Be yourself; Everyone else is already taken.
— Oscar Wilde.
This is the first post on my new blog. I’m just getting this new blog going, so stay tuned for more. Subscribe below to get notified when I post new updates.
Post #9
With the COVID-19 Pandemic still going on in full force you’d be hard pressed to find some bit of news that doesn’t make some reference to it. That said, as many employers have shifted their work forces into working remotely from home, new security concerns that a given organization may not have had to worry about previously now have to be considered. This Forbes article gives a great few suggestions for areas to focus on that may be lacking given the abrupt switch for many companies.
The first major big one that might be a bit obvious off the bat is that now employees are using their own home wifi networks to access work information. Instead of having stringent security protocols across the work network and devices, because the employee has to use their own internet connection, these networks are not necessarily configured to protect against malicious entities.
Phishing, an age old tactic and common scheme has had a resurgence in effectiveness. With all the general confusion surrounding this time, phishers are finding new success in legitimate-sounding e-mails sent to employees. If an employee believes the e-mail was sent from their employer, it’s likely the phisher is successful.
Finally, the article makes mention of insecure passwords. Many organizations have had to utilize some sort of portal now that remote work is a necessity, with the idea of new log-in’s and passwords, come a strict reminder about the security of passwords. As we all know, insecure passwords are much easier for some hacker to breach than something more secure that might be easier to define on a secure work network than remotely.
Hopefully these things won’t be forever as this pandemic eventually ramps down!
Blog Post #8
And another post about Coronavirus! Kind of. With the pandemic raging on and things not even really at a culminating point (the calm before the storm so to speak) there are always going to be people out there trying to take advantage of the panic and confusion. Previously, one of these blog posts focused on some early attempts to capitalize on Coronavirus. This post however, focuses on a “vigilante” Cybersecurity group who have taken to calling themselves, “COVID-19 CTI League” or The Cyber Threat Intelligence League. With malicious parties trying to steal user info while masquerading as health care products, entire websites popping up with COVID-19 info, and other ransomware and malware all specifically aimed through a lens of COVID-19, COVID-19 CTI League was formed. Chiefly, their focus is on preventing attacks on health care institutions such as hospitals. The team is a volunteer team of Cybersecurity experts who have already found success defending health care facilities from these types of attacks. One of the members of the team commented on this being the highest amount of phishing he’s ever witnessed. With the end of this pandemic not really in sight, this brings up an interesting idea. If we’re forced to adopt this remote/social distancing lifestyle for much longer than we’re currently anticipating, these kinds of attacks will only become more and more prominent, not less. And, because this is a pandemic, it’s clouded in fear and panic, probably the two best emotions to elicit when stealing one’s information. People will have to become more security savvy, or we’re in for a long road ahead.
Post #7
https://techxplore.com/news/2020-04-qa-vyas-sekar-covid-pandemic.html
Unfortunately, I think that COVID-19 will almost exclusively what anyone will be talking about for some time. This post is much the same! With people working from home remotely and most of the general public staying home and engaging in social distancing, things have definitely changed our way of life, although hopefully temporarily. A professor at Carnegie Mellon, Vyas Sekar, who does work related to network security raised warnings to organizations that now is the time to be as prepared as possible on a security front. Chief among his concerns is the idea that whereas previously some organization may have had a closed network or specific security practices in place that cannot maintain when working remotely. Now, those all exist on the open internet as we’ve transitioned to the remote model. He went on to say that previously, companies/organizations would be concerned about allowing employee devices on their closed networks for fear of malware or lapsed security policies. However, now the opposite is somewhat true. Work devices are being brought home, and further, those original concerns have evaporated as these entities are unable to suspend operations completely and need to make things work in the interim until this pandemic relaxes. Typically, not following recommended practices would endanger some individual. The point here being that companies are now also at risk by the actions of the employee working from home on his/her own devices. If ever there was a time to teach employees about safe policies and practices, it’s now.
Post #6
It seems like all that anyone is talking about right now is the Corona virus, and I’m happy to jump on that bandwagon so long as it’s interesting. With more organizations discouraging their members from traveling (see our own Metro’s extension of Spring Break) these groups need to start thinking about how to switch to a remote format, allowing their employees/members to continue to work or use services without needing to physically be present. Specifically, the Cybersecurity and Infrastructure Security Agency, or CISA is going to have some percentage of their employees not physically travel to work, and have them stay home instead. This is described as a stress test of their telework system and hopes to gauge their ability to deal with the idea of inhibited travel. While there are of course some responsibilities of CISA that can’t be handled remotely, but for the majority of their other systems the test has them doing their jobs from home. Overall, it’s to see how capable CISA could be if the Coronavirus continues to spread and force more and more people into self imposed quarantine. This is a really interesting article because we’ve been able to see this first hand. Just as Metro State has suspended the week of classes immediately following the originally schedule Spring Break, here too is a Department of Homeland Security agency essentially doing the same. Metro is going to take their additional week and try to pivot to remote content delivery systems in order to discourage physical travel of it’s students, and here CISA is basically trying to test their own same function. Depending on how long COVID-19 is actively a threat, this could bleed into more and more industries. It could be really interesting to see how these strategies might hold up long term.
Post #5
Somewhat related to another blog post which talked about how there are people out there trying to exploit fears about the Coronavirus to gain personal user information and spread malware. However, this article touches on a perspective I had not considered prior to reading. The idea being that interference in our upcoming presidential election (akin to interference in the 2016 presidential election to spread misinformation and push American voters toward a particular candidate or ideology) might be aimed at potential voters through the lens of the Coronavirus. Chris Krebs is the head of the cybersecurity division at the Department of Homeland Security, and he’s quoted as saying this is “one of a number of potential scenarios”. I did not know this beforehand, but there is a section of the State Department dedicated to fighting propaganda, and it appears that they’ve found something like 2 million tweets that attempt to employ the Coronavirus in conspiracy theories. To what end? Well some of those tweets are claiming that the pentagon itself had a hand in creating the actual virus. Even weirder still, some are claiming that the Bill and Melinda Gates Foundation had a hand in creating the virus as well. The problem is and has been it’s very difficult to identify whether these individuals are operating by themselves, or on behalf of a larger entity, or foreign government. There are even concerns that these entities could target very local populations through even text message campaigns and try to sway voters in a specific direction. The article even makes mention of how our political machine isn’t the only one who is subject to these misinformation campaigns, and cites Israel as attempting to spread more factual information to combat these parties. Perhaps the most interesting part of this article is when the writer talks about how these scenarios, if able to confirm that some of them are coming out of Russia, provide a really interesting test of sorts for big social media companies. Particularly Facebook received a lot of criticism in the previous election for what many felt was allowing the spreading of objectively false information on their platform. People still talk about how Facebook mishandled it and it would be really interesting to see how they’ll react as a company should something like this come their way again.
Post #4
Particularly interesting to me, personally. The two Wisconsin cities that are referred to in the article are Racine, and Oshkosh, respectively. I’m originally from Wisconsin, and lived in Milwaukee for 4 years which is fairly close to Racine. My hometown was about 20 minutes away from Oshkosh, and I used to take classes at the University of Wisconsin-Oshkosh. A topic which has come up a few time in our lectures, Ransomware, has been levied at both of these two cities. A 3rd party cybersecurity firm has claimed that the Ransomeware in question was deployed by Russian based hackers. The firm goes on to suggest that these hackers have been collecting information from these cities as far back as September 2018 to hold ransom. So far, it appears that officials in Oshkosh have confirmed the Russian relation while Racine officials have not. There is an ongoing investigation underway by the FBI while both cities are still attempting to get all of their systems back online. Notably, the mayor of Racine has stated that there have been no actual attempts to collect a ransom in this case and that the city would not comply or pay with any if they are eventually made. A little bit too close to home! I have tons of friends that are from Oshkosh and many from Racine, I hope everyone’s info is okay!
Post #3
Pretty disconcerting. The cybersecurity firm ImmuniWeb based in Switzerland did an evaluation of the cybersecurity standards and protocols of 100 of the busiest airports in the world. In an industry in which physical security standards have ballooned post 9/11, one would think that cybersecurity protocols are also held to a high standard. ImmuniWeb found that this was not even close to being the case. Apparently, of the 100 they tested, only 3 were found to not have any major security flaws in their system. These airports seem to fall the flattest in terms of compliance with regulatory policies/agencies. Of these airports, a huge 24% of them had weaknesses that were simply waiting to be taken advantage of, and these were weaknesses that have been known for some time. A staggering 73% of these airports were found to be non compliant with regulations placed by the Payment Card Industry Data Security Standard. Airports have seemingly had about a decade or so of bad press generally with incidents on flights going viral more and more. It’s a necessary industry to exist, and it will never go away and that may lend itself to the idea that these companies can kind of get away with whatever they want. But this revelation that their mobile apps, websites, etc. are so vulnerable to exploits, doesn’t do them any good will. – Faisal
Post #2
https://www.wxii12.com/article/coronavirus-cybersecurity-computer-viruses-warning/30738057#
I found this article both humorous and honestly a bit depressing. Basically, people are taking advantage of the current events and the slowly building concerns over the Coronavirus spreading as quickly as it has been. Essentially, they’re pretending to supply information about how to protect yourself from the Coronavirus, however that’s simply to get people’s attention and prey on their fear and paranoia. In actuality, they’re disguising computer viruses as helpful info from a ‘good samaritan’. In fact one of the cybersecurity experts that commented on the article draws a comparison between the virus spreading quickly around the internet across devices and the actual Coronavirus spreading quickly across populations. I find that comparison to be really interesting and also I feel like it helps outline just how important it is to protect ourselves online as well as in real life. Like I said above, this is both somewhat funny in a really dark way but mostly just sad that these people are using peoples’ fears to make money. – Faisal
Post #1
Blog Post #1 – Due 1/28/2020
https://www.businessinsider.com/uk-warns-huawei-cybersecurity-poor-5g-2020-1
This was an interesting read. The United Kingdom’s own organization meant to deal with cybersecurity, The National Cyber Security Centre is being openly critical of the Chinese company Huawei as they are being allowed to launch their brand’s devices on the UK’s new 5G wireless network. One of the NCSC’s primary concerns actually coincides with our own current government administration as both parties seem to believe that a huge potential risk of allowing Huawei access might lead to the company being coerced into sharing potentially sensitive information over to their own government under Chinese law. It appears the British government is trying to assuage fears by stating that Huawei’s devices will only be for ‘non-core’ parts of the network and would therefore be unable to access potentially risky areas. Huawei appears to have been long suspected to have a close relationship with their own Chinese government but they have continually denied supplying them with sensitive materials. I find it really interesting that they’re basically blasting this decision wholesale and publicly. It will be interesting to see how this decision pans out. – Faisal
