ICD Brief 20.
28.11.2016. – 04.12.2016.
This weekly International Cybersecurity Dialogue Brief is our pro bono contribution to each of you. It is an after action of our roundtable at the National Press Club with Dr. Gabi Siboni, The Institute of National Security Studies (INSS), Tel Aviv University.
Lots of news this week: new bilateral cybersecurity agreements between US and Israel as well as China and Russia; wide spread advice on cybersecurity to the incoming US administration; increased legislative regulations and privacy concerns in the US, UK, China, India, Russia and New York State; cyber attacks in UK and Germany and “Turbo Boost” defense spending by the EU.
USA
Panel Urges Better Cybersecurity to President-Elect Trump
“A presidential commission Friday made 16 urgent recommendations to improve the nation’s cybersecurity, including creating a nutritional-type label to help consumers shop wisely and appointing a new international ambassador on the subject – weeks before President-elect Donald Trump takes office. The release of the 100-page report follows the worst hacking of U.S. government systems in history and accusations by the Obama administration that Russia meddled in the U.S. presidential election by hacking Democrats.”
Check If You Were Hit by the Massive ‘Avelanche’ Cybercrime Ring
“The U.S. government has posted links for free scanning programs so companies and individuals can check their computers to make sure they weren’t victims of a massive, international cyber criminal operation that was taken down Thursday after a four-year investigation. “This is probably the biggest operation that law enforcement has ever done against cyber crime,” said Catalin Cosoi, chief security strategist with BitDefender, one of the dozens of companies worldwide that worked with law enforcement to attack the group.”
FBI to Gain Expanded Hacking Powers as Senate Effort to Block Fails
“A last-ditch effort in the Senate to block or delay rule changes that would expand the U.S. government’s hacking powers failed Wednesday, despite concerns the changes would jeopardize the privacy rights of innocent Americans and risk possible abuse by the incoming administration of President-elect Donald Trump. Democratic Senator Ron Wyden attempted three times to delay the changes, which will take effect on Thursday and allow U.S. judges will be able to issue search warrants that give the FBI the authority to remotely access computers in any jurisdiction, potentially even overseas. His efforts were blocked by Senator John Cornyn of Texas, the Senate’s second-ranking Republican.”
US Presidential Commission Issues Recommendations on Cyber Security
“The U.S. government and the private sector must cooperate to improve the security of digital networks, a U.S. presidential commission on cyber security recommended in a wide-ranging report issued on Friday. The commission created by President Barack Obama earlier this year also recommended that the president and Congress accelerate the pace at which technology is updated in the federal sector and that the president appoint an ambassador for cyber security for efforts abroad.”
New York’s New Cyber-Security Demans Draw Near
“There is no shortage of guidance and frameworks for dealing with the risk of data breaches and fending off would-be hackers. What there hasn’t been, until now, is an industry-wide set of rules comparable to what New York’s Department of Financial Services has in store for financial institutions that fall under its oversight. The agency’s regulations will impose a host of new security, personnel, attestation, and reporting requirements. ”
How to Use Insurance Markets to Improve US Cybersecurity
“Robert Knake, a cybersecurity expert with the the Council on Foreign Relations, has recently released a report calling for the creation of a federally sponsored cyber insurance program. The report argues:
“Anticipating a catastrophic event in cyberspace, Congress should put in place a federal backstop for cyber insurance. Doing so would set expectations for the market and, if constructed properly, reduce the likelihood of a catastrophic cyber event by stimulating the adoption of best practices through insurance requirements and creating incentives to participate in programs that reduce risk for everyone connected to the internet.”
Cybersecurity in President Trump’s America: The First 100 Days
“The divisive US presidential election was heavily influenced by an explosion of social media and the rise of hacking. If any one fact is certain it is that technology is the new normal. During his first 100 days in office President-elect Trump will be tasked with solving a number of policy challenges that require a technological solution, like modernizing the economy, encouraging business innovation, determining immigration and visa policy, and protecting the United States government and companies from attack.”
DHS Helps You Make Your Control Systems More Secure
“This past August, the Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC) received notice that a remote attacker had used a zero-day exploit against the maritime transportation sector. The attacker exploited an SQL injection vulnerability in a web-based application used by multiple U.S. ports that provides real-time access to operational logistics information, resulting in a loss of valuable data.
Once notified of this cyber attack, the NCCIC’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) notified potentially-affected U.S. ports about the threat through an alert which details the specific vulnerability and provides preliminary mitigation measures. ICS-CERT also contacted the vendor of the application that had been exploited to learn additional details about the vulnerability and the status of an available patch. ICS-CERT successfully notified all U.S. ports that used the software and confirmed that they acquired and installed the necessary patch. ICS-CERT also shared the alert with relevant international partners and encouraged them to install the patch.”
China
Microsoft, Intel, IBM Push Back on China Cybersecurity Rules
“Tough new Chinese cybersecurity rules are providing a rare, behind-the-scenes look at a regulatory skirmish between U.S. technology companies and Beijing. China is moving to require software companies, network-equipment makers and other technology suppliers to disclose their proprietary source code, the core intellectual property running their software, to prove their products can’t be compromised by hackers.
Tech companies are loath to offer up their source code, saying this will heighten the risk of their code falling into the hands of rivals or malefactors—and may not guarantee it is hack-proof. Microsoft Corp., Intel Corp. and International Business Machines Corp. are among those filing objections.”
China’s New ‘Cybersecurity Rules Look Like Cyberprotectionism Instead
“A recently published U.S.-China Economic and Security Review Commission report notes China’s stricter new security requirements for information and communication technology due to purported cybersecurity concerns. The report comes on the heels of a hearing last month at the Office of the U.S Trade Representative, where U.S. telecommunications industry raised specific concerns about the new Chinese cybersecurity rules, which some fear may create market access barriers and discriminate against foreign information and communication technologies.”
Pentagon Links Chinese Cyber Security Firm to Beijing Spy Service
“A Chinese cyber security firm is covertly working with Beijing’s Ministry of State Security intelligence service in conducting cyber espionage operations, according to Pentagon intelligence officials. The company known as Boyusec, officially the Bo Yu Guangzhou Information Technology Co., is also working with China’s global telecommunications company Huawei Technologies, which has been identified by U.S. intelligence agencies as linked to the Chinese military.”
China, Hong Kong Firms Face Highest Level of Cybersecurity Risk, Says PwC
“Chinese companies have seen a more than 900 per cent increase in cybersecurity incidents since 2014, following the country’s rapid adoption of connected devices and a dip in regional cybersecurity budgets, according to a survey by PricewaterhouseCoopers.In 2014, only 241 security incidents were reported, compared to 2,577 so far this year, equal to a 969 per cent increase, according to PwC’s Global State of Information Security survey.”
EU
Brussels Plans to ‘Turbo Boost’ Defence Spending
“Brussels is to unveil plans to “turbo boost” spending on cyber security, war ships and drone technology as part of a multibillion-euro European Defence Fund, which comes as US president-elect Donald Trump presses Nato allies to significantly increase military spending.”
Germany
Suspected Hackers Knocks German Households Offline
“About 900,000 internet customers experienced severe internet outages over the weekend in what Deutsche Telekom has blamed on an apparent indiscriminate cyberattack. “We believe that influence was exerted on the routers from outside,” an unnamed company spokesman told the AFP news agency, noting that malware had been installed on routers that prevented them from connecting to the company’s network.”
India
Cyber security in cashless era: Will India fight AK-47s with lathis?
“As India attempts a transition to a cashless society, cyber security experts raise serious concerns about India’s preparedness. With the lack of sophisticated defence systems, experts say India is prone to attacks that could cause public chaos. Gulshan Rai, the national cyber security chief in the Prime Minister’s Office (PMO), admits there are several challenges. He told TOI from Delhi: “It is a mindset question but India has the wherewithal to address concerns.” ”
Israel
US, Israel Set to Boost Teamwork on Cybersecurity
“Israel and the United States are poised to collaborate more closely on cybersecurity research and development as lawmakers passed two bills that aim to strengthen the collaboration between the nations. The US House of Representatives on Tuesday unanimously passed legislation introduced by Reps. John Ratcliffe of Texas and Jim Langevin of Rhode Island. The bills, the United States-Israel Advanced Research Partnership Act of 2016 and the United States-Israel Cybersecurity Cooperation Enhancement Act of 2016, now await action in the Senate.”
Russia
Putin Brings China’s Great Firewall to Russia in Cybersecurity Pact
“Russia has been working on incorporating elements of China’s Great Firewall into the “Red Web”, the country’s system of internet filtering and control, after unprecedented cyber collaboration between the countries. A decision earlier this month to block the networking site LinkedIn in Russia is the most visible in a series of measures to bring the internet under greater state control. Legislation was announced this month that gives the Kremlin primacy over cyberspace – the exchange points, domain names and cross-border fibre-optic cables that make up the architecture of the internet.”
Russia Claims that Foreign Spies Want to Sabotage Its Banks with Cyber Strikes
“The Russian Federal Security Service (FSB) has claimed that foreign spies want to disrupt the country´s financial system on December 5, through a major cyber strike that could cause an incredible damage. Without saying which could be the nations involved in this conspiracy, Russia also stated that the main goal from the foreign spies is to sabotage the most important banks in several dozen cities.”
UK
Bank of England Recruits Fintech Firms to Ramp Up Cybersecurity Drive
“The Bank of England is working on new ways to warn banks and other finance firms about cyberattacks in real time, so the City of London can put its defences on full alert against online fraudsters and saboteurs, the central bank’s top fintech executive has revealed. Officials are getting financial technology (fintech) firms into Threadneedle Street to work on ways to use new systems to combat fraud.”
UK Homes Lose Internet Access After Cyber-Attack
“More than 100,000 people in the UK have had their internet access cut after a string of service providers were hit by what is believed to be a coordinated cyber-attack, taking the number affected in Europe up to about a million. TalkTalk, one of Britain’s biggest service providers, the Post Office and the Hull-based KCom were all affected by the malware known as the Mirai worm, which is spread via compromised computers.”
Insurance
Audit Hits Regulator for not Testing Brokerage Firms’ Cyber Security Policies
“The U.S. Commodity Futures Trading Commission failed to verify whether futures and swaps brokerage firms have adequate policies to help ward off cyber attacks, an internal CFTC audit found. The audit was completed in October by Brown & Company CPAS and Management Consultants PLLC at the request of the CFTC’s inspector general. It found that the CFTC, in conducting cyber security examinations of the firms, did not employ a “risk-based approach” to “independently test results of the cybersecurity assessments” it did.”
Feature
What Trump Can Do About Cybersecurity – Bloomberg View
“When Donald Trump takes the oath of office on Jan. 20, he’ll face an urgent and growing threat: America’s vulnerability to cyberattack. Some progress has been made in fortifying the nation’s digital defenses. But the U.S. is still alarmingly exposed as it leaps into the digital age. If the 45th president wants to make America great again, he needs to address this growing insecurity.”
What Executives Need to Know About Managing D&O Liabilities: Allianz Report
“Company directors and senior managers across the globe are increasingly likely to face costly regulatory investigations, criminal prosecutions or civil litigation, which not only put their company’s assets, and their own assets, at risk, but also may threaten their personal liberty, according to a report published by Allianz Global Corporate & Specialty.”