By Colby Proffitt
1.) Pentagon’s network defense headquarters is fully operational (February 1, 2018)
https://www.cyberscoop.com/dod-network-cyber-command-fully-operational/
Summary: U.S. Cyber Command’s network defense headquarters is fully operational, the Department of Defense announced on Wednesday.
Why it matters: The Pentagon has operations worldwide – that’s a big defensive undertaking. If you look at the presentation from the Pentagon defining the organization, it’s both a relief to see what strides the government is taking to secure our nation and its infrastructure, but also a reality check as to what challenges our government is up against when it comes to defending out networks and data: 3 billion emails received, 16 million attempted intrusions, 11K events to be analyzed.
2.) Global fitness tracker data exposes IoT policy gap (January 29, 2018)
https://fcw.com/articles/2018/01/29/fitbit-strava-heatmap-iot-policy.aspx
Summary: The use of Fitbits by service members is leaving a digital trail of breadcrumbs around some of the world’s most sensitive military installations. Analysts and journalists have been able to identify secret or sensitive military posts around the world using fitness tracker data released by Strava in a global heat map.
Why it matters: Although a data release, the media has to a certain extent treated this incident as a data breech. This article does a good job distinguishing between the hype and the actual problems introduced by the data release. While base locations and perimeters are now neatly identified and outlined (and publicly available), local populations likely already knew about the base so it’s not unreasonable to assume that adversaries did as well. That being said, one can’t help but wonder what other data has been captured – through Strava or other personal IoT devices and applications – and will eventually be discovered. While many would argue IoT policy is needed, it’s important that any such policy is strategic and future-looking, not reactionary and limiting.
3.) Baby boomers more cybersecurity savvy than Gen-Z, study (January 28, 2018)
Summary: Generation Z are the least ransomware savvy generation while baby boomers were more likely to accurately define ransomware and were the savviest when it comes to not forwarding emails from unknown senders.
Why it matters: While an interesting study with telling stats, the respondents ability to accurately define ransomware may not necessarily be an entirely accurate indicator of the respondents’ cyber awareness or cyber practices. Given the ages of baby boomers compared to the ages of those in Gen-Z, it’s not surprising that baby boomers were better informed. Regardless, it’s best that cyber best practices be taught at a young age; if you’re old enough to use it, it’s your responsibility to protect it.
4.) Many of the issues that concern cyber strategists today were already clear at the turn of the century (January 30, 2018)
Summary: The defense secretary for a newly elected president is entering his third month in office when a chilling report crosses his desk warning of the catastrophic damage an enemy could visit on the U.S. with a cyberattack.
Why it matters: While this article indicates that the government followed most of the suggestions from the 2000 report, it also points out that the U.S. is roughly in the middle of what will likely turn out to be a 50 year development cycle in cyber warfare. With ever-evolving threats and a volatile threat landscape and more attackers surfacing regularly, the best defense is a fast one.
5.) Report: In a U.S. first, jackpotting attacks are forcing ATMs to ‘make it rain’ (January 29, 2018)
Summary: Organized criminals are physically accessing ATM machines and infecting them with malware that makes them spit out cash, in what reports are calling the first-ever confirmed case of “jackpotting” attacks in the U.S.
Why it matters: Things haven’t slowed down since last week’s roundup. What this story highlights is the intersection of cybersecurity, physical security, and business security. Financial institutions can take all the cyber precautions in the world, but at the end of the day, their assets are filled with cash and are accessible to anyone. ATMs pose some of the same challenges as IoT devices – they are designed for the convenience of end users (although far more security is built into ATMs), but that convenience also creates opportunities for hackers to attack. It will be interesting to see what measures financial institutions put into place to halt or at least deter jackpotters, and the resulting response of end users.