The IT Nerd

In a paper published by University of South Australia and Charles Sturt University, professors have developed an algorithm to detect and intercept man-in-the-middle (MitM) attacks on unmanned military robots that aim to interrupt the operation, modify the transmitted instructions, and assume control and instruct the robots to take malicious actions.

The technical paper detailed how the robot operating system is extremely susceptible to data breaches and electronic hijacking because it is so highly networked, and can be compromised at various levels, from the core system to sub-components of sub-systems. Meanwhile, crewless vehicle systems operate under fault-tolerant modes further complicating MitM detection.

Using machine learning techniques, University researchers developed the algorithm to detect these attempts. Furthermore, the professors tested the algorithm in a replica of a bot used by the U.S. Army and recorded successful attack prevention 99% of the time, with false positives occurring in less than 2% of the tested cases.

“The advent of Industry 4, marked by the evolution in robotics, automation, and the Internet of Things, has demanded that robots work collaboratively, where sensors, actuators, and controllers need to communicate and exchange information with one another via cloud services,” comments Professor Anthony Finn, who participated in the study.

Ted Miracco, CEO, Approov Mobile Security had this comment:

   “Using AI to address security concerns in military robots raises significant concerns and warrants critical examination. While the development of an algorithm to detect and intercept man-in-the-middle (MitM) attacks is a commendable effort, relying on AI for such critical tasks may not be the most responsible approach.  A 99% success rate in preventing attacks may initially sound impressive, but when it comes to matters of national security and potential harm caused by compromised military robots, even a 1% failure rate is unacceptable if you are on the receiving end of the attack. MitM attacks can have severe consequences, including the potential for loss of life and significant damage and AI algorithms are probabilistic by nature, making them inherently fallible. There is always a risk of false positives or the much more disconcerting false negatives, where attacks go undetected. In the context of military operations, these errors can lead to disastrous outcomes.

   “To ensure the security and integrity of military robots, deterministic solutions that provide 100% accuracy should be prioritized. While AI can play a role in augmenting security measures, it should be used as a supportive tool rather than the primary line of defense. Incorporating reliable, deterministic protocols and encryption techniques that leave no room for ambiguity or uncertainty should be the foundation of any security framework for military robots. It is imperative to prioritize deterministic solutions that eliminate any margin for error and take a comprehensive approach to security to ensure the safety and effectiveness of unmanned military systems.”

Given that these are military vehicles, I have to admit that I have concerns that they might not be secure. If they aren’t, I hope there are means in place to make them as secure as possible. As in every possible way should be taken to ensure that these military vehicles are as secure as possible.

Last week, in a letter to state drinking water administrators, the EPA announced that it will no longer require cybersecurity audits of U.S. water utilities through sanitary surveys after litigation from various states and trade associations raised questions about the long-term, legal viability of the initiative to regulate water utilities cybersecurity.

Experts from the water industry who opposed the use of the EPA to be the cybersecurity industry authority doubted whether a sanitary survey was the right tool to enforce cybersecurity mandates, as the process traditionally does not involve security auditors who understand the complex nature of protecting industrial systems.

The EPA said it encourages “all states to voluntarily review public water system cybersecurity programs to ensure that any vulnerabilities are identified and corrected, and assistance is provided to systems that need help.”

Of the existing 16 critical infrastructure sectors, many, like water and wastewater, lack cybersecurity regulations. Using a voluntary approach to regulate cybersecurity was described in the National Cybersecurity Strategy as resulting in “inadequate and inconsistent outcomes.”

Emily Phelps, Director, Cyware had this to say:
 
   “No industry or sector is immune from cyber threats. Although there are legitimate concerns about the efficacy of sanitary surveys to assess cybersecurity readiness, securing our critical infrastructure must be a top priority. To truly combat rising cyberattacks, funding is necessary. Public-private partnerships can be instrumental in bridging this gap. Leveraging expertise from private cybersecurity firms can alleviate staffing issues and provide the needed technical expertise.

  “It’s crucial to address this across all sectors, ensuring there’s a unified approach to cybersecurity. Sector-specific cybersecurity frameworks, combined with cross-sector collaboration, can result in a stronger and more resilient infrastructure.”

Craig Harber, Security Evangelist: Open Systems follows with this comment:

   “The IT/OT convergence occurring within our industry sectors and the nation’s critical infrastructure creates new opportunities for efficiency and innovation, while it also introduces new cybersecurity challenges that organizations must mitigate.

   “These cybersecurity challenges are not limited to just attacks directed at the OT devices and systems from IT infrastructure. The IT infrastructure is equally as vulnerable to attacks originating on OT devices and systems. Both environments potentially expose new threats and create new attack vectors that, if not addressed, will become high-value targets for exploitation by threat actors.

   “The EPA’s approach to create a “coalition of the willing” whereby they encourage states to voluntarily do the right thing is not likely to succeed. Cybersecurity is not a siloed problem; it is a team sport. States need to develop a collective defense strategy where security teams from each industry sector share threat intelligence and work in collaboration to identify and neutralize threats. This collaborative approach will allow security teams within an industry sector (and possibly amongst industry sectors) to fully leverage the limited resources and skilled analysts available to combat cyber threats that are increasing in velocity and sophistication.”

Public infrastructure needs to be secure. Everyone needs to work together to ensure that infrastructure that we rely on is secure or we will all fail.

According to the Identity Theft Resource Center’s Q3 2023 Data Breach Report, there were 2116 reported US data breaches and leaks in the first nine months of 2023, already beating out previous all-time high of 1862 for the year set in 2021, with a whole quarter left to go.
 
The record figure is despite a 22% decline in Q3 from the previous quarter. Also, the ITRC counted an estimated 234 million victims from these breaches, 45% less than the 425 million individuals impacted by incidents last year.

Also notable, Zero-day attacks trended up 1620% in the first three quarters of 2023 versus the whole of 2022 and, due to the global MOVEit software attack campaign, supply chain attacks also remained a major threat in Q3, with 1321 organizations reporting breaches due to attacks on 87 third parties. 4 of the top 10 compromises in Q3 were caused by the MOVEit campaign.

A persistent concern is the lack of transparency from breached organizations with 53% of reported breaches not offering any explanation about the initial attack vector.

Craig Harber, Security Evangelist: Open Systems had this comment:

   “The rise in cyber breaches and the lack of transparency from impacted companies is not surprising. Frankly, most do not see the point because the attacks are predominantly generated from overseas and it is unlikely that law enforcement will offer any significant assistance to restore operations or prevent stolen data from switching hands. As a result, organizations focus their limited resources towards correcting internal deficiencies, ensuring that this doesn’t happen again, and fulfilling their legal obligations of notifying affected parties and regulators.

   “The new cyber incident reporting laws announced in recent years act on the long-held view that information sharing is vital to national security and private sector cyber-readiness. It is a major step forward from what has traditionally been ad hoc, industry-specific guidance for voluntary disclosures by companies that have experienced cyberattacks.

   “The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) was signed into law last year. It required the Cybersecurity and Infrastructure Security Agency (CISA) to develop and implement regulations requiring covered entities to report covered cyber incidents and ransomware payments to CISA. These reports will allow CISA to rapidly deploy resources and render assistance to victims suffering attacks, analyze incoming reporting across sectors to spot trends, and quickly share that information with network defenders to warn other potential victims.

   “In addition, the Securities and Exchange Commission (SEC) established cybersecurity risk management, governance, and incident reporting requirements. These new requirements will apply to foreign private issuers and U.S. public companies with compliance deadlines starting at the end of this year.”

Paul Valente, CEO & Co-Founder, VISO Trust follows with this:
 
   “The Q3 2023 Data Breach Report by the Identity Theft Resource Center highlights a growing threat to CISOs and businesses. With 2116 data breaches in the first three quarters of 2023, exceeding the 2021 record, it’s imperative to focus on third-party risk management and adapt to evolving attack surfaces.

   “The rise in zero-day attacks and supply chain vulnerabilities, as exemplified by the MOVEit software campaign, underscores the growing urgency for robust cybersecurity measures. Organizations should also prioritize transparency, as 53% of breaches lack explanations about the initial attack vectors.”

This is really bad and shows that everyone needs to buckle down on making sure that environments are as secure as possible. And organizations who get pwned need to own up to it rather than hide it. Period.

According to a report conducted by the Ponemon Institute for Proofpoint, of the 653 health care IT and security practitioners in the study, 88% had experienced an average of 40 attacks in the past 12 months with the average total cost of successful cyber attacks reaching almost $5 million.

• 66% reported disruptions to patient care
• 57% observed poor patient outcomes due to delays in procedures and tests
• 50% saw an increase in medical procedure complications
• 23% claimed an increased patient mortality rate

All organizations surveyed had at least one data incident involving confidential health care data within the past two years with malicious insiders as the most likely cause identified by 32% of respondents. While 58% of survey respondents claimed a lack of cybersecurity expertise and 50% said insufficient staffing were the two biggest challenges they faced.  

The majority of health care providers are relatively small to midsized organizations that devote most of their resources to patient care, noted Ryan Witt, chair of the Healthcare Customer Advisory Board at Proofpoint.

Ted Miracco, CEO, Approov Mobile Security had this comment:

   “The challenges faced by healthcare organizations in addressing cybersecurity include a lack of cybersecurity expertise and insufficient budget and staffing. These challenges need to be addressed to ensure effective security measures are in place, especially in the critical areas of mobile app and API vulnerabilities and the persistent phishing and business email compromise (BEC) attacks. With the average cost of a cyber attack reaching almost $5 million, it makes sense for these organizations to invest ahead of the attack versus spending money to remediate after the patient data has been exfiltrated and other damage has been done.”

Emily Phelps, Director, Cyware follows with this:
 
  “Healthcare is a consistently attractive target for threat actors because of the valuable data they collect and store. Adversaries far outnumber available cybersecurity pros so to mitigate the risks, healthcare organizations must leverage automation tools that enable lean security teams to efficiently address threats; employees should have regular security awareness training so they are prepared to recognize and avoid common threat tactics; and organizations should consider partnering with security providers that can offer expertise that is difficult to source and retain internally.”

Jan Lovmand, CTO, BullWall provided this comment:

   “Hospitals and healthcare organizations are particularly attractive targets for cybercriminals, and their reliance on technology to manage everything from patient records to surgical equipment makes them uniquely vulnerable. This is compounded by their limited resources to invest in cybersecurity measures. But with ransomware continuing to be a significant threat to these organizations, investments must be made to contain these attacks, eliminating the need to resort to a complete shutdown of IT systems, and healthcare services.”

Healthcare organizations are prime targets. That shouldn’t be in dispute at this point. But clearly the right resources are not being applied to stop these organizations from getting pwned. That needs to change. And change quickly.

The Wall Street Journal is reporting that Israel’s cybersecurity community is mobilizing to defend against a surge of continuous cyber attacks in the wake of Saturday’s Hamas attack that killed over 1,200 people and took hundreds of hostages.

Members of Israel’s technology community have formed an “all-volunteer Israel Tech Guard” to help in the search for hostages and missing people.

According to Microsoft, Israel is the Middle Eastern country most targeted by nation-state cyberattacks. Israel’s industrial systems have become constant, with attacks coming from Iran, Syria and pro-Russia hacktivist group Killnet. 

Many municipal and consumer websites have been targets of DDos attacks, including the website of the Jerusalem Post. 

Snehal Antani, CEO and Co-Founder of Horizon3.ai (former CTO within U.S. Special Operations) had this comment:

   “First and foremost, most employees of Israeli companies are reservists first, and are now preparing to fight. This isn’t a video game or a liberal arts thesis, this is real for the victims, the reservists, and families. Those that oppose terrorism should find ways to support the fight, not with an eye for profit, but with the sincere desire to help.

   “From a cybersecurity standpoint, there have been several reports of Hacktivist groups targeting Israeli critical infrastructure and industries. Given the robust cyber ecosystem within Israel, I expect Israeli industries are prepared for cyber warfare.

   “The “combined digital arms” of synchronizing information operations with cyber has been accelerated with AI, empowering Hacktivist groups with capabilities once only available to nation states. We should expect highly effective disinformation campaigns that, when combined with cyber attacks that steal information or disrupt systems, will shape the information battlefield globally.”

Roy Akerman, Co-Founder & CEO, Rezonate (Former chief of cyber defense operations in Israel) follows with this:

   “Israel has called up everyone in active reserve service, both in infantry and support roles, to join the effort. Induction orders have been sent to those in active service – in Israel, US and abroad.  Pilots, infantry, intelligence, and many others, with the backing of high-tech companies and both Israeli and Jewish groups, are boarding planes to offer their support.

   “Those not immediately required are assisting from here through donations, organizing the mobilization of Israelis who can join the protective efforts, and more. We are witnessing an increasing trend of efforts from Israel’s adversaries, both organized and unorganized, to introduce a cyber-attack dimension to this conflict. As for Israeli companies in the US, Israel, and in General, many have a strong presence globally and continue to operate as usual, to the best of my knowledge. Rezonate, along with numerous other security firms, is offering assistance to Israeli companies whose teams have been inducted, providing various forms of support to safeguard them in cyberspace.”

This perhaps should not be a surprise as wars in 2023 are no longer fought on the battlefield. They’re fought in cyberspace as well. Hopefully this conflict is short lived as any conflict, in real live and in cyberspace is never a good thing.

In their annual ransomware survey, Hornet Security found that nearly 60% of companies were still ‘very’ to ‘extremely’ concerned about ransomware attacks. However, almost 40% said they were “happy to “leave it to IT to deal with the issue’.

While 87.8% confirmed they have a disaster recovery plan in place for a ransomware attack, more than one in eight organizations, or 12.2%, have no disaster recovery plan.  The primary reason for no plan was that it was ‘not considered a priority by management.”

Most used tools to combat potential threats:

• 87.8% –    End-point detection software with anti-ransomware capabilities
• 84.4% –    Email filtration and threat analysis’
• 22.4% –    ‘AI-enabled security solutions’ to combat ransomware

The most common primary security feature to protect backups from ransomware is:

• 40.6% – Immutable storage
• 38.3% -Tight control of user and application permissions
• 27.8% – Air-gapped storage

Craig Harber, Security Evangelist: Open Systems had this to say:

    “Last year was a breakout year for ransomware and it continues to plague all industry sectors to varying degrees. The financial and brand reputation effects of ransomware forced many to rethink their investments in cybersecurity tools and best practices. Despite the potential devastating impacts of a ransomware attack, there are still organizations that don’t believe ransomware is a priority because they haven’t been targeted or they are unwitting of the fact they have been targeted and possibly breached. Ransomware is here to stay for the foreseeable future.

   “Organizations need to understand there is no silver bullet to defend against ransomware. It will take a multilayered approach by security teams to improve IT security tools, proactively monitoring and hunting for indications of an attack, and training the workforce on their cybersecurity responsibilities.”

Dave Ratner, CEO, HYAS follows with this comment:

   “Ransomware continues to be a major issue for companies of all sizes, and too many do not implement a security-in-depth strategy needed to drive resiliency.  Regardless of the EDR and other prevention-oriented components, a modern strategy must be complimented with Protective DNS and other visibility solutions to identify the telltale signs of a breach before encryption and damage occurs.”

For those 12.8% who have no plans to deal with a ransomware attack, I simply have to shake my head as they are just asking to be put out of business. Because one ransomware attack will take them out. Just look at this example.

According to the 2023 Security Budget Benchmark Summary Report published last week by IANS Research and Artico Search, researchers revealed that cybersecurity spending saw a 65% drop in growth during the 2022-23 budget cycle with spending in the US and Canada increasing by an average of 6%, down from 17%.

Of the more than 550 CISOs surveyed, 37% reported flat budgets or budget decreases during the 2022-23 cycle, up from 21%. Technology firms, which saw a 30% growth in security spending last cycle, saw the greatest decline with just a 5% increase on average this cycle.  
 
Of the 63% who reported budget increases this year, 17% said it was due to increased risk, while 15% said it was the result of a digital transformation at their organization, such as after a major industry disruption, like a high-profile breach. On average, organizations adjusting spending in response to major incident boost their budgets by 27%.

“The incremental growth in cybersecurity budgets is insufficient relative to the increases in scope facing security teams. In the latter part of Q4 2022 and throughout 2023, many CISOs reported difficulty getting the resources they need, with some indicating outright budget freezes,” said Nick Kakolowski, senior research director of IANS, in an accompanying press release.

Kelly Robertson, Principal Security Practitioner, Horizon3.ai had this to say:

   “The key to this information is that GROWTH is slower, but the title can be interpreted as a 65% drop in other ways. Cyber spending is increasing still, just not at 17%. “spending in the United States and Canada increased by just 6% on average in 2022-23, down nearly two-thirds from the 17% growth” That could have been better titled for clarity.”

Perhaps that is true. But I think we all can agree on the fact that it is a good thing that organizations are spending on cybersecurity needs. But at the same time, I am hoping that spending isn’t about to drop at a time when more not less spending on cybersecurity is required.

The Department of Defense published its 2023 Cyber Strategy aimed to open up communications with other federal agencies and the private sector on the topics of cyber threats, elections and other critical systems, and increasing collaboration with foreign allies.

The strategy may be a challenge for the Defense Department which has a shortage of cybersecurity-trained personnel and doesn’t typically share intelligence outside agency walls, and, for decades, only focused its Cyber Command defense operations on protecting U.S. military networks from cyberattacks.

“DOD’s cyber strategy was extremely reactive in nature and led U.S. Cyber Command to really only be prepared to help recover from a cyber […]. During those days, I would frustratingly refer to Cyber Command as the ‘clean up on Aisle 6’ and ‘break glass in time of war’ command,” said Lt. Gen. Charlie Moore, who served as deputy commander of Cyber Command from 2020 to 2022.

DOD is now aiming to provide more resources and intelligence to tighten the bond with the private sector— which controls almost 90 percent of all critical U.S. networks.

Rather than merely asking companies to share information about breaches after they’d occurred, DOD is starting to say to companies: “‘we owe you actionable intelligence, and you will defend the networks yourselves,’” said Eoyang, the deputy assistant secretary.

Ted Miracco, CEO, Approov Mobile Security had this comment:

   “This new cyber strategy from the DoD represents an important shift from a reactive to proactive posture and is ultimately about far more than DoD’s capabilities. Networks crossing sectors and borders require a global security mindset. This strategy’s direction is right, but execution will determine whether it leads to meaningful improvement in cyber resilience as talk of information sharing and partnership is good, but only if it is backed-up by real, sustained commitments. The strategy’s emphasis on sharing actionable intelligence to enable better private sector defenses, rather than just mopping up after the fact, is wise, but it will require overcoming cultural obstacles.

Emily Phelps, Director, Cyware follows with this:

   “Securing critical infrastructure is complex, and with today’s threat landscape, it requires a modern, proactive approach. Threat intelligence alone is not enough to combat a persistent wave of adversaries. Intelligence must have the necessary context and clarity so that the right people can take the right action. It requires strategic automation to rapidly collaborate so that teams have the actionable intel they need without the noise that slows them down.”

This is a good move by the DoD as different federal agencies and the private sector working to stop cyber threats makes them all stronger. I hope we see more joint efforts like this going forward.

In its 2023 State of API Security Report, security company Traceable reported a sharp increase in API-related data breaches. The report is based on feedback from 1629 cybersecurity experts in over six major industries across the United States, the United Kingdom and the European Union.

Fully 58% of respondents either strongly agree or agree that APIs are expanding the attack surface across all layers of the technology stack, with fully 57% saying that traditional defensive measures are not capable of distinguishing “legitimate from fraudulent activity at the API layer.”

• 74% Reported at least 3 API-related data breaches in the past two years
• 48% of Organizations say API sprawl is their top challenge
• Just 38% can distinguish between vaild API activity, user behaviors, and data flow
• Organizations are managing an average of 127 third-party API connections
• Majority are not confident in WAF, WAAP or Lifecycle Management Tools to protect APIs

“34% of organizations feel uncertain about the efficacy of their tools like WAF and WAAP, rating them as moderately effective (scores of 5 or 6). Meanwhile, 23% rate theirs as less effective (scores of 1 to 4). Although 43% find their solutions more satisfactory (scores of 7 to 10), it underscores that over half aren’t fully confident in their API security measures” the report stated.

Ted Miracco, CEO, Approov Mobile Security had this comment:

“APIs clearly enable innovation and interoperability, but unfortunately this study reinforces the risks posed by porous APIs and the inadequacy of traditional controls. With API breaches rampant and third-party connections multiplying, many organizations are flying blind. This uncertainty, especially in mobile apps, demands radically new API security paradigms centered on identity, Zero Trust, and continuous validation, and attestation of API requests. Companies must review and in some cases re-architect their API protections. Otherwise it is not a question of “if” but rather of “when” their next API breach will strike.”

This is an area where improvements can be made to enhance security. Hopefully this report is noted and heeded by those who work with APIs so that we are all a whole lot safer.

The Department of Defense published an article yesterday covering a top Pentagon information security executive’s call for collaboration and cooperation throughout the Defense Department and across private sector partners in order to maintain a robust defense against emerging cyber threats.

During a FedTalk discussion with government and private sector technology executives in Washington, Principal Deputy Chief Information Officer Leslie Beavers warned emerging cybersecurity challenges pose a “whole of government, almost whole of society threat,” and “at the end of the day, security requires everyone to be a part of the solution.”

In addition to developing a stronger workforce, Beavers outlined several key approaches underway within DoD including a transition to the zero-trust security paradigm which will move the DoD into a more modern security framework.

In accomplishing these key goals, she said close partnership with industry partners is critical.

“The Department of Defense, as large as it is, is heavily reliant on civilian infrastructure and companies as well as other government organizations. It’s a journey that we have to go on together,” Beavers said.

Ted Miracco, CEO, Approov Mobile Security had this to say:

   “State-sponsored cyberattacks from adversaries like China and Russia are a major component of the emerging threats facing the US defense industry and government. Countering these threats requires even greater information sharing and collaboration between the US government and private sector cybersecurity companies. The initiatives underway at DOD are an important piece of confronting this complex challenge as it isn’t just a defense problem, it can impact both national security and the economy. It’s encouraging to see cybersecurity leaders like Beavers emphasize the role everyone must play in this effort.”

Jason Keirstead, VP of Collective Threat Defense, Cyware follows with this:

   “I’m glad to see the DoD’s focus on collaboration. It’s arguably one of the most important areas that can produce tangible cybersecurity improvements. When we consider the expansive and complex nature of the Defense Industrial Base (DIB), the most basic and effective countermeasure that we can deploy against the adversary is to more rapidly develop and deploy our response. Collective defense enables trusted collaboration inside and outside organizations, allowing the DoD and the DIB to work together to accelerate these initiatives, reducing the attack surface an adversary has to work with.”

Working with others when it comes to cybersecurity can only help to make all of us more secure. Thus I applaud this and I hope that we see more of this sort of things.