Categories
Articles Cyber Security Wireless Ecosystems

Cyber Wireless Defense Initiatives An Evolving State

Cyber Wireless Defense Initiatives are one of the least understood but most important aspect of today’s “connected” business world. In the relatively short time since their inception, cyber-physical systems (CPS) have become ubiquitous in most facets of business and government operations, connecting and supporting applications and infrastructure.

They are used to manage mundane tasks, such as running a factory or office building autonomously, as well as providing critical infrastructure capabilities essential for military operations. This rapid growth and adoption indicates that CPS will be the next technological revolution.

While this paradigm shift is occurring, there has been relatively little attention paid to how vulnerable CPS are to cyber attack.

For example, in February 2021, an unidentified hacker gained remote access to a computer system at a water treatment plant in Florida and increased the amount of sodium hydroxide to nearly 100X its standard levels. Luckily an operator was able to instantly respond and minimize the level, but this event demonstrates the potential for risk that accompany adoption of CPS.

The Problem With Traditional Security Methods

It is imperative that government data is fully secure to prevent threats. Today’s network-based threats require a different security strategy and solution than those based on physical or software barriers, which often stop at either the hardware or encryption level.

Terrorism, foreign government actors, hackers and spies are getting better at accessing government communications and attempts to breach security are increasing. To ensure that data can’t be stolen and influence can’t be exerted over American businesses, the Defense Department needs control of all related devices — including smartphones and personal IoT gadgets connected to wireless networks.

The Evolving State of Cyber Defense Initiatives

There is a growing need for real-time internet traffic analysis to combat the ever-increasing threat of cyber attack. This has led to a new school of thought on traditional network security based around monitoring IoT devices and the data they produce to identify malicious intent or activity.

Cyber defense is moving away from a “black box” approach, where all internet traffic is treated as hostile until deemed safe, to a “white box” model, where devices are scanned before being allowed to connect to government networks.

Existing Mobile Defense

Much of the increased focus on mobile technology is in response to a growing interest in the security of federal networks while federal officials are away from those networks, either at home or abroad.

This increasing emphasis on cyber wireless defense initiatives has led to several proposed network solutions that would keep federal agencies and their data safe while also preventing the theft of sensitive information from malicious entities.

Anonymized Cellular IDs

This approach anonymizes the identity of each mobile device, stopping an attacker in their tracks. It also allows for the identification of rogue devices not associated with any known entity, such as a government or business.

This makes it possible to block GPS-spoofing, which has been used to create disinformation campaigns and confusion during conflicts, or mitigate potential data leaks on vulnerable cellular networks. The anonymized IDs can be paired with the telecommunications company’s existing network data, allowing the government to determine who is using a particular device at a given time.

The Benefits of an Insider Threat Management Approach

By pairing CPS with other insider threat programs that have proven success in deterring and detecting malicious activity, the federal government will be able to improve awareness of suspicious behavior and identify malicious insiders who are seeking to steal data and jeopardize national security.

Deception of Hostile Entities

In addition, the federal government is also moving towards a more proactive model of network defense that monitors information from both within and outside agency networks to detect potential attacks in real-time and respond accordingly.

This provides multiple layers of protection against cyber attacks and a greater chance of mitigating damage before it occurs.

The Ability to Roam Securely in Any Terrain, At Home or Abroad

While many security measures are focused on securing government networks while federal officials are abroad, there is also increasing interest in the ability of our military to operate outside their normal geographic area with a reasonable level of security.

MDM Solutions

Many federal agencies are developing cyber wireless defense management solutions to allow for secure access of sensitive information on both their own and the telecommunication companies’ networks. These solutions will be necessary to implement the anonymized ID approach outlined above.

VPNs

vpn-securityAdditionally, there has been an uptick in the use of Virtual Private Networks (VPNs) to allow personnel access to network resources when officials are away from the office and unable to access these networks directly. These VPNs are increasingly being used in both government and business, although there is also a growing interest in the ability to operate secure systems without using a VPN at all.

Private APNs

Finally, there is also an interest in the capabilities to operate private Access Point Names (APNs) for military personnel that would not be accessible by malicious parties, but would still allow for secure data transfer via a VPN. This is making it possible to access government networks both on and off base using secured devices without the concern for international security threats.

Security Information and Event Management

Security Information and Event Management (SIEM) solutions are also becoming more commonplace to keep an eye on potential network outages and other potential security concerns.

This allows for a better understanding and viewpoint of all the devices connected to these networks, as well as responding appropriately when unauthorized or corrupt entities attempt to access sensitive information. SIEM is also being used to identify devices that have been compromised, which allows the government to secure these systems before they can be used for malicious purposes.

Protecting Critical Infrastructure

Many federal agencies are also developing plans to protect their critical infrastructure from a cyber threat, particularly when it comes to the use of mobile technologies within those industries.

One of the most notable examples is the United States Nuclear Regulatory Commission, which has an increasing interest in the ability to detect cyber attacks against nuclear power plants and other critical infrastructure while also preventing sensitive information from being stolen.

This amounts to a more robust approach to network defense that is focused on protecting government networks not only while federal officials are located within those networks, but also when they are away from their normal geographic area.

What Is the Future of Cyber Wireless Defense?

There will be a high demand for technology that can identify and maintain secure data traffic at rapid speeds, while keeping both equipment and government data safe from outside threats.

As we enter the next chapter of IoT adoption, defense against cyber attacks will become more crucial and agencies must be prepared to use high tech solutions that can adapt to attacks on the fly and respond accordingly. By preparing for IoT now, the government can ensure citizens’ privacy and security in the future.

Have a need to recruit a C-level, functional leader, or a principal cyber wireless engineer for private or DoD need, consider NextGen’s experience in wireless and cyber security.

Categories
Articles Artificial Intelligence Cyber Security

Healthcare Cyber Attacks to Medical Devices, EMR Apps, and Cloud

Embracing next technology healthcare without adequate preparation will only open new risk avenues and threat vectors for healthcare cyber attacks.  Technology is perceived as a solution to address operational inefficiencies within the healthcare industry and to expand the reach of high quality healthcare services to remote regions. But the risks are mounting.

Vulnerable Devices for Critical Medical Practices

The proliferation of smart technologies will encompass the healthcare industry in coming years. Digital devices such as smart pacemakers and insulin pumps are used widely today, and the next generation of smart technologies will cover a variety of critical cardiovascular, respiratory, and neurological medical practices. However, next technology healthcare devices aren’t immune to sophisticated attacks. In control of malicious actors, vulnerable smart medical devices can deliver the killer blow to patients instead of maintaining stable health.

Cloud Vulnerabilities for Healthcare Cyber Attacks

Cloud connectivity is critical to access patient information anywhere-anytime, a promise that’s driving transition to the cloud for healthcare institutions. PHI data is effectively stored in off-site data centers beyond the control of healthcare providers originally in charge of maintaining patient data privacy and security. Any vulnerability in their cloud networks is an open invitation for hackers to compromise sensitive patient information.

IoT Networking

Unlike cloud vendors subject to stringent compliance regulations, patients themselves are unable to secure IoT-connected medical devices at home. A malware infected dialysis machine could be part

of a DDoS attack intended to bring down the entire network infrastructure of a hospital. Since IoT devices come from multiple vendors, through different processes and offer different technologies, it’s not entirely possible to maintain a consistent standard and control around healthcare cyber attacks and IoT device security.

Next Technology Healthcare Cyber Attacks to Mobile Apps

Healthcare providers adopting telemedicine practices using smartphone health apps may not realize or control the personally identifiable information shared with third-party advertisers. These apps run on mobile platforms vulnerable to security threats, especially when the OS is not updated to apply the latest available security patches.

Considering the general lack of security awareness among patients using outdated mobile app and OS versions, and fall prey to mundane social engineering ploys, the industry has a long way to go before considering mobile apps as secure channels to offer effective firewalls and security against healthcare cyver attacks.

Do you think the next technology healthcare industry is ready to take a deep dive into cyber security adoption without adequate preparation and fixing loopholes that exist within the technology itself?

Recruiting expertise in medical devices and electronic health records

Need an executive search consultant with deep knowledge and contacts in the medical field?  NextGen has identified and recruited key personnel ranging from principal / chief engineers in software development, systems design, and embedded wireless to directors and VPs in sales, business development, and technology to president of business unit for medical device manufacturers, electronic health records developers, clinical integration, and bio medical research and development.

Categories
Articles Cyber Security

Proactive Ransomware Mitigation Strategy for EMR

Ransomware is distributed as a social engineering ploy via email, malicious links and malvertizing, among other techniques. A proactive ransomware mitigation strategy for EMR is needed as once a user falls prey to these human exploits, ransomware is downloaded to the victim’s computer to begin the malicious process.

The virus attempts to connect with encryption-key servers, takes hold of public encryption keys and uses various encryption algorithms to encrypt mission-critical data on the network.

This data typically includes file formats of PDF, JPG, and Microsoft Office extensions. Basic OS recovery and reboot systems are disabled. The compromised data is moved, renamed, encrypted, and renamed again to ensure the required data cannot be queried using actual file names when ransomware is executed, which is when ransom is demanded via Bitcoin or other digital money transfer services. At execution, the start-up screen and several basic features are also locked until this payment is processed.

Why a Proactive Ransomware Mitigation Strategy for EMR Matters

Despite the prevalent security awareness, phishing schemes and drive-by-downloads remain one of the most effective techniques to deliver ransomware payloads onto target computers. To combat ransomware, a proactive ransomware mitigation strategy is to set up systematic corporate security training programs to prevent ransomware payload delivery onto your EHR systems in the first place.

Employ expert social pen-testers to phish your own staff. Emulate real-world exploits but do no ream harm to your organization or employees. Establish gamification-based rewarding programs to encourage dedicated adoption of security best practices. And yes, prior executive approval will be required to prevent awkward situations.

Secondly, it’s best to perform social penetration testing procedures on a separate, isolated network infrastructure such that sensitive data remains inaccessible and uncompromised. This strategy will essentially build the most effective line of defense against ransomware: the human firewall.

Advanced phishing attacks are known to bypass standard spam filtering standards set up by email clients. Another part of a proactive ransomware mitigation strategy for EMR is to establish strong spam filtering techniques such as blacklisting and whitelisting email and IP addresses, and real-time blackhole lists that are maintained by third-party security providers. Use content-based filters to ward off malicious content that’s most relevant to your organization.

Email validation systems such as Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and Domain Keys Identified Mail (DKIM) can prevent phishing emails from reaching your workforce. Establish strong administrative and access controls to prevent unauthorized and unintended downloads of executable files via email or the Web – even legitimate website could be compromised to deliver ransomware as downloadable content.

Strict controls that allow the absolute least user privileges to appropriate users will reduce the proportion of workforce who can inadvertently facilitate ransomware delivery to the corporate IT network. This approach will prevent anomalous and unauthorized downloads, installations, data transfer, editing and encryption from taking place.

Furthermore, streamline the updating, patching and validation processes for every tool used in the EHR systems. Most of the ransomware attacks exploit known vulnerabilities that remain unpatched. Standardizing mass rollout of updates across all systems is a time-consuming and cumbersome process if the operating systems and software are installed on local hard drives.

Organizations that maintain such systems take months and sometimes years before evaluating, authorizing and installing updates individually on each computer. On the other hand, organizations that maintain virtualized and cloud-based environments for the delivery of desktop OS and electronic heath records solutions can automate and streamline the process of software updates.

Although these measures drastically reduce the chances of successful malware delivery to your systems, your organization should be prepared to tackle the threat of ransomware infection and prevent execution of malicious programs. For instance, another proactive ransomware mitigation strategy is to limit user privileges and controls to install software against targeted file extensions.

If an installation is critical, the process should be flagged and transferred to a sandbox environment for detailed security assessment. Unauthorized changes to medical devices, files and data sharing should be blocked to prevent potential ransomware processes from executing.

Proactive Ransomware Mitigation Strategy for EMR Advanced Security

Deploy advanced security solutions that would detect anomalous processes, raise the alarm and cut-off compromised systems from the network to prevent the malware from spreading. Maintain an efficient backup recovery system that performs data backup in real-time and can be used to retrieve mission-critical data in a matter of minutes, as required. Consider using differential backup techniques that preserve the only the new changes performed to data that’s already backed up.

The minds behind ransomware attacks intend to hold this data to hostage so that victims are left with no option but to process the payments. If you can access this data using alternate means within acceptable schedule, the ransomware attack is rendered useless and you can eventually get security and IT experts to clean up the infected systems.

Finally, a sound proactive ransomware mitigation strategy for EMR is to coordinate with your security solutions providers and federal agencies to report possible ransomware attacks – they may already have relevant information and could be able to crack down on the perpetrators with the additional reporting, thereby preventing future attacks from the same sources.

Need help recruiting Cyber Security Professionals for HL7 or EMR Development?

NextGen Executive Search as successfully recruited and placed software developers, analysts, firewall and firmware design, sales, and product management for clinical integration, healthcare patient records management vendors, including medical device manufacturers for over 20 years.

 

Categories
Articles Cyber Security

Mobile Threat Exploits Are You Prepared to Defend Against Malicious Apps?

When we think of cyber threats to endpoints, typically what comes to mind is the need to protect our PC’s and laptops. Many more businesses are adding comprehensive security solutions and user policies administered to include mobile threat exploits.

But it’s unquestionable now that mobile phones are just as likely (if not more likely) to be targeted by cyber criminals. There are a few reasons for that.  The first reason that mobiles are now a legitimate target is the sheer number of them. It’s estimated that there will be over 6 billion smartphones in use by the year 2020. That’s around 70% of the world’s population using a smartphone in 3 years’ time.

Modern smartphones are now small computers. The processing power, functionality, and the way we’ve integrated them into our lives make them a treasure trove of valuable information and easy food for hackers wishing to use mobile threat exploits. And IoT Botnets further increases the vulnerability of cloud based data and mobile devices.Many people today use their mobile phones to access online banking and as a physical payment method in store. Cybercriminals tend to follow the money and so are putting resources into targeting mobiles. Last year, security vendor ESET discovered a form of malware that presented a false version of online banking login screens to steal credentials.

Exposing Vulnerabilities of Mobile Threat Exploits

Like any operating system, there is a continual process of discovering vulnerabilities and attempting to patch them before hackers can take advantage.

This can be complicated on the Android OS. Android is open source, allowing stakeholders to modify and redistribute it to fit their needs.

This means that when mobile threat exploits and vulnerabilities are fixed at the source, it doesn’t always translate to the problem being resolved for the user.

Mobile-Threats

The most famous example of this is the Stagefright vulnerability. This was mobile threat exploits in the code library associated with media playback. If a hacker sent malicious code within a video via MMS, the attack could be successful without any interaction from the user.  This vulnerability was said to affect 95% of Android users making patching a nightmare. Although there had been previous serious vulnerabilities in Android, such as FakeID, TowelRoot, and PingPong, this was the first exploit of this scale that could be successful without any user input.

No OS is Safe

Typically, we see most of mobile attacks targeted at Android devices. But iOS is not completely bulletproof. XcodeGhost was a copycat version of Apple’s development environment, used for creating apps.  Developers that used the rogue version of Xcode to create their apps unwittingly delivered their product to the App Store with the malware in tow.

Mobile Threat Exploits Protection Starts with Education

So clearly, we need a robust plan in place to protect mobile devices from mobile threat exploits. But how do we go about this? The first thing to consider is user education. When using a laptop, most people know not to open attachments from unknown sources.  But mobile users are not always as careful. Educate them to apply this same level of caution to mobiles; only downloading apps from trusted sources and giving the application, the minimum permissions required to perform its task.

Management is Not Security

Your company likely already has an Enterprise Mobility Management (EMM) solution in place. This is useful for managing a fleet of mobiles and preventing opportunistic crimes by enforcing passcodes, for example. But EMM is not sufficient to protect against more advanced threats, and most suites don’t have the functionality to detect, analyze and respond to cyber attacks. For this reason, it’s important to supplement your EMM with a Mobile Threat Defense (MTD) product.MTD has far greater mobile threat exploits threat-detection capabilities and can help to prevent man-in-the-middle attacks, detect non-compliant or malicious apps, and spot jailbroken devices. It’s important to have this level of security on your mobile devices due to the amount of corporate data that can typically be accessed via mobile now.

User-Based Access Controls

A cloud-based Identity as a Service (IDaaS) solution can also help to increase security. The benefits of this to a business are two-fold: For the user, all their corporate systems can be accessed via a single sign-on (SSO). This eliminates the need to remember multiple login credentials.It’s likely to be a multifactor sign-on process which is more secure than a static password. IDaaS also allows users to be automatically granted certain access rights or privileges based on their role. Employees get the right tools to complete their job function and no more. This means that in the event of a mobile threat exploits, the compromise, the amount of accessible information can be limited.

Effective Patching

As mentioned, patching mobile devices is not always straightforward, particularly in Android ecosystems. Updates can be blocked by Google, the handset manufacturer, or the mobile operator. However, this situation has improved since Stagefright. Even given these difficulties, it’s important that you have a process for keeping your operating systems up to date. This should be easy to configure in your EMM solution.Ultimately, we don’t need the statistics to tell us that mobiles are here to stay in the business world; we see evidence of this every day. Mobiles are now integral to huge chunks of our working lives. And because of this, the threat from hackers will continue to grow.

What steps are you taking to ensure that mobiles aren’t an easy attack vector into your business?  And do you feel that your users are as educated on mobile threat exploits as they are about conventional PC-based malware?

 

Categories
Articles Cyber Security

Healthcare Is Unprepared for Cyber Attacks and here’s why…

Healthcare is unprepared for cyber attacks and as the cybercrime threat landscape for medical devices and electronic health records is evolving at unprecedented rates this lack of preparation does not bode well.  The malicious intent of financially motivated or state-sponsored cyber-criminals was best served by victimizing financial institutions, power infrastructure and the business sector.

The sheer wealth of profitable consumer information stored within the servers and IT networks powering these industry segments have attracted cyber attack interests for decades. At the same time, these industries are investing vast resources to strengthen their security posture. Cyber criminals pursuing easier targets are aiming for the healthcare industry instead, where a similarly vast deluge of sensitive personally identifiable information powers increasingly digitized healthcare services from less-secure network infrastructure.

Inherent Loopholes as Healthcare Is Unprepared for Cyber Attacks

Healthcare institutions excel in medical practices but are inherently prone to security attacks. 2017 might have seen only a limited number of successful attacks, but make no mistake that healthcare is unprepared for cyber attacks and this is a very real threat, and here’s why. The future of healthcare centers are paperless medical practices. Digital patient information stored in network-connected servers is a recipe for disaster unless strong security defense capabilities are in place to ward off sophisticated cyber attacks. And that’s precisely the problem with the healthcare industry they are woefully unprepared for technology adoption.

While the government and the industry is pushing to embrace Electronic Health Record (EHR) systems, the same attention is not given to invest in strong security solutions, technologies, and processes across the widening industry of healthcare institutions, hospitals, surgery centers and EMR/EHR management providers.

Equating Compliance to Security: Global regulatory authorities enforce strict laws to ensure security of digital health records and electronic systems used in the healthcare industry. However, these laws are designed to establish and maintain a minimum standard of security capabilities and practices. The risks could be far worse and varied. Therefore, it becomes more obvious why healthcare is unprepared for cyber attacks by maintaining compliance standards such as HIPAA do not translate into strong security capabilities.

Lack of Security Awareness: A significant proportion of life-threatening spearphishing and ransomware attacks are designed to exploit the human element. Random clicks to malicious links by unsuspecting workforce in the healthcare industry cost millions of dollars in damages. Inadequate workforce education and training on maintaining security of digitized records and new healthcare technologies is prevalent in the industry considering the simple root causes of these costly attacks.

Lack of Resources: Many healthcare institutions do not operate on the same IT security budget in comparison with financial and business organizations. A recent conducted by The Ponemon Institute finds healthcare organizations rate their ability to defend against cyber-attacks at a meager 4.9 out of 10.

Outsourcing May Alleviate Healthcare Industry Unprepared for Cyber Attacks

Healthcare institutes work to excel in the services they have to offer, and tend to outsource critical healthcare IT operations. These IT service providers are subject to strict regulations including HIPAA, whereas healthcare organizations cannot accurately assess the risk of business associates or ensure security of Protected Health Information (PHI) shared with them.

Categories
Articles Cyber Security

Personal Cyber Security Has Now Become More Personalized

Cyber-attacks are amplifying across the globe.  Personal cyber security is important as not only have they becoming more frequent, but they are also impacting a wider band of digital terrain. A single worm, like WannaCry is capable of infecting countless systems in numerous ways, from email accounts to personal data to service disruptions and other critical disturbances. The impact and frequency has led to billions of dollars’ worth of damage, to include lost productivity. Damage to an organization’s reputation is not even calculable.

Budgets are growing tight due to the continued cost of cyber security protections and investigations. While this regularly effects large organizations, small to mid-size businesses are also seeing an increase in cyber-attacks. Hackers are turning toward smaller targets because they are less likely to have secure infrastructure and even less likely to know they are under attack. A worm or virus can sit in a computer system for months and without an in-house IT team, small businesses are especially vulnerable.

Personal Cyber Security Thwarts Hackers

A target that is even smaller than a small business is you. Personal cyber security is becoming more relevant as hackers seek out any vulnerability. But if small businesses can’t even afford an IT team, and if large organizations are finding their budgets shrinking due to cyber security costs, then how can an individual protect themselves?Personal Cyber SecurityCompanies like Rubica are offering personal cyber security options that protect individuals, and the businesses they own or work for, from cyber-attacks by providing easy-to-use and affordable cyber security options.

I rarely recommend any company’s products or services, but Rubica has options and features that warrant a serious look by executives and Board members alike.

Far too often individuals do not adhere to security protocols because the protocols are too complicated or time-consuming. People take short-cuts to avoid tedious passwords or log-in requirements.

Doing so on your personal device is risky, but when your personal device is also synced to business applications results can be catastrophic. By providing employees with personal cyber security features, Rubica protects individuals and businesses.

Some of Rubica’s defining features include its mobile ready app that can be downloaded on desktops, tablets and smart phones. There is no need to install hardware or receive staff training on its use. The app is backed by Rubica’s signature concierge service. The cyber ops team is on call at any time. But users rarely need to contact Rubica since the security app and service does its work without the user even knowing.

Personal Cyber Security Solution by Rubica

Rubica’s cyber ops team provides personal cyber security to any user who has downloaded the application. Once downloaded, the cyber ops team is able to monitor your data, identify threats and alert you when necessary. By paying attention to personal behavior patterns, the team is able to deduce when an imposter has entered a network.

If the idea of data and behavioral monitoring is not a price you are willing to pay in exchange for personal cyber security, then don’t worry. Rubica can be turned on and off. Users are able to access the app and view activity graphs, review investigated events and ask Rubica staff questions about their data or any ongoing threats. Rubica’s personalization means that your personal cyber security choices just got more personal.

Require the rolodex and expertise of an executive search team?

NextGen has a solid track record in identifying and recruiting “A players” – the top 14% of the workforce that produces 8 to 10 times more than even “B platers” – AND these “A players” exist at every level from lead software developer to cyber analyst to Director of business development to VP of Cyber Counterintelligence and much more.  We recruit for red, blue, and purple teams for cyber defense contractors and DoD as well as private sector cyber security needs.

 

Categories
Articles Cyber Security

Facing New Cyber Warfare Tactics – Implement CCI Methods

Cyberspace is an official battlefield for almost a decade in many states. According to a series of data breach investigations report (2013-2016) of Verizon facing new cyber warfare tactics, despite cyber criminals remain a major actor category in causing data breaches, the significant participation of nation-states and state-affiliated groups in cyber-operations is not to be underestimated.

The operators in the latter category do not simply target short-term monetary gain, but in-depth and persistent penetration to attain strategic objectives, notably the advanced persistent threat (APT). Our businesses, government, and military are facing new cyberwarfare tactics used in economic espionage, geopolitical campaigns and remote sabotage attempts. High profile events in recent years ranging from the Chinese APT1 eavesdropping over 140 international companies, Russian APT28 implementing asymmetric warfare against Georgia and Ukraine between 2008 and 2014, to the DNC email hacking in the recent US presidential election and Olympic Games (Stuxnet) sabotage incident in 2010, contribute to the rapid development of cyber intelligence landscape.

Methods in Facing New Cyber Warfare Tactics

Thus, in this troubled water, not only the digital assets and intellectual properties of private companies are under constant surveillance of ​cybercriminals but also public critical infrastructures and new Internet of Things connected data and devices are at stake. Highly skillful and resourceful actors enthusiastically collect intelligence through sophisticated hacking tools, computer worms and network mapping technologies.This intelligence collection empowers malicious actors to succeed in striking companies and governments. One key underlying factor for successful risk mitigation is not only to catch up with the ‘hardware’ technological advancement, but also the software in facing new cyber warfare tactics to analyze the pattern, identity and objectives of the intruder so as to effectively counterstrike intelligence collection of the adversary.Facing new cyber warfare tactics by implementing CCI methodsThus, adopting military doctrines such as decoy, deception and deterrence to detect and mitigate cyber risks becomes a valuable cyber counterintelligence (CCI) strategy for both private companies and states. In the tactics, techniques, procedures (TTP) guidelines implemented by the U.S. Department of Defense (DoD) Joint Chiefs of Staff, at least four major intelligence collection methods can be identified in cyberspace. Intelligence can be collected through human (HUMINT), open-source (OSINT), signal (SIGINT) and geography (GEOINT).Based on these notions, the security researcher, Robert Lee, suggests two approaches to apply these concepts in CCI policy making: defensive CCI and offensive CCI.The former recommends regular red team assessment to evaluate both internal network vulnerabilities and external threat landscape. The latter is about setting up honeypots and sock puppets to interact with the adversary so as to achieve deception and delay effects. Both approaches require a comprehensive understanding of the internal networks, operations and procedures about one’s own organization. Ideally, one optimal CCI employment involves a mix of active and passive intelligence gathering to understand the potential adversaries.

Assessments in Facing New Cyber Warfare Tactics

In other words, it implies the hybrid application of conducting internal and external assessment as well as interacting with the intruders. Hence, the organization can be better prepared in facing new cyber warfare tactics by drafting its response plan and internal policies with more concrete scenarios, evidence, and more significantly, grasp of the tactics of the adversary.

In addition, internal analyst and general employee training is a prerequisite for the successful implementation of CCI strategy. On the one hand, improving the security awareness of general employees is an important, yet underestimated, means to prevent initial network compromise. For example, the victims of APT1 mostly started by falling prey to spear phishing which eventually caused successive large-scale data breaches. Educating employees to be cautious of unverified and false web information addresses the most vulnerable human factor in cybersecurity trust chain.

In other words, it implies the hybrid application of conducting internal and external assessment as well as interacting with the intruders. Hence, the organization can be better prepared in facing new cyber warfare tactics by drafting its response plan and internal policies with more concrete scenarios, evidence, and more significantly, grasp of the tactics of the adversary.

In addition, internal analyst and general employee training is a prerequisite for the successful implementation of CCI strategy. On the one hand, improving the security awareness of general employees is an important, yet underestimated, means to prevent initial network compromise. For example, the victims of APT1 mostly started by falling prey to spear phishing which eventually caused successive large-scale data breaches. Educating employees to be cautious of unverified and false web information addresses the most vulnerable human factor in cybersecurity trust chain.

On the other hand, the training of in-house analysts has to be rigid and unconventional. They must be able to identify, evaluate and distinguish accurate intrusion data to defend the organization. Putting themselves into the adversary’s shoes is a crucial perspective to anticipate the interests, objectives and strategies of the intruder. It also prevents them from being misled to well-crafted falsified data.

To optimize the performance of the duties of in-house analysts, a number of emerging cybersecurity vendors in deception technology like TrapX, Attivo and Cymmetria develop products and solutions adapted to this specific need. Through setting up decoys and buffering zones such as honeypot servers, sandbox and other buffering mechanisms, the defending organization can maximize the counterintelligence efforts to study the attacker.

In conclusion, adopting CCI perspectives in facing new cyber warfare tactics is an imminent issue for companies and governments to cope with constantly evolving and sophisticated cyberattacks. After all, the information security solutions of major vendors in the market target a more general public having relatively less security challenges than institutions dealing with multi-billion digital assets, IoT networks, and critical infrastructure. Installing ubiquitous anti-virus/ spyware detection software is the earliest phase in defending one’s institution.

In case of constant aggressive network breaches that their existing cybersecurity solutions and internal policies are ineffective, even defenseless, against the adversary, it is time to consider integrating CCI tactics and perspectives into the institution’s cyber defense strategy.

If the states are involved in attacking private entities, for what reasons companies should not introduce CCI to their management?

Whether you are a manufacturer, hardware or software vendor, or defense contractor, you Must have the best talent available who has a TSI and /or active security clearance to work in cyber defense and cyber counterintelligence.  NextGen has served companies with identifying and recruiting cyber analysts, red / blue / purple team engineers, and more.

 

Categories
Cyber Security Articles Internet of Things

IoT Medical Devices Cyber Security – Diagnosis and Dispensing

Now that we are fully engrossed in the cyber age, there are rapid advances across the board for all things connected to the Internet and IoT medical devices cyber security is no exception.  These devices, often called “The Internet of Things,” or IoT, has certainly made much of life much easier. For the medical profession, it has certainly become a simple, safe and easy way to monitor patients away from a clinical setting.

This is all fine and good, but there is a fundamental question of IoT that needs answering: Are these safe and secure when away from a closed environment? This article is going to address the issues home devices face and possible ways to prevent cyber attacks and/or hacking.

Dispensing for IoT Medical Devices Cyber Security

The number one concern of healthcare professionals looking at and addressing potential problems is the HIPAA. This protection act of 1996 means patients under the care of physicians have a reasonable expectation of privacy and are protected under a patient/medical professional relationship. IoT’s are free from human intervention by and large.

This means the patient carrying the device is completely removed from interacting with it on any level. Most of the IoT medical devices are used strictly for monitoring, data collection and medical dispensing. They are passive because the medical professionals are looking for a true a baseline as possible and is only effective when the patient is at ease with or completely unaware of the device. This lack of concern in cyber security for medical devices is the problem.

ISSUES AT STAKE

The information transmitted, no matter how insignificant at the time, could be used to gain identity information. The IoT’s are often coded to the patient with a name, number and medical coding information. All that would be needed is access to the information on the device, and personal, private information is available. This includes social security numbers, medical information and possible fiscal information to boot. This compromised information is enough to wreak havoc on a medical practice, hospital or medical equipment distributor – if not all of them in conjunction – all because of a HIPAA violation.

Solutions for IoT Medical Devices Cyber Security

While computers have software to keep them from attacks, these medical devices do not. There is scant little that can be done if malfeasance is intended. A skilled and determined computer hacking specialist with the understanding of IoT’s can quickly and easily undermine its basics. Doing so would cause serious issue with the medical professional monitoring the patient and for the patient, who could, as a result, receive incorrect treatments and/or medications. Unable to track the information back to a source, this could potentially open a flood of medical malpractice suits, and there would be little the medical professional could provide as a substantial defense.

POTENTIAL SOLUTIONS

Medical administration in conjunction with information teams and network security specialists should realize there needs to be a move from the “Internet of Things” to “Security of Things” to protect themselves, their practices and patients from hacking. There are a few things that could be considered.

DATA ENCRYPTION

Safe and secure encryption should be on the forefront. As more and more medical practices move from paper to online and cloud patient records, the same can be said for IoT’s. Signed contracts with network encryption professionals about software and the devices themselves should be a first step. Each contract to include audits, verifications and regular testing to ensure the validity and security of the data on the IoT.

​​​​​AUTHORIZED DEVICES

​A Holter monitor is one of these IoT’s. Its purpose is to collect a 24 hour EKG for cardiac patients in various settings for the best possible heart function in normal settings. The contract should provide for each device to collect only the necessary information and nothing more. Systems that download, read or output the information is additionally a part of the contract.

To address needed IoT medical devices cyber security, the device should be built in a such a way that any tampering of any sort is quickly noticed and/or built in such a way that the device immediately informs the medical professionals. Patient contracts protecting the device is also a sound idea.

The physical security of the device itself also should not be overlooked. The device should be configured to prevent data storage media from being accessed or removed, and the device itself should not be easily disassembled. In short, building a strong security to protect data during transmission is undercut if the data can be removed from the device itself.

CREDENTIALS

No one but a medical professional can dispense medical advice, so only those who will be reading the results need access to the data contained thereon. All information should only be retrieved under a secure server under select passwords. Focusing on cyber security for IoT medical devices, only the absolutely necessary individuals outside of those interpreting the data need access to any element of the entire procedure.

PERSONNEL

diagnosis-dispensing-IoT-medical-devices-cyber-securityProper training for every step only makes sense. All medical professionals are bound under an ethics code with severe penalties for infringement. There have not yet been any serious attacks on medical IoT’s.

When will it happen is the question. Ideally, every possible step should be covered; however, there is no guarantee of anything until an attack.

What are your thoughts and opinions on the issue of IoT medical devices cyber security, and what steps in addition to those mentioned would be a necessary part?

Categories
Articles Cyber Security

Mobile BYOD Security IT Best Practices

Mobile BYOD security is always an issue for IT and security.  Going online increasingly means going mobile. “There’s an app for that” is the truth these days. Unfortunately, mobile device security brings the same set of concerns that full computer and cloud systems are battling – threats, hacking, and ransomware.

The biggest security threat to mobile devices that is not found in desktops or servers is that very mobility. In mid-2015, 2.1 million Americans reported their mobile phones lost or stolen according to Consumer Reports.  That’s a drop. Add tablets and the count is higher, but still less than what it has been. CR doesn’t try to say why the number of missing devices is down.

Mobile BYOD Security in the Work Environment

The ability to wipe data or lock down a smartphone was considered high end security. Apple led the pack in that kind of security, but even the vaunted iPhone was hacked. It’s probably easier than you think. “More than 86% of Apple iPhones in the world are apparently still vulnerable to a security flaw that allows a hacker to completely take over the device with just a text message, according to data from mobile and web analytics firm MixPanel,” said a report at Business Insider.

It does not matter if your work environment is BYOD or company-supplied. Once the mobile device is gone, expect it to be hacked.  Think a remote wipe of the mobile device is going to protect your information? It won’t. A quick google on “recover lost data from smartphone” turned up plenty of companies selling information-recovery software.

YouTube also has plenty of videos teaching people how to recover files from a smartphone. While these tutorials are aimed at helping someone find and restore “lost” photos or text messages, there’s not a real difference between a picture of someone’s kids at the park and a file with a client’s payment information. Data is data.

Some of these ideas are worth adding to your company’s mobile BYOD security policies.

  1. Lock it. Set a strong passcode or password on company-supplied devices. The more numbers used, the better. Get the IT staff to set passwords or codes. A lot of employees, if allowed to do it themselves, will choose something simple or something personal like a birthday for numbers or children’s names for passwords. For BYOD either limit access to sensitive information or have IT set strong codes for access to those files.
  2. Auto erase after failed unlocks. Restoring deleted data is cheaper than covering losses from a hack.
  3. No public charging stations. Viruses and malware at public charging stations have been around for years. CNBC said the problem is getting worse.  “Here is how it works: The cybercriminal needs to hide an HDMI [high-definition multimedia interface] splitter and recorder in the charging station. Most smartphones are now HDMI-enabled so you can share images from the phone onto a TV. Once plugged in, the station uses the built-in HDMI to record everything done on the smartphone without the user’s knowledge.”

None of these are guaranteed to stop a dedicated hacker when it comes to mobile device security.   But they will frustrate someone who stole the phone or tablet and hoped for an easy score. They can also create enough of a delay for you to lock out the device from your system and alert any customers whose information may be compromised.

Enable Stronger Mobile BYOD Security

The US Computer Emergency Readiness Team (CERT) says mobile hacks are steadily climbing. The report lists things to do to protect mobile devices.  CERT’s best security ideas are:

 

  • Don’t put sensitive information on mobile devices. May not be practical, but this is the best mobile BYOD security policy.
  • Limit the type and number of apps allowed on a mobile device. For a BYOD, this could be problematic. If you are in a BYOD environment, have the employee sign an agreement allowing the IT department to lock company information and restrict access to it.
  • Step up the basic access to the phone with longer pass codes and more complicated passwords.
  • Disable Bluetooth, infrared and Wi-Fi.

Mobile-BYOD-SecurityMobile may not be part of your company’s business model right now, but it is coming.  If you already have it, what are you doing to make things secure? What’s in your company’s written mobile device policy?  How do you enforce it? How do you monitor the devices, especially if you are BYOD?

Having issues with recruiting cyber security experts with deep experience in wireless protocols, mobile networks, mobile security apps and BYOd security?  Click below to ask NextGen how we can solve recruitment issues and deliver the right candidates for hire.

 

How to Evaluate an Executive Search Firm
Receive the latest news

Subscribe To Our Newsletter

Get notified about new articles, videos, seminars and all the breaking industry news as it happens