MK-Ultra and the Patriot Act: A Privacy Dilemma
0
Dan Gavin
MK-Ultra and the Patriot Act: A Privacy Dilemma

MK-ULTRA. It was a “classified covert mind-control and chemical interrogation research program, run by the Office of Scientific Intelligence”. It began in the early 1950’s. The Central Intelligence Agency (CIA) insists it has been shut down. But a 14-year veteran of the CIA, Victor Marchetti, has stated in many interviews, that the claim is a “cover story.” The program is likely still in operation.

From the CIA’s own website we read that the CIA is “prepared to accomplish what others cannot accomplish and go where others cannot go” and that they are “the Nation’s eyes, ears, and sometimes, its hidden hand”.

Since they are the self-declared extra-legal arm of the US government, and from their history the extra-ethical arm of the country, we may deduce there are many activities conducted by the Agency we simply cannot see. Yet.

In a redacted Memorandum for the Record dated June 9, 1953 Director Gottlieb penned these words about MK-ULTRA, “The estimated budget of the project at XXXXXX is $39,500.00. The XXXXXX will serve as a cut-out and cover for this project and will furnish the above funds to the XXXXX as a philanthropic grant for medical research. A service charge of $790.00 (2% of the estimated budget) is to be paid to the XXXXXX for this service.”

The direct quotations printed above are from the CIA Freedom of Information Act (FOIA) page on their website. Therefore, I’m not making any unsubstantiated claims. I’m just the messenger for their own message. From this point forward I will be making wild unsubstantiated claims and speculate like an unrestrained adolescent.

MK-ULTRA isn’t the only CIA program to use US citizens for experimentation. It’s just the one we used for this article. But since smoke indicates fire, maybe we should feel free to speculate. Which leads me to the technical portion of this article.

Most people treat the details of their personal life on the World Wide Web very carelessly. People who (in person) are very guarded and suspicious, disclose the most sensitive information about themselves on Facebook, or in an email. Which, by the way, are both unencrypted and easily accessible by anyone.

Most people use Gmail and Google Docs – the free one. They are under the mistaken impression that since they have it protected with a password, only they have access to it. They forget that Google also has access to it. And through the PATRIOT ACT, so does any arm of the Federal Government, or law enforcement; even without a warrant. The Big Tech companies like Google, Microsoft, Apple et.al. provide wonderful free cloud-based services like email, word processor, spreadsheets, etc. We fail to understand the scope of the reach tech companies have into our lives.

You may think, “but I am a law-abiding citizen. I have nothing to worry about.” The truth is, you are only partially correct. In his blog, Moxie Marlinspike, the creator of the encryption tool Signal, said the following, “Imagine if there were an alternate dystopian reality where law enforcement was 100 percent effective, such that any potential offenders knew they would be immediately identified, apprehended, and jailed.” Our entire culture has evolved when a critical mass of citizens pushed back against laws we collectively decided were outdated or just plain wrong. That couldn’t have happened in a world where even a whiff of social disobedience is detectable.

This may sound a little like the movie “Minority Report”. If law enforcement could peer into the digital lives of us all, would they possibly use artificial intelligence to prognosticate whether someone was contemplating a crime? Would there be a law to punish such a person? Furthermore, have you ever made a comment that might be construed as terrorist leaning? I bet you have but you didn’t know.

Truth be told, maybe we all have lives that we should have the power to keep private. Even from the CIA.

This article was originally published here.

One Click That Shutdown 15,000 Businesses, the CDK Hack 
0
Dan Gavin
One Click That Shutdown 15,000 Businesses, the CDK Hack 

What started out as a peaceful shift for one of the country’s largest Auto Dealer Software-as-a-Service vendor, turned into a nightmare.  By 2:00AM, the security team determined that they needed to shut down two of their data centers to stop the ransomware from spreading.   

The vendor is CDK Global and they provide software services for over 15,000 car dealerships nationwide. They provide a platform that handles all aspects of an auto dealership’s operation including customer relationship management, financing, payroll, support and service, inventory, and back-office operations.  On June 19th, CDK announced there was a cyber incident they were investigating, and services were not available.   They started restoring service later in the day, but then they had a second cyber incident which caused them to take the systems offline again.   

What makes the problem more complicated is that their clients are always connected to their network through an “always-on” VPN. This provides a tunnel from the client to the data centers.  Normally that would be a good thing, but in this case, the always-on VPN just extended a network that was poisoned by ransomware.  They recommended that the clients disconnect so that the hacker could not “pivot” from the CDK network to the client dealership network.  What was even more critical was that the CDK software had administrative privilege on the client systems to do software updates. Hacking that software would give the attackers admin access to the local computers.  Thankfully no clients reported any contagion.  

This attack caused widespread disruption at car dealerships with no ability to track and order car parts, conduct new sales and offer financing.  Some dealerships shut down completely, while others reverted to the tried-and-true method of pen and paper assisted by spreadsheets.  They are projecting to have all their clients fully operational by July 4th.   However, the damage has been done.  The disruption comes at a cost to CDK and the dealerships an estimated $944M. 

The attacker is purported to be a hacking group identified as BlackSuit, who although only starting a couple years ago, have been responsible for over 95 breaches across the globe.  They are known for using a technique called “double extortion.”  During the breach, they upload the victim’s data to their server before encrypting (locking) the data on the client system.  They request a ransom for the key to unlock the data allowing the victim to continue operations.  Additionally, they also threaten to release the data on the dark web if the victim does not pay a second ransom.  

This breach may have been avoided if CDK fully implemented Zero-Trust methods.  In a Zero-Trust environment, it is assumed hackers are on the network and only trusted applications can run.  Application whitelisting would have stopped this attack in its tracks.  Whitelisting allows only those known trusted applications to run on the network.  Any new application, like ransomware, would not be allowed to run. 

The attack also highlighted the importance of being prepared for anything.  All businesses should have a Contingency Operations Plan written and validated prior to any incident or emergency.  Those dealerships that adapted the process without a computer could continue to sell and service vehicles.  Those that did not have a plan suffered. 

The ray of sunshine in this otherwise dreary incident was that our local dealerships were unaffected by the attack. All the dealerships from Sierra Vista to Tucson escaped this disaster as they do not use the CDK service for their management.  

For CDK, one improper click costs them and their clients a billion dollars.  Implementing Zero-Trust concepts and employing continuous cybersecurity training would have been a much more cost-effective solution.  The problem is many companies don’t really understand that until it is too late. 

The original article was published in the Sierra Vista Herald here.

How Bilbo Baggins Almost Hacked Your Email 
0
Dan Gavin
How Bilbo Baggins Almost Hacked Your Email 

In the story created by JRR Tolkein, “The Hobbit”, little Bilbo Baggins was just a hobbit. But he became a burglar. No one suspected that this little Shireling was capable of such great feats. Although he did have great feet. The least suspecting of all was the dragon Smaug. Smaug had a great treasure. You see dragons love gold. It turns out they love gold even more than dwarves.  

But Bilbo was not after the gold. He was after something much more precious. The Arkenstone.  With his special ring, Bilbo became the first hobbit burglar.  

The next part of the story you are about to read is true. The names have been withheld to protect the victims. 

I received a phone call recently from a client who had a concern about an email. In this case it was an email sent from their own account rather than the typical phishing email one would receive. The email was requesting an ACH wire transfer from my client. My client, I was informed, did not use ACH transfers. How could that be?  This request was coming from their legitimate email account. What happened? 

All the evidence points to a compromised email account. The burglar had created a rule in the account that moved very specific sent emails to a folder called RSS feeds. This folder is almost always added by default to your Outlook client. It’s a folder almost no one uses, and even fewer users look at it. Certain emails were redirected to the RSS folder so that the legitimate user had no knowledge that it existed.   However, it was very easy for the threat actors to simply monitor this folder. As soon as a targeted message appeared, the burglars crafted a follow-on email requesting the ACH transfer. The legitimate email was simply asking if an invoice was payable, and the burglar asked for a transfer of funds to his account.  

Fortunately, this story has a happy ending. Thanks to the diligence of a very astute employee, this discrepancy was caught and the theft was blocked. The resolution to this almost tragic episode was quite simple. Change the password to the email account.  Make the password long and enable multi-factor authentication. Never re-use passwords.  This is like putting a dragon at the gate.  

Unlike Smaug, you don’t have an Arkenstone. But what you may not have thought about is your email. It is often the gateway to your gold. You must be as vigilant with it as if it were gold itself. You may want to consider having two email accounts. One account is for your entertainment, and a separate one is used to access and manage your financial accounts. And the latter? Protect that one with a dragon as if it were the Arkenstone itself.  

This article was originally published in the Sierra Vista Herald here.

Ransomware Shuts Down Municipalities; How To Protect Our Cities
0
Dan Gavin
Ransomware Shuts Down Municipalities; How To Protect Our Cities

On June 9, 2024, the city of Cleveland, Ohio uncovered a “cyber incident” which was later determined to be a ransomware attack. Since the attack, city hall has been closed to the public for over a week.  Citizen facing services have been offline as well. To contain the damage of the ransomware, the city shut down the affected systems until they could restore them safely.  On a positive note, emergency services, works, utilities and healthcare were not impacted. 

Details about the attack have been kept close-hold as the investigation continues.   Some employees were allowed back to work on the 12th, but many issues remained.  They could not process building permits and birth/death certificates.  After over a week, the mayor’s office still has not disclosed what information was exposed.  The city did say that they were not negotiating with the hackers and will not pay the ransom.

This is not the first major city in the U.S. to get hit with ransomware.  In 2019, the city of Baltimore, MD was hit with a devastating attack that crippled their municipal services for weeks.  The cleanup cost the city over $18M.  In May of 2023, Dallas, TX was hit with ransomware that disrupted the city’s 911 emergency services. New Orleans, Knoxville, and Las Vegas also have joined the Ransomware Victim Club. 

Don’t think that this only happens in faraway places in different states.  The city of Kingman, AZ experienced a significant cyberattack where the city’s computer system was compromised.  The breach included social security and driver’s license numbers mostly affecting employees. 

There are several reasons why hackers target city governments.  For one, cities have valuable data.  This includes sensitive information such as personal records and financial data.  Secondly, hackers assume that municipalities are a soft target.  Municipalities often lack the necessary funding and skilled personnel to address technology challenges.  Often the IT infrastructure is outdated, making them vulnerable to attack.  Lastly, municipalities provide critical services.  Hackers think that if they take down critical services, the city will gladly pay the ransom.  

Many of these municipalities had cybersecurity services which monitored their systems.  So, how did the hacker install the ransomware?  The problem with this method is that the hacker must be actively inside the network before the threat can be identified, and sometimes that is too late. New malware (zero-day attack) is not in the antivirus databases and is not automatically stopped.  

The solution to this problem is “application whitelisting” or “application allow listing.” With this method only applications which have been validated previously can run on the computer.  Even if an employee clicked a malicious link, when the software tried to run on the local system, it would fail. It is not on the allow list.  There is upfront friction with this implementation where users cannot load anything they want whenever they want.  They submit a request for their new software to be put on the allow list.  The cybersecurity personnel validate the software in their testing environment looking for unusual behavior.  If it checks out, the software is approved for use.  

Another cybersecurity aspect which is often neglected by municipalities is continuous cybersecurity training.  The one-time annual cyber classes are not effective. However, if the training is kept short, about three minutes per week every week, delivered to user’s email box, the results are exponentially better. Cybersecurity is top of mind. 

The lesson to be learned is that every government municipality is a target, not just big cities.  The data is valuable to hackers.  If they can take down emergency services, the hackers expect a fast payment.  Does your local government have the proper cybersecurity measures in place, such as application whitelisting and continuous training, to avoid the disaster that Cleveland is experiencing?

The original article was published in the Sierra Vista Herald and can be found here.

The Rising Importance of Cybersecurity in Our Digital Age
0
Dan Gavin
The Rising Importance of Cybersecurity in Our Digital Age

Tom and Dan were camping deep in the woods one night when Dan runs into the tent and says “There’s a bear attacking our site, we have to go!” Tom is confused when Dan stops to put his shoes on. Tom says, “What are you doing that for, you can’t outrun a bear?” Dan says, “I don’t have to outrun a bear, just you.” That’s how it is in the cyber world. In general, hackers are lazy. If it’s too hard, they move along to an easier target. 

Cybersecurity is crucial to our very survival. As technology continues to advance, so too do the threats that lurk in the deep recesses of the World Wide Web. From individuals to businesses and governments, everyone is a potential target for cybercriminals who seek to exploit vulnerabilities for their gain. 

Cybersecurity is the practice of protecting systems, networks, and programs from digital attacks. These cyberattacks are aimed at accessing, changing, or destroying sensitive information, extorting money from users, or interrupting normal business processes. The internet is ubiquitous. The proliferation of connected devices means the scope and scale of these attacks have grown exponentially. Cybersecurity is no longer a concern solely for large corporations or government agencies. It is a critical issue for individuals and small businesses as well.

One of the most common types of cyberattacks is phishing. Phishing attacks involve sending fraudulent emails that appear to come from reputable sources, tricking recipients into revealing sensitive information like passwords or credit card numbers. Another prevalent threat is ransomware. It is a type of malware that encrypts a victim’s files and demands a ransom payment to restore access. Ransomware can have devastating consequences, leading to financial losses, reputational damage, and operational disruptions.

The increasing frequency and sophistication of cyberattacks highlight the need for robust cybersecurity measures. You must be vigilant about protecting your personal information online. Simple steps such as using strong, unique passwords for different accounts, enabling two-factor authentication, using an adblocker on all your browsers, and being cautious about clicking on links or downloading attachments from unknown sources can go a long way in preventing cyberattacks.

For businesses, cybersecurity must be a top priority. It is no longer a cost center. It is a revenue guarantee. Businesses need to implement comprehensive security policies, conduct regular security assessments, and provide continuous cyber education for employees. Small businesses are particularly vulnerable. They often lack the resources and expertise to defend against cyber threats. They can take advantage of various tools and services designed to enhance their cybersecurity posture. For instance, investing in a zero-trust provider can help protect sensitive data and prevent unauthorized access.

Businesses should develop and practice an incident response (IR) plan to quickly address and mitigate the impact of a cyberattack. The IR plan outlines steps taken in the event of a security incident, including notifying affected parties, containing the threat, and restoring normal operations. By being proactive and prepared, businesses can minimize the damage caused by cyber incidents and recover more swiftly.

Cybersecurity is an essential component of our digital world. As cyber threats continue to evolve, it is imperative for individuals and businesses to take proactive measures to protect themselves. By staying informed and implementing robust security practices, we can collectively enhance our resilience against cyberattacks and safeguard our digital future. The key to success is to make yourself a hard target so that the bear goes after the easy prey instead of you. 

The original article was published in the Sierra Vista Herald and can be found here.

The Saga of Joe Public, A Social Media and Email Tragedy
0
Dan Gavin
The Saga of Joe Public, A Social Media and Email Tragedy

This is a story about Joe. Joe could be any one of us. During the day he is a nose-to-the-grindstone, focused, and hardworking employee. After work, however, he is careless and free, enjoying all that social media has to offer: posting photos, catching up with friends, reading the links his friends on social media post, and yes, he does enjoy the occasional cat video. He is active on his email account too.

Unfortunately, Joe is not really keen on cybersecurity hygiene. He clicks on any link he gets via email or social media without checking the URL first. He makes his life easy by using the same password for all his different accounts. Two-factor authentication is too much work and why would he need it anyway. Nobody would hack a regular guy. Since he is so friendly, his social media account is open to the public, so everyone knows everything about him. What he had for his birthday dinner last night; where he was born; his mother’s maiden name; and even the name of his first pet. 

Although Joe seems to be the life of the party when it comes to social media, Joe was not ready for the party crasher. After work, as Joe was ready to relax and catch up on some email, he discovered he could not login – password failed. That’s strange. He had not changed the password to his email account. Ever. So, he decided to check his Facebook account to see if anyone else was having trouble with their email provider. And what do you think happened to his Facebook account? He was locked out of Facebook too. As he sat back to ponder what was happening, a friend from high school called. His friend asked why he was sending out emails pretending to be a Nigerian prince looking for money? He also noticed that Joe started posting advertisements on social media for the Pink Princess Palace. That’s when Joe figured out that he had been hacked! How could this have happened to him?

The hacker could have come in from many different attack vectors. After checking the website, https://haveibeenpwned, Joe noticed that his username and password were compromised in 17 different breaches. Since he used the same username and password for every site, it was easy for the hacker to take over his email and social media. Also, the hacker could have just used Joe’s username combined with all the information on Joe’s Facebook profile to answer the typical “security” questions many web applications use for password resets. 

What does Joe do now to get back into his accounts and secure them? First, he should get in touch with his email and social media providers to let them know what happened to regain access to the account. This could even involve sending Facebook a copy of his Driver’s License to prove his identity. He will need to change his password to a nice long pass phrase – 16+ characters. He will also need to change his password on all his other accounts because the password has been compromised. Next, he should set up two factor authentication for all email and social media; and any other account he doesn’t want breached (like his bank and investment accounts). Two-factor authentication involves having the web service send a text with a one-time code. Even better, Joe would use a third-party application like Duo or Microsoft Authenticator. 

To do this on your Facebook account for example, you need to login to your account. Click the arrow icon in the top-right corner and select “Settings & Privacy” and click “Settings.” In the left-hand navigation bar, choose “Security and Login.” Scroll down to the “Two-Factor Authentication” section and click “Edit” next to “Use two-factor authentication.” Follow the instructions from there based on the way you choose to receive your notifications. All email and social media apps have this option. 

Now that Joe has so many usernames and passwords to remember, he decided to use a password manager to help him out so that he only needs to remember one long password. He downloaded Bitwarden to his computer and added the Bitwarden extension to all his browsers so that he has his secure passwords wherever he goes. 

Joe is so excited about securing his email and social media that he tells his brother, John Q, and the rest of his friends so that they don’t have to go through similar torture. Joe has since become the lead blogger for the Cybersecurity Evangelist.

This article was originally published in the Sierra Vista Herald and can be found here.

Bob’s Social Security Tale, Is Yours Safe 
0
Dan Gavin
Bob’s Social Security Tale, Is Yours Safe 

Social Security benefits are a lifeline for many retired Americans, providing essential income for daily needs and a comfortable retirement. The sad part is that it’s relatively easy to redirect your checks to a threat actor’s bank account. It really is a growing concern. Understanding how this can happen and how to protect yourself is crucial. 

Bob (names have been changed to protect the victim) is a 70-something retiree who had always been diligent about protecting his personal information. He kept his Social Security number safe and was cautious about sharing his personal details. Bob suddenly realized something was wrong when for the second month in a row his social security check hadn’t been deposited. The gnawing in his stomach was overwhelming. He contacted his bank and the Social Security Administration (SSA). He discovered his benefits had been redirected to an unknown bank account. Bob was a victim of a scam. 

Bob’s situation is, unfortunately, not uncommon. Scammers often use phone calls, emails, or even postal mail to impersonate SSA officials. They may ask for personal information, claiming there is an issue with your account or that you need to verify details to continue receiving benefits. Once they have your information, they can use it to change the bank account where your benefits are deposited. 

There are steps you can take to minimize the probability and the impact of this type of scam. First, guard your personal information like it was a pot of gold. Because it is. Never share your Social Security number, bank account details, or other personal information over the phone, email, or online. One way to ensure you survive a phishing attack is to contact the bank or other financial organization using a number you have called before. One you know for sure is the correct number.

Second, remember, the SSA will never call you and ask for personal information. If you receive a suspicious call, hang up immediately without uttering a word. Occasionally the scammer will ask questions designed to get you to say the word “yes”. Then they will manipulate the audio of the call and use it nefariously.

Third, regularly check your bank account and Social Security statements for any unusual activity. If you notice anything suspicious, report it immediately. 

Fourth, if you have created an online account at https://www.ssa.gov/myaccount enable the multifactor authentication to secure your benefits. Also, make sure the password you use here isn’t used anywhere else. Not even a permutation of the password. All the websites you use to manage your money should be secured with the strongest password the app allows, and absolutely enable multifactor authentication. 

Lastly, if you believe you are a victim of identity theft or fraud, contact the SSA and your bank immediately to report the issue and take steps to secure your accounts.

Bob’s story is a cautionary tale. It is a reminder to be vigilant and to trust no one. These simple steps will not guarantee you will never be a victim, but they WILL contribute to a more secure future. 

Any communication, regardless of the form, that causes you to feel an emotional response (urgency, catastrophe, or promise of punishment or reward) is most likely tied to a scam in some way. So, talk to someone you trust face-to-face. This can help calm you down and ensure you take careful methodical measures to resolve an issue.

Beware: Phishing Attacks Enter the Deepfake Era 
0
Dan Gavin
Beware: Phishing Attacks Enter the Deepfake Era 

Bob’s boss was asking for something really weird. A wire transfer this big was never done. In all the years Bob worked for Alice, she had never asked for a transfer of this magnitude. But there she was in the zoom meeting, in the flesh (well, digital flesh anyway). How was Bob to know that wasn’t really Alice? 

In the digital dimension, threats to our life aren’t always the mortal kind. They also lurk behind screens, ready to exploit our human weaknesses. Those are the ones that we too often overlook. While phishing attacks are nothing new, they have evolved. Welcome to the Deepfake world. Oh, is that word new to you? Well, buckle up. You need to learn it… and fast. A deepfake is a video or audio of yourself or someone you know created by Artificial Intelligence (AI) out of parts and pieces of other audio or video. With deepfake voice and video capabilities, cybercriminals can now mimic your trusted contacts (like your boss) and authority figures (like your spouse) with alarming accuracy, aiming to deceive and manipulate you. If you use the internet to do banking or email, you are a target. You need to understand the risks and implement precautionary measures to safeguard your online identity and personal information. 

Deepfake technology uses AI to combine audio and video recordings, seamlessly grafting a person’s likeness onto another’s voice or image. This tool, once restricted to Mission Impossible, is real. And it has been weaponized by cybercriminals seeking to exploit your trust in familiar voices and faces. 

Imagine receiving a phone call. On the other end someone is demanding you confirm sensitive account information. The voice on the other end sounds EXACTLY like your boss, complete with the cadence and intonation you’ve come to recognize. Or perhaps you receive an email from your biggest client requesting urgent wire transfers, accompanied by a convincing video message imploring immediate action. In both scenarios, the other person isn’t a person at all. It’s an AI impostor, leveraging deepfake technology to deceive and manipulate you. 

The consequences of falling victim to a deepfake phishing attack can be dire – from financial fraud and identity theft to reputation damage and compromised personal data. The ramifications are deep. Being deceived by someone you trust, even if it was a fake someone, creates a psychological fissure that erodes your confidence in digital communications and exacerbates feelings of vulnerability and distrust. 

The threat posed by deepfake phishing attacks is unsettling. But there are proactive steps you can take to mitigate risks and bolster your defenses. 

Verify Identities: Before responding to any requests for sensitive information or financial transactions, independently verify the identity of the sender through alternative channels. Contact your bank or employer directly by phone using a number you know to be good to confirm the legitimacy of any requests. 

Exercise Caution: Whenever you receive unsolicited emails, phone calls, or messages treat them with profound skepticism. This is especially true if they contain urgent or unusual requests. Scrutinize the content for inconsistencies or irregularities. It may indicate a phishing attempt. 

Stay Informed: Find someone you trust to keep you informed about emerging cybersecurity threats and trends, including advancements in deepfake technology. Educate yourself and your loved ones about the risks posed by phishing attacks.  

Use Multi-Factor Authentication: Implement multi-factor authentication wherever possible to add an extra layer of security to your online accounts. This additional step can help thwart unauthorized access, even if your credentials are compromised. 

Report Suspicious Activity: If you encounter a suspected deepfake phishing attempt, report it to the relevant authorities, such as your IT department, cybersecurity agency, or the Federal Trade Commission. 

The emergence of deepfake technology underscores the evolving nature of cyber threats and the importance of proactive cybersecurity measures. By remaining vigilant, verifying identities, and staying informed, you can safeguard yourself against the perils of deepfake phishing attacks. Together, we can navigate the digital landscape with resilience and confidence, thwarting cybercriminals at every turn. 

The original article was publish in the Sierra Vista Herald and can be found here.

Cyberwarfare: How foreign wars can affect us at home
0
Dan Gavin
Cyberwarfare: How foreign wars can affect us at home

On April 13, 2024, for the first time from their own country, Iran launched a huge missile and drone attack against Israel. This is all over the news, but did you know there was a cyber-attack prior to the strike against the Israeli radar systems? The pro-Iranian cyber gang known as Handala claimed to have breached radar systems and sent 500,000 text messages to Israeli citizens. The attack was meant to soften up the Israeli defense system and intimidate citizens, although it appears not to have had the desired effect.

More and more, cyberwarfare is part of the multi-pronged attack in kinetic warfare. So far, it has not been something that wins wars directly, but it contributes to the effects of other strategies. Cyberwarfare encompasses a range of activities, from espionage and sabotage to propaganda and disinformation campaigns. It is characterized by its low visibility and high impact, making it an attractive tool for state and non-state actors seeking to achieve strategic objectives without resorting to conventional military force. Additionally, the cyber domain offers a level of deniability and the ability to strike at the heart of critical infrastructure and societal functions.

There are three types of cyberwarfare commonly used today: wipers, distributed denial of service (DDoS), and defacement. The objective of wipers is to delete information from a network. This denies users access to their own data. Wiper attacks may include ransomware. A DDoS attack aims to take down a website or online resource by overwhelming it with malicious traffic. This is usually done with botnets (remotely controlled malware infected computers). Both types of attacks deny the end user access to their information or network. The third type of attack goes about their objective slightly different. Defacement deletes or modifies information on a website. The objective is to mislead the public into thinking the malign planted news is reliable with the hopes of that news going viral. This can be part of a wider psychological operation in the campaign.

There are estimates that the Iranian Ministry of Intelligence (MOIS) carried out more than 2,000 attacks each in the first week of April. Together, they operate more than 10 different attack groups. A cybertracker from CyberKnow reveals that 65 groups were involved in the campaign against Israel from the 1st to the 8th of April 2024, carrying out DDoS, defacement, and other types of attacks.

The targets of these attacks are not always digital. During the April 13th missile attack, Iranian-backed hacktivist group, the “CyberAv3ngers,” caused power outages in several Israeli cities. The CyberAv3ngers became famous in the U.S. in November and December 2023 for targeting U.S water facilities. Water utilities in Pennsylvania, Texas, and Florida were compromised. Although the consequences of the compromises were not dire, the group was sending a message that it could compromise high value targets and do damage if it wanted. The group targeted U.S. utilities for the U.S. support of Israel.

Although Iran’s cyber-attacks are noted above, it is not specific to that country. Cyberwarfare is being employed by all major powers across the globe. Israel, the U.S.A, China, Russia, North Korea, the UK, and European Union countries use these activities as part of their wider strategy to affect their influence.

Even though a kinetic war is being waged over 6000 miles away, cyber-attacks can affect us at home. Public utilities should especially be cyber prepared for anything in this environment.

You can find the original article here from the Sierra Vista Herald.

Supply Chain Security: Safeguarding Critical Infrastructure from Cyber Threats 
0
Dan Gavin
Supply Chain Security: Safeguarding Critical Infrastructure from Cyber Threats 

Imagine you invented a hypoallergenic egg. For one, you’d be a zillionaire. For another, you’d be the hero for everyone who loves lemon merengue pie but is allergic to eggs. Now imagine a psychopath who wanted to hurt your customers. All they need to do is insert regular eggs into one of your delivery trucks. Mayhem and disaster would be the result. 

In today’s interconnected world, supply chains form the backbone of the global barnyard. Supply chains enable the seamless flow of goods and services around the world. But the increased reliance on digital technologies and third-party suppliers means supply chains have become prime targets for cyber-attacks. This poses significant risks to critical infrastructure and services (like electrical distribution grids). As organizations struggle with the challenges of supply chain security, the importance of building resilience to cyber threats has never been more apparent. 

Supply chain vulnerabilities, particularly those stemming from third-party software and hardware suppliers, present many cybersecurity risks. These risks vary greatly. Malicious actors inject malware into supplier networks to compromise the integrity of software or hardware components. And don’t forget about the everyday users who inadvertently expose sensitive data to unauthorized users. The interconnected nature of supply chains amplifies the impact of these vulnerabilities. A break in one link of the supply chain can cascade through the entire chain. This disrupts operations and causes widespread damage. 

One of the key challenges in supply chain security is the lack of visibility and control over third-party suppliers. Many organizations rely on a complex network of suppliers, each with their own cybersecurity practices and vulnerabilities. This diversity makes it difficult to enforce consistent security standards across the supply chain, leaving organizations vulnerable to exploitation by cyber adversaries. Outsourcing critical functions to third-party providers further complicates the security landscape. Sometimes it’s necessary to allow external partners access to sensitive data and systems. 

To address these challenges, companies need to recognize and accept the need to strengthen the supply chain. They must take steps to fortify cybersecurity strategy. This will involve adopting a proactive default-deny zero-trust approach to access, rather than merely reacting to incidents after they occur. Key elements of a zero-trust supply chain include: 

  • Access control: Creating a policy of default-deny for applications, users, networks, and devices. 
  • Risk Assessment and Management: Conducting thorough risk assessments to identify vulnerabilities and dependencies within the supply chain, and implementing zero-trust-based risk management measures to mitigate potential threats. 
  • Vendor Management: Establishing robust vendor management processes to vet suppliers, monitor their security posture, and enforce compliance with cybersecurity zero-trust standards and best practices. 
  • Supply Chain Monitoring and Intelligence: Implementing continuous monitoring and threat intelligence capabilities to detect and respond to cyber threats in real-time, both within the organization and across the supply chain. 
  • Contingency Planning and Response: Developing contingency plans and response strategies to minimize the impact of supply chain disruptions, including alternative sourcing options and incident response protocols. 
  • Collaboration and Information Sharing: Engaging in collaborative efforts with industry partners, government agencies, and cybersecurity organizations to share threat intelligence and best practices for supply chain security. 

By investing in these proactive measures, organizations can strengthen their supply chain resilience and reduce the risks posed by cyber threats. In a time of escalating cyber-attacks and supply chain vulnerabilities, safeguarding critical infrastructure and services requires a coordinated effort to fortify the weakest links in the supply chain. 

Supply chain security is paramount in safeguarding critical infrastructure and services from cyber threats. As organizations navigate the complexities of global supply chains, building resilience to supply chain vulnerabilities becomes imperative. By adopting a proactive approach to supply chain security and implementing robust risk management practices, organizations can mitigate the risks posed by third-party suppliers and ensure the continuity of operations in an increasingly interconnected world. 

You can find the original article from the Sierra Vista Herald here.

Copyright © 2024 CyberEye Call us at: ‪(520)224-8981