Across the country, government teams are pushing through roadblocks and finding new ways to get the job done while working remotely. The challenge is that as “how” and “where” work happens evolves, cyber threats likewise adapt. Adversaries are exploiting vulnerabilities and finding new ways to attack government networks and data. These attacks include an alarming rise in ransomware, phishing, smishing and vishing, with agencies experiencing upwards of 6.5 million attacks a day, up from 150,000 daily attacks before the pandemic. I recently moderated an ACT-IAC panel of experts from the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Education and the Federal Risk and Authorization Management Program to discuss how organizations can take a threat-based approach to cybersecurity, paving the way for expanded use of cloud services and resiliency for the future.  Here are some takeaways from that discussion:

The state of the threat landscape

“As we look at our threatscape, it’s important for us to understand that [attacks are] evolving at a rapid pace … and we have to evolve and adapt faster than they do,” Education Department Chief Information Security Officer Steven Hernandez said. “We have a greater [resilience] in a few areas: technology, our people — investing in them to ensure that they’re the best that they can be — and then building the coalitions so that we can outflank those threat vectors.”

Often, organizations think of cybersecurity as preventing/protecting networks against cyber threats – but that is just one element of the cybersecurity framework, as outlined by the National Institute of Standards and Technology.

NIST framework includes five functions, which match the pillars for cyber resiliency: identify, protect, prevent, respond and recover.

In a new letter to the editor pulled from the prestigious scientific journal Nature, a team of Israeli researchers pose a frankly wild-sounding question: could a computer hack result in a scientist being swindled into creating a piece of genetic code that’s harmful—or potentially toxic—rather than helpful?The answer seems to be yes, albeit with some pretty weighty caveats. The “end-to-end cyberbiological attack” described above requires some lackluster cybersecurity chops from both sides of the genetic research supply chain: both the academics who might order genetic materials online, and the labs that might supply those materials back. While this sort of attack hasn’t been seen in the wild yet, the research team behind the letter pointed out that it’s not outside the realm of possibility—especially as more and more genetic research moves into the digital realm.

At the heart of this hypothetical hack is the software that biologists use to “print” strands of DNA from scratch and then assemble them together, a process known as “DNA synthesis.” In recent years, we’ve seen this synthesizing software underpin tons of groundbreaking biomedical research. In the mad dash to create a treatment for Covid-19, for instance, a handful of major pharma companies turned to using man-made strands of DNA as one of the components of their experimental vaccines.

…

ZDNet – “This is the time of year when PC makers offer irresistible deals on new hardware. If you’ve taken advantage of a Black Friday or Cyber Monday deal to replace your old Windows PC with a shiny new model, congratulations! So, what are you planning to do with that old, not yet obsolete device? You might be planning to hand it down to a family member or reassign it to another employee in your small business. Maybe you’re going to donate it to a local charity or put it up for sale. Whichever option you choose, your top two priorities should be safely expunging your personal data from the old device and restoring its operating system so the new owner can be productive right away. And as with all things Windows, there are multiple ways to accomplish this goal. In this post, I’ll outline the three best alternatives you have, with some thoughts on when you should choose each one. (Spoiler: The most important question is who you’re planning to give that PC to.)…”

beSpacific Subjects: Cybersecurity, PC Security, Privacy

ZDNet Topic: Windows 10

Original release date: December 3, 2020 – IBM X-Force has released a report on malicious cyber actors targeting the COVID-19 cold chain—an integral part of delivering and storing a vaccine at safe temperatures. Impersonating a biomedical company, cyber actors are sending phishing and spearphishing emails to executives and global organizations involved in vaccine storage and transport to harvest account credentials. The emails have been posed as requests for quotations for participation in a vaccine program.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages Operation Warp Speed (OWS) organizations and organizations involved in vaccine storage and transport to review the IBM X-Force report Attackers Are Targeting the COVID-19 Vaccine Cold Chain for more information, including indicators of compromise. For tips on avoiding social engineering and phishing attacks, see CISA Insights: Enhance Email & Web Security.

RSS feed for topic – https://us-cert.cisa.gov/ncas/current-activity.xml

EFF: “This is not a drill. Red alert: The police surveillance center in Jackson, Mississippi, will be conducting a 45-day pilot program to live stream the security cameras, including Amazon Ring cameras, of participating residents.  Since Ring first made a splash in the private security camera market, we’ve been warning of its potential to undermine the civil liberties of its users and their communities. We’ve been especially concerned with Ring’s 1,000+ partnerships with local police departments, which facilitate bulk footage requests directly from users without oversight or having to acquire a warrant.  While people buy Ring cameras and put them on their front door to keep their packages safe, police use them to build comprehensive CCTV camera networks blanketing whole neighborhoods. This  serves two police purposes. First, it allows police departments to avoid the cost of buying surveillance equipment and to put that burden onto consumers by convincing them they need cameras to keep their property safe. Second, it evades the natural reaction of fear and distrust that many people would have if they learned police were putting up dozens of cameras on their block, one for every house…”see also

https://www.jacksonfreepress.com/news/2020/nov/02/mississippi-program-use-door-cameras-fight-crime/

EFF RELATED TAGS – STREET LEVEL SURVEILLANCE

Privacy, Identity & Online Security