Keeping the internet secure is everyone’s job

By Morf Morford
Tacoma Daily Index

If you need anything to keep yourself up at night, you might consider studying cybersecurity.

If you thought taking a close look at climate change, political corruption, election manipulation, obfuscation and deception in the marketplace or the fundamentals of the world economy (from national loan defaults and bankruptcies to debt/credit ratios) would be unnerving, you might not be ready take a look at the intricacies, hazards and inevitabilities of the failures of cybersecurity.

The old saying of those who work in internet security is “There are two categories of businesses in the world – those who have been hacked, and those who don’t know that they have been hacked.”

No business, agency, school, hospital or branch of the military of any size, scale or level of secrecy, is safe.

Internet connectivity is our access to the world – and  being able to control who gets into our business has become a full time job for all of us.

No business, no agency, and no individual is immune from “phishing,” deception or unauthorized intrusion.

Constant vigilance is required – and no solution will stand for very long.

The “threat-scape,” as IT professionals put it, is varied, determined and relentless.

Attackers have different motives that could be criminal, military, political, financial, personal, romantic or just opportunistic.

Hackers are by definition innovative. They will work their way through any layers of security and passwords – eventually.

I know someone who worked in IT security with a major aircraft manufacturer in the Los Angeles area. They bid for and held many government and military contracts.

Their standard policy was to change their passwords every forty-five minutes. That was several years ago.

How many of us – in business, or personal use (like banking or online purchasing) have been using the same password for too many years?

There are few certainties in life, but one of them is that you can be guaranteed that your old passwords are floating around cyberspace somewhere.

If you use a mash-up of your pet’s name, phone number and current friend or favorite band, a diligent hacker has probably figured it out.  (1*)

Hackers have different motivations, from money, personal revenge or military and business sabotage, and our response to them is to be even more focused and innovative than they are.

There is no permanent protection and the potential threats are nearly infinite.

Those were just a few of the observations from a recent presentation on cybersecurity in Seattle sponsored by FICO.

Here are a few more;

The biggest threat to any organization is their 3rd party members – the vendors, contractors and partners that make the business or agency work. Scammers can disguise themselves as legitimate partners and, taking advantage of trust and identity, can compromise security.

Each individual is the first – and last – line of defense. Any single lapse can endanger the entire company.

An example was given of a particular FBI office with 1,500 personnel who received the same “phishing” email.

Two people clicked on it. The branch took two weeks to identify, detect, correct and recover from the intrusion.

Two out of 1,500 – that is far less than half of one percent, but that’s all it takes to compromise security and possibly ruin a business or reputation – or create international  chaos.

Internet attacks come from a few main categories; first, hostile nation/states (some continual sources are Russia, China, Iran and North Korea – each with their own motives and means – from  election meddling to stealing corporate confidential information), and second, criminal. Criminal hackers are involved in scams (The Nigerian Prince scam still nets about $700,000 each year) trafficking, money laundering and far more.

Distance and national borders are irrelevant – no place that is “connected” is safe.

It takes an average of six months for an intrusion to even be discovered. A lot of money can be moved to bogus accounts or proprietary information compromised in that time.

Here are a few features of the current “threat-scape” –

Most common is credit card scams. Credit card numbers can be lifted in all kinds of settings and cards can be easily purchased on the “dark web”.

BEC (Business Email Compromise – where someone has a facsimile account and redirects information or funds to an outside account.

Ransomware (where a business or agency has their computer system held hostage) is increasingly common.

Crypto-jacking is where accounts are intercepted and computers themselves are use to harness victims’ machines to “mine”, meaning to perform the computations necessary to update cryptocurrencies’ blockchains, creating new tokens and generating fees in the process. These new tokens and fees are deposited to accounts belonging to the attackers.

A new approach is “jack-potting”. This is where an ATM is programmed to dispense all of its holdings – essentially turning it into a jack-pot gambling machine.

There is nothing new about all this.

Back in 1999 I was teaching at a university in Beijing, China.

One Monday morning I asked a couple of my students what they did over the weekend. They looked at each other with shy, mischievous grins, “We crashed the US Army main website”.

These teenagers had done this on their own by connecting a series of 286 PCs together.

Fast forward twenty years, add corporate or state sponsorship and state of the art equipment and you have a world where no bank account (or even bank) is safe, every military command center (of any nation) is vulnerable, and even our utility grid is accessible to teen-age, criminal or state-sponsored intervention.   (2*)

All is not lost however, you can see an assessment of your cyber-risk potential here – https://www.fico.com/en/products/cyber-risk-score or here – https://www.uschamber.com/cyber-abc#/.

(1*)    Coming up with a secure password that you can remember may be a challenge. I suggest any familiar random word, a number and a symbol. Mix them up and change them often. Here are some password protection apps – https://top5-passwordmanagers.com/password-protection?

(2*)    At a recent workshop on cybersecurity one speaker said that his biggest fear was hacking of urban sewage systems. Contamination of water supplies, and spread of disease would only be the beginning.