Tag Archives:cybersecurity

The Energy Department’s Warning

The U.S. Energy Department has released its Quadrennial Energy Review, in which it warned of U.S. electrical power grids being in ‘imminent danger’ of cyber attack. The Department also stated that a widespread power outage caused by a cyber attack could mean the undermining of “critical defense infrastructure” and much of the economy, as well as place the health and safety of millions of citizens in jeopardy. As attacks of this nature are becoming more frequent and sophisticated, The U.S. Department of Homeland Security has gone as far as to say that an attack on a U.S. power grid by a foreign enemy is one of their top concerns because such an attack could be one of the quickest ways to destroy the U.S. economy.

The issue of power grid security has become a concern for the Energy Department after allegations of Russian hacking on the U.S. election last year, as well as a supposed Russian attack on a Vermont electric utility at the start of the new year; However, whether or not these alleged Russian hacker scares are true, attacks of this nature have actually happened in the past quite frequently, and it is important to learn from these previous attacks on grids across the globe in order to properly secure these sources of energy from further attack.

Cyber Attacks on Energy Systems Across the Globe

Idaho, United States

In 2007, researchers for the Department of Energy conducted a vulnerability test on the power plant system at their Idaho lab. The staged attack, dubbed ‘Aurora,’ was launched by researchers to see where vulnerabilities might be hiding which ultimately resulted in the self-destruction of a generator. experimental cyber attack caused a generator to self-destruct. Though these were not malicious actors hacking into the system, this experimental cyber attack highlighted just how easy it would have been for a hacker to break in and cause harm. This was a bit of a wake up call for the federal government and electrical industry, as it made them think about what might happen if such an attack were carried out on a larger scale and by someone looking to cause harm to the American people.

Thankfully, by researching the vulnerabilities of the power grid in Idaho, the Energy Department has learned how to strengthen the cybersecurity defenses on these devices more so than ever before; though this is good news, acting undersecretary of DHS’s National Protection and Programs Directorate, Robert Jamison, said that vulnerabilities of this type cannot be easily eliminated, rather they need constant monitoring and updates that tests like these can aid in.

Kiev, Ukraine

Though the cyber attack on the Idaho power plant was a staged event and not malicious in its nature, some grid attacks do not pan out so nicely. Just last month, an alleged Russian cyber attack was launched on a Ukrainian power grid in the country’s capital. This was the second year in a row where a holiday-timed cyber attack hit the Kiev grid. Vsevolod Kovalchuk, acting chief director of Ukrenergo, stated that a power distribution station near Kiev unexpectedly switched off early on a Sunday morning, leaving the northern part of the capital without electricity, adding that the outage amounted to 200 megawatts of capacity, which is equivalent to about a fifth of the capital’s energy consumption at night. He said there were only two possible explanations for the accident: a hardware failure or external interference; either way, regardless of which of these was the actual cause, it comes down to an inherent cybersecurity flaw.

Grid Vulnerabilities in the Modern Age

In the continental United States, there isn’t a single national grid; instead there are three major grids, (1) the Eastern Interconnect, (2) the Western Interconnect, and (3) the Texas Interconnect (in addition to the grids covering Alaska and Hawaii). As these electric grids comes into the 21st Century through things like Smart grids, which automate operations and ensure that components of the grid can communicate with each other as needed, cybersecurity needs to be even stronger in order to properly protect these grids. There are four major vulnerability areas in 21st Century electric grids (detailed below), and it is important for the U.S. to take note in order to properly prepare for future cyber attacks on power grids.

1. Platform Configuration– This vulnerability comes from improper OS and application security patches maintenance, inadequate access controls, and unenforced password policies.
2. Platform Software– This security flaw is similar to what businesses and individuals face daily, with cyber attacks such as DDoS, lack of intrusion detection and prevention, and malware/ransomware threats as well.
3. Network Configuration– A grid experiences Network Configuration Vulnerability if network configurations or connections are not protected by something, specifically a hardware firewall. If there is nothing between the hackers and the network to protect it, it falls into this category. Also under this category are Network Perimeter Vulnerabilities which include any network leaks or insecure Internet connections.
4. Network Communication– This vulnerability occurs when communication between people via devices connected on the network are compromised. This, like Network Configuration Vulnerabilities, is primarily caused by a leak in network security.

In their Quadrennial Energy Review, the Energy Department also stressed the importance of incorporating cybersecurity in these grids because of their impact on the Internet of Things.

Grid control systems now handle, sense, and control endpoints numbered in the thousands. Widespread DER/DR penetration implies that future grid control systems may have to coordinate millions of end point control devices to support grid functions. These devices vary in type, from digital sensors and smart boards built into transformers, to mobile devices used by field operators and grid control managers… Grid control systems must evolve from being centralized to a hybrid of central and distributed control platforms… grid security and reliability assurance concerns mean that Federal authorities must be included in designing 21st-century grid control systems.

Hailey R. Carlson | Axiom Cyber Solutions | 01/25/2016

Image Source

Cyber security professionals often harp on the importance of businesses adopting the latest technologies–Next-Generation Firewalls, cloud-connected-everything, two-factor authentication, and much, much more– to protect their enterprises from attack; However, none of these defenses are effective in the least if their operators are not aware of the vulnerabilities and threats that face them. Who are these operators? Your employees–and they need to know how to protect themselves and your company from attack.

Employee error was sited as the number one cause of data breaches in 2015, and though a small portion of these might have been caused intentionally by malicious employees, IT pros believe that nearly 80% of breaches they deal with are caused by employee negligence and lack of cyber security knowledge.  As Sir Francis Bacon and the characters on Schoolhouse Rock have taught us all, knowledge is power. It’s the kind of power that, when spread to others, makes us all stronger as a unit–and this applies to companies as well. You can strengthen your company’s overall cyber security defenses by educating your employees with these helpful tips:

Implementation of Password Best Practices

Almost every one of us could fill a Rolodex with the number of websites we subscribe to which require some sort of password to access the specific account, so it seems obvious that password security is a key issue when it comes to protecting yourself while online; however, in a world where ‘123456’ and ‘password’ still top the list as the most popular passwords, it is worth reviewing with your employees some of the ‘password best practices.’

• Create unique, strong passwords for each account—Employees should create passwords that are longer than 8 characters in length, have a combination of letters, numbers, and symbols, and these passwords should not contain “guessable” words and phrases, such as employee’s username or the company name.
• Change passwords often—Of those surveyed, 76% of employees are prompted by IT to change passwords on work accounts every 1-3 months. This not only allows for current employees to protect their active accounts, but it gives the IT department the ability to detect dormant accounts which are often the gateways which leave a company vulnerable to attack.
• Require multi-factor authentication—In addition to passwords, many companies require their employees to enter in another identifier in order to indicate their true validity. These include things such as a time-sensitive code, facial recognition, fingerprints, and even retina scan.

Training of All Employees

• Have a cyber security plan–All companies should have a strong cyber security plan in order to protect their business. Many people think that the IT department of a company is the only place where people need to be well-versed in all that is cyber security, including knowledge of the company’s cyber security plans; however, the reality is that protecting a company on the cyber front is the responsibility of all employees. Pat Toth, a Supervisory Computer Scientist at NIST, said, “You can’t just rely on one person in a 10-person company; everyone needs to have a good understanding of cybersecurity and what the risks are for the organization.”
• Educate everyone–Toth’s sentiment not only applies to lower level employees, or even solely to mid-level employees and below–Everyone from the CEO on down to the newest employee should be knowledgeable, not only of the corporation’s cyber security plan, but also current cyber threats and how to identify them.
• Threat awareness & testing—Ransomware and DDoS have plagued companies more than ever in 2016, and the primary way they got access to private information has been through phishing schemes. Phishing occurs when impostors pose as reliable entities, such as banks, universities, or other well-known companies, via electronic communication, to solicit personal information which they can then use to steal people’s identities or infect their computers with malware. Employees receive emails with a suspicious link and when they click on it, they are infected with some cyber-attack which can either leak data from their own computer, or give the hacker unauthorized access to vital information. It is important for corporations to train their employees to be able to spot such threats. Companies like J.P. Morgan have taken a different approach to training employees on this when they sent out fake phishing emails to employees shortly after training them on the cyber-scheme. They were able to trick 20% of their employees–a scary thought when factoring in the massive size of the company.
• Secure handling of sensitive data—Employees need to know how to handle your company’s sensitive data. Be it digital encryption or hard copy paper shredding, employees need to take every precaution when it comes to protecting your data. Though it is important for employees to do things such as back up information to an external hard drive, they should be responsible in making sure that that is not stored in an easily accessible place.

Promotion of Open Communication Among All Employees

If an employee finds a suspicious email in their inbox, they should feel comfortable verifying its validity with others. It is important for employees to be able to ask questions when they are in doubt, as this shows that they have paid attention during training sessions and don’t want to do something that would put the entire company in jeopardy. Promoting open communication about cyber security best practices among all employees will help them to learn from and teach each other, making every member of the company cyber-aware.

Educated employees are able to recognize threats and they continually take simple steps that allow them to practice strong cyber security defenses– if you fail to teach your employees how to defend against attack in the first place, it is not them who have failed the company, rather you. By making your employees cyber-aware, you can protect your business better than with any other piece of machinery. Employees don’t have to be tech savvy to be technologically responsible and aware of their impact on the company’s overall cyber security.

For more tips on how to keep your employees educated on the latest cyber security threats, read Employees: The Greatest Risk and Defense In Cyber Crime, written by Axiom Cyber Solutions President, Shannon Wilkinson.

Hailey R. Carlson | Axiom Cyber Solutions | 12/22/2016

National Cyber Security Awareness Month (NCSAM) is being recognized for the thirteenth year in a row this October, and with this anniversary comes the reminder that enhanced cybersecurity defenses are necessary for everyone from large, multinational corporations all the way down to families and individuals. The overall theme of the month is that cybersecurity is our shared responsibility, meaning that it is not just the duty of IT professionals or CEOs to be cyber aware, but it is all of our collective obligation to act as a cohesive unit in the fight against cyber crime.

Many people become overwhelmed with the amount of information they are supposed to remember surrounding cybersecurity–“don’t click on this type of link,” “watch out for this sign of malware,” and so many more–but these issues cannot even begin to be addressed until we refine the most basic and essential cybersecurity measure of them all: strong password security. 

At this point in our technological age, everyone is well aware of passwords being of significant importance when it comes to safety and security on the Internet; though most may agree with this sentiment in theory, many are not implementing this idea in practice, despite being well-aware of the consequences.

The Myspace data breach from earlier this year left 360 million accounts’ passwords exposed on the Internet. Despite this massive amount of personal information now out there in the open, many people did not feel the same way about this breach as they might a breach of another website, primarily due to the fact that they had not visited the site since the prominence of Facebook and Twitter came about. Though many people may not have accessed that site in quite some time, some still use their Myspace password or one similar to it as passwords for other websites. Consequently, these dormant accounts with poorly secured passwords have left people vulnerable to a plethora of other attacks. Password security is an area of cybersecurity that needs to be taken much more seriously in order to avoid these types of threats.

Secure Password Tips

The average person today has a whopping 22 passwords just for their professional data, and that does not even include their personal information like social media and private email accounts. ‘Password hygiene’ is the active implementation of password security best practices and some tips to make keep your password hygiene squeaky clean include:

• Do not use the same password for different accounts–Three-quarters of consumers use ‘repeat passwords’ across multiple platforms. When they do this, if one account is compromised, they leave all other accounts protected by the same password exposed to further attack.
• Change your passwords often–By leaving passwords stagnant rather than changing them regularly, it is that much easier for hackers and other cyber criminals to guess your password and give them access to your personal information. Forty-seven percent of people are securing their financial accounts online with passwords that have not been changed in five years, and this is extremely dangerous. In addition to changing your own passwords often for both professional and personal accounts, it is important for employers to avoid using default passwords when setting up accounts for new employees. Default passwords give criminals an open, unsecured door into your entire enterprise.
• Never give out your password to anyone–When you share your password with even one other person, you are exposing your accounts that much further to cyber criminals. By being solely responsible for your own data, you can contribute to the NCSAM philosophy of security being our shared responsibility by being personally accountable for your own data.
• Do not use easy to guess words or phrases in your password–Though you may sincerely love your dog or favorite band, it is important to be aware of what information people know about you that they can use to guess your password. Though you should not blatantly use ‘dictionary words,’ this idea can be a good jumping off point for coming up with more complex passwords. One way to do this is by being liberal about character substitutions, such as replacing “o” with “0,” “e” with “3,” or “i” with !.”
• When possible, utilize sites’ multi-factor authentication–Most websites now use two-factor authentication where there is not only a password used to protect your account, but also a one time code you enter in to verify your identity. This simple step takes a few minutes at most and can make a huge difference in your personal cybersecurity defense.
• Use a password manager to make remembering passwords simple–A big complaint by most of us is that there are just so many passwords to remember across the different areas of our lives, and it can be very difficult to remember all of these when they are also meant to be intricate and hard for hackers to guess. One way to ease this burden is by utilizing a password manager. A password manager is generally a free database that you can download to your computer (often coupled with a smartphone application option) where you can store all of your passwords. When this is used, you only have to remember one complex password rather than your entire catalog of password information.

One of the biggest fallacies people believe surrounding cyber crime is “It won’t happen to me,” when in reality, it is likely that this will not be the case. A major philosophy of many cyber experts is that it is not a matter of if we will all be attacked online, but when. While this is a rather daunting thought, there are ways which we can lessen these chances, the most basic of which being securing our passwords. By coming together and taking this small step, we can be more accountable for our presence online as a whole, sharing the struggle of cybersecurity as our shared responsibility.

Hailey R. Carlson | Axiom Cyber Solutions | 10/21/2016

Image Source

No matter what side of the political fence you fall on, you are probably exhausted by now with the constant 24-hour a day news cycle bombarding us all with ads for politicians on both the local and national scale. While this is a fairly common occurrence, as we experience this feeling every few years, many people are feeling a similar weariness which has not been seen before when it comes to cybersecurity.

A new study published by the National Institute of Standards and Technology in partnership with the Institute of Electrical and Electronics Engineers has found that over 94% of people between the ages of 20 to 60 years old feel “overwhelmed and bombarded, and tired of being on constant alert, adopting safe behavior, and trying to understand the nuances of online security issues.” This exhaustion leads to many people flat out ignoring security warnings, while others tend to grow worn out by security updates and the ever-expanding grocery list of passwords which they must remember. These experiences of high levels of fatigue coupled with many of the respondents’ claims of not knowing anyone who has been attacked and being skeptical of an attack on themselves as well, leads to people throwing security and safety measures out the window, putting themselves and the companies they work for in danger of attack.

What websites can do to ease security fatigue

While many times it is recommended that users do something to combat security issues and cyber-crimes, this is exactly what is leading to their fatigue. Because of this, the study says websites and online services needed to do a better job of coordinating how they approach security to lighten the load on users. A few ways which they can achieve this are by:

1. Limiting the number of security decisions users need to make
2. Making it simple for users to choose the right security action
3. Designing for consistent decision making whenever possible

These are some of the best ways we can combat security fatigue at the source, but one of the biggest issues raised from the study not resolved by these steps is that of password security.

Password security fatigue, solved

Many people in the study claimed that not only having to have different, intricate, and long passwords for each site was stressful, but trying to remember them all actually made them simply resort to the poor practice of using the same one for all sites. The average number of passwords per person today is 22 compared to just one not that many years ago, so it is easy to see how people can get overwhelmed when it comes to password security. The study says that you are not supposed to remember all of your passwords, however, rather you should use a computer password manager which can store everything for you and even generate new, complex passwords, saving you even more time. With this, you only need to remember one password and then you have access to all others. KeePass is just one of the many password managers out there that is free, easy-to-install, and gets the job done. By simplifying password security, we can ease the stress put on ourselves by security fatigue.

What companies can do to ease security fatigue

In addition to websites and users, companies have a significant role when it comes to easing user security fatigue. There will continuously be a new variant of ransomware, a more intricate phishing scam, or some other threat posed to companies and their employees. With all of these threats imposing themselves on employees constantly, companies need to have clear, specific guidelines to show users what to do in the event they become exhausted by implementing cybersecurity best practices. By clearly going over what to do in various situations with set ‘plans of attack’, companies can prepare their employees by instilling good cybersecurity habits in them. “If safe behavior becomes habitual, then when we feel swamped by the craziness of the online world we will at least fall back into habits that have been designed to protect us, rather than put us at greater risk,” says the reports’ co-author Mary Theofanos.

Security fatigue in America is a real thing and it is a major threat to the future of cybersecurity. By websites, companies, and users coming together to try and ease this process, hopefully, we can make the online world a little more safe and a little less overwhelming.

Hailey R. Carlson | Axiom Cyber Solutions | 10/14/2016

Image Source

From data breaches affecting multi-million dollar corporations to ransomware targeted at the health-care industry to the real-life repercussions of insulin pump hacking, cybersecurity threats are everywhere. Emphasized by both the current President and both major political party nominees as well as the director of the FBI, it is apparent that cybersecurity is a serious concern for the nation.

Because of these impending threats, it is important for awareness of cybersecurity to be a nationwide occurrence. This October marks the thirteenth year of celebrating National Cyber Security Awareness Month (NCSAM). Created by the National Cyber Security Alliance (NCSA) in collaboration with the Department of Homeland Security’s National Cyber Security Division (NCSD), the observance of this month has grown both in popularity and in importance.

In addition to being the thirteenth year of the month’s observance, it is also the sixth year of the STOP. THINK. CONNECT. campaign. This campaign is a movement to promote simple cyber-awareness for all individuals which they can use every single time they access the Internet. The steps are quite clear:

STOP: make sure security measures are in place. THINK: about the consequences of your actions and behaviors online. CONNECT: and enjoy the Internet.

The STOP. THINK. CONNECT. campaign is the focus for the first week of National Cyber Security Awareness Month, with the subsequent weeks’ topics including harboring a cybersecurity culture in the workplace, recognizing and combating threats, examining the future of tech and IT security, as well as emphasizing the importance of critical infrastructure. While it is important for individuals to be cyber-aware, it is equally if not more important for businesses to know their risks as well.

All Businesses Need Cybersecurity

Different things come to people’s minds when they think about cybersecurity in relation to business. For some, they think of the statistics surrounding small-to-medium-sized businesses such as how 71% of cyber attacks target SMBs. For others, the data breaches of major corporations such as Target and Sony come to mind. In reality, all of these entities have a dire need for cybersecurity. There is no silver bullet when it comes to securing cyber defenses, however, so it is important for companies of all sizes to put in place multiple layers of protection against threats. Some key precautions that need to be implemented regardless of size or industry of a business include:

1. Anti-virus Protection—Utilizing an anti-virus software is one of the most basic ways to protect a company’s computers and system. A strong anti-virus software is necessary in order to detect and remove viruses before they harm your system.
2. Firewall Implementation—Use of a firewall helps secure your network from cyber attacks by preventing them from accessing your system in the first place. Though there are both software and hardware options when it comes to firewalls, for businesses, it is recommended that hardware firewalls, especially Next-Generation Firewalls, be used since these protect whole systems compared to their software cousins that only protect the individual computer on which they are installed.
3. Network Monitoring—Network monitoring, be it performed internally or provided externally through a cybersecurity partner, is a crucial aspect of cybersecurity defense. This service notifies the network administrator of any oddities such as intrusion detection and overloaded servers, which can help them to fix these issues quickly. Simply setting up cybersecurity will not be enough, these defenses need to be monitored often so that a company knows where its weaknesses lie.
4. Employee Education—While employees are often a company’s greatest asset, they can also be its greatest cybersecurity threat. Malicious actors do make up a large portion of the threat, however, a major, fixable component is a lack of employee knowledge. The easiest way to fix this is to have company-wide training on various cyber-threats including phishing, able to trick nearly a third of employees, as well as ransomware threats. These two cybercrimes are the most egregious according to the FBI and are increasingly becoming their focus in the fight against cybercriminals, so it is especially important to educate employees in these areas. By educating employees, a company can both strengthen their cybersecurity defenses, as well as empower their employees to be more accountable for their behavior online.

Our Shared Responsibility

The major theme with National Cyber Security Awareness Month is the idea of a collective accountability when it comes to cybersecurity defenses. We are all connected through the Internet, and because of this, the NCSA emphasizes that it is our shared responsibility to protect this shared resource. This sentiment cannot be better summarized than by the following quote,

No individual, business or government entity is solely responsible for securing the Internet. Everyone has a role in securing their part of cyberspace, including the devices and networks they use. Individual actions have a collective impact and when we use the Internet safely, we make it more secure for everyone. If each of us does our part—implementing stronger security practices, raising community awareness, educating young people or training employees—together we will be a digital society safer and more resistant from attacks and more resilient if an attack occurs.

If you would like to find out more about National Cyber Security Awareness Month, please visit https://staysafeonline.org/ncsam/ to learn more about how you can get involved. If you would like to enhance your own cybersecurity defenses, regardless of the size of your company, please contact Axiom Cyber Solutions to see how our managed cyber solutions can help you get and stay secure.

Hailey R. Carlson | Axiom Cyber Solutions | 10/07/2016

Image Source