July 8, the U.S. Coast Guard issued a safety alert to report an incident in February whereby a deep draft vessel on an international voyage bound for the Port of New York and New Jersey reported that it was experiencing a significant cyber incident impacting its shipboard network, according to a recent report on www.marinelog.com. The Coast Guard responded to the incident by establishing a set of recommendations for vessels and facility owners to improve cybersecurity. Read more.

Maryland Department of Labor Reports Cybersecurity Incident

A recent report on https://www.nbcwashington.com/ details efforts by the Maryland Department of Labor to notify roughly 78,000 customers about potential unauthorized activity in two of its database systems. On July 5, the department reported that some personal information might have been accessed without authorization, but that an investigation by the department has not found any misuse of data. Read more.

 

 

Get the Facts About 5G Network Security

Balakrishnan Dasarathy, Ph.D., collegiate professor and chair for Information Assurance and Cyber Operations programs at University of Maryland University College (UMUC), cuts through the hype about 5G networks and gets to the truth about potential security threats and the ways to mitigate them.

The promise of 5G networks is that they’ll provide an order of improvement in both data rates and latency over the current generation of cellular networks and, as such, will introduce a host of new applications that support industry and critical infrastructure. Telecom equipment supplier Ericsson predicts that the number of cellular IoT connections will reach 4.1 billion in 2024—increasing with an annual growth rate of 27%.

The upside of 5G is its support of an unprecedented number of connected devices. Its networks will rely on new architectural concepts and service delivery models that will improve functionality across numerous vertical markets and drive down costs.

The downside is that 5G will create a threat landscape that we have not experienced with previous networks. Ironically, the security challenges inherent in 5G will arise from the attributes that make it such an improvement.

Any security plan for 5G should focus on the following six threats:

  1. Loss of availability: flooding an interface and crashing a network element by sending malformed packets by poorly authenticated, malware-infested devices
  2. Loss of confidentiality and integrity: eavesdropping, data leakage and data modification due to lack of energy-efficient cryptographic techniques on low cost, low power connected devices
  3. Loss of control: an attacker taking control of the network or compromising the network
  4. Malicious insider threats: an attacker modifying the network elements as the network is opened up and services rely on out-sourced entities
  5. Code in network elements: spying such as Trojan horse, trap door and logic bomb

Minimizing Future Threats to the 5G Network

Managers of network security can mitigate these six 5G security threats with new service and trust models, and by keeping close watch on Huawei, the Chinese global provider of information and communications technology infrastructure and smart devices.

New service models, for example, must be expanded to include roaming agreements to support a specific business such as drones from Amazon and car fleets from GM, and not just cell phones. Trust models must address new data protection challenges across 5G networks that include more actors of different types. Today’s trust model addresses SIM cards issued by a few vendors for phones. Any future 5G trust model must address industry automation control devices, vehicles, sensors, drones and other IoT devices. Federal agencies, namely the National Institute of Standards and Technology (NIST), must accelerate advancements in lightweight cryptographic techniques that are designed to implement in constrained environments such as RFID tags, sensors and medical devices.

Finally, any 5G-network security framework must also identify and address potential malicious activity from Huawei, and the only way to do so is to review the underlying code of network equipment. Since an adversary like Huawei, with direct links to the Chinese government, will not supply anyone with the functional specifications for the malware they may plant, the U.S. must actively review the code in Huawei equipment much in the way that the U.K. is doing now through its Huawei Cyber Security Evaluation Centre (HCSEC).

About the Author

DasMarch2018v6Dr. Balakrishnan Dasarathy, collegiate professor and chair for Information Assurance and Cyber Operations programs at UMUC, brings more than 30 years of experience in research and development and management in the fields of information assurance, cyber security, and related areas of computer science. He has worked in the telecommunications and finance industries and currently teaches courses in network and software security and cyberlaw. Dasarathy received his PhD in computer and information science from Ohio State University.

Cyber Connections News Roundup: July 2

Get the latest cybersecurity news from leading companies, news outlets and blogs.

Cyber Connections News Roundup is a bi-weekly brief of online links to news stories and commentary of interest to the cybersecurity community, delivered on the second and fourth Tuesday of each month. Articles are selected for their newsworthiness, timeliness, potential impact, and reach.

July 2, 2019

Hacking Risk to Medtronic Insulin Pumps Exposes Vulnerabilities IoT Medical Devices

According to a report on www.forbes.com, the U.S. Food and Drug Administration (FDA) warned recently that a number of insulin pumps from Medtronic MiniMed might be at risk of a cybersecurity breach. According to the FDA, Medtronic is recalling affected MiniMed pump and providing alternative insulin pumps to patients. The Medtronic recall illustrates the increase in vulnerabilities of such medical devices as more and more go online and shift to IoT and wearables. Read more.

NIST Releases Guide to Managing Cybersecurity Risks Posed by IoT

Health IT Security reports that on June 25 the National Institute of Standards and Technology (NIST) released a guide to managing the privacy and cybersecurity risks posed by IoT, the first in a planned series on IoT designed to help both federal and private sector organizations shore up IoT vulnerabilities. In October 2018 NIST issued a draft IoT report, which laid out the top considerations that can impact the management of IoT devices across the enterprise. The guide released last week builds on the initial report and is designed to serve as a foundation for a planned series on more specific IoT assets. Read more.

M&A Deals Hamstrung by Cybersecurity

According to a recent report by Forescout Technologies titled The Role of Cybersecurity in M&A Diligence, half of IT decision makers (53%) found critical cybersecurity issues that put mergers or acquisition deals in jeopardy during their initial assessments, according to Forescout Technologies’ survey of 2,700 executives. Furthermore, undisclosed data breaches represent an immediate deal-breaker for their company’s M&A strategy, according to 73% of surveyed decision makers. Acquiring a company, only to find critical cybersecurity issues down the line, made 65% of decision-makers feel buyer’s remorse once the deal closed. Read more.

Maryland Gov. Hogan Hires Cybersecurity Chief

Gov. Larry Hogan (R) has named Maryland’s first statewide chief information security officer, part of an effort to boost defenses against cybersecurity threats, according to a recent report on www.washingtonpost.com. John Evans, who had served as the chief information security officer for the state Department of Information Technology since October, will lead the newly created Office of Security Management and chair the Maryland Cybersecurity Coordinating Council, a panel made up of nearly a dozen agency heads. The move comes just after a powerful ransomware attack nearly paralyzed the city government for the past month. Read more.

Iranian Hackers Ramp Up Cyber Campaigns Against U.S.

A recent article on www.time.com details how Iran has increased its offensive cyber attacks against the U.S. government and critical infrastructure as tensions have grown between the two nations. The article describes how hackers believed to be working for the Iranian government have targeted U.S. government agencies, as well as sectors of the economy, including oil and gas via spear-phishing emails, according to cybersecurity tracking companies CrowdStrike and FireEye. The cyber offensive is the latest chapter in the U.S. and Iran’s ongoing cyber operations targeting the others. Read more.

 

Cyber Connections News Roundup: June 4

Get the latest cybersecurity news from leading companies, news outlets and blogs.

Cyber Connections News Roundup is a bi-weekly brief of online links to news stories and commentary of interest to the cybersecurity community, delivered on the second and fourth Tuesday of each month. Articles are selected for their newsworthiness, timeliness, potential impact, and reach.

June 4, 2019

Startup BlueVoyant Raises $82.5 Million at a Valuation in Excess of $400 Million

According to a recent article on www.techcrunch.com, New York based cybersecurity startup BlueVoyant, a provider of managed security, professional services and, threat intelligence, has raised $82.5 million in a Series B round of funding at a valuation in excess of $430 million. The funding is coming from a range of new and existing investors that includes fintech giant Fiserv. Read more.

Cybersecurity Stands to Benefit from Advancements in AI

An article on www.globalsign.com reports that cybersecurity may be one of the key beneficiaries of advancements in artificial intelligence (AI). AI, for example, can be used to detect imminent threats by collecting data from different logs and records and identifying new threats that are being spread by hackers. AI can also identify malware and spyware trends by analyzing data across multiple channels. AI lets users detect malware systems faster and before they can do damage on a large scale. Read more.

Middle East and Africa Cybersecurity Market Expect to Take Off

A new report featured on www.researchandmarkets.com predicts that the Middle East and Africa cybersecurity markets will expand at a CAGR of 11.9 percent and is expected to be valued at USD 23.4 billion by 2023. Contributing to this rise is the digitization in verticals such as banking, financial services, government, and the oil and gas industries, which has triggered the risk of cyber attacks. The main reason for the cybersecurity market’s exponential growth rate is improved awareness, and the adoption of various cybersecurity services that are needed to safeguard smart grid devices, digitized businesses, and IoT-based smart cities. Read more.

New Cybersecurity Legislation Aims to Secure Nation’s Election

Sens. Amy Klobuchar, D-Minn., and Susan Collins, R-Maine, introduced legislation to secure the nation’s elections by providing training to state and local election officials, according to a report on www.brainerddispatch.com. The “Invest in Our Democracy Act of 2019” would direct the Election Assistance Commission to provide grants in support of continuing education in election administration or cybersecurity for election officials and employees. The Act would establish a grant program administered by the Election Assistance Commission to cover up to 75 percent of the cost of the yearly tuition of election officials and employees who are enrolled in an accredited certificate program for election administration or cybersecurity. The Act would also provide $1 million for fiscal year 2021 and such sums necessary for each fiscal year between 2022 and 2028. Read more.

Poor Cybersecurity Can Do Damage Beyond Your Bottom Line

A recent article on www.securityboulevard.com enumerates the ways poor cybersecurity measures could harm your business. For example, your initial impression may be that weak cybersecurity only affects your organization, but a lack in cybersecurity can also be problematic for an organization’s customers and wider markets. Companies can steer clear of this fault by taking a top-down approach to cybersecurity. Read more.

 

Cyber Connections News Roundup: May 21

Get the latest cybersecurity news from leading companies, news outlets and blogs.

Cyber Connections News Roundup is a bi-weekly brief of online links to news stories and commentary of interest to the cybersecurity community, delivered on the second and fourth Tuesday of each month. Articles are selected for their newsworthiness, timeliness, potential impact, and reach.

May 21, 2019

States Make Strides In Cybersecurity But Is it Enough?

On https://www.govtech.com, blogger Dan Lohrmann offered a report from the National Governors Association Center for Best Practices’ third National Summit on State Cybersecurity (May 14-15, 2019 at the Shreveport Convention Center). The event convened state homeland security advisors, chief information officers, chief information security officers, governors’ policy advisors, National Guard leaders and others to explore cybersecurity challenges and promising practices. Overall, Lohrmann observed “a sense of how far the nation has come regarding cybersecurity, tempered by a recognition of how much more needs to be done.” He also highlighted comments from keynote speaker Chris Krebs, director, Cybersecurity & Infrastructure Security Agency, U.S. Department of Homeland Security, who discussed the actions of Russia during the 2016 election and reminded the audience that ransomware and a host of other cyber trends are also top priorities of the administration. Read more.

IoT Is Major Driver in Growth of Artificial Intelligence Market

According to a new report from B2B research provider MarketsandMarkets, the artificial intelligence in cybersecurity market is projected to reach USD 38.2 billion by 2026 from USD 8.8 billion in 2019. Major drivers for the market’s growth include the adoption of IoT. Other factors are the increasing number of connected devices, rising instances of cyber threats, and increasing vulnerability of Wi-Fi networks to security threats. According to the report, titled “The Artificial Intelligence in Cybersecurity Market,” opportunities include the growing need for cloud-based security solutions and the increased use of social media for business functions. Read more.

The Intersection of Trade Wars and Cybersecurity

A recent article on www.forbes.com highlights the potential for foreign adversaries to create and exploit vulnerabilities in information and communications technology and services. In light of the current trade war with China, the administration has banned two Chinese technology companies from entering U.S. markets. The Commerce Department added Huawei, the telecom equipment giant, to the Bureau of Industry and Security’s “Entity List,” a designation that bars firms from doing business with U.S. companies without a special license from the bureau. Prior to that move, the FCC voted unanimously to deny China Mobile’s application to provide telecommunications services in the United States. Read more.

The Evolution of the Utilities Industry Could Mean a Rise in Cyber Threats

The evolution of the utilities industry to a “smart infrastructure” that relies on digitized equipment and connectivity across devices, plants, and systems will most likely result in a growing number of cybersecurity threats, according to a recent article on www.helpnetsecurity.com. Current security policies of many utilities have not evolved in step with this evolution and could leave companies vulnerable. Of the six risks enumerated in this article, boundary protection tops the list. Read more.

Defining and Deploying a Cybersecurity Culture Is an Ever-Evolving Challenge

A recent article on https://cybersecurity.isaca.org/ by Luis Emilio Alvarez-Dionisi, Ph.D. and Nelly Urrego-Baquero offers a path forward, but the authors concede: “Having a cybersecurity culture is a dynamic process that demands continuous attention.” The main objective of cybersecurity culture is to develop and implement a cybersecurity culture ecosystem to support cybersecurity. Sharing the experience of establishing an advanced social and psychological groundwork may help support cybersecurity. Deploying a cybersecurity culture requires senior leadership buy in. The board of directors and senior management must decide to support and enable a cybersecurity shield to mitigate the risk associated with cyber attacks. Read more.

 

 

Don’t Let Romance Scams Spoil Your Valentine’s Day

By Dr. Richard White

Valentine’s Day is for romance and connection, but scammers are skilled at using emotion as a social engineering tool.

In my book “CYBERCRIME: The Madness Behind the Methods,” I explain in detail how social engineering manipulates how we see and hear what we want to believe. In turn, dopamine released in the brain reinforces our new actualized belief.

There are five areas where scammers are most successful at engineering our beliefs and driving our actions through emotional connections.

1. Email and Phishing scams are always a threat. When romance is in the air, concerns for security may take a back seat to the excitement of finding the perfect romantic gift.

For example, scammers develop ads designed to lure victims to malicious websites or steal their credit card information with promises of gift cards, great discounts or a gift you never knew existed. Be wary of unknown companies and always verify the validity of a company before clicking a link.

2. Facebook and social media are powerful marketing sights for scammers. Perpetrators use the power of search algorithms to seek out the right victims for their scam and ads you clicked in the past combined with your search patterns allow just the right ad to be placed on your screen.

Scammers’ ads may look legitimate and their products or services may be real, but their goal is to steal your information or take your payment without delivering merchandise. Remember that social media platforms are designed to get people to respond to ads. Don’t click on an ad until you research the company with a Google search or the Better Business Bureau to ensure trustworthiness.

3. Fake profiles are a common problem on dating sites. Leading up to and during Valentine’s Day, scammers up their romantic game to establish online relationships. Remember, people tend to see and hear what they want to believe.

A common scam involves a U.S. citizen or service member who is living abroad but soon to return home, conveniently right near were you live. Once the online relationship is established, the scammer comes up with an issue and needs your financial assistance to return home.

4. Variations of the Nigerian prince scam abound. This scam involves receiving something amazing in exchange for documentation, money or a credit card number.

You receive some type of communication from a person searching for someone with your name who claims to be a long-lost love, family member, or special someone who got away. But he or she is not sure you’re the right person, so asks you to provide information to prove who you are.

Remember who is at risk here, and that you are the one putting yourself out there—possibly in harm’s way. Slow down, think and verify whom you are dealing with.

5. Compromised websites are a great way to spread malware. A website may be real and belong to a legitimate business or person, but it may have been hacked.

Be careful with any type of site that is open to the public for posting comments. Anyone can post a link that will direct you to malware or a compromised website. Whether an advertisement, a product review, or a personal ad from someone searching for you, do not let your emotions get the better of you and do not rush into something out of pure excitement. Research links before clicking on them and don’t ever post personal information online.

Also, don’t forget about the things you can do to mitigate your risk. Here are five:

  1. Always be mindful of phishing emails and attachments. If a link seems to be exactly what you are looking for, beware. Scammers may have targeted you.
  2. Many websites will allow you to test a link before you click on it, such as checkshortURL.com, virusdesk.kaspersky.com/, and scanurl.net/. These sites will let you know if the link has been reported as malicious or if malware was found on the site. Always test a link before clicking on it.
  3. Be careful when sharing personal or financial information with someone you have not met personally.
  4. Protect your privacy when using an online dating site. Do not use the same username and email address used for your normal daily activity and never put your full name on your profile.
  5. Never go off-site to use personal email or instant messaging. Social media and dating sites have a communication platform designed to protect you and keep your information private.

Finally, if you do have a need to send money overseas please follow this advice: Wiring money is the same as sending cash. It is gone as soon as it is sent. The most secure way to send money to a U.S. citizen abroad is through the U.S. State Department. To find out more about this and other options for sending money abroad go to http://www.travel.state.gov and visit the international travel section or contact Western Union and ask about this program.

Remember, your best defense online is combining awareness of cyber threats and risks with recognizing your own personal bias in the moment. Ultimately, if you are not completely comfortable with an email or website, then leave it alone.

Happy Valentine’s Day!

Dr. Richard White is an adjunct professor of cybersecurity and information assurance at University of Maryland University College (UMUC) and the author of Cybercrime: The Madness Behind the Method.”