By Oz Sultan
By way of a little background. If you can think back to Target data breach of 2013 and their subsequent $18.5M settlement with 47 states — one of the key takeaways was that Target’s systems were compromised by a spearphishing attack.
Defined, “Spear phishing is a phishing method that targets specific individuals or groups within an organization. It is a potent variant of phishing, a malicious tactic which uses emails, social media, instant messaging, and other platforms to get users to divulge personal information or perform actions that cause network compromise, data loss, or financial loss. While phishing tactics may rely on shotgun methods that deliver mass emails to random individuals, spear phishing focuses on specific targets and involve prior research.”
Yesterday’s Problem Is Now Today’s Risk Issue. Researchers recently discovered a security flaw in ALL wifi routers that use WPA2 security. The flaw, known as KRACK, opens all networks to breaches where Hackers could monitor all data sent across them, specifically, “The actual details of the hack get a little bit technical, but essentially the attacker can manipulate the security handshake that Wi-Fi networks perform with devices that connect to them, stealing the numerical key that would otherwise encrypt the transmitted data.
“This allows attackers to effectively eavesdrop on any information a connected device sends across the compromised network.”
What This Means for You and Your Company. The core issues stemming from this hack is that all existing systems including your phone, home computer and critical business systems should be backed up and updated. If you’re in charge of a company — consider the nominal cost of secure backups and software upgrades the ounce of prevention you need — versus the pound of cure that would be required were you to lose mission critical data or systems.
Anti-virus scanners should also be updated — our recommendation is to avoid Webroot (that makes itself virtually uninstallable) and stay clear of Kapersky Anti-Virus software that could be leaking information to the Russian government.
For yourself and any corporate remote users — consider that any public Wi-Fi network that you sign on to could be compromised. A comprehensive guide to VPN selection is available here, while a less technical guide is available here. Steer clear of free VPN services. They could contain malware or terms and services — puttingyou at risk.
What Should Industry Do? The WPA2 Breach puts corporations with lax security policies in an especially vulnerable position. Companywide security policies should be updated, as well as critical systems.
For healthcare, power generation and manufacturing / extraction companies that have custom equipment that has dedicated or modified versions of older operating systems, such as DOS, Win95, WinXP, or older Unix distributions — it’s recommended that the systems be isolated from both wifi and traditional Ethernet networks — ideally separated on their own private network to mitigate risk.
At the very minimum, annual security audits should account for cyber, social media, social engineering, and cryptoransomware reviews. The emerging field of blockchain technology and Bitcoin has brought a wealth of opportunities to the financial sector — while opening other doors to new challenges.
Easy access to digital currencies has allowed for the proliferation of malware and viruses that could both corrupt and ransom critical data and infrastructure.
What’s the Worst That Could Happen? Consider South Korea in the past few months. At the new digital front line with North Korea — they’re the guinea pig for North Korea’s next generation cyber Attacks. North Korean spearphishing recently compromised South Korean electric companies — which, while not leading to an immediate disruption of power distribution, demonstrates a need for increased vigilance if we’re to maintain critical infrastructure security.
Oz Sultan is a leading Big Data and counterterrorism expert who focuses on anti-recruiting and ISIS counterterror (CT) research within social media. He also advises a number of Fortune 1000 companies and is Adjunct Faculty at City University of New York (CUNY) Baruch. To read more of his reports — Click Here Now.