Cyber Security News

Photo by Andrea Piacquadio from Pexels
News Insights: HHS Fails Security Audit for Fourth Year in a Row 
According to the HIPPA Journal, The US Department of Health and Human Services (HHS) has failed their security audit for
Policy Insights: U.S. Cyber Command Collaborates with Private Sector to Share Threat Insights
The U.S. Cyber Command has created a collaborative program with the private sector to share insights and information about critical
Bloomberg: U.S. Brings Back Cyber Team to Combat Possible Election Meddling
(Bloomberg) -- The U.S. has reassembled an election security team to safeguard the 2022 midterm vote, with officials citing fears
Photo by Victoria Borodinova from Pexels
From VentureBeat: Cybersecurity reporting mandates could make us more vulnerable, not less
  https://venturebeat.com/2022/05/07/cybersecurity-reporting-mandates-could-make-us-more-vulnerable-not-less/
From WaPo: Lack of a federal privacy law opens the door to dystopia
By the Editorial Board Imagine every one of us could be located using only a photograph, or identified based on the
Photo by Victoria Borodinova from Pexels
Reuters: Israel keen to set up cyber ‘Iron Dome’ to curb rise in attacks
TEL AVIV, May 2 (Reuters) - Israel's government on Monday ordered communications firms to step up their cyber security efforts
Policy Insights: FDIC Notification for Cyber Incidents
The FDIC Notification rules has gone into effect this week. Banks and other covered institutions muse report cyber incidents. Policy
From WaPo: Hacking Russia was off-limits. The Ukraine war made it a free-for-all.
Experts anticipated a Moscow-led cyber-assault; instead, unprecedented attacks by hacktivists and criminals have wreaked havoc in Russia By Joseph Menn For
From Wired: Russia Is Leaking Data Like a Sieve
NAMES, BIRTHDAYS, PASSPORT numbers, job titles—the personal information goes on for pages and looks like any typical data breach. But this
Photo by Andrea Piacquadio from Pexels
Wall Street Journal: In Ukraine, a ‘Full-Scale Cyberwar’ Emerges
By Dustin Volz  in Washington and Robert McMillan in San Francisco Apr. 12, 2022 12:16 pm ET Ukrainian and Western intelligence

Cyber Security News

Why track cyber security news? Cyber security is a world unto itself. It’s a profession, an IT discipline and now a major industry. Companies, consumers and governments are spending billions of dollars a year on cyber security. Security also pervades many areas of life that have little to do, seemingly, with cyberspace. Thus, to keep up with the world in general, it’s helpful to stay aware of news that relates to cyber security.

For example, the dispute between the US government and Huawei is at once about international trade, national security, telecom industry competition… and cybersecurity. Security is a root issue with Huawei, given the suspicions about the company’s connections to the Chinese Communist Party (CCP). However, the company’s size, reach and technological innovation push the matter to the forefront of US-China relations.

cyber security newsOr, take consumer cyber risks. We cover cyber security news that deals with consumers’ exposure to cybercrime and fraud. Consumers are increasingly at risk for identity theft, credit card and other malfeasance at the hands of cyber criminals. The articles we curate on this subject come from law enforcement publications, mainstream media and specialized blogs.

Public policy is now being influenced (or should be) by cyber security news. Policy makers should be aware of how cyber security affect their jobs and constituents’ lives. For instance, the “smart city” is both an innovation and a threat. Using IoT sensors and advanced data analytics to improve municipal services is a great idea. However, the smart city also exposes government data to breach.

This is particularly urgent given the relatively insecure technologies (e.g. Chinese-made sensors) used for the smart city and the wireless connectivity that make it all possible. Add malicious nation-state actors to the mix, such as the ones currently paralyzing American cities with ransomware, and one can see the potential danger.

 

News Insights: HHS Fails Security Audit for Fourth Year in a Row 

According to the HIPPA Journal, The US Department of Health and Human Services (HHS) has failed their security audit for a fourth consecutive year. 

The audits were conducted for the HHS’ Office of Inspector General (OIG) to confirm compliance with the Federal Information Security Modernization Act of 2014 (FISMA) for fiscal years 2018 through 2021. Audits were conducted at five of the HHS’ 12 operating divisions and all resulted in the program receiving a ‘not effective’ rating. The HHS was found to have failed in all divisions to fully implement a continuous diagnostics and mitigation (CDM) strategy and stated that “The HHS … does not have a definitive schedule for fully implementing the CDM program across all operating divisions.”

News Insights:

Garret Grajek, CEO, YouAttest:  

“The negative report on the state of security for the HHS is indicative of a larger problem and belies a larger industry problem. There is no lack of guidance and regulations on the industry. With the National Institute of Technology and Standards (NIST) constantly revising their CyberSecurity Framework SP 800-53 and then releasing updates for key sectors, such as for supply chain (SP 800-161) and zero trust (SP 800-207) – the baseline best practices is out there. And these guidelines are then put into regulations as HIPAA has done for the health care industry, enforced by the US government – and HITRUST created and enforced by the industry. The failure has been the adoption of automation to ensure that this intelligent and well-meaning guidance is put into place. The industry simply does not have the personnel and resources to implement these best practices manually.”

Policy Insights: U.S. Cyber Command Collaborates with Private Sector to Share Threat Insights

The U.S. Cyber Command has created a collaborative program with the private sector to share insights and information about critical cyber threats in an effort to further bolster national cybersecurity, according to reporting in FedScoop: Cyber Command creates forum with industry to share threat information. “The program, dubbed ‘Under Advisement,’ involves members of the command’s elite cyber national mission force (CNMF) — which is responsible for tracking and disrupting specific nation-state adversaries — sitting in chat rooms and disclosing threats with the cybersecurity sector, officials have said. These military personnel use their real names for the sake of transparency and actually talk to members of the private sector…”

Policy Insights:

David Stewart, CEO, Approov:

“This kind of initiative, where experts from different parts of the cyber eco-system share information, is vital to our safety. You might think that there is already plenty of data about cyber-attacks in the news but those stories usually only cover ‘what’ the outcome of a given cyber-attack was. The important, rarely revealed information, is the detail about how it was done. Sharing of the ‘how’ between experts is an excellent way to propagate the appropriate knowledge needed to bolster our defenses quickly and efficiently.”

Dave Cundiff, CISO, Cyvatar:

“These types of activity are critical to our success as defenders against attack.  The attackers only have to be right once, where the defenders have to be right always.  The more information which flows between groups the better to be able to respond more effectively against emerging attacks.  The only drawbacks are the ability of misdirection, or red herrings creating noise which is difficult to reduce once created.  As long as the program takes into consideration the curation of the data as well as the sharing of information, this could be a wonderfully helpful approach between the two groups.”

Bloomberg: U.S. Brings Back Cyber Team to Combat Possible Election Meddling

(Bloomberg) — The U.S. has reassembled an election security team to safeguard the 2022 midterm vote, with officials citing fears that Russia could seek to conduct new influence operations aiming to undermine democracy.

“The band is already back together, it’s formed,” General Paul Nakasone, who leads the National Security Agency and U.S. Cyber Command, told a Vanderbilt University summit on modern conflict this week.

The election security team is comprised of military and civil personnel from both of Nakasone’s agencies, who will liaise with the FBI, the Cybersecurity and Infrastructure Security Agency and U.S. National Guard units at the local and state level, among others.

“We’re less than 200 days before our nation goes to vote for midterm elections, and I assure you that we are ready and we will be ready going forward,” he said.

The effort comes amid warnings from U.S. officials that Russia could seek to sway voters during the midterms, which are viewed as a critical referendum on the Biden administration. Pollsters predict the Democratic Party stands to lose seats in both the House, where it has a slim majority, and potentially in the Senate, where it is already neck-and-neck with the Republican Party.

Full article: https://www.bnnbloomberg.ca/u-s-brings-back-cyber-team-to-combat-possible-election-meddling-1.1762167

From VentureBeat: Cybersecurity reporting mandates could make us more vulnerable, not less

 

Cybersecurity reporting mandates could make us more vulnerable, not less

From WaPo: Lack of a federal privacy law opens the door to dystopia

By the Editorial Board

Imagine every one of us could be located using only a photograph, or identified based on the way we walk — that our fingerprints could be scanned from afar, and our productivity assessed remotely as we work. This might sound like a dystopia, but at least one technological juggernaut thinks the vision will sell.

Read full article: https://www.washingtonpost.com/opinions/2022/05/05/clearview-ai-dystopia-congress-must-pass-federal-privacy-law/

Reuters: Israel keen to set up cyber ‘Iron Dome’ to curb rise in attacks

TEL AVIV, May 2 (Reuters) – Israel’s government on Monday ordered communications firms to step up their cyber security efforts in the wake of a rise in attempted hacking attacks.

New regulations are currently being implemented in which mandatory and unified standards will have to be met, the Communications Ministry and Israel’s National Cyber Directorate said.

Under the new rules, firms must formulate plans to protect communications networks using a combination of monitoring and control mechanisms to make it possible to establish an up to date picture of cyber protection while ensuring privacy.

Read full article:

https://www.reuters.com/world/middle-east/israel-keen-set-up-cyber-iron-dome-curb-rise-attacks-2022-05-02/

Policy Insights: FDIC Notification for Cyber Incidents

The FDIC Notification rules has gone into effect this week. Banks and other covered institutions muse report cyber incidents.

Policy insights:

According to Chris Strand, Chief Risk and Compliance Officer, Cybersixgill:

“The new cyber incident reporting rules turn up the heat on U.S. Banks to up their game in terms of quantifying and qualifying a compelling ‘security incident’ or breach. Even though the changes from 72-hours to 36-hours to identify allow banks some additional flexibility in the broadness of notification and greater analysis time on determination of an incident, it could drive some positive trends on how businesses manage and analyze their digital threat surface as well as how they go about reducing the noise and intelligence associated with profiling their enterprise for security.

The shortened window to identify an incident will no doubt endeavor to speed up the identification of an attack before it can proliferate across the enterprise and its integrated partners.  It could also push banks to invest more time and possibly resources on how they measure their business process, their use of data, and find any of the gaps that could make those assets vulnerable.  If the shortened notification drives banks to develop solutions that can identify security gaps faster, this could make its way into other industries and perhaps other regulations where similar themes are developing around analyzing and understanding the threat-scape faster.

One such industry wide theme that could benefit by this new reduced notification rule is the trend towards proactive vulnerability and gap analysis.  Accelerated prioritization of security gaps can play a major role in helping to identify potential security incidents faster or even before a targeted attack happens.  Many cybersecurity regulations and compliance standards have injected vulnerability prioritization into their requirements.  The easiest way to achieve and fulfill that requirement is to proactively understand one’s enterprise assets to the point where the security hot spots or gaps stand out faster.  If that awareness can be driven by the need to demonstrate alignment with the 36-hour window, then it could have a positive effect on driving needed change across the market. “

From WaPo: Hacking Russia was off-limits. The Ukraine war made it a free-for-all.

Experts anticipated a Moscow-led cyber-assault; instead, unprecedented attacks by hacktivists and criminals have wreaked havoc in Russia

By Joseph Menn

For more than a decade, U.S. cybersecurity experts have warned about Russian hacking that increasingly uses the labor power of financially motivated criminal gangs to achieve political goals, such as strategically leaking campaign emails.

Read full story: https://www.washingtonpost.com/technology/2022/05/01/russia-cyber-attacks-hacking/

From Wired: Russia Is Leaking Data Like a Sieve

NAMES, BIRTHDAYS, PASSPORT numbers, job titles—the personal information goes on for pages and looks like any typical data breach. But this data set is very different. It allegedly contains the personal information of 1,600 Russian troops who served in Bucha, a Ukrainian city devastated during Russia’s war and the scene of multiple potential war crimes.

The data set is not the only one. Another allegedly contains the names and contact details of 620 Russian spies who are registered to work at the Moscow office of the FSB, the country’s main security agency. Neither set of information was published by hackers. Instead they were put online by Ukraine’s intelligence services, with all the names and details freely available to anyone online. “Every European should know their names,” Ukrainian officials wrote in a Facebook post as they published the data.

Full article:

https://www.wired.com/story/russia-ukraine-data/?bxid=5be9e3713f92a40469fa2eae&cndid=53679941&esrc=growl2-regGate-1120&mbid=mbid%3DCRMWIR012019%0A%0A&source=EDT_WIR_NEWSLETTER_0_DAILY_ZZ&utm_brand=wired&utm_campaign=aud-dev&utm_content=WIR_Daily_041322&utm_mailing=WIR_Daily_041322&utm_medium=email&utm_source=nl&utm_term=P4

Wall Street Journal: In Ukraine, a ‘Full-Scale Cyberwar’ Emerges

By Dustin Volz
 in Washington and Robert McMillan

in San Francisco

Ukrainian and Western intelligence officials feared Moscow’s elite corps of state-sponsored hackers would launch crippling cyberattacks to complement its invasion of Ukraine. Instead the cyberwar has been something closer to Internet trench warfare: a grinding conflict of relentless, if sometimes unsophisticated attacks that have taken casualties but had limited impact on the course of the fight.

Some attacks have been bothersome, slowing some Ukrainians’ internet service or knocking it out altogether, defacing websites, and destroying files on a small number of computers. Others have accomplished little more than keeping Ukraine’s cyber-defenders busy. More recently, as Russia’s strategic aims appear to be shifting to eastern Ukraine, new and more alarming attacks on Ukraine’s energy sector have been discovered, suggesting the next phase of the war could include a more active cyber conflict.

https://www.wsj.com/articles/in-ukraine-a-full-scale-cyberwar-emerges-11649780203

Privacy Policy