The #DataInsecurity Digest | Issue 73

Cyber threats are ‘blinking red’ as U.S. readiness struggles continue

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: While Director of National Intelligence Dan Coats was raising the alarm over U.S. lack of cybersecurity readiness to lawmakers last week, cybersecurity issues continued to plague American businesses–especially concerning given new research that data breaches are more financially devastating to U.S. companies than to any others around the globe. In further bad news for businesses, researchers have found a site on the dark web that is selling backdoors to computers (including three at a single international airport) for a mere $10. Finally, Russian state-sponsored hacking has compromised “hundreds” of American electrical utilities, potentially giving adversaries the power to literally turn out the lights on millions of U.S. consumers.

And now, on to the clips!

—————–

Director of National Intelligence Dan Coats: Cyber threat warnings are ‘blinking red.’ The top intelligence official compared America’s current cyber threat with pre-9/11 characterizations of our preparedness for terror attacks. “‘Here we are nearly two decades later and I’m here to say the warning lights are blinking red again,’ Coats said.” (Source: Washington Post)

Russians ‘could have thrown switches’ at utilities. State-sponsored Russian hackers have compromised “hundreds” of supposedly secure American electric utilities and possess the ability to cause blackouts, said Department of Homeland Security officials this week. “‘They got to the point where they could have thrown switches’ and disrupted power flows, said Jonathan Homer, chief of industrial-control-system analysis for DHS.” (Source: Wall Street Journal)

The government continues to struggle with sharing cyber threat intelligence. Last week, at a Washington Post Live event, current and former policymakers lamented that “the U.S. government needs do a better job sharing cyber threat information with the private sector if it’s going to defeat increasingly complex cyberattacks from nation states. …” During the event, government officials acknowledged they “have been too focused on trying to get companies to share information with them — and less on sharing with private companies who want threat intelligence the government detects.” (Source: Washington Post)

Data breaches cost U.S. companies more in 2018 than foreign counterparts. A new report from Statistica shows that American companies “paid significantly more on average for every data breach in 2018 than [did] companies in any other country — a little over $3 million more than companies in runner-up Canada, and more than twice [as much] as everyone other than Canada, Germany, and France.” (Source: Business Insider)

Backdoors into your computer could be for sale on the dark web for $10. A dark web store is advertising backdoors into computer systems and offering tips on how to use the logins without being caught. In one frightening case, cybersecurity researchers examined the IP address of compromised machines advertised on the store’s site “to discover that three belonged to a single international airport. ‘This is definitely not something you want to discover on a Russian underground RDP shop,’ said John Fokker, head of cyber investigations for McAfee Advanced Threat Research.” (Source: ZDNet)

2018 has not been a good year for cybersecurity. With a little more than half of 2018 behind us, we have a pretty good idea of what is going well and what isn’t in the cybersecurity space. @lilyhnewman reports that, while “there haven’t been as many government leaks and global ransomware attacks as there were by this time last year… that’s pretty much where the good news ends. Corporate security isn’t getting better fast enough, critical infrastructure security hangs in the balance, and state-backed hackers from around the world are getting bolder and more sophisticated.” (Source: Wired)

Quick hit: none of Google’s 85,000 employees have been a victim of a phishing attack since it began requiring their use of physical security keys to log into their workspaces in early 2017. (Source: Krebs on Security)

Advocates raise concern over CFPB nominee Kraninger’s questionable data security track record. While working at DHS, Kathy Kraninger advocated for a biometric data collection program that would later be criticized by the GAO for “significant information security control weaknesses.” (Source: Allied Progress)

SEC opens probe against Facebook. The SEC has now acknowledged that it is investigating whether Facebook “adequately warned investors that developers and other third parties may have obtained users’ data without their permission or in violation of Facebook policies.” (Source: Wall Street Journal)

Upcoming Events

August 9-12, 2018 – DEF CON 26 – Las Vegas, NV
DEF CON is the world’s longest-running and largest underground hacking conference. Each summer, hackers, corporate IT professionals, and three-letter government agencies all converge on Las Vegas to absorb cutting-edge hacking research from the most brilliant minds in the world. (Source: DEF CON)

October 2018 – National Cybersecurity Awareness Month
Every October, the National Cybersecurity Alliance organizes the National Cybersecurity Awareness Month to address specific challenges and identify opportunities for behavioral change. (Source: Stay Safe Online)

National Consumers League
Published July 26, 2018