Tag: cyber attacks

Apparent cyberattack forces Florida hospital system to divert some emergency patients to other facilities | CNN Politics

[ad_1]

CNN
—

An apparent cyberattack has forced a network of Florida health care organizations to send some emergency patients to other facilities and to cancel some non-emergency surgeries, the health care network said Friday.

Tallahassee Memorial HealthCare, which operates a 772-bed hospital and multiple specialty care centers, said an “IT security issue” late Thursday night forced it to take down its computer system.

“We are also diverting EMS [emergency medical services] patients and will only be accepting Level 1 traumas from our immediate service area,” the hospital system said in a statement. Level 1 trauma refers to the most acute injuries and illnesses.

Tallahassee Memorial HealthCare spokesperson Tori Lynn Schneider told CNN “some” emergency patients were being diverted to facilities outside of the organization’s network, but declined to say how many patients. All non-emergency and elective procedures scheduled for Monday were canceled because of the hacking incident, Schneider said.

It’s the latest in a series of cyberattacks that have continued to hit resource-strapped US health care providers in the nearly three years of the Covid-19 pandemic. In another case, hackers accessed the personal data of nearly 270,000 patients in an attempted ransomware attack on a Louisiana health care system in October.

The FBI last month shut down the computer infrastructure used by a notorious ransomware gang to attack multiple US hospitals, according to the bureau. But the threat remains as multiple ransomware groups are known to target the health sector.

It’s unclear who was responsible for the apparent hack of Tallahassee Memorial. Tallahassee Memorial did not specify whether it had suffered a ransomware attack, but the organization’s statement described activity, including the need to shut down computer networks, consistent with a ransomware attack.

Staff have been unable to access digital patient records and lab results because of the shutdown, a hospital source told CNN.

Mark O’Bryant, Tallahassee Memorial’s CEO, notified staff in person Friday morning that the system had suffered a “cyberattack,” according to the source.

“To help us contain the issue, please completely turn off all PCs connected to TMH’s network immediately and leave them off until notified otherwise,” Tallahassee Memorial leadership said in a memo sent to employees Friday morning and obtained by CNN.

Max Henderson, a Tallahassee native and cybersecurity specialist who focuses on health care, said the effects of a shutting down a hospital’s computer network can last for weeks or months.

“Immediate, unplanned shutdowns can lead to a loss of recently gathered data regarding diagnosis, clinical notes, shift handovers and other various setbacks for the medical staff,” Henderson, who is senior manager for incident response at security firm Pondurance, told CNN.

“Nearly all hospitals rely on the internet for connectivity with vendors and remote offices for processing information in critical departments such as radiology, pharmacy, medical device maintenance, patient document scanning and payment processing,” Henderson added.

[ad_2]

Source link

February 3, 2023
5 Cybersecurity Predictions Home Users Need to Know for 2023

[ad_1]

Opinions expressed by Entrepreneur contributors are their own.

This time last year, I reviewed the cybersecurity landscape around the world and predicted a year ahead involving advanced threats against home users, the continual growth of ransomware and gaming as a growing attack vector. Looking back over 2022, we indeed saw those predictions play out.

For 2023, we can expect the continued trends of attacks against consumers and remote employees, like phishing and social engineering attacks, including email and SMS scams, which are commonly used to exploit individuals. Trojan viruses, sophisticated malware and new attack vectors will be highly prevalent in 2023, including novel threats such as the Metaverse Attack vector dubbed “Big Brother” discovered by RAV Researchers.

With all this in mind, what else can we expect for 2023?

1. Phishing and social engineering

Unfortunately, humans are still the weakest link in the cybersecurity chain. Home users remain the easiest targets as AV providers are focused on securing enterprise dollars for their services. Phishing and social engineering scams will become more sophisticated as they continue into 2023, and cyber criminals employ more complex technologies such as deep fakes.

Continued use of email phishing is to be expected, with Office Documents that hide macro code still being used as vectors to lure users to run the malicious code in emails. Other means of deploying scams, such as SMS and social media platforms — be it affiliate links, clickbait or credentials pages that attempt to steal your password information — are all likely to continue.

Raising awareness for online users is our best leverage to stop these phishing attempts from being successful. Taking note of simple telltale signs such as misspelling of words, the incorrect use of URLs and completely irrelevant messaging can make all the difference.

Related: The Emerging Cybersecurity Trends In 2023

2. RaaS and CaaS

Ransomware-as-a-Service (RaaS) and overall Cybercrime-as-a-Service (CaaS) are on the rise. Data breaches are to be expected, as data is still seen as profitable barter on the Dark Web. These services are becoming more commonplace as cyber warfare persists. As the motivations behind cybercrime move from profit-related to geopolitical, the nature of the Dark Web is changing. Worryingly, cyber-criminal groups can now use the malware they trade on these platforms to go after more sensitive computing systems connected to critical infrastructure and government services of other nation-states.

3. Online user demographics

Cyber victims are becoming increasingly younger. We will see the continued targeting of unsecured consumers such as tweens and teens, who are highly connected, starting to use crypto and buying into the metaverse and other digital assets. Likewise, criminals themselves are getting younger. Cybercrime activity by teens and young adults now covers everything from large-scale attacks on enterprises and governments to low-level crimes that target families, friends and strangers. Hacktivism will also be fueled by cyber use — the younger generation can use their cyber skills to show their discontent in ways the past generation didn’t have access to or the ability to do.

Related: A Business Leader’s Beginner Guide to Cybersecurity

4. Bypassing 2FA

Cracking and bypassing two-factor authentication (2FA) is on the rise and will be exploited more and more in the coming year. It’s likely that in the future, we may move on to three or even four-factor authentication. As the technology to crack multi-factor authentication continues to mount up, more and more companies may opt to use biometric authentication.

5. Next-generation threats

As next-generation technologies, such as virtual reality, make it into the mainstream, we will see the continued deployment of next-generation threats. Whether or not the allure of the metaverse and augmented realities makes it into 2023 remains to be seen — but as ever, new vectors offer new opportunities and broader attack surfaces.

Related: 4 Major Cybersecurity Risks of Working From Home

What can we do?

Despite ongoing cybersecurity concerns, there’s sometimes a distinct lack of action. For example, 12 months after the Log4J hack, the CISA and FBI agencies are concerned that many companies have still not applied updates, despite their security alerts warning that if organizations haven’t yet patched or mitigated Log4j vulnerabilities, they should assume their network is compromised and act accordingly.

Organizations and individuals alike need to shift their cybersecurity strategies to a more holistic approach. Log4J is a great example of why cybersecurity companies shouldn’t rest on their laurels. Experts have warned that threat actors are perfectly capable of playing the long game; even if a disaster hasn’t struck yet. Unless you are fully prepared, it still can.

As with all aspects of technology, cybersecurity is fast-paced and ever-evolving. Security companies need to constantly mitigate threats, deploying the best cybersecurity available for their users. One thing is certain in 2023: More hacks are coming our way. Cybercriminals will be spending the year ahead fine-tuning their methods. The question is whether the defense can keep up.

[ad_2]

Andrew Newman

Source link

January 31, 2023
Hackers stole data from multiple electric utilities in recent ransomware attack | CNN Politics

[ad_1]

CNN
—

Hackers stole data belonging to multiple electric utilities in an October ransomware attack on a US government contractor that handles critical infrastructure projects across the country, according to a memo describing the hack obtained by CNN.

Federal officials have closely monitored the incident for any potential broader impact on the US power sector while private investigators have combed the dark web for the stolen data, according to the memo sent this month to power company executives by the North American grid regulator’s cyberthreat sharing center.

The previously unreported incident is a window into how ransomware attacks on critical US companies are handled behind the scenes as lawyers and federal investigators quietly spring into action to determine the extent of the damage.

The ransomware attack hit Chicago-based Sargent & Lundy, an engineering firm that has designed more than 900 power stations and thousands of miles of power systems and that holds sensitive data on those projects.

The firm also handles nuclear security issues, working with the departments of Defense, Energy and other agencies “to strengthen nuclear deterrence” and keep weapons of mass destruction out of terrorists’ hands, according to its website.

Two people familiar with the investigation of the Sargent & Lundy hack told CNN that the incident was contained and remediated, and didn’t appear to have a broader impact on other power-sector firms.

There is no sign that data stolen from Sargent & Lundy, which includes “model files” and “transmission data” the firm uses for utility projects, is on the dark web, according to the memo from the Electricity Information Sharing and Analysis Center.

But security experts have long been concerned that schematics held by electric and nuclear power contractors could be dumped online and used for follow-on physical or cyberattacks on those facilities.

“These are literally the configurations for your programmable logic controllers, your relays,” said longtime security consultant Patrick Miller, referring to critical electric equipment that keeps the lights on. “We’re really concerned about the data that’s in those organizations.”

Those concerns are particularly acute following a spate of physical attacks and vandalism at electric utilities in multiple states. Tens of thousands of people lost power in Moore County, North Carolina, this month after Duke Energy substations were damaged by gunfire. On Christmas, thousands of people lost power in a Washington county after someone vandalized multiple substations there.

“We’re fully recovered from the incident, which had minimal impact on our normal business operations,” Brenda Romero, a spokesperson for Sargent & Lundy, said in a statement to CNN. Romero said the firm “notified law enforcement” of the hack.

Romero declined to answer further questions on the ransomware attack, including whether the hackers had tried to extort Sargent & Lundy, citing an ongoing investigation.

The Biden administration has urged companies to share data on such hacks as US officials have tried to get a grip on the epidemic of ransomware, which has cost critical infrastructure firms many millions of dollars.

The hackers that hit Sargent & Lundy used a strain of ransomware known as Black Basta that first surfaced early this year, according to two people familiar with the investigation. Scores of Black Basta attacks have been reported since April, according to cybersecurity firm Palo Alto Networks. The hackers steal data from their victims to give them added leverage in ransom negotiations.

Sargent & Lundy is one of several engineering firms whose work on critical infrastructure projects cuts across different sectors of the economy. For US cybersecurity officials, this engineering work can be harder to evaluate in terms of its risk to supply chain security than a firm that only makes software.

Federal regulations require electric utilities to maintain certain cybersecurity standards for protecting their systems from hacks. Companies that contract with those utilities, such as Sargent & Lundy, aren’t necessarily held to the same standard and are instead bound by the security requirements in the contract, experts told CNN.

“Utilities are effectively allowed to accept as much risk as they want,” said Miller, who is CEO of Oregon-based Ampere Industrial Security, a consulting firm. “Is it perfect? No, but [the contractors] are being assessed [for their security] in some ways through the utilities.”

[ad_2]

Source link

December 27, 2022
How to Get Today’s Top Cybersecurity Certifications
[ad_1]

Opinions expressed by Entrepreneur contributors are their own.
Over the past few years, cybersecurity has become a bigger issue for small-business owners. Cyber attacks could cost you huge amounts of money, no matter how big your business is. But hiring a cybersecurity or IT team isn’t in the budget for all businesses. Instead, it might be more cost-effective to add cybersecurity to your own list of skills. With The Complete 2023 Cyber Security Developer & IT Skills Bundle, you’ll have a central hub to study to earn some of today’s leading cybersecurity certifications.

StackCommerce

This massive bundle includes 26 courses and, yes, that means it covers 26 different cybersecurity exams. With exams from Microsoft, CompTIA, CISSP, Cisco, CertNexus, and many more leading organizations represented, it’s one of the best resources you’ll find for taking your cybersecurity skills to the next level. Each course is presented by iCollege, one of the most trusted marketplace in online learning for nearly two decades. They’ve helped students in 120 countries learn in-demand tech skills, and are even trusted by Silicon Valley and Fortune 500 organizations to help employees keep their skills up to date.

The bundle casts an extremely wide net when it comes to security, covering cloud security, network security, system security, mobile security, penetration testing, first response, and much more. Some of the exam highlights you’ll cover include:
- CertNexus CyberSec First Responder (CFR-310)
- ISACA Certified Information Security Manager (CISM)
- Palo Alto Networks Cybersecurity Fundamentals (PCCSA)
- (ISC) CISSP
- NIST Cybersecurity & Risk Management Frameworks
- CompTIA Security+ (SYO-601)
- CompTIA PenTest+ (PT0-002)
- General Data Protection Regulation (GDPR)
- Microsoft Azure Security Technologies (AZ-500)
Get a comprehensive cybersecurity education that will help you protect your business. Right now, The Complete 2023 Cyber Security Developer & IT Skills Bundle is on sale for just $79 for a limited time.

Prices subject to change.
[ad_2]

Entrepreneur Store

Source link
December 25, 2022
Are Your Business Partners Exposing You to Cyber Threats?

[ad_1]

Opinions expressed by Entrepreneur contributors are their own.

The cybersecurity business has become everyone’s business. It only takes one viral data breach to destroy a company’s social proof and send its clients running to rival organizations in search of safer conditions. IBM estimates that the average data breach this year costs affected businesses $4.35 million, a near 13% increase since 2020. That figure doesn’t include the sometimes irreversible harm to a company’s reputation.

Headline-grabbing data leaks aren’t limited to credit card or identity information, however. These incidents encompass anything and everything having to do with private and personal details. If you submit a car loan application, you trust the prospective lender to be a good steward of your information. When your business does business with another company, you similarly expect the same level of security.

Related: 3 Reasons Why Privacy Matters to Your Business, Your Brand and Your Future

In the financial services world, we’re held to high standards of security where even the smallest misstep must be reported to several entities. Ours certainly isn’t the only industry facing tremendous expectations when it comes to prioritizing the importance of cybersecurity in business, either. It’s become mission-critical across the board.

There can be a surprising upside to so much rigidity and concern, though. If you’re doing a great job and implementing the strongest, most reliable cybersecurity solutions for businesses, you have the opportunity to make your protocols a differentiator. When customers see “social proof” of something, they tend to trust what they see. Yet, you can’t tap into this social proof if you don’t control all your cybersecurity business elements, and that includes how proactive and protective your partners act with your shared data.

Lowering risk exposure starts from the inside

As mentioned above, we’re in the financial services world. To maintain our license, we must use advanced data encryption tools and technologies. Encryption is essential during the process of buying currency online because so much personal information moves back and forth, including a high degree of money-related data like bank routing numbers.

We also must follow BSA/AML compliance guidelines to the letter, just like any financial institution. Therefore, we have a BSA compliance officer who handles all compliance coordination, monitoring and oversight. The BSA compliance officer serves as a critical player in assuring regulatory entities, board members, customers and the public that we’re doing what needs to be done when it comes to lowering our risk exposure.

Opening a money service business like ours is difficult. After taking so many steps and performing intense due diligence, we’re understandably careful about the partners we choose. You should be, too, as one bad apple can ruin the entire bunch.

Related: Five Ways to Protect Your Company Against Cyber Attacks

Know exactly who you’re doing business with

All companies — especially MSBs, or money service businesses — need to be vigilant and put strategies in play to reduce the chances of a breach. A lot goes into building such a comprehensive, cohesive protection plan. Running online business transactions on a private server and implementing data encryption processes are the minimum requirements to get off the ground, but that’s just the start.

Beyond those necessary action items, companies of all sizes should consider leveraging the following methods to make certain that anyone with access to even a sliver of your data believes in safety as strongly as you do:

1. Vet each partner on basic compliance

Foundational elements to review thoroughly include having up-to-date security certificates, performing detailed security audits, using a VPN to fully protect browsing data and getting federal agency approval when necessary. If a potential partner is cutting compliance corners — intentionally or otherwise — you’d be better off continuing the search until all of your concerns are alleviated. Don’t settle for less than the best.

It’s important to treat each potential partner with the same level of due diligence, as threats and attacks can come from small startups and big corporations alike. The Verizon Business 2022 Data Breach Investigations Report found that 62% of “system intrusion” incidents originated with an organization’s partner. And the Ponemon Institute reported that 54% of organizations were “not monitoring the security and privacy practices of third parties that they share sensitive or confidential information with on an ongoing basis.”

That’s hugely concerning. Opportunistic cybercriminals are always looking for the weakest link in the supply chain, after all.

2. Check for third-party verification

In the complicated digital reality we all live in, honesty can be at a premium. This can be especially true when verifying the real identity of a person — or the motives of a potential vendor. Enter third-party providers who use a variety of tactics to drill down to the actual, accurate identities of customers who might attempt to make a financial transaction or businesses that want to join forces. These third-party testers do the thankless work of monitoring platform security and infiltration.

My company, Xchange of America, uses a third-party verification service to authenticate customer identities by specific inputs. A series of four random verification questions that only the true person would know are asked, such as the make and model of previous vehicle(s) owned, street names where the customer previously lived and previous employer(s). Confirming these unique details keeps nefarious actors at bay and prevents sales fraud.

Different industries will perform third-party verifications differently than ours, but the importance is the same for every company. Do your partners employ thorough third-party verification tactics? Stipulate that they do.

Related: Authentication Technology is Shaping Vendor Partner Verification and Onboarding

3. Demand full transparency

What happens if you start to ask questions of your partners and run into brick walls? This may be an indication that they’re not being forthright. You want partners who welcome questions because they have nothing to hide. For example, all money service businesses like ours must be registered and licensed in the states we operate in. If a potential partner is required to have certain registrations, licenses or permits and doesn’t, that’s a major red flag.

Be persistent when it comes to getting the compliance answers you seek. Don’t be hesitant to ask pointed follow-up questions, such as how data encryption works at a partner’s company. Data breaches can be thwarted if information is always encrypted, whether it’s in motion or in storage.

Dropbox is an example of a company that takes data encryption (and protection) seriously. According to Dropbox’s help center, files at rest are encrypted using 256-bit Advanced Encryption Standard (AES). The company also uses Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to protect data in transit between Dropbox apps and its servers, among many other layers of protection.

Related: Cybersecurity Trends and Drivers in 2022

You deserve to know the level of data encryption of any associated organization, not just that they have “some kind of encryption.” Dropbox’s transparency in that regard should serve as the rule, not the exception.

As long as cybercriminals are willing to hack into systems, corporate leaders and their teams must find and remove their cybersecurity vulnerabilities. Just make sure that you’re not just looking at ways to improve your own cybersecurity. Insist that all companies you do business with also treat it as a pressing priority.

[ad_2]

Robert Hoffman

Source link

December 15, 2022
8 Ways You Can Save Yourself and Others From Being Scammed

[ad_1]

Opinions expressed by Entrepreneur contributors are their own.

Statistics on the number of scam websites that litter the internet are disturbing. During 2020, Google registered more than 2 million phishing websites alone. That means more than 5,000 new phishing sites popped up every day — not to mention the ones that avoided Google’s detection. In 2021, the U.S. Federal Bureau of Investigation (FBI) reported nearly $7 billion in losses from cybercrime that is perpetrated through these sites.

What exactly are scam websites? Scam websites refer to any illegitimate website that is used to deceive users into fraud or malicious attacks. Many scammers operate these fake websites and will download viruses onto your computer or steal passwords or other personal information.

Reporting these sites as they are encountered is an important part of fighting back. In other words, if you see something, say something. Keeping quiet, even if you avoid falling prey, allows the scammers to aim at another target.

Perhaps you’ve received a suspicious link in an email? Or maybe a strange text message that you haven’t clicked on. Fortunately, there are many organizations out there that have launched efforts aimed at reducing the threat that they pose. In general, these organizations put scam websites on the radar by collecting and sharing information about them. In some cases, they prompt an investigation into the scammers behind the sites.

Related: Learn How to Protect Your Business From Cybercrime

It’s free to report a suspicious website you’ve encountered, and it takes just a minute. Here are eight ways you can report a suspected scam website to stop cyber criminals and protect yourself and others online.

1. The Internet Crime Complaint Center

The IC3, as it is known, is an office of the FBI that receives complaints from those who have been the victims of internet-related crime. The IC3 defines the internet crimes that it addresses to include illegal activity involving websites. Complaints filed with the IC3 are reviewed and researched by trained FBI analysts.

2. Cybersecurity and Infrastructure Security Agency

CISA, which is an agency of the U.S. Department of Homeland Security, targets a wide range of malicious cyber activity. It specifically requests reports on phishing activity utilizing fraudulent websites. Information provided to CISA is shared with the Anti-Phishing Working Group, a non-profit focused on reducing the impact of phishing-related fraud around the world.

3. econsumer.gov

The econsumer.gov site, run by the International Consumer Protection and Enforcement Network, is for reporting international scams. It is supported by consumer protection agencies and related offices in more than 65 countries. A secure version of their site is used by law enforcement agencies to share info on scams.

4. Google Safe Browsing

While Google does not have a mechanism for reporting all varieties of website scams, there is a form for reporting sites that are suspected of being used to carry out phishing. Reports made via the form are managed by Google’s Safe Browsing team. Google’s Transparency Report provides information on the sites that it has determined to be “currently dangerous to visit.”

Related: Is That Instagram Email a Phishing Attack? Now You Can Find Out.

5. PhishTank

This service was founded by Cisco Talos Intelligence Group to “pour sunshine on some of the dark alleys of the Internet.” Phishtank includes an ever-growing list of URLs reported as being involved in phishing scams. To date, it has received more than 7.5 million reports of potential phishing sites. It says that more than 100,000 of the sites are still online.

Related: 6 Ways Better Business Bureau Accreditation Can Boost Your Business

6. Antivirus Apps

Antivirus providers such as Norton, Kaspersky, and McAfee have forms that can be used to identify pages that users feel should be blocked. Scam sites would definitely fall under that category. With some antivirus platforms, reporting forms can only be accessed by registered users. Norton’s is open to anyone.

7. Web host

There is a chance that the DNS service hosting the scam site will take action to shut it down. There are a variety of online resources that can help you to find the DNS of a particular site. Once you identify it, send a message to their customer service reporting the site in question and the experience that you had.

8. Share your experience on social media

This is actually more like sounding an alarm than filing a report, but it might protect one of your connections who stumbles upon the same site or is targeted by the same type of scam. At the very least, it could draw attention to the fact that scam sites affect real people. A post on Facebook about a close call you had with a scam might better equip your network to avoid any dangerous entanglements. If it does, they’ll thank you.

[ad_2]

Jay Feldman, DO

Source link

December 3, 2022
How Businesses Can Combat Fraud and Increase Efficiency

[ad_1]

Opinions expressed by Entrepreneur contributors are their own.

“There is no kind of dishonesty into which otherwise good people more easily and frequently fall than that of defrauding the government.”

These words of wisdom from Benjamin Franklin have, unfortunately, proven timeless. People have been defrauding the government for centuries, but last month, the US hit an estimated $45 billion in COVID-19-related unemployment fraud. Now the government starts the long, costly and inefficient process of recouping the money, conducting investigations and punishing those responsible. This process is often called the “pay and chase” model.

With all that fraud, it can be challenging for government agencies and private companies to separate the wheat from the chaff (or, in this case, the fraud from the noise). For example, is a person calling your call center with a device you haven’t seen before actually an existing customer with a new phone or someone attempting to take over an account?

These issues create room for inefficiencies and cost companies huge operational sums when they cannot tell the difference. But, going too heavy with stricter verification that may dampen the customer experience is also something you have to avoid. The good news is it’s possible to identify fraudulent activity with modern technology better and thus increase efficiency.

Related: The Government Is Not Immune to Account-Takeover Fraud, and That Could Be Trouble for You and Me

Modern fraud and its noisy neighbor

At its core, the focus of fraudsters has remained on tricking people into giving access to as much money or data as possible. It’s nothing new; the term “con man” was likely coined in the 1800s. Whether it’s Bill Starbuck’s “The Rain Song” from the musical 110 in the Shade, where the charismatic con man convinces townspeople to give him money to make it rain and end a drought, or someone calling your grandmother and pretending to be a government agency, fraud has always been, and always will be.

Our ability to close fraud loopholes is improving. Still, fraudsters are constantly creating new schemes, and technology continues to enable them to get better at fooling us and covering their tracks. This requires businesses and the government to react to new trends quickly; the best defense against fraud is to be aware of the techniques, remain on guard and educate consumers to do the same. All the while, businesses and governments must walk a tightrope between restricting freedoms too much and being purely reactive to crime.

The public and private sectors utilize call centers for customer account issues and require telephonic calls for some account actions. Unfortunately, these call centers are very susceptible to fraud. The time customer service reps spend trying to distinguish between fraud and noise (i.e., the legitimate calls that get flagged as fraud) distracts from more critical business and carries high costs.

For example, in the financial services industry, the cost of fraud to businesses is $4 for every $1 of actual fraud. That means, on average, if a person defrauds $1,000 from a company, that business’s related costs will be $4,000. And this figure doesn’t include additional costs incurred if a fraudster secures enough information on their first attempt to follow up with more attempts on the same business or its clients, nor the cost of reputational damage post-attack.

One of the big problems, though, is that fraud and noise can often seem similar. For instance, imagine you broke your cell phone and got a new one. When you try to access your bank account from your new phone, your account gets flagged because it doesn’t recognize the device. Now, you have to call to unlock your account, and your bank needs to spend resources confirming your identity. This protects the consumer and the bank but introduces inefficiency for both parties.

Related: How to Identity Proof in an Increasingly Virtualized World

So, what’s an agency to do?

Is there a solution? Modern identity proofing continues to progress in leaps and bounds. The technology exists now to implement much better identity proofing that’s device-agnostic and uses powerful, behind-the-scenes algorithms to prove a customer’s identity — often without them even realizing what’s going on. Artificial intelligence (AI) helps us use data points across the web to calculate the risk associated with a person or caller and create a dynamic risk profile. Then, based on their risk level, they may be required to complete additional automated steps to log in to their account or conduct business.

There are more straightforward steps, as well. For example, impersonating the dead has long been a lucrative tactic for fraudsters. Years ago, criminals even got hold of the Social Security Administration’s (SSA) Death Master File, a restricted record with millions of people to impersonate. One of the first steps a company can take during the account creation process is to check the Death Master File. Every time a person initiates a request for money with an agency, a quick screening can be done to ensure the person requesting a payment from the government is not a dead person. That would be a sure sign something’s amiss.

Of course, there’s no end to the trickery. Recently, I watched in real-time as a phone-based scam targeted my stepmother. She received a text that appeared to be from a friend saying her email had been the target of a scam, and my stepmom should call a particular number to make sure hers hadn’t also been compromised. I had to explain that it wasn’t her friend texting but someone using her friend’s number.

Older people are especially susceptible to fraud like this, but scammers have discovered impersonating a government agency or some entity with authority is a winner. If we get a call saying we’re in trouble with a government entity, will we ignore it? Probably not — many of us will do exactly what they say.

Related: How Technology Can Improve CX for Government Services

A continuous process

We aren’t going to be able to screen out fraud completely. But we can get better at thwarting it, saving operational dollars and resources and providing good customer experiences. The greatest vulnerability in any system is usually the humans using it, so implementing more automated identity-proofing and anti-scam tools can help bridge the gap. We can build efficiency into our systems by keeping up with the latest scam trends and implementing adequate technical controls to stop them.

[ad_2]

Scott Straub

Source link

November 29, 2022
Chinese hacking group targeting US agencies and companies has surged its activity, analysis finds | CNN Politics

[ad_1]

Washington
CNN
—

An elite Chinese hacking group with ties to operatives indicted by a US grand jury in 2020 has surged its activity this year, targeting sensitive data held by companies and government agencies in the US and dozens of other countries, according to an expert at consulting giant PricewaterhouseCoopers.

The findings highlight the biggest cyber-espionage challenge facing the Biden administration: combating a Chinese hacking program that the FBI has called more prolific than that of all other governments in the world combined.

The Justice Department has aggressively sought to expose the alleged data-stealing campaigns through indictments, and made the case that Chinese hackers have robbed American companies of intellectual property, causing huge losses. But China-based hackers have often developed new tools or otherwise altered their operations, according to analysts.

One of the Chinese groups tracked by PwC has targeted dozens of US organizations in the last year, including government agencies and software or tech firms, said Kris McConkey, who leads PwC’s global cyber threat intelligence practice. The intruders often comb networks for data that could offer insights into foreign or trade policy, he said, but also dabble in cryptocurrency schemes for personal profit. He declined to detail what types of US government agencies, whether at the federal, state or local level, were targeted.

“They are, by far, the most active and globally impactful [hacking group] that we track at the minute,” McConkey, who closely follows China-based hackers, told CNN. He believes the attackers have been successful in breaching at least some organizations because they operate on a vast scale, targeting organizations in at least 35 countries this year alone.

McConkey traced part of the activity to an ostensibly legitimate cybersecurity company based in the Chinese city of Chengdu, but he stopped short of publicly connecting the hacking to the Chinese government. US officials have for years accused China of using front companies to conduct hacking that feeds the government’s sprawling intelligence collection efforts.

China has repeatedly denied allegations of hacking and Beijing has in recent months stepped up its own accusations that Washington has conducted cyber operations against Chinese assets.

Cybersecurity issues have been a repeated source of friction between the world’s two biggest economies; President Joe Biden raised the subject on a call with Chinese President Xi Jinping last year.

McConkey was one of multiple private cyber specialists who exposed the operations, and sometimes the alleged locations, of hackers from China, Iran and elsewhere at a recent conference called LABScon, hosted by US security firm SentinelOne, in Scottsdale, Arizona.

Adam Kozy, who tracked Chinese hackers at the FBI from 2011 to 2013, showed the audience a photo of a People’s Liberation Army building in the city of Fuzhou that allegedly houses officers who conduct information operations against Chinese adversaries. That unit has targeted Taiwan, Kozy said, and “is the main area for China’s disinformation operations.”

In their investigations of foreign hackers, the FBI and Justice Department prosecutors have drawn on those types of revelations from private researchers.

At least one FBI agent and officials from the National Security Agency and the US Cybersecurity and Infrastructure Security Agency attended the conference, a reminder of how reliant government officials are on data held by tech firms to pursue spies and cybercriminals. Sometimes that work happens not in a classified facility but in the halls of a luxury hotel.

Morgan Adamski, a senior NSA official, told conference attendees that the coronavirus pandemic changed how her agency worked with private firms to guard sensitive data targeted by hackers.

“The pandemic actually helped because it no longer revolved around big government meetings in a room, in a SCIF [Sensitive Compartmentalized Information Facility], where you couldn’t use any of the information,” said Adamski, who heads the NSA’s Cybersecurity Collaboration Center, which works with defense contractors to blunt the impact of foreign hacking.

After US defense contractors began working from home during the pandemic, she said, Chinese government hackers exploited the virtual private networking (VPN) software the contractors were using. One hacked contractor, which she didn’t name, shared data with federal agencies so they could build a clearer picture of what was going on.

Asked by CNN whether the NSA and other federal agencies responding to the hacks were able to evict the Chinese hackers, Adamski said it’s an iterative process.

“When you talk about nation-state actors, you kick them out, but they’re going to come back,” Adamski said, “especially if you’re a defense industrial base company that is producing critical military intelligence for the Department of Defense.”

[ad_2]

Source link

October 2, 2022
FDA requires medical devices be secured against cyberattacks | CNN Business

[ad_1]

New York
CNN
—

The Food and Drug Administration will now require medical devices meet specific cybersecurity guidelines after years of concerns that a growing number of internet-connected products used by hospitals and healthcare providers could be hit by hacks and ransomware attacks.

Under FDA guidance issued this week, all new medical device applicants must now submit a plan on how to “monitor, identify, and address” cybersecurity issues, as well as create a process that provides “reasonable assurance” that the device in question is protected. Applicants will also need to make security updates and patches available on a regular schedule and in critical situations, and provide the FDA with “a software bill of materials,” including any open-source or other software their devices use.

The new security requirements came into effect as part of the sweeping $1.7 trillion federal omnibus spending bill signed by President Joe Biden in December. As part of the new law, the FDA must also update its medical device cybersecurity guidance at least every two years.

A 2022 report released by the FBI cited research finding 53% of digital medical devices and other internet-connected products in hospitals had known critical vulnerabilities. The report listed a number of medical devices that are susceptible to cyber attacks, including insulin pumps, intracardiac defibrillators, mobile cardiac telemetry and pacemakers.

“Malign actors who compromise these devices can direct them to give inaccurate readings, administer drug overdoses, or otherwise endanger patient health,” according to the FBI report.

In 2021, a group of researchers investigating software used in medical devices and machinery used in other industries found over a dozen vulnerabilities that, if exploited by a hacker, could cause critical equipment such as patient monitors to crash.

The FDA has faced criticisms over the years for not doing enough.

A 2018 report from the US Department of Health and Human Services’ Office of the Inspector General said the FDA was not adequately protecting devices from getting hacked.

“FDA had plans and processes for addressing certain medical device problems in the postmarket phase, but its plans and processes were deficient for addressing medical device cybersecurity compromises,” the report said.

[ad_2]

Source link

April 12, 2021
China-based hackers breached US government email accounts, Microsoft and White House say | CNN Politics

[ad_1]

CNN
—

China-based hackers have breached email accounts at two-dozen organizations, including some United States government agencies, in an apparent spying campaign aimed at acquiring sensitive information, according to statements from Microsoft and the White House late Tuesday.

The full scope of the hack is being investigated, but US officials and Microsoft have been quietly scrambling in recent weeks to assess the impact of the hack, which targeted unclassified email systems, and contain the fallout.

The federal agency where the Chinese hackers were first detected was the State Department, a person familiar with the matter told CNN. The State Department then reported the suspicious activity to Microsoft, the person said.

The Department of Commerce, which has sanctioned Chinese telecom firms, was also breached. The hackers accessed Commerce Secretary Gina Raimondo’s email account, one source familiar with the investigation told CNN. The Washington Post first reported on the access of the secretary’s account.

The Chinese hackers were detected targeting a small number of federal agencies and just a handful of officials’ email accounts at each agency in a hack aimed at specific officials, multiple sources familiar with the investigation told CNN.

“Microsoft notified the (Commerce) Department of a compromise to Microsoft’s Office 365 system, and the Department took immediate action to respond,” a department spokesperson said in a statement on Wednesday.

The spokesperson did not immediately reply to a request for comment on the targeting of Raimondo’s email account.

The hackers targeted email accounts at the House of Representatives, but it was unclear who was targeted and if the breach attempts were successful, two sources familiar with the matter told CNN.

The breaches add to what is already one of the steepest cybersecurity challenges facing the Biden administration: limiting the ability of Beijing’s formidable hacking teams to access US government and corporate secrets.

“Last month, US government safeguards identified an intrusion in Microsoft’s cloud security, which affected unclassified systems,” National Security Council spokesperson Adam Hodge said in a statement to CNN.

“Officials immediately contacted Microsoft to find the source and vulnerability in their cloud service,” Hodge said. “We continue to hold the procurement providers of the US Government to a high security threshold.”

The State Department “detected anomalous activity, took immediate steps to secure our systems, and will continue to closely monitor and quickly respond to any further activity,” a department spokesperson said on Wednesday.

US Capitol Police declined to comment, referring CNN to the FBI.

Hodge did not identify who was behind the hack, but Microsoft executives said in a blog post that the hackers were based in China and focused on espionage.

In response to the Microsoft and White House statements, the Chinese foreign ministry on Wednesday accused Washington of conducting its own hacking operations.

US officials have consistently labeled China as the most advanced of US adversaries in cyberspace, a domain that has repeatedly been a source of bilateral tension in recent years. The FBI has said Beijing has a larger hacking program than all other governments combined.

China has routinely denied the allegations.

The hacking began in mid-May, when the China-based hackers used a stolen sign-in key to burrow their way into email accounts, according to Microsoft. The tech giant has since blocked the hackers from accessing customer emails using that technique, Microsoft said late Tuesday.

Secretary of State Antony Blinken visited China in mid-June, but it was not immediately clear if the cyber-espionage campaign was connected to that high-stakes visit.

Some US officials credited the State Department with investing in more cyber-defense capabilities, allowing the agency to detect the suspicious activity earlier than in past advanced hacks.

The number of US organizations, public or private, impacted by the hacking campaign is in the “single digits,” a senior US Cybersecurity and Infrastructure Security Agency official told reporters on Wednesday.

“This appears to have been a very targeted, surgical campaign,” the official said.

This story has been updated with additional information.

[ad_2]

Source link

April 12, 2021
Microsoft is giving out free cybersecurity tools after an alleged Chinese hack | CNN Business

[ad_1]

New York
CNN
—

Microsoft is offering free cybersecurity tools to some government and commercial customers following criticism of the tech giant’s handling of a major alleged Chinese hack that compromised US government email accounts.

Starting in September, Microsoft cloud computing customers won’t have to pay extra money to get access to critical data to help them spot cyberattacks, Microsoft said Wednesday. The Wall Street Journal first reported on Microsoft’s policy change.

The move comes after cybersecurity officials privately expressed frustration that Microsoft had not done enough to detect the alleged Chinese cyber-espionage campaign, according to US officials. The campaign hit two-dozen organizations and became public last week. The State Department says it detected the cyber activity in June and reported it to Microsoft.

The email accounts of Commerce Secretary Gina Raimondo and State Department officials were breached in the activity, CNN has reported.

One of the victims of the hack was a human rights organization that could not detect the activity because they were not paying for a premium software license, according to US cybersecurity firm Volexity, which works with the human rights organization.

Logs, or computer files that gather artifacts about a hack, are critical to understanding and thwarting cyberattacks, according to experts. Until now, Microsoft’s business model has involved charging customers extra for access to these logs. With customers worldwide and more data than most other firms in the security industry, Microsoft’s decision could have a broad impact on the security posture of its customers, analysts said.

The free tools announced on Wednesday “will enable incident response teams, regardless of license level, to conduct more complete investigations,” Sean Koessel, a vice president at Volexity, told CNN.

“We can’t help but feel this change is long overdue,” Koessel told CNN, adding that some of his past investigations into hacks of customers have been frustrated by a lack of data.

The US Cybersecurity and Infrastructure Security Agency — part of the Department of Homeland Security — said its own investigations into hacks over the years had also been hindered by the lack of “critical data” that costs extra for Microsoft customers to access.

CISA Director Jen Easterly applauded Microsoft’s decision and said her agency had been working with Microsoft on the issue for over a year.

“We will continue to work with all technology manufacturers, including Microsoft, to identify ways to further enhance visibility into their products for all customers,” Easterly said.

[ad_2]

Source link

April 12, 2021
Biden picks Air Force general to lead NSA and Cyber Command | CNN Politics

[ad_1]

CNN
—

President Joe Biden has nominated an Air Force general to head the nation’s powerful electronic spying agency and the US military command that conducts offensive cyber operations – a crucial position as the US continues to battle Russia, China and other foes in cyberspace.

Lt. Gen. Timothy Haugh, who has served for years in senior US military cyber positions, is Biden’s choice to replace outgoing Army Gen. Paul Nakasone as head of the National Security Agency and US Cyber Command, an Air Force official confirmed to CNN.

Politico first reported on Haugh’s nomination.

The White House did not respond to a request for comment.

Haugh’s nomination could face a roadblock in the Senate after Republican Sen. Tommy Tuberville of Alabama put a hold on senior military nominations because he objects to the department’s abortion travel policy.

Haugh is currently deputy of US Cyber Command, a command of thousands of US military personnel who conduct offensive and defensive cyber operations to protect US critical infrastructure. Officials from the command traveled to Ukraine in late 2021 to prepare Kyiv for an onslaught of Russian cyberattacks that accompanied the full-scale Russian invasion.

The command and NSA also have taken an increasingly active role in helping defend American elections from foreign interference under Nakasone’s leadership over the last five years.

During the 2020 election, Iranian hackers accessed a US municipal website for reporting unofficial election results and Cyber Command kicked the hackers off the network out of concern that they might post fake results on the website, a senior US military official revealed last month.

Haugh’s nomination signals a continued emphasis on election security work at Fort Meade, the sprawling military base in Maryland where the NSA and Cyber Command are housed. As a senior US military cyber official, Haugh has been involved in election security discussions in recent midterm and general elections.

[ad_2]

Source link

April 12, 2021
Russian-speaking cyber gang claims credit for hack of BBC and British Airways employee data | CNN Business

[ad_1]

CNN
—

A group of Russian-speaking cyber criminals has claimed credit for a sweeping hack that has compromised employee data at the BBC and British Airways and left US and UK cybersecurity officials scrambling to respond.

The hackers, known as the CLOP ransomware gang, say they have “information on hundreds of companies.” They’ve given victims until June 14 to discuss a ransom before they start publishing data from companies they claim to have hacked, according to a dark web posting seen by CNN.

The extortion threat adds urgency to an already high-stakes security incident that has forced responses from tech firms, corporations and government agencies from the US to Canada and the UK.

The compromise of employee data at the BBC and British Airways came via a breach of a human resources firm, Zellis, that both organizations use.

“We are aware of a data breach at our third-party supplier, Zellis, and are working closely with them as they urgently investigate the extent of the breach,” a BBC spokesperson told CNN Wednesday. The spokesperson declined to comment on the hackers’ extortion threat.

A British Airways spokesperson said the company had “notified those colleagues whose personal information has been compromised to provide support and advice.”

The hackers — a well-known group whose favored malware emerged in 2019 — last week began exploiting a new flaw in a widely used file-transfer software known as MOVEit, appearing to target as many exposed organizations as they could. The opportunistic nature of the hack left a broad swath of organizations vulnerable to extortion.

Numerous US state government agencies use the MOVEit software, but it’s unclear how many agencies, if any, have been compromised.

The US Cybersecurity and Infrastructure Security Agency has ordered all federal civilian agencies to update the MOVEit software in light of the hack. No federal agencies have been confirmed as victims, a CISA spokesperson told CNN.

Together with the Federal Bureau of Investigation, CISA also released advice on dealing with the CLOP hack. Progress, the US firm that owns the MoveIT software, has also urged victims to update their software packages and has issued security advice.

CISA Executive Director for Cybersecurity Eric Goldstein said in a statement: “CISA remains in close contact with Progress Software and our partners at the FBI to understand prevalence within federal agencies and critical infrastructure.”

But the effort to respond to the cyber attack is very much ongoing.

The CLOP hackers are “overwhelmed with the number of victims,” according to Charles Carmakal, chief technology officer at Mandiant Consulting, a Google-owned firm that has investigated the hack. “Instead of directly reaching out to victims over email or telephone calls like in prior campaigns, they are asking victims to reach out to them via email,” he said on LinkedIn Tuesday night.

Allan Liska, a ransomware expert at cybersecurity firm Recorded Future, also told CNN: “Unfortunately, the sensitive nature of the data often stored on MOVEit servers means there will likely be real consequences stemming from the [data theft] but it will be months before we understand the full fallout from this attack.”

[ad_2]

Source link

April 12, 2021
TSMC confirms supplier data breach following ransom demand by Russian-speaking cybercriminal group | CNN Business

[ad_1]

CNN
—

Taiwanese semiconductor giant TSMC confirmed Friday that one of its hardware suppliers was hacked and had data stolen from it, but said the incident had no impact on business operations.

Confirmation of the breach came after Russian-speaking cybercriminals claimed TSMC as a victim on Thursday and demanded an extraordinary $70 million ransom from the semiconductor firm.

There were no signs that TSMC or the hardware supplier, Taiwanese firm Kinmax, had any plans to pay the hackers (representatives from both companies didn’t respond to CNN’s questions about any ransom).

TSMC — one of the world’s largest chipmakers and a key supplier to Apple

(AAPL) — was quick to assure investors and the public that the hack had no impact on its operations and that it did not compromise its customers’ data.

“After the incident, TSMC has immediately terminated its data exchange with this concerned supplier in accordance with the Company’s security protocols and standard operating procedures,” TSMC said in a statement to CNN.

The hackers accessed Kinmax’s internal “testing environment” for the technology it prepares to deliver to customers, Kinmax said in a statement distributed by TSMC.

“The leaked content mainly consisted of system installation preparation that the Company provided to our customers as default configurations,” Kinmax said. The company apologized to customers whose names may show up in the leaked data.

Ransomware groups are known to exaggerate the value of the data they steal and make outlandish demands that are never met.

LockBit is the name of the group claiming responsibility for the hack of the TSMC supplier and the type of ransomware they use. LockBit ransomware was the most deployed ransomware around the world in 2022, according to US cybersecurity officials.

Jon DiMaggio, an executive at security firm Analyst1 who has studied LockBit extensively, said the hackers will likely publish the stolen data or sell it if TSMC refuses to negotiate a ransom.

For years, American officials and Taiwanese cybersecurity experts have looked to fortify the island’s infrastructure in the face of hacking threats.

Taiwan’s chip industry is critical to the global hardware supply chain, making any potentially impactful cyberattacks on it a concern for government officials and business executives around the world.

While the TSMC-related hacking incident doesn’t appear to have been impactful, a separate ransomware attack in 2020 on Taiwan’s state-run energy company temporarily disrupted some customers’ ability to pay for gas with company cards, according to local media reports at the time.

[ad_2]

Source link

April 12, 2021