now browsing by tag
Last July, officials from the Federal Bureau of Investigation and the Department of Homeland Security revealed that Russian hackers were behind cyber intrusions into the U.S. energy power grid. The intrusion illustrated the severe threat that hackers pose to our most critical industries – energy, finance, healthcare, manufacturing and transportation.
The DHS and FBI downplayed the danger in a joint statement: “There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks.”
But that might not be the end of it. Russia may be laying the groundwork for more damaging hacks, on America as well as other nations, using new cyber weapons like CrashOverride and BlackEnergy 3.
In 2015, Russia tested this on the Ukrainian capital of Kiev. These tools were specifically developed to disrupt electric power grids and it blacked out 225,000 people in the Ukraine.
One might wonder what is Russia’s end game for this kind of attack. To hurt us financially? To show us how vulnerable we are? In preparation for a more sinister attack?
Is it to punish America for anti-Russian policies? The White House expelled 60 Russians from the United States this week, joining western allies in response to Russia’s poisoning of a former Russian spy in Britain with what was a banned chemical weapon.
When DHS and FBI dissected the hackers’ tradecraft, it turned out to be very clever indeed. Mark Orlando, Chief Technology Officer for cyber services at Raytheon, broke down the particulars of why the new world of hacking works so well in America.
One of the attackers’ main strategies is to divide targets into two groups – intended targets which are the energy companies themselves, and staging targets like vendors, suppliers, even trade journals and industry websites.
Instead of going straight to the larger and better-protected targets, like a $60 billion energy company with a cyber security department, the hackers worked their way into the smaller and less secure companies’ networks like those that supply the big ones with smaller equipment. Or the local utilities that are partnered with them. Local regulators may also have good access.
There is even an Electric Utility Industry Sustainable Supply Chain Alliance that many of the large energy companies use.
When the hackers get into those systems, they use that access to gather intelligence and set traps for the larger company.
This targeting of the supply chain partners is brilliant. The manufacturer of natural gas turbines that supply a gas power plant would have great access to the plant’s systems and management, would probably have password access, and would not be questioned very hard.
‘It’s important to raise awareness,’ says Orlando. ‘These details, if taken by themselves, might not seem that impactful. When presented with the entire story, we can see it was part of a larger, sustained campaign, potentially causing a lot of damage.’
This is a long-term strategy that takes patience – just the kind of thing traditional espionage has perfected over the last century.
America seems to be getting the message. A recent survey from Raytheon and Ponemon showed that two-thirds of cyber security executives and chief information security officers in America, Europe and the Middle East believe cyber extortion, such as ransomware and data breaches, will increase in frequency and payout.
The traps themselves are pretty imaginative. Many are based in social media. No one would suspect a cute kitten video of hiding malware. But they do. And if your co-worker is a kitten-nut, they may not hesitate to download that video without thinking that it is a trap.
‘The weakness in cybersecurity are the users themselves, those that are not necessarily computer-savvy,’ says Quinn Mockler, a young cyber security researcher at Columbia Basin College in the Tri-Cities Washington near the Hanford Nuclear Reservation. ‘People overall need better awareness of cyber security. Otherwise, we will be open to constant attack.’
In one example discussed by Orlando, the attackers found a harmless-looking photo on one company’s human resources site that contained valuable information – the manufacturer and model of a certain piece of control-systems equipment.
That provided critical information on how the plant runs and set up the next phase of the attack – spear phishing – which is the use of customized, highly deceptive emails designed to deliver malware. Using resumés, curricula vitae, policy documents and other common messages, the hackers made reference to these control systems creating plausible, well-informed emails likely to fool someone into opening a malware-laced attachment.
One was an invitation to a company New Year’s Eve party.
Another common method used to infiltrate is called a watering-hole attack which plants malicious code in a place the targets trust, then waits for them to come pick it up.
In the energy-sector attack, DHS and FBI found that watering holes included trade publications and informational websites that dealt with matters specific to the energy industry. The hackers corrupted those sites and altered them to contain malicious content. The targets saw no reason to suspect anything was wrong when they visited them.
‘It’s a low-complexity, low-effort, high-yield attack,’ Orlando says. ‘With relatively little effort, you can target lots and lots of users.’ The best defense, he says, is for a company to monitor its own networks for signs that a user may have unwittingly stumbled into a watering-hole.
Much of the malware in the energy-sector attack was designed to capture user credentials, or the digital identity of someone authorized to use a target network. Credential harvesting includes usernames and passwords, hashes or a computer’s digital signature, often stolen through tricking someone at a false login page for a familiar site.
The hackers’ spear phishing emails contained documents that ordered the target’s computer to retrieve data from a server – one the hackers either owned themselves, or had commandeered. Once the hackers had the target’s credentials, they could apply techniques to reveal the password in plain text.
Requiring multiple modes of authentication to sign in, such as a thumbprint or a security token code, is the best way to thwart this type of attack.
Hackers imitated login pages themselves, planting a link that redirected users to a page whose ‘username’ and ‘password’ fields fed credentials straight to them. Orlando notes, ‘If I can come into your environment using authorized credentials, detecting that just became exponentially more difficult.’
There are two main lessons from the power-grid hack, Orlando says. First, businesses should know that small hacking attempts like suspicious emails are often part of a larger campaign. Also, they should understand that truly cyber-secure businesses look beyond their own networks. Like tracking the spread of a new Flu virus.
‘Your network isn’t just your network. It’s your network, plus your trusted partners, plus your suppliers,’ he says. ‘If you’re not mitigating risk across the entire cyber ecosystem, you’re potentially missing a very large exposure to your business.’
Since smaller companies are the hacker’s first stop on the way to the bigger targets, Orlando recommends monitoring computer networks for unusual activity, installing security patches regularly, developing a response plan to disclose breaches and limit damage, and communicate up and down the supply chain on cyber security.
Data diodes, air gaps, field programmable gate arrays – all the sophisticated approaches to cyber security that the nuclear and defense industries use – eventually need to be part of everyone’s defense.
But as Orlando summed up, the daunting new reality in modern cyber security is that a company’s cyber defenses are only as strong as the defenses of everyone connected to it.
The post Here Are The #Clever Means #Russia Used To #Hack The #Energy #Industry appeared first on National Cyber Security Ventures.
View full post on National Cyber Security Ventures
There is no doubt that there are numerous threats to organisations worldwide, and that it can seem increasingly difficult to manage your chances adequately. Whereas many years ago cyber-attacks were a rare warning sign, nowadays cybersecurity has increased in danger and frequency.
It seems that every day you can encounter another article on the topic, and this has managed to create a real and significant concern for both small and large organisations. More and more people are turning to reliable services such as those provided by Prosyn, a London IT services company dedicated to implementing safe and stress-reducing IT solutions.
Although some have taken precautionary measures against these possible attacks, many organisations have continually underfunded their importance. Here is why you need to take cybersecurity seriously:
Cybersecurity Threats are everywhere
As a general rule of thumb, we view technology as an intriguing subject which is bound to increase our lifespan and quality of life. However, it’s essential to understand that while some people can focus on innovative ways to help others, there will always be the ones who will look for an easy way to make money.
Professional hackers are paid to understand possible cybersecurity problems, and this is done in order to make the technology of a specific company safer and more reliable. Nonetheless, it appears that a reoccurring theme can be spotted: we are not getting better, and our security problems are not changing. While we depend more and more on technology and potential advancements, we are opening ourselves more and more to the possibility of an attack.
Hackers will tell you that most technology is prone to these attacks, rendering it vulnerable. There are many examples in our everyday lives, starting from smartphones, home alarm systems, cars, plane systems, and even medical pacemakers. Of course, the goal is not to instil fear in you, but to make you aware that even critical infrastructure such as dams or power grids can and have been hacked in the past. Thus comes the question, how confident are you in your cyber security measures?
Loss of revenue
According to experts in the industry, a staggering 60% of smaller businesses suffer a data breach each year, and that sometimes includes bigger names you might not expect. Yahoo and UPS are two clear examples of this threat, and so is JP Morgan –having lost the details of 76 million customers during an attack. This loss means that you are exposing your customer’s sensitive information, endangering their financial health, and causing significant revenue loses for your company.
According to a 2015 report published by the World Economic Forum (WEF), a whopping 90% of companies worldwide recognise the fact that they are ill prepared in case of a cyber-attack or breach of confidential data. In fact, it is estimated that this problem costs the global economy over US$400 billion per year –based on a prognosis by the Centre for Strategic and International Studies
The consequences of cyber crime
There are two main aspects that organisations should have in mind when dealing with cyber-attacks: are they meant as a data security breach or a deliberate act of sabotage? A security breach can be viewed as intellectual property or company secrets that an attack might target –ranging from information about bids to personal data. In comparison, sabotage is when fake messages flood web services, or when there is an effort to disable infrastructure systems which are being used by millions each day.
The direct result of these problems is not only a commercial loss, but also a disruption of public relations, with the goal of potentially extorting an individual, company, or organisational chain. Of course, there are also modern-day vigilantes who tirelessly work to expose negligence claims, fraud, and other issues which an organisation may try to sweep under the rug.
Whatever the reason for the cyber-crime, it should be noted that most of these incidents are often not reported, and that loss of information is rarely if ever mentioned. This problem does go hand-in-hand with companies not wanting to damage their reputation or be seen as unsafe by its customers. Besides, it’s hard to take legal action against the culprits –many of them have not even been identified.
Why do some companies underestimate the threat?
One of the main reasons that experts highlight is the difficulty of predicting the likelihood of a cyber-attack happening in your company. It’s also incredibly hard to estimate potential losses; thus the question many have on their mind is “should I invest this much to protect something that might never happen to me?”
An article published in the Harvard Business Review revealed that many decision makers are faced with making the judgement of how much they are willing to invest in cybersecurity, and most of them don’t fully understand the dangers of it. Here are the three main reasons highlighted in the article:
An empirical assumption that security frameworks like FISMA or NIST represent sufficient security
A security breach has never been an issue in the past, so there is no need to fix what isn’t broken
Companies have previously dealt with a small cyber-attack which was quickly resolved
It’s easy to see how individuals would follow this mindset. However, the problem with these mental models is that they view cybersecurity as a problem that can be solved, rather than on-going process which requires a robust prevention strategy. In fact, cybersecurity should focus mainly on risk management and minimise the possibility of future attacks rather than on risk mitigation. As previously discussed, some attacks could cost millions or even put you out of business.
The reality is that cyber-attacks are not solely related to one geographical area or another; criminals operate across borders, and very few of them have moral principles relating to uncovering corruption plots or cases of fraud. Therefore, there is a need to respond to cyber-attacks by having a global vision and strategy, all while understanding how law enforcement agencies work and how IT services can aid you.
The post Here is #why you need to take #Cybersecurity #seriously appeared first on National Cyber Security Ventures.
View full post on National Cyber Security Ventures
For “romance fraud” is at an all-time high with the National Fraud Intelligence Bureau reporting that 3,889 lonely hearts incurred losses totalling in excess of £39 million in 2016. But now global exclusive matchmaking company – Gray & Farrar – …
View full post on National Cyber Security Ventures
It’s TV’s biggest night and, once again, “Game of Thrones” is your best bet for Sunday night’s big winner, since the HBO show leads the 68th annual Emmy Awards with 23 nominations, followed closely by “American Crime Story: The People v. O.J. Simpson” with 22 noms.
Yes, tonight is the night when all your favorite shows and stars will battle it out live from the Microsoft Theater in Downtown Los Angeles. Though we are fairly certain “GoT” will dominate in the Outstanding Drama category, the show is up against “Homeland,” “House of Cards,” “Mr.
View full post on Parent Security Online
It’s 2016 and it seems that online banking is here to stay. After all, the majority of adults in the United States own mobile phones, and more than three-quarters of those are internet-enabled smartphones. Since 2011 when the Federal Reserve System board of governors began tracking such things, the use of mobile banking tools has […]
The post Despite security concerns, mobile banking here to stay appeared first on National Cyber Security.
View full post on National Cyber Security
Are you ready for a jolt of STEAM inspiration this spring? Well look no further – the 2016 April STEAMed Magazine issue is finally here! Each quarter (in January, April, July and October), we publish this FREE digital magazine for you to download and use in your classroom. Each issue is jam-packed with lessons, resources and ideas from teachers who are doing some inspiring work with arts integration and STEAM. And we also have the […]
View full post on EducationCloset
This year in September, police arrested a student from Vadodara for illegally using credit cards of three American nationals to book air tickets. In March 2013, two top officials of an online shopping portal were arrested after almost 200 complaints were received from customers who said they paid for things they never ordered or received. Like these, there are numerous examples to highlight a growing trend of frauds and scams related to online transactions, which are generally done by credit or debit cards. As per the ASSOCHAM-Mahindra SSG Report-2015, the number of cyber crimes reported in 2011 was 13301, which shot up to 300,000 in the year 2015. Of the reported cyber crimes, credit and debit card frauds topped the list and saw six-fold times increase over last three years. What should an online shopper do now? Stop shopping? Online shopping is very convenient but when we use are credit card online we expose ourselves to potential frauds. Here are some ways you can safeguard yourself from online frauds 1. Choose your credit/debit card wisely: While choosing a card, it is important that you focus not only on the fees, credit limit, reward structure etc, but also on the security […]
For more information go to http://www.NationalCyberSecurity.com, http://www. GregoryDEvans.com, http://www.LocatePC.net or http://AmIHackerProof.com
The post Here are 6 ways to protect yourself from credit card frauds appeared first on National Cyber Security.
View full post on National Cyber Security
Why does the word “single” always have ladies cringing? I’m here to tell you that being single is a great thing, thanks to these 17 benefits! I’m single! Yes, I said it. No, I’m not crying over a bucket of ice cream, with dripped mascara staining my cheeks as I watch Nicholas Sparks movies. Read More….
View full post on Dating Scams 101
0 0 Comments (0) Authors Sahil Baghla (left) and Arun Soni in Sector 17, Chandigarh, on Tuesday. IMAGINE you are a newlywed and on your honeymoon, or a single girl traveller who fears that the hotel room might have a hidden camera. What would one do in such a situation? What if, you still have your ATM card on you, yet a transaction has taken place with it elsewhere. Or what happens when someone creates your fake Facebook profile and hacks your email? Don’t worry, city’s renowned cyber crime experts Arun Soni and Sahil Baghla have answers to all such questions in their book Digital Cop, which was released on Tuesday. “There are parents who are worried about their children surfing too much Internet, tense whether their children will be back in time. We live in a digitally active world, surrounded by technology, yet we are the most clueless and vulnerable when it comes to securing and protecting ourselves from its vicious hackers. With Digital Cop, we are providing that security guard,” say Soni and Baghla. A one-of-a-kind book, it’s a layman’s guide to cyber security, and gives valuable tips to secure your virtual life and be a digital vigilante. […]
The post Chandigarh: Here comes Digital Cop to safeguard you against virtual crimes appeared first on National Cyber Security.
View full post on National Cyber Security