[Enter Victim Name Here] Suffers Cyber Attack

The information accessed may have included names, dates of birth, Social Security numbers, health care ID numbers, home addresses, email addresses, employment information, including income data. We have no reason to believe credit card or banking information was compromised, nor is there evidence at this time that medical information such as claims, test results, or diagnostic codes, was targeted or obtained” Taken directly from large insurance company website notice, 18 February 2015.

Yet another big cyber-attack involving our personal data… The experts say we can expect a big one a month but it seems like they are happening with a higher frequency – more like weekly.

I was thinking to rush this little note out to stimulate thinking while the “cyber-attack” was fresh in everyone’s mind. Then it dawned on me, I could reach the same goal if I finished this note up next week (or the week after, or after that, etc.) Waiting a few days would also give me time to complete more of my thoughts, another plus.

This time around, [enter victim name here] is making the press and being large insurers, they are holders of many folks’ personal data. “No credit card data” was stolen we are assured. Just names, social security numbers, e-mail addresses, birthdays, street addresses, member IDs, and employment information (including salaries) of some 80 million current and former customers. Whew, I almost got concerned, but it’s just all the data needed to commit insurance fraud at the doctor, get a credit card, etc. so I don’t need to worry too much. Then again, 80 million folks is about SIXTY ONE TIMES the entire population of the state I live in here in the United States… hmm, maybe I will worry just a bit. If anything should happen, my family should be okay though-[ enter
victim name here] are already offering credit monitoring and identity protection so after you have been taken for a ride down a long dark road by the thieves you will have help straightening out your life again. Which brings up something that most folks don’t know-AAA in the US offers free protection with their plans!¹

My mind wanders… Why? Why do these cyber security events keep happening so often here in the US and abroad in places like Europe? Why after spending 2 decades overseas practicing my profession was my identity stolen shortly upon my return home a few years back? The answer as I know all too well, is a bit more complex than a simple why and requires a few more “w’s” to understand a bit more clearly.

Who-Who’s behind these attacks: criminals, nation-states, and even governments, shapes the scale and intent.

The who was criminals and is increasingly becoming very organized crime, nation-states which is a nice way of saying those who hate us (this latest breach is already being aimed at China) or more frighteningly, our own governments who don’t hate us and swear to want to protect us in some cases. In my case, the same government (United States) that a Edward Snowden has been releasing information about and the same government that deployed without proper controls and testing, a medical insurance website at a cost of over 1 Billion dollars that was knowingly not HIPAA compliant.² HIPAA is a US Statute that sets national standards for electronic healthcare information among other things.

What-What gets stolen today isn’t just credit cards, it’s identity, history, and everything needed to impersonate you for years.

The what was stuff the criminals could steal-cash traditionally, then other tangible goods like draining your credit card through some online account etc. As of late, you’re personal details, who you work for, what you are paid (a highly valuable bit of information in certain competitive markets), how many children you have and their details (I don’t like to think about the motives or value of that information) are more valuable than a credit card. In my example, [enter victim name here] lost details of current and former customers back 10 or so years-the breach occurred in December 2014 and the folks affected date to 2004 as of this writing! Why was 10 year old data, or even 5-6 year old data stored in the same place as current customers? I am guessing their data retention policy was/is 10 years. In my book, a layer of security in this case would/should have been archive this old stuff somewhere else to limit risk should a breach occur which we see did happen. The what in my example could have been much harder to steal had the risk been properly assessed and mitigated.

Where-The “where” of attacks has moved from dark alleys to your home network, your car, your medical devices, and every vendor you trust.

Years ago, the where was simple for criminals and others of ill repute-it was a back ally, a darkened parking lot after hours, a little used stairwell in a mall, and worse case was something along the lines of a car-jacking. Times have changed though, the modern world has brought convenience through all things “cyber.” Today’s dark parking lot is your home network while you are at work, it is the machine you swipe your credit card through at the local grocer on your way home from work or in the case of one recent high profile attack, it starts with the air and ventilation systems vendors that are conveniently given credentials to the computer network of some large chain of stores³. Where will it be in the future? How about your car (already proven vulnerable by experts)? Your medical device?⁴ The “smart” meter the electric company put on the front of your house?

Why-Why these attacks keep happening comes down to one truth, information is the new currency, and everyone wants it.

The why is simple-it is for undeserved gain of some sort, whether it be directly financial or otherwise. While an end goal of financial gain is still the prime river for most security incidents, increasingly information itself is becoming a target. This newer target likewise has quite significant value-to governments, large multinationals, advertisers, etc. With the Eric Snowden releases, which have continued to little notice of many, the reach of various regimes aka Five Eyes is being uncovered like a blanket pulled off a couple lying naked in bed-and it is very hard to remove from memory for those of us that can build a bigger picture of the consequences.

Does anyone think that today’s computer analytics could (or have) be applied to home smart meters on the line running to your house and used to determine if someone is home/watching TV/listening to music or something more sinister like building patters of WHEN the family comes home, the burglar alarm is on or off, when they eat dinner and then retires to bed…? Keeping a detailed history of your life at home? I do… What is a home smart meter? It is a digital online version of the little spinning disk of old that told the power company how much energy you were using-a man or woman used to come around frequently to notate the numbers and determine usage for billing purposes. Online and readable remotely. Are they secure you ask? Maybe, maybe not depending on how much the developers spend in money and time as they rush the cool new gadgets to market. And don’t ask about regulations to protect privacy-we can’t get
credit cards and medical data secure, don’t set expectations too high for your home meter although a few companies should step up and do things right.

What (is next?)-Security professionals must design layered, end-to-end defenses before the next wave of tech makes today’s breaches look small.

Security professionals, when given the reins, like to design security in layers… layers upon layers of measures that reduce the risk and limit potential damage when something DOES happen. Layered end to end security controls still work quite well-they are often not employed though (cost either in CAPEX or OPEX) Professionals are also the first to tell you (and the CEO who they work for) that security is never 100% but… One can take risk reduction measures by technical means that could include protection against denial of service attacks, fire-walling, malware detection or measures that are more human oriented such as security awareness training, the lighting the parking lot or back ally if you will.

Security researchers who understand the deep technical reasons behind many of the vulnerabilities continue to valiantly identify vulnerabilities, fight and churn out notifications to vendors who are lacking proper attention to security in their products – the modem on your Internet connection is something that comes to mind, along with your smart TV, your laptop running a web browser with voice recognition, and the list goes on. The researchers are fighting a never-ending but critical fight in the battle-space that is technology growth. Vendors speeding not-so-secure products to market faster than the next Vendor are part of the problem. Consumer demands and expectations are ravenous, much like ones appetite after a day of Lenten Fasting or around sundown during Ramadan – but that is not an excuse for ignoring basic design, coding, or security principals or the proper implementation of a product in a secure manner if risk warrants it.

Security professionals have a plethora of tools at their disposal as well as drivers to better security via regulation and standards. For years we in the community have been playing catch up with security, trying to bolt on fixes over the years in what many feel is a long drawn out battle but things are looking up, or at least there is an opportunity to change the dynamic.

With the introduction of the concepts NFV (Network Functions Virtualization) and SDN (Software Defined Networks) a few years back, the world is starting finally to look closer and discuss deploying these solutions to increase network flexibility, reduce hardware costs, speed service deployments, etc. Technology bodies such as ETSI⁵ and IEEE⁶ are looking closely at these technologies and several areas, including security. Security practitioners therefore have a chance to “get in at the start” to ensure that security is a major consideration as these technologies start getting the nod across the market. I hope they rise to the occasion.

Also on LinkedIn

1. http://ww1.northernnewengland.aaa.com/en-nne/become-member/pages/benefit-comparison.aspx ↩︎
2. http://www.newsmax.com/Newsfront/obamacare-cost-hearing-website/2013/10/24/id/532856/ ↩︎
3. http://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/ ↩︎
4. http://www.wired.com/2014/04/hospital-equipment-vulnerable/ ↩︎
5. https://portal.etsi.org/tb.aspx?tbid=799&SubTB=799#5069-meetings ↩︎
6. http://grouper.ieee.org/groups/srpsdv/meeting_information.html ↩︎