Cyber Security 2018

For this year’s edition of our annual Cyber Security update, we are taking a somewhat different approach. In addition to covering “cyber security”, we are also taking a broader look at related subjects. To put this white paper together, we have researched the thinking of a great many experts in a number of fields. We have read what seems like countless papers, columns, blogs, etc. As always, we are going to start with an analysis of cyber security as we head into 2018, but then we are going to look at other topics that are directly and indirectly relevant to security issues, including IoT (the Internet of Things), AI (Artificial Intelligence), crypto currency, and even “fake news”. (We also highly suggest you read last year’s paper on Cyber Security 2017, as the content of that piece is still highly relevant today.)

When companies such as Anthem, the Federal Office of Property & Management and Equifax were breached, a tremendous amount of meta-data was stolen and we expect that this data will be used highly targeted cyber attacks based on psychographic and demographic algorithms created by cyber criminals employing artificial intelligence to create them. But the data collected from an unknown number of smaller unpublicized breaches will certainly be added to the data of the larger attacks to create “big data algorithms” to precision target spear-phishing to influence purchasing, behavior and, yes, democratic institutions. This is in addition to DDoS, ransomware, and other attacks that will harm businesses and governments alike. This paper is structured to help you fight back. That said, not everything in this paper may be directly related to your own company’s cyber security, but we sincerely believe that in today’s highly interconnected digital world, it is incumbent on every business owner and executive to be on top of at least the basics of digital technology and the risks involved.

Cyber Security

Data breaches have been in the news for several years. Last year saw breaches that stole information related to healthcare, government clearances, financial institutions, etc. We also saw one small company that warded off literally tens of thousands of cyber attacks until one got through, with devastating consequences. While that was a ransomware attack that could have been prevented by a qualified managed IT support provider, we are concerned about small company breaches that will lead to consumer losses, and will lead back to lawsuits against the breached company. While 100% protection may never be completely possible, we do believe that the legal standard will be to provide all reasonable protection and those that do not will find themselves subject to serious legal and financial problems.

Many cyber security experts are also concerned that this will be the year the USA will see the same type of infrastructure attack as Europe has suffered during the last two years, where power grids as well as manufacturers have been attacked. Near the end of last year (2017), both the Department of Homeland Security and the FBI advised that they were seeing continued and persistent activity indicating the targeting of critical infrastructure such as water, energy, avionics, construction, and others. They have also signaled their concern that major companies in these sectors are not prepared to ward off such attacks. These attacks could come from bad actors with specific political motives, or with schemes to steal and/or defraud their way to other people’s money.

There are new industries that the cyber-criminal is starting to attack. Healthcare, while it has been attacked before, is one that may see significant increases in the number and types of attacks because the technology that serves this industry is still catching up. Security experts are predicting ransomware attacks that lock-down patient records and can affect patient care. The travel industry is another, as travel sites often have wide-ranging personal details such as passport numbers and credit card info, along with home addresses and personal preferences…and often information on when people will be away from home.

Cyber Security Regulation

The European Union has introduced a comprehensive set of cyber security regulations entitled the General Data Protection Regulation (GDPR) and with it the EU has become the world leader in such privacy laws. If your company does business with any EU countries, it is imperative that you become familiar with these rules. Many experts expect other countries to adopt similar regulations, although the USA seems to be waiting to see how this plays out.

The reality is that many EU companies are struggling with the enormity of meeting the May 25, 2018 deadline (remember Y2K?), but heavy fines have been promised against those firms that fail to meet the deadline and are then victims of such attacks. We expect that among the companies singled out will be multi-nationals who fail to meet launch targets, especially if they cannot show good faith attempts to complete the work. Smaller multi-nationals may not be exempt, particularly if consumer damage results.

The Internet of Things (IoT)

In a blogpost we published last year, we discussed the vulnerabilities that exist in IoT devices, but with Congress essentially ineffective in dealing with cyber security issues, tied together with powerful lobbying efforts, we doubt that much regulation is in the near-term future…at least not until potential problems turn into real problems. (What’s an IoT device? Click here, but note that this article will NOT go into the potential dangers of IoT) The GDPR regulations discussed above deal with IoT, but we will have to wait and see how strictly these are enforced. If they are tough and if they achieve results, that could trigger needed movement on this side of the pond.

Please note that attacks against IoT devices are no longer just a prediction, they are happening. What is an IoT attack? For example, hackers can use information from your IoT connected refrigerator to determine times when your home is generally empty (the refrigerator door is never opened between 8 AM and 6 PM.) They can get the same info from your thermostat (the temperature in the house drops from 72 to 64 at 8:30 AM every day, then back up to 72 at 5.)

Home invasion is not the only concern. If the robots on an automotive assembly line are hacked and on-the-road malfunctions are caused, lives could be lost and corporate reputations severely damaged. Major manufacturers and working on this and security companies are offering fixes, but there are thousands of manufacturers with millions of products and all are looking for consumer IoT “hot buttons”…but are they also looking at the security issues? And if your business uses these devices, what will be the effect?

Since it seems that regulations are unlikely to be passed that will create adequate controls, we expect that the marketplace will be the force that compels manufacturers to build in proper security as consumers, seeing future news reports of IoT enabled crimes, will demand it. If this is true, those companies that are building in security before the bad news hits will be the beneficiaries.

Fake News and Cyber Security

Just to be clear, we are not looking at fake news from a political perspective. While it’s out there, maybe on both sides, and almost certainly from foreign actors, we are going to look at fake news strictly from the perspective of cyber security.

We have seen headlines stating that cyber threats are on the rise and to be wary; conversely, we have also seen stories about how over-hyped the threat actually is and that negative releases have been placed for the benefit of cyber security software companies and those that sell it, install it and monitor it. Our concern is a feeling of over-confidence. The threat is real and grows annually. While we cannot state with any accuracy where the positive stories, those that tell you everything is ok, are coming from, we feel it is our obligation to provide you with some “real news” stats.

Reliable sources say that in 2016, cybercrime hit the economy to the tune of $450 billion, and is expected to rise to $1 trillion by 2021. Nine billion records have been stolen since 2013, including 2 billion in just the first half of 2016. (We don’t yet have stats for the second half.)

Why? Cybercrime is a booming and highly profitable business and in any profitable business, people will be working on new technologies and ways to increase their “bottom line.” These are highly sophisticated professional criminals who are working night and day to steal from you.