How Secure Are Our Water Supplies From Cybercriminals?

Earlier this year, a hacker was able to infiltrate the water supply in Oldsmar, Florida. The cybercriminal was able to increase the levels of lye, or sodium hydroxide, in the city’s water treatment system. Luckily, a city worker detected the hack and reversed any potential damage done, reports the BBC.

The cyberattack touched on both cybersecurity and public health concerns, one of multiple recent examples of how vulnerable our nation’s water supplies are to ever more sophisticated hackers.

The threat to the nation’s water supplies

Another similar example came on January 15, when a hacker attempted to attack a water treatment plant that is used by portions of the San Francisco Bay Area. The cybercriminal utilized the login information for the program that employees of the plant use to operate their computers remotely. The hacker — who has yet to be identified — deleted programs used by the plant to treat the area’s drinking water. This person’s activity was detected the next day, prompting the plant to immediately reinstall programs and change login information for employee accounts, reports NBC News.

In their broad-ranging report, NBC spotlights just how vulnerable our nation’s water system is to hacks — more than other sectors of our infrastructure.

This is due to the fact that water systems nationwide are difficult to institute universal cybersecurity safeguards and, unlike other parts of the infrastructure, can have severe impacts on the population at large if tampered with.

One benefit of our nation’s water supplies is that each system differs, there is no centralization. This means it would be very difficult to carry out a nationwide hack all at once given that each water facility functions on its own. On the flip side, this means there is no standard protocol that each system can implement. This results in a somewhat chaotic situation.

"It's really difficult to apply some kind of uniform cyber hygiene assessment, given the disparate size and capacity and technical capacity of all the water utilities," Mike Keegan, an analyst at the industry trade group, the National Rural Water Association, told NBC. “You don’t really have a good assessment of what’s going on.”

The vulnerabilities of local water systems

The threat is very real. NBC reports there are more than 50,000 drinking water facilities throughout the country. Most of them are nonprofit companies. While some are for the nation’s large metropolitan and urban centers, many provide drinking water for rural areas that might not have the means, staff, or defense protocols in place to defend against a major cyberattack.

A big problem facing these rural water facilities is the fact that many rely on remote employee system logins as with the situation in Oldsmar.

For facilities located in difficult-to-reach rural areas — an employee might have to drive 50 miles to work at a water treatment plant — and in a year where the pandemic saw all industries embrace work-from-home routines, we are facing an environment where these rural facilities are especially vulnerable.

NBC reports that some light is on the horizon. Congress just gave the Cybersecurity and Infrastructure Security Agency (CISA) authority to compel Internet providers to reveal the identities of organizations and companies that are prone to hacks. The Biden administration is also aiming to begin a cybersecurity initiative, an overdue collaboration between these water plants and the U.S. government.

Hopefully, we are entering an era where we are particularly vigilant about keeping the water we drink — and our communities depend on — are safe from cyberattacks.

How To Keep Your Cybersecurity Front and Center During Summer Vacation

It’s summer vacation time, and it’s safe to say that this season of fun in the sun will be a lot better than last year. In fact, a survey from April found 50 percent of U.S. adults are likely to take one vacation during the summer months — June to September — this year. This July Fourth saw record-setting road travel, with 43.6 million holiday revelers hitting the highways, 5 percent more than the last record set in 2019, Reuters reports.

While a post-vaccination summer means you’ll be able to enjoy the summer sun with friends and family, the regular concerns of daily life still persist. While it might seem like the ideal time to be carefree, the Center for Internet Security (CIS) cautions that it’s crucial to keep personal cybersecurity at the top of your mind.

In a guide written in partnership with the National Cybersecurity Alliance (NCSA), CIS outlines that you have to think of “your smartphones and devices as being just as important as your wallet.” Here are a few of the key tips they highlight:

• Keep your devices up to date: Make sure you update your devices to the latest software versions. If there’s an update, don’t put it off. These contain important security patches to keep your data secure.

• Come up with strong passwords: Make sure you have a strong laptop password that is at a minimum of eight characters and that ideally includes a phrase with both upper and lowercase letters, numbers, and special characters. For smartphones, they recommend a passcode of at least six characters, or “a swipe pattern with at least one turn of direction when protecting the lock screen.”

• Lock your device: If you’re leaving your phone behind to jump in the pool or head to the volleyball court, make sure you set an automatic device lock that would require someone to enter your secure passcode after a specific period of inactivity.

• Be vigilant about travel booking sites: Booking your lodging and vacation itinerary through travel websites can come with security risks, especially as you share credit card and other personal information. Before you log on, make sure to review the reputation of the website if it is one you haven’t used before. Try to focus on sources with good reputations and if you feel you’re being asked intrusively for information that is too personal or has nothing to do with your travel itinerary, do not share your data and please use a different method for booking your trip.

• Keep a tab on your device: Similar to the need for an automatic device-locking system, be vigilant at all times about where your devices are. Keep them on your person, or if not, in a secure location while you’re enjoying summer activities. Devices like smartphones and tablets contain your most sensitive information and they are expensive, a major target for thieves.

• Be wary of public W-Fi: While public Wi-Fi signals might be convenient when you’re on the go in a new town or city, they pose significant security risks. These Wi-Fi systems are unregulated — they often don’t need specific credentials for logging on and are generally not protected by encryption services. Your browsing activity, bank account and social media information — even your geo-location — are not secure. Avoid making financial transactions while using these networks. Use your phone carrier’s Internet connection, make another device a personal hotspot, or set your device to ask for your permission before it logs onto any Wi-Fi network.

• Be careful with your social media: It can be tempting to post every aspect of your vacation on Facebook or Instagram, but keep in mind this comes with risks. It can alert potential burglars that your home is unattended, or could also open you up to travel-related scams. Consider setting your posts to private — only accessible to select family or friends — or, at the least, be judicious about what you’re sharing and who can see it.

What New Tech to Fight Hackers Can Teach Us About Our Cybersecurity

It sounds like something out of a science fiction film. Scientists just developed new technology that entraps hackers in an artificial, cyber “shadow world.” The goal is to prevent these cybercriminals from carrying through with their objectives by luring them into what is being defined as “an attractive — but imaginary — world.”

The cybersecurity technology is called “Shadow Figment,” and has been designed mainly to protect key physical targets like the electric grid, water systems, and pipelines, among other crucial aspects of our country’s infrastructure.

This groundbreaking tech was created by researchers at the U.S. Department of Energy’s Pacific Northwest National Laboratory (PNNL), according to a recent announcement.

Shadow Figment: A new era of national cybersecurity defense

Shadow Figment uses AI to keep attackers engaged in an illusory online world once they enter a system like the electrical grid. The hackers are led to believe they are interacting directly with users in real time, with the AI responding realistically to commands.

“Our intention is to make interactions seem realistic, so that if someone is interacting with our decoy, we keep them involved, giving our defenders extra time to respond,” said Thomas Edgar, a PNNL cybersecurity researcher who led the team designing Shadow Figment, in the announcement.

The AI utilized in this program is very sophisticated. Hackers will be given false signals of success, thinking they have accurately infiltrated a system. This gives a cybersecurity defense team time to learn about the hack itself and better fortify the real system. Think of it like a digital smokescreen, throwing the hackers off their game.

PNNL’s research team says this “model-driven dynamic deception” made possible by advanced machine learning is a more credible AI defense than “static decoys” that have more traditionally been a part of cyber defense.

The real-world threat of hackers

The PNNL stresses there is a pressing need for this kind of technology. In recent years, we’ve seen examples like the 2015 attack on Ukraine’s electrical grid as well as the hack of the Colonial pipeline here in the United States.

While this new technology can be a game changer in national defense, it further reiterates why we all need to be vigilant about our own cybersecurity hygiene.

We might not be able to deploy our own version of Shadow Figment, but we can still make sure we use unique passwords for all of our accounts and devices, set up two-factor authentication, and be judicious in what emails and links we open to avoid phishing scams and ransomware attacks.

These new innovations from the U.S. government can offer a helpful reminder of how pressing the threat of cybercriminals is in our daily lives and what we can do to defend ourselves.

Cybersecurity Needs to Keep Up With A Changing World

The past year has brought cybersecurity front and center as work-from-home became the norm and the average person had to become better equipped at keeping sensitive data safe and secure. Despite these security friendly cultural and societal shifts, a new survey of tech professionals reveals we might not be quite up to par with best cybersecurity practices.

Tech news website TechRepublic reports that the survey from the Thales Group shows security teams across a wide international range of companies have generally been having difficulty adjusting to the new cybersecurity demands of the COVID-19 era. This means security teams have not been brought up to speed on ever-evolving cybersecurity protocols — from lack of modern infrastructure needed to defend their firms from hacks to improper training in current programs and software.

The extensive report found 20 percent of respondents said their security systems were ready for a sudden shift to the cloud as the pandemic altered overnight how companies handled their workflows. The survey also revealed 82 percent of respondents were concerned about security risks posed by the push for at-home work and 44 percent said they feared their firms’ systems were not equipped to keep data generated and transferred from home-based employees secure.

A need to embrace cloud computing

This doesn’t mean the majority of firms have security teams that are lacking in talent. It’s quite the opposite. Instead, the report reveals that these cybersecurity professionals just haven’t been given the appropriate tools fast enough to handle this changing world.

“Technologies such as encryption and multi-factor authentication (MFA) have not reached saturation levels such that the majority of applications and data are fully protected,” TechRepublic cites in a passage from the report.

One of the main cybersecurity realities that has emerged during COVID-19 is the need to embrace cloud computing. As we continue to normalize working from home — with many workplaces turning to hybrid home-and-office models — the cloud will only continue to be a necessity.

The Thales Group found that just 17 percent of respondents said more than 50 percent of sensitive data hosted on the cloud is encrypted at their firms. If you zero in further, 24 percent reported having full knowledge of where their data is even stored in the first place while 45 percent say their teams have clearly defined company-wide cloud protocols.

What this means is there is a lot of work left to do.

The Thales report lays it out clearly — everyone at a firm needs to be on the same page when it comes to cybersecurity: “Senior executives need to ensure that they obtain a more complete understanding of the levels of risk and attack activity that their front-line staff are experiencing. They can't make effective strategy and security investment decisions when perspectives across the organization aren't aligned." 

How Cybersecurity Impacted Working from Home During COVID-19

The past 12 months reoriented daily life in myriad ways. This is represented most starkly in how we work. In 2020, 62 percent of Americans worked from home, with 49 percent doing so for the first time, reports business website B2C.

That high volume of employees in the United States taking their work laptops home and from brought with it a 300 percent increase in cybercriminal activity targeting remote workers. The frequency of these hacks increased during the first six weeks of American quarantine and shelter-in-place orders early last spring.

The business website reports that 20 percent of companies experienced data breaches linked to these home-based workers.

If you’re a business owner — or even just an employee who still sees your home as your “office” for the foreseeable future — it is understandable that numbers like this give you cause for concern. With cybercrime targeting work from home on the rise, one bright spot appears to be the reality that cybersecurity etiquette is also on the rise.

Best practices for keeping your personal and professional data secure are part of the normalized parlance of office conversation. Now, it is becoming second nature for American workers to be cognizant of the importance of keeping their information protected from hackers.

Two-factor authentication, secure passwords, and wariness over phishing and ransomware attacks are increasingly a normalized part of professional life. In short, protecting your data isn’t just reserved for the company’s IT team.

CFO reports that companies are relying on the cloud. One example is the fact that organizations are using cloud-located intranets that use direct, private connections and even virtual desktop interfaces.

Artificial Intelligence (AI) and machine learning are also playing a needed role in identifying threats.

CFO cites a recent Infosecurity Magazine piece that shows how machine learning is detecting phishing attacks, referencing a cloud-based algorithm that scans email header messages to pinpoint what is known as “ratware,” or software that generates automatic mass messages. Then, another algorithm looks for phishing vocabulary in the body of an email. Eventually, this algorithm continues to grow more sophisticated, better picking up on suspicious emails as it collects more information about what is and isn’t malicious information hitting your Inbox.

While the rise of cybercrime is worrying, there is reason to hope. The deployment of canny AI made specifically to fight back against hackers coupled with increased cybersecurity literacy among America’s workforce hints at a future primed for a world that will continue to rely on working from home — safely.

The Need for More Cybersecurity Professionals

The past 12 months have been uncertain, with the COVID-19 pandemic causing major economic damage to a range of industries, from retail to education to communications.

Cybersecurity is one field that hasn’t necessarily experienced mass job loss, but is still suffering from a different problem — retention and hiring.

A new report from ISACA and HCL Technologies found that a high 61 percent of cybersecurity leaders say their teams are understaffed, while 55 percent say they have unfilled cybersecurity positions in their offices. The survey reached 3,600 information security professionals who revealed they had a hard time holding on to important talent over the past year, reports Help Net Security.

Difficulties with hiring and retention

While the pandemic might not have led to layoffs in the cybersecurity space, the cultural shifts brought about by the health crisis certainly impacted the information security workforce. One big reason for such low hiring and retention numbers seems to be “limited remote work possibilities” at their firms, as work-from-home culture has largely — in many instances, enthusiastically — been adopted by most American workers.

The report also found that 50 percent of cybersecurity leaders say the applicants they do see are “not well qualified.”

Ensuring cybersecurity firms are fully staffed is important given the crisis that has been growing ever grimmer in recent years — the rise of cyberattacks

About 68 percent of those surveyed who said they’ve experienced more cyberattacks also reported being “somewhat or significantly understaffed.” Additionally, 63 percent who have experienced these cyberattacks revealed they have a hard time retaining “qualified cybersecurity professionals.”

Jonathan Brandt, ISACA information security professional practices lead, told Help Net Security that the past year revealed “just how vital cybersecurity is to ensuring business continuity.”

“As a global cybersecurity community, it is imperative that we all come together to recalibrate how we hire, retain and train our future cyber leaders to ensure we have a solid workforce to meet these evolving cybersecurity needs,” Brandt added.

Skills cybersecurity professionals need

If you’re a cybersecurity professional and looking for work, the industry leaders surveyed by ISACA and HCL Technologies highlighted what they’re looking for.

About 95 percent of respondents said they are seeking candidates with hands-on cybersecurity experience, 89 percent cited credentials, while 81 percent cited hands-on training. When it comes to gaps in experience, 56 percent said “soft skills” are often lacking, 36 percent cited security controls and 33 percent referenced software development skills.

To close these gaps and fix this cybersecurity hiring void, they pointed to better training programs for non-security staff who hope to move to security positions, an increased reliance on contract employees and external contractors to better adjust to our modern “gig economy,” more emphasis on artificial intelligence (AI) and automation, as well as better performance-based trainings.

In an ever more complex world full of increased cybersecurity threats, it’s crucial we continue to build and harness a workforce that can keep our companies and personal and professional data safe and secure.

Does the Rise of Machine Learning Bring More Security Risks?

It’s one of those buzzword terms used increasingly over the years — machine learning (ML).

Conjuring images of science fiction films and sentient robots, machine learning refers to computer systems that can utilize algorithms and statistical models to analyze and process data without direct human instruction. As we’ve developed better, more versatile connected devices, our machines have gotten smarter. Just look at IBM’s Watson supercomputer or even your Apple device’s favorite AI assistant, Siri.

The more advanced our AI, the more security risks emerge.

A new report from Tel Aviv startup Adversa tackles this issue.

Cybersecurity blog The Daily Swig recently spotlighted the new paper, discussing how it asserts that in AI systems, “vulnerabilities can exist in images, audio files, text and other data used to train and run machine learning models.”

This makes it easier for these systems to be manipulated by cybercriminals, with AI having a hard time filtering out “malicious inputs and interactions,” the report reads.

Adversa found that AI machine learning systems that processed visual data were most sensitive to these attacks. “Vision” stood at 65 percent of attacks, followed by “analytics” at 18 percent, “language” at 13 percent and “autonomy” at just 4 percent.

“With the growth of AI, cyberattacks will focus on fooling new visual and conversational interfaces,” according to the report. “Additionally, as AI systems rely on their own learning and decision making, cybercriminals will shift their attention from traditional software workflows to algorithms powering analytical and autonomy capabilities of AI systems.”

The big concern is that, given how relatively new these advanced AI systems are, not enough defenses have been put in place to keep them safe and, most crucially, protect the sensitive data in their charge. At many companies today, there unfortunately are not specific security teams put in place to zero in specifically on AI.

Alex Polyakov, co-founder and CEO of Adversa, told the tech blog the tide is changing. His company and others are now advising other organizations on how to address these machine learning threats.

“The technology itself is a double-edged sword and can serve both good and bad,” Polyakov said.

As with all technology, it’s important that a firm stays abreast of developing industry standards to ensure precious data is handled safely. We might be entering an ever more complex AI world, but as always, safety must come first.

How to Make Security Priority No.1 When Buying a New Laptop

As we get deeper into fall and closer to holiday season, you might start to think about finding new tech gifts for your loved ones or … for yourself. Obviously, one of the most popular go-to tech items is a new laptop. Whether for personal or business use, laptops are an essential for most people. About 73 percent of adults in the United States own either a desktop or a laptop computer, according to Pew Research Center. If you’re one of the millions of computer owners thinking about purchasing a new laptop, security must be front-and-center in your mind.

What are some simple, common-sense ways to protect your new laptop?

PCWorld offers some crucial advice:

• Install top-notch security software. They write that Internet use poses the greatest threat to laptop safety. While Mac and Windows devices come with their own built-in security protections, they suggest purchasing additional security systems. One example is Norton.

  • “Norton is an integral piece of the world’s largest civilian cyber intelligence network, allowing them to see and protect against advanced cyber threats,” the computer magazine writes. “Norton also has the Virus Protection Promise, and Norton is so confident in its protection that it’s guaranteed. If your PC or Mac gets a virus that Norton experts cannot remove, they’ll give you a refund.”

• They also suggest using virtual private networks (VPN), which offer privacy by way of a private network when using public Internet connections.

• Transportation is always key. If you plan on taking your laptop on trips, to coffee shops or business meetings, you’ll need to also purchase a secure bag for your computer. Make sure you get one with safe internal padding so that your computer doesn’t get damaged from all the jostling around that comes with travel. Also, pick a laptop bag with waterproof fabric on the outside in case you get caught in a rainstorm.

• Always purchase insurance for your new computer in case it gets damaged or stolen.

• Beyond all of this, discussions around computer security always come back to data. Back up your data on the cloud — like Apple’s iCloud — or use an external hard drive in case your computer either becomes compromised by a hack or gets damaged irreparably. Make sure your precious documents and data are stored and saved so you can retrieve them at a later time.