Cyber Policy in the News
At small and rural hospitals, ransomware attacks are causing unprecedented crises
News Insights: Germany Shuts Down Hydra Darknet Market
Germany’s Federal Criminal Police Office recently announced that the world’s largest illegal dark web marketplace, Hydra Darknet Market, has been taken down. The Darknet market, which has been in operation since 2015, was a Russian-language darknet marketplace that opened as a competitor to the now-defunct Russian Anonymous Marketplace (aka RAMP). The agency attributed the shutdown to an extensive investigation operation conducted by its Central Office for Combating Cybercrime (ZIT) in partnership with US law enforcement authorities since August 2021.
News Insights:
Chris Olson, CEO, The Media Trust, a digital safety platform, said, “The shutdown of Hydra is a small win for cybersecurity, but a win nonetheless. Attackers who target consumers for credit card details and other personally identifiable information (PII) can’t use it directly without risking discovery and arrest; therefore, they sell this information on darknet markets instead. Without them, the incidence of cybercrime would undoubtedly decrease. Unfortunately, Hydra represents a miniscule drop in the bucket of global cybercrime, which will cost organizations (and therefore consumers) about $10.5 trillion per year by 2025. Cyber actors have perfected the pipeline from Web and mobile-based phishing attacks to darknet markets which we will not name, and new ones are opening all the time. In truth – if past precedent is anything to go by – Hydra operators will likely take their digital assets and resurface in the near future under new identities and domains.”
Cyberwire: FBI spends millions on social media tracking software.
FBI spends millions on social media tracking software.
The US Federal Bureau of Investigation (FBI) has signed a $27 million contract for five thousand licenses to use social media tracking software Babel X. The software, developed by US tech firm Babel Street, is intended to aid the FBI in searching social media sites for indicators of possible threats of national security, and the contract calls for translation abilities in at least seven foreign languages, geofencing sentiment analysis to help “determine likely attitudes of the targets, and even emoji searches, “predictive analytics,” and bot detection. Jack Poulson, head of research advocacy group Tech Inquiry, told the Washington Post the contract is the largest Babel Street contract he’s encountered. The FBI stated, “The FBI uses social media tools to search publicly available information pertinent to predicated investigations in order to identify and respond to threats of violence, acts of terrorism, and potential federal violations within the scope of the FBI’s mission.”
Civil liberties advocates and lawmakers on both sides of the aisle are concerned that such widespread social media tracking could be a threat to privacy. Greg Nojeim, a senior counsel and co-director at the Center for Democracy and Technology’s Security and Surveillance Project, says such sweeping searches could easily result in misinterpretation. “The risk of misinterpretation is high. So is the risk that an FBI agent who misinterpreted what you said on social media will come knocking on your door,” he stated. Representative Jim Jordan, the House Judiciary Committee’s top Republican, has asked the FBI for a briefing to address “real concerns based on the [FBI’s] history and based on the fact that we don’t know how they’re using it and who they’re going after.”
Paul Bischoff, privacy advocate with Comparitech, stated:
“I can foresee several issues with the FBI monitoring social media. First, it will surely have a chilling effect on free speech. People behave differently when they know they’re being watched, leading to self-censorship. Second, this is bulk surveillance, which means the vast majority of people whom the FBI is monitoring are not suspected of any crime. Third, sentiment analysis is about as reliable as astrology. The odds of misinterpretation are very high. Fourth, it sets a dangerous precedent. Dictators in autocratic countries could contract with Babel X or a similar company to spy on dissidents, activists, journalists, and others who speak out. Last, it’s notable that the FBI is using a third-party vendor instead of working with the social networks themselves. This is probably because the social networks would never agree to let the FBI directly monitor their users, even though the FBI says it only wants public info. That could mean Babel X scrapes info from social networks using bots, a practice that Facebook and other social media have prohibited in their terms of service and actively fought against to little avail.”
Chris Hauk, consumer privacy champion at Pixel Privacy, commented:
“Unfortunately, the FBI and other federal, state, and local law enforcement agencies will happily use “attacks” like the January 6th event to violate the privacy of American citizens. While the monitoring of social platforms can help law enforcement to plan for possible incidents, my fear is that it may eventually lead to a “Minority Report” type situation where the FBI and other agencies may arrest or otherwise detain citizens that haven’t actually violated any laws. I also don’t think we can count on the FBI to use the software only for its stated purpose. If there is a way to misuse a tool, you can rely on government agencies to do so.”
NY Times: U.S. Says It Secretly Removed Malware Worldwide, Pre-empting Russian Cyberattacks
The United States said on Wednesday that it had secretly removed malware from computer networks around the world in recent weeks, a step to pre-empt Russian cyberattacks and send a message to President Vladimir V. Putin of Russia.
The move, made public by Attorney General Merrick B. Garland, comes as U.S. officials warn that Russia could try to strike American critical infrastructure — including financial firms, pipelines and the electric grid — in response to the crushing sanctions that the United States has imposed on Moscow over the war in Ukraine.
Full article: https://www.nytimes.com/2022/04/06/us/politics/us-russia-malware-cyberattacks.html
From Nextgov: U.S. Cybersecurity Policy heads back to square one as a public-private bargain that emerged from the Congressionally mandated Solarium Commission breaks down.
Senior House Democrats and Republicans disagree on legislation Rep. John Katko, R-N.Y., has proposed that calls on the Department of Homeland Security to identify “systemically important critical infrastructure”—SICI—for prioritizing the government’s efforts to improve the nation’s cybersecurity.
Full article: https://www.nextgov.com/cybersecurity/2022/04/partisan-rift-stalls-efforts-secure-critical-infrastructure-cyberattack/364120/
Research Insights: Only One Third of Businesses Require MFA
A new study finds that only one third of businesses require #MFA access, have separate staff /guest WI-FI or use VPNs for remote workers. The UK government released their Cyber Security Breaches Survey 2022 this week reporting that only around third of organizations follow any of these practices, with the percentage being only slightly higher for businesses vs charity organizations. The report goes on:
“Two-factor authentication was covered for the first time in this year’s survey. Just over a third of businesses (37%) and just under a third of charities (31%), have a requirement for their people to use two-factor authentication when accessing their network, or for applications they use. … Two-factor authentication is noticeably more prevalent among businesses in information and communications (63%). Conversely, fewer than one in five (18%) businesses operating within the food and hospitality sector employ two-factor authentication procedures. It is also relatively under deployed among utilities, production, and manufacturing businesses (28%).”
Percentage of organizations that have the following rules or controls in place
Businesses Charities
- Any requirement for two-factor authentication 37% 31%
- Separate Wi-Fi networks for staff and visitors 33% 26%
- VPN, for staff connecting remotely 32% 26%
- Monitoring of user activity 33% 32%
- Up-to-date malware protection 83% 68%
- PW policy that ensures users set strong passwords 75% 57%
- Firewalls that cover the entire IT network 74% 56%
- Restrict IT admin and access rights to specific users 72% 68%
- Backing up data securely via a cloud service 71% 53%
- Security controls on company-owned devices 61% 45%
- process to follow with fraudulent emails or websites 57% 40%
- Backing up data securely via other means 56% 50%
- Only allowing access via company-owned devices# 56% 30%
- Rules for storing and moving personal data securely 49% 9%
- policy to apply software updates within 14 days 39% 23%
The Cyber Security Breaches Survey is an influential research study for UK cyber resilience, aligning with the National Cyber Strategy. It is primarily used to inform government policy on cyber security, making the UK cyber space a secure place to do business. The study explores the policies, processes, and approaches to cyber security for businesses, charities, and educational institutions. It also considers the different cyber attacks these organizations face, as well as how these organizations are impacted and respond.
Research Insights:
Rajiv Pimplaskar, CEO, Dispersive Holdings, Inc.:
“MFA, while crucial for preventing credential theft and mitigating unauthorized access, can be met with business resistance as many MFA solutions tend to increase user friction. Organizations should consider implementing a zero trust strategy while also bolstering and modernizing existing VPN environments as both support different use cases for improving workspace security. MFA solutions need to also be implemented along with endpoint device posture checking and in conjunction with the concept of least privilege to truly drive a zero trust posture. Finally, some modern VPNs have capabilities like multi-pathing and managed attribution which can enhance security by making users and network resources virtually invisible and hard to target by threat actors in the first place.”
Ismet Geri, CEO, Veridium:
“Of the 39% of UK businesses who identified an attack, the most common threat vector was phishing attempts (83%). The main goal of a phishing attack is to access the user’s credentials, that is mainly their password. Besides 37% are using two-factor authentication, the level of security depends on what that second factor is. As when it is an OTP via SMS or a link via email for example, these are not secure enough and could be under man in the middle attack vectors. Authentication is crucial for everything in our digital life, we cannot rely anymore password shortcomings related not only to security but also usability, productivity, and compliance. Enterprises need to put in place robust MFA, phishing-resistant second factors. Passwordless authentication is the foundational step to eradicate most of these attacks.”
State Department Opens Bureau of Cyberspace and Digital Policy
The Department is pleased to announce that the Bureau of Cyberspace and Digital Policy (CDP) began operations today. A key piece of Secretary Blinken’s modernization agenda, the CDP bureau will address the national security challenges, economic opportunities, and implications for U.S. values associated with cyberspace, digital technologies, and digital policy.
The CDP bureau includes three policy units: International Cyberspace Security, International Information and Communications Policy, and Digital Freedom. Ultimately, the bureau will be led by a Senate-confirmed Ambassador-at-Large. Starting today, Jennifer Bachus, a career member of the Senior Foreign Service, is serving as Principal Deputy Assistant Secretary for the CDP bureau. PDAS Bachus will serve as Senior Bureau Official until an Ambassador-at-Large is confirmed. Michele Markoff is serving as Acting Deputy Assistant Secretary for International Cyberspace Security, Stephen Anderson is serving as Acting Deputy Assistant Secretary for International Information and Communications Policy, and Blake Peterson is serving as Acting Digital Freedom Coordinator.
The Department appreciates the service and collaboration of all who will work with and within the CDP bureau in the coming months and years to empower it to achieve its vital mission.
https://www.state.gov/establishment-of-the-bureau-of-cyberspace-and-digital-policy/
News Insights: Biden’s $11 billion 2023 cybersecurity budget
From Fedscoop: The White House is calling for an 11% overall increase in federal IT spending for fiscal 2023 in addition to nearly $11 billion proposed to bolster federal cybersecurity. President Biden’s 2023 budget proposal, released Monday, requests a total of $65.8 billion for civilian IT spending, a significant increase over the estimated $58.4 billion spent in the current fiscal year. According to White House data on IT spending, the 11% boost is the biggest in the past dozen years. The budget does not group defense IT funding or civilian grant spending with these numbers.
News Insights:
Mark Manglicmot, VP of Security Services, Arctic Wolf:
“In the wake of critical infrastructure concerns stemming from the conflict in Russia – paired with the ongoing risk of nation state attacks – it’s clear that the administration is concerned with ensuring the forward progress of collective cybersecurity efforts. There have been consistent motions from the Biden administration for organizations to focus on strengthening their cyber ecosystems – from internal initiatives to the recent memorandum holding federal contractors accountable for their efforts, too.
To improve their defenses, organizations must, at a minimum, improve their cybersecurity budgets. In fact, 50% of surveyed security teams don’t have the budget to feel adequately equipped to thwart threats. Inadequate budgets impact important avenues for improving security postures, including tools, talent acquisition and retention and robust and consistent awareness training for employees. Spending the funds efficiently enables organizations to shore up gaps in technical controls, remediate known vulnerabilities, and add talent to address 24×7 coverage deficits.
Additional budget can continue to advance both defensive and offensive cybersecurity operations. It can also expand the resources to continue the recent progress made in bringing both private and public sector leaders together to fight adversarial attacks. With this motion to put more resources behind our nation’s security, both sectors are in a better position to collectively defend against attackers that are most certainly resource backed.”
Biden calls for 11% boost in federal IT budget, $10.9B for cyber
XM Cyber Research Finds That Hackers Can Claim ‘Checkmate’ on 94% of Critical Assets in Just Four Moves
First Annual Impact Report Reveals Hackers’ Journeys and How To Mitigate;
Demonstrates XM’s Ability to See All Ways that Critical Business Assets Can Be Compromised
Herzliya, Israel, March 31, 2022 — XM Cyber, the multi-award-winning hybrid cloud security company, today announced findings from its first annual Impact Report. Attack Path Management Impact Report: 2021 Year in Review incorporates insights from nearly two million endpoints, files, folders, and cloud resources throughout 2021. The XM research team analyzed the methods, attack paths and impacts of attack techniques that imperil critical assets across on-prem, multi-cloud and hybrid environments, and developed tips for thwarting them.
Today’s security tools enable organizations to detect all kinds of misconfigurations, vulnerabilities and other security gaps. However, they fail to show how these seemingly unrelated issues form hidden attack paths that hackers can use to pivot through a hybrid cloud environment and compromise critical assets.
XM’s Impact Report takes the attackers’ perspective to show how, once they get a foothold in the network, they can easily move towards critical business assets. The report was enabled by the company’s namesake attack path management platform, which allows users to see all of the ways that hackers can leverage attack paths across cloud and on-prem environments, aiding mitigation and prevention efforts.
Key insights include:
- 94% of critical assets can be compromised within four steps of the initial breach point
- On average, 75% of an organization’s critical assets can be compromised in their current security state
- 73% of the top attack techniques involve mismanaged or stolen credentials
- 95% of organizational users have long-term access keys attached to them that can be exposed
- 78% of businesses are open to compromise every time a new Remote Code Execution (RCE) technique is found
- The main attack vectors in the cloud are misconfigurations and overly permissive access
- By knowing where to disrupt attack paths, organizations can reduce 80% of issues that would otherwise have taken up security resources
An attack path is a chain of attack vectors (vulnerabilities, misconfigurations, user privileges, human errors, etc.) that a hacker can use to move laterally through the network. Hybrid cloud computing architecture is especially vulnerable, as attackers can exploit security gaps to obtain a foothold in the network and then move laterally between on-premises and cloud applications. XM Cyber’s report outlines the security gaps and hygiene issues that exist in multiple attack paths across on-prem and cloud environments, demonstrating the importance of risk visibility across the entire network.
“Modern organizations are investing in more and more platforms, apps and other tech tools to accelerate their business, but they too often fail to realize that the interconnection between all these technologies poses a significant risk,” said Zur Ulianitzky, Head of Research, XM Cyber. “When siloed teams are responsible for different components of security within the network, nobody sees the full picture. One team may ignore a seemingly small risk, not realizing that in the big picture, it’s a stepping stone in a hidden attack path to a critical asset. To keep pace with today’s technology and business demands, attack path remediation must be prioritized.”
Highlights of the report include:
- Methodology and Synopsis of the Attack Path
- The Top Attack Techniques Used to Compromise Critical Assets in 2021
- New Attack Techniques Used in 2021
- Cross-platform Attack Insights
- Key Findings Across On-Prem and Cloud
To download the XM Cyber Research Impact Report, visit: https://info.xmcyber.com/2022-attack-path-management-impact-report.
###
About XM Cyber
XM Cyber is a leading hybrid cloud security company that’s changing the way innovative organizations approach cyber risk. Its attack path management platform continuously uncovers hidden attack paths to businesses’ critical assets across cloud and on-prem environments, enabling security teams to cut them off at key junctures and eradicate risk with a fraction of the effort. Many of the world’s largest, most complex organizations choose XM Cyber to help eradicate risk. Founded by top executives from the Israeli cyber intelligence community, XM Cyber has offices in North America, Europe, and Israel.
Wall Street Journal: Secret World of Pro-Russia Hacking Group Exposed in Leak
A Ukrainian researcher revealed the operations of Trickbot, one of the most powerful cybercriminal enterprises with its Conti ransomware, after the group defended Russia; chats range from hospital attack plan to hackers grousing about vacation
Full article: https://www.wsj.com/articles/trickbot-pro-russia-hacking-gang-documents-ukrainian-leaker-conti-11648480564