These billion-dollar anti-hacker plans reveal flaws in companies’ cybersecurity defenses

Recently, major tech companies left a meeting with President Joe Biden pledging to spend billions on cybersecurity defenses. Google, for instance, pledged to invest more than $10 billion on cybersecurity programs over the next five years, while IBM said it would train more than 150,000 people in proper security measures. Computing giant Microsoft said it would commit to $20 billion in more sophisticated cybersecurity tools, CNBC reports.

The focus on cybersecurity initiatives during these White House discussions were important given the rise of major hacks of companies such as Colonial Pipeline and SolarWinds. At the same time, smaller-scale cybercriminal activities have been on the rise, especially during the past year of social and economic disruptions due to the COVID-19 pandemic.

In an era when shoring up defenses around our sensitive personal and corporate data is paramount, it is understandable why these major companies will put cybersecurity at the forefront.

That might not be enough. Detailed in a recent CNBC piece by Eric Rosenbaum, one vulnerability in these lauded initiatives has been the fact that all of the increased spending on cyber protections hasn’t resulted in a drop in hacks. One big issue centers on the shortage of workers who are trained in cybersecurity. Essentially, there aren’t enough trained professionals to utilize these new tools to push back on cybercrime.

“It’s a big problem,” Larry Ponemon, chairman and founder of information security think tank Ponemon Institute, said in the article. “We see lots of organizations making investments in technology that never get deployed.”

Another expert, David Kennedy, founder and CEO of Trusted Sec, told the financial news network “these companies will buy products, but not include direct staff to support it or else they can’t get the internal funding approval to support it.”

“So, the cybersecurity investments are only half installed or not at all and just languish,” he added.

One big solution to this issue is directing more resources to recruitment and training initiatives to usher in a new generation of cybersecurity professionals. Major companies like Google have put significant energy into training new staffers. Beyond this, universities and colleges nationwide have been answering the call, increasing degree programs specifically in cybersecurity.

In his article, Rosenbaum also points to the threat of artificial intelligence (AI), which will only continue to be leveraged by hackers.

In an incredibly complex world of modern cybersecurity and data protection, both companies as large as Apple and small businesses alike will need to respond on multiple fronts. They’ll have to increase funding for cyber defense programs, hire and train more people to use them, and meet the challenges of more sophisticated AI and new tactics for carrying out cybercrime.

Data Leak Exposes 38M Records, Including COVID-19 Public Health Data

A new report from cybersecurity firm UpGuard unearthed data leaks from 47 different organizations. This compromised 38 million records.

The leak is due to default permissions tied to Microsoft Power Apps portals. This latest data reveal is significant because some of the affected companies and businesses included state governmental public health organizations.

Healthcare IT News spoke with a Microsoft representative who made clear that just a small subset of customers had the portal configurations set to make this data vulnerable. Microsoft asserts that Design Studio, the portal designer, “uses strong privacy settings by default.”

“Our products provide customers flexibility and privacy features to design scalable solutions that meet a wide variety of needs. We take security and privacy seriously, and we encourage our customers to use best practices when configuring products in ways that best meet their privacy needs," the spokesperson told Healthcare IT News.

The data that was leaked is certainly sensitive. It includes personal information used for COVID-19 contact tracing, vaccination appointments, health worker employee IDs, and Social Security numbers, among other data.

"In cases like registration pages for COVID-19 vaccinations, there are data types that should be public, like the locations of vaccination sites and available appointment times, and sensitive data that should be private, like the personally identifying information of the people being vaccinated," UpGuard researchers state in their report.

"The number of accounts exposing sensitive information, however, indicates that the risk of this feature — the likelihood and impact of its misconfiguration – has not been adequately appreciated," the report continued.  

After identifying the data leaks, UpGuard notified Microsoft as well as the affected organizations. Some examples include the Indiana Department of Health and the Maryland Department of Health.

"This research presents an example of a larger theme, which is how to manage third-party risks (and exposures) posed by platforms that don't slot neatly into vulnerability disclosure programs as we know them today, but still present as security issues," the UpGuard researchers add.

For its part, the Indiana Department of Health stated that UpGuard “inappropriately accessed” the data, a claim that the cybersecurity organization dispute.

UpGuard states they did not “exceed our authorized access, and while the data should not have been public, the nature of the data could only be ascertained by downloading and analyzing it,” Healthcare IT News reports.

Retail Companies Should be on High Alert for Ransomware

Out of all of the sectors of our global economy that should be especially vigilant about cybersecurity threats, the retail industry ranks toward the top. A recent global survey from Sophos showed that ransomware attacks have been on the rise for retail companies. During the past year-and-a-half, the COVID-19 pandemic gave hackers the perfect environment of chaos to wreak havoc.

For the survey, Sophos reached out to 5,400 IT professionals — 435 retail IT managers among them — throughout 30 countries. The participants extended from North and South America, Asia-Pacific, Europe, Central Asia, Africa, and the Middle East, according to Cybernews.

The survey shows that 44 percent of retail and education organizations were victims of these cyberattacks.

‘An attractive target for cyberattack

“The retail sector has always been an attractive target for cyberattacks, with its complex, distributed IT environments, including a multitude of connected point-of-sale devices, a relatively transient and non-technical workforce, and access to a wide range of personal and financial customer data,” said Chester Wisniewski, a principal research scientist at Sophos, in a Sophos release cited by Cybernews. “The impact of the pandemic introduced additional security challenges that cybercriminals were quick to exploit.” 

A lot is on the line when it comes to these attacks. The average amount it costs for a retail company to respond to — and attempt to undo the damage caused by — these ransomware attacks totals a high $1.97 million. For reference, the average cost across all industries highlighted by the report was $1.85 million.

The nature of what was stolen is also significant and should give pause to any retailer who has yet to implement proper cybersecurity defenses across their systems.

About 54 percent of the retail companies said the ransomware hackers succeeded in encrypting their data. Beyond this, 32 percent who reported this data was encrypted ultimately paid the high ransom requested.

A lot at stake

An average ransom payment for these companies was $147,811. Even more crushing for retailers was that even paying these high ransom bills failed to regain all that was lost. On average, companies that paid a ransom only got back about 67 percent of the stolen data.

Only 9 percent of these businesses got all of their stolen encrypted data back.

Sophos’s Wisniewski said it wasn’t completely negative news for retailers.

“While enabling, managing, and securing IT during the pandemic increased the overall IT workload for three-quarters of retailers – the sector was also the most likely — at 77 percent — to see a positive return in terms of enhanced cybersecurity skills and knowledge,” he added.

Essentially, this current era of intense cybersecurity awareness can ultimately ensure retail companies are in a better position than they were in before. If they put the protection of their data at the forefront, they will be better equipped to handle the demands of the ever-complex demands of 21st century data protection and security.

Report: U.S. Government Cybersecurity Defenses Are Too Weak

When it comes to a report card for how fortified its cybersecurity defenses are, the United States federal government doesn’t make the grade. That’s according to a new 47-page report issued by the Senate Homeland Security Committee. Out of eight federal agencies, four received grades of “D,” three earned “Cs,” and just one earned a “B,” according to coverage from tech news website Ars Technica.

“It is clear that the data entrusted to these eight key agencies remains at risk,” quotes Ars Technica from the report. “As hackers, both state-sponsored and otherwise, become increasingly sophisticated and persistent, Congress and the executive branch cannot continue to allow PII and national security secrets to remain vulnerable.”

This isn’t the first report of its kind. Two years ago, an earlier review of these agencies found glaring failures in protecting personal data, maintaining a list of hardware and software used on all agency networks, and installing timely security patches. That report covered information from a decade-long period — from 2008 to 2018.

Here is how the different federal agencies fared in the new report:

• Department of State: D

• Department of Transportation: D

• Department of Education: D

• Social Security Administration: D

• Department of Agriculture: C

• Department of Health and Human Services: C

• Department of Housing and Urban Development: C

• Department of Homeland Security: B

For many in the government, this kind of oversight report signifies we are in a precarious moment where our federal agencies need to better defend against sophisticated hacks that threaten some of the nation’s most sensitive data — not to mention the data of its citizens.

"From SolarWinds to recent ransomware attacks against critical infrastructure, it's clear that cyberattacks are going to keep coming and it is unacceptable that our own federal agencies are not doing everything possible to safeguard America's data," said Ohio Senator Rob Portman in a statement reported by CBS News.

“This report shows a sustained failure to address cybersecurity vulnerabilities at our federal agencies, a failure that leaves national security and sensitive personal information open to theft and damage by increasingly sophisticated hackers,” Sen. Portman added. "I am concerned that many of these vulnerabilities have been outstanding for the better part of a decade.”

In the face of these concerns, some movement has been made. In July, the Biden Administration swore in its first National Cyber Director Chris Inglis. During his public introduction, Inglis announced he will make it a point to guarantee the digital infrastructure utilized by “the 102 civilian components of the federal government” have “the right technology and the right practices” to reach “unity of effort and unity of purpose,” CBS News reports.

During a time when so much is at stake regarding how we safeguard our data, reports like this reiterate that the U.S. is at an inflection point where cybersecurity has to remain front and center.

Just How Secure are the Tokyo 2020 Olympics?

We’re now in the middle of the 2020 Olympics Games in Tokyo — a moment of international connection after a challenging year when the COVID-19 pandemic postponed the original date of the iconic sporting competition.

While it’s a celebratory moment, speculation has ramped up about just how secure the global sporting competition is after all.

Concerns are justified. Both the 2016 and 2018 Olympic Games were targets of Russian hackers. In fact, the attack on the winter 2018 Olympics in PyeongChang, South Korea went straight for the opening ceremonies, hitting stadium Wi-Fi and even affecting security gates, according to Wired.

Leading up to these games, cybersecurity experts and international watchdogs have been sounding the alarm that governments, Tokyo officials, sporting teams, and individual athletes alike should all be on high alert.

The Washington Post reports on some of the most common concerns surrounding this year’s Olympics. For example, the FBI was recently alerted to the potential of a major hack, aware that live broadcasts could be targeted as well as the personal data of athletes and their teams.

“In 2021, the Tokyo Summer Olympics may shape up to be what COVID-19 PPE and vaccine diplomacy was to 2020 — a clear opportunity for nation states to deploy information campaigns to denigrate their adversaries, promote their system of governance, and burnish their image on the world stage,” wrote Rachel Chernaskey, Max Glicker, and Clint Watts in a piece for the German Marshall Fund’s Alliance for Securing Democracy, as cited by the Post.

Despite these concerns, the Olympics seem to be going along smoothly so far. Earlier, reports surfaced that Olympic ticket data was leaked, with IDs and passwords from the Tokyo Olympic ticket portal was posted publicly to a leak website.

A spokesperson for the Tokyo 2020 International Communications Team told ZDNet that this was not in fact a leak from Tokyo 2020’s system and that “we have already taken measures int he form of password resets to limit any damage for the very limited number of IDs detected in this case based on the information supplied by the government.

Cybersecurity officials will be ever present as the 2020 Olympics continue. The games run through the Closing Ceremony, which will be held on Sunday, August 8.

As the world continues to reckon with the ever-present threat of hackers who are growing consistently more sophisticated, vigilance over personal and government data will vault to the forefront of everyone’s minds as the summer games roll on.

How Secure Are Our Water Supplies From Cybercriminals?

Earlier this year, a hacker was able to infiltrate the water supply in Oldsmar, Florida. The cybercriminal was able to increase the levels of lye, or sodium hydroxide, in the city’s water treatment system. Luckily, a city worker detected the hack and reversed any potential damage done, reports the BBC.

The cyberattack touched on both cybersecurity and public health concerns, one of multiple recent examples of how vulnerable our nation’s water supplies are to ever more sophisticated hackers.

The threat to the nation’s water supplies

Another similar example came on January 15, when a hacker attempted to attack a water treatment plant that is used by portions of the San Francisco Bay Area. The cybercriminal utilized the login information for the program that employees of the plant use to operate their computers remotely. The hacker — who has yet to be identified — deleted programs used by the plant to treat the area’s drinking water. This person’s activity was detected the next day, prompting the plant to immediately reinstall programs and change login information for employee accounts, reports NBC News.

In their broad-ranging report, NBC spotlights just how vulnerable our nation’s water system is to hacks — more than other sectors of our infrastructure.

This is due to the fact that water systems nationwide are difficult to institute universal cybersecurity safeguards and, unlike other parts of the infrastructure, can have severe impacts on the population at large if tampered with.

One benefit of our nation’s water supplies is that each system differs, there is no centralization. This means it would be very difficult to carry out a nationwide hack all at once given that each water facility functions on its own. On the flip side, this means there is no standard protocol that each system can implement. This results in a somewhat chaotic situation.

"It's really difficult to apply some kind of uniform cyber hygiene assessment, given the disparate size and capacity and technical capacity of all the water utilities," Mike Keegan, an analyst at the industry trade group, the National Rural Water Association, told NBC. “You don’t really have a good assessment of what’s going on.”

The vulnerabilities of local water systems

The threat is very real. NBC reports there are more than 50,000 drinking water facilities throughout the country. Most of them are nonprofit companies. While some are for the nation’s large metropolitan and urban centers, many provide drinking water for rural areas that might not have the means, staff, or defense protocols in place to defend against a major cyberattack.

A big problem facing these rural water facilities is the fact that many rely on remote employee system logins as with the situation in Oldsmar.

For facilities located in difficult-to-reach rural areas — an employee might have to drive 50 miles to work at a water treatment plant — and in a year where the pandemic saw all industries embrace work-from-home routines, we are facing an environment where these rural facilities are especially vulnerable.

NBC reports that some light is on the horizon. Congress just gave the Cybersecurity and Infrastructure Security Agency (CISA) authority to compel Internet providers to reveal the identities of organizations and companies that are prone to hacks. The Biden administration is also aiming to begin a cybersecurity initiative, an overdue collaboration between these water plants and the U.S. government.

Hopefully, we are entering an era where we are particularly vigilant about keeping the water we drink — and our communities depend on — are safe from cyberattacks.

How To Keep Your Cybersecurity Front and Center During Summer Vacation

It’s summer vacation time, and it’s safe to say that this season of fun in the sun will be a lot better than last year. In fact, a survey from April found 50 percent of U.S. adults are likely to take one vacation during the summer months — June to September — this year. This July Fourth saw record-setting road travel, with 43.6 million holiday revelers hitting the highways, 5 percent more than the last record set in 2019, Reuters reports.

While a post-vaccination summer means you’ll be able to enjoy the summer sun with friends and family, the regular concerns of daily life still persist. While it might seem like the ideal time to be carefree, the Center for Internet Security (CIS) cautions that it’s crucial to keep personal cybersecurity at the top of your mind.

In a guide written in partnership with the National Cybersecurity Alliance (NCSA), CIS outlines that you have to think of “your smartphones and devices as being just as important as your wallet.” Here are a few of the key tips they highlight:

• Keep your devices up to date: Make sure you update your devices to the latest software versions. If there’s an update, don’t put it off. These contain important security patches to keep your data secure.

• Come up with strong passwords: Make sure you have a strong laptop password that is at a minimum of eight characters and that ideally includes a phrase with both upper and lowercase letters, numbers, and special characters. For smartphones, they recommend a passcode of at least six characters, or “a swipe pattern with at least one turn of direction when protecting the lock screen.”

• Lock your device: If you’re leaving your phone behind to jump in the pool or head to the volleyball court, make sure you set an automatic device lock that would require someone to enter your secure passcode after a specific period of inactivity.

• Be vigilant about travel booking sites: Booking your lodging and vacation itinerary through travel websites can come with security risks, especially as you share credit card and other personal information. Before you log on, make sure to review the reputation of the website if it is one you haven’t used before. Try to focus on sources with good reputations and if you feel you’re being asked intrusively for information that is too personal or has nothing to do with your travel itinerary, do not share your data and please use a different method for booking your trip.

• Keep a tab on your device: Similar to the need for an automatic device-locking system, be vigilant at all times about where your devices are. Keep them on your person, or if not, in a secure location while you’re enjoying summer activities. Devices like smartphones and tablets contain your most sensitive information and they are expensive, a major target for thieves.

• Be wary of public W-Fi: While public Wi-Fi signals might be convenient when you’re on the go in a new town or city, they pose significant security risks. These Wi-Fi systems are unregulated — they often don’t need specific credentials for logging on and are generally not protected by encryption services. Your browsing activity, bank account and social media information — even your geo-location — are not secure. Avoid making financial transactions while using these networks. Use your phone carrier’s Internet connection, make another device a personal hotspot, or set your device to ask for your permission before it logs onto any Wi-Fi network.

• Be careful with your social media: It can be tempting to post every aspect of your vacation on Facebook or Instagram, but keep in mind this comes with risks. It can alert potential burglars that your home is unattended, or could also open you up to travel-related scams. Consider setting your posts to private — only accessible to select family or friends — or, at the least, be judicious about what you’re sharing and who can see it.

What New Tech to Fight Hackers Can Teach Us About Our Cybersecurity

It sounds like something out of a science fiction film. Scientists just developed new technology that entraps hackers in an artificial, cyber “shadow world.” The goal is to prevent these cybercriminals from carrying through with their objectives by luring them into what is being defined as “an attractive — but imaginary — world.”

The cybersecurity technology is called “Shadow Figment,” and has been designed mainly to protect key physical targets like the electric grid, water systems, and pipelines, among other crucial aspects of our country’s infrastructure.

This groundbreaking tech was created by researchers at the U.S. Department of Energy’s Pacific Northwest National Laboratory (PNNL), according to a recent announcement.

Shadow Figment: A new era of national cybersecurity defense

Shadow Figment uses AI to keep attackers engaged in an illusory online world once they enter a system like the electrical grid. The hackers are led to believe they are interacting directly with users in real time, with the AI responding realistically to commands.

“Our intention is to make interactions seem realistic, so that if someone is interacting with our decoy, we keep them involved, giving our defenders extra time to respond,” said Thomas Edgar, a PNNL cybersecurity researcher who led the team designing Shadow Figment, in the announcement.

The AI utilized in this program is very sophisticated. Hackers will be given false signals of success, thinking they have accurately infiltrated a system. This gives a cybersecurity defense team time to learn about the hack itself and better fortify the real system. Think of it like a digital smokescreen, throwing the hackers off their game.

PNNL’s research team says this “model-driven dynamic deception” made possible by advanced machine learning is a more credible AI defense than “static decoys” that have more traditionally been a part of cyber defense.

The real-world threat of hackers

The PNNL stresses there is a pressing need for this kind of technology. In recent years, we’ve seen examples like the 2015 attack on Ukraine’s electrical grid as well as the hack of the Colonial pipeline here in the United States.

While this new technology can be a game changer in national defense, it further reiterates why we all need to be vigilant about our own cybersecurity hygiene.

We might not be able to deploy our own version of Shadow Figment, but we can still make sure we use unique passwords for all of our accounts and devices, set up two-factor authentication, and be judicious in what emails and links we open to avoid phishing scams and ransomware attacks.

These new innovations from the U.S. government can offer a helpful reminder of how pressing the threat of cybercriminals is in our daily lives and what we can do to defend ourselves.