ICD Brief 43.
29.05.2017. – 04.06.2017.
A global brew of terror and politics frames our cyber updates this week. Updates from the US, Australia, Estonia, China, the EU, Germany, India, Israel, Japan, NATO, Netherlands and the UK focus on the offensive, regulations, many new bilateral working partnerships. We are an unsettled world, searching for order and stability.
Welcome to the 43rd edition of our ICD weekly Brief. A year ago, most activity concerning cyber was still mired in plans and frameworks. I decided to focus on what was working and share it with a few friends and colleagues. Today, our readers are in 42 countries and each comes to us through an introduction or reference. In the near future, we will add interviews as well as return to our signature roundtable discussions.
“Cybersecurity should not be left completely to the military and intelligence agencies, according to former CIA and National Security Agency chief Michael Hayden. In his keynote speech at the ZertoCON user conference in Boston last week, Hayden said the private sector needs to step up and do its part in stopping cyberthreats in the internet age.”
“A special report on cybersecurity during the era of Donald Trump is featured in the latest edition of the ISMG Security Report. In the Security Report, you’ll hear (click on player beneath player to listen) excerpts from the May 16 keynote panel at Information Security Media Group’s Breach Prevention Summit in Washington.”
“Two U.S. senators have introduced a bill that would create a bug bounty program for the Department of Homeland Security (DHS), but industry experts warned those participating in the program need to be properly vetted.”
“Many in the federal IT community waited months longer than expected for President Donald Trump to sign an executive order on cybersecurity, wondering, “What will this mean for my agency?” The first concrete answers to that question started showing up last week with the release of the administration’s fiscal 2018 budget proposal, especially for the Department of Homeland Security.”
“I don’t know if people have really realized what’s possible,” hacker Jared DeMott tells CNBC. “We all live with a gross amount of insecurity.” DeMott, a Ph.D. whose very first job out of college was at the NSA, is working about as hard as a person can to help Americans better understand the threat posed by cyber-criminals — and the ways to protect yourself and your data.”
“Prime Minister Malcolm Turnbull launched Australia’s cybersecurity strategy in April 2016, and more than one year on, there’s work to be done. Upon launch, the strategy was criticised for its lack of funding and vague goals. Among other targets, it aimed to ensure more information was shared between government agencies and the private sector about cyber threats, and that universities were training “skilled cyber security professionals”. The recent Australian Strategic Policy Institute’s (ASPI) publication “Australia’s cyber security strategy: execution & evolution” is something of a report card on the government’s progress so far. The aim of the strategy was to improve the security of Australian government organisations as well as businesses and individuals, and while ASPI said there had been “significant encouraging progress”, it also noted investment in a number of key goals has been insufficient. The Conversation asked a panel of experts to weigh in: how is the government doing 12 months into its cybersecurity strategy?”
“Australia and Singapore have agreed to strengthen cybersecurity cooperation, with a two-year Memorandum of Understanding (MOU) signed on Friday (Jun 2). Key areas of collaboration include having a regular exchange of information on cybersecurity incidents and threats, sharing best practices to promote innovation in cybersecurity, training in cybersecurity skillsets, and having joint exercises that focus on the protection of critical information infrastructure.”
“Almost 600 key experts and decision makers of the global cyber defence community have gathered in Tallinn, Estonia, for the international conference on cyber conflict, CyCon 2017.The event, opened on 31 May by the Estonian president, Kersti Kaljulaid, will see keynotes delivered by admiral Michelle Howard, the Commander of the US Naval Forces Europe; the control system security consultant, Ralph Langner; Katie Moussouris of Luta Security; professor Michael Schmitt; the chair of the Global Commission on the Stability of Cyberspace, Marina Kaljurand; and others.”
“China consistently ranks as the world’s worst abuser of internet freedom. A law on cyber security, which took effect on Thursday, is no doubt intended to tighten Beijing’s grip on the speech and thought of its citizens. As if this were not bad enough, the law will also serve as a barrier to global companies operating in China and impede Chinese companies’ ability to compete on the global stage.”
“China’s cybersecurity law (CSL) officially took effect on Thursday. The New York Times warns that “as China moves to start enforcing a new cybersecurity law, foreign companies face a major problem: They know very little about it.” Certainly, the language of the law is broad and ambiguous, and that vagueness creates problematic uncertainties. But we actually know more about how the CSL might operate in practice than it seems at first glance.”
“Since Russia’s intervention in eastern Ukraine, the three Baltic States – Estonia, Latvia and Lithuania – have been particularly worried they could be the next targets of military aggression. While a conventional attack remains a major source of fear in Vilnius, Riga and Tallinn, cyber-attacks are increasingly perceived as a potential hybrid warfare threat by the Baltics.”
“Cyber security is a rapidly evolving sector. Oftentimes, regulatory frameworks lag behind the latest developments. And when legislators finally act, companies, institutions and other influencing stakeholders must be fully aware of newly implemented regulations. In 2018, the new European Union (EU) regulation on data, cyber and information security will be a game changer. Here’s why.”
“German intelligence has informed the United States that it is not looking for help staving off the same kind of election hacking attributed to Russia during the U.S. campaign, NBC News reported Tuesday. The refusal is “a sign of the lack of trust that seems to be growing between Germany and the United States,” NBC said.”
“Dark web intelligence, bio-authorization and even plain old cloud security: Cybersecurity commands a futuristic and slightly dystopian-sounding lexicon. One term that may well become more familiar is deception technology. It’s a small but growing field that has sparked the interest of some of the largest multinational companies. Israeli startup illusive networks, which is the way they spell it – no capital letters for a deception technology firm, and Germany-based pharmaceutical and life sciences company Merck KGaA, Tuesday announced a deal for the use of illusive‘s “Deception Everywhere” cybersecurity technology.”
“India and Spain on Wednesday signed seven agreements, including on cooperation in cyber security and renewable energy, following talks here between Prime Minister Narendra Modi and his Spanish counterpart Mariano Rajoy. The two countries signed a memorandum of understanding (MoU) on cooperation in cyber security. A second MoU was signed on cooperation in renewable energy.”
“Israel is home to almost 300 cybersecurity companies. Check Point Software (CHKP) and CyberArk (CYBR) are among the well-established cybersecurity companies with roots in Israel. Tax breaks and the Israeli government’s funding have provided a fertile environment for startups to grow. Investment in Israeli cybersecurity companies rose 23% from $560 million in 2015 to $689 million in 2016, according to investment firm YL Ventures. Microsoft is interested in the cybersecurity space and seems to find Israel an attractive source of investment.”
“With the recent wave of ransomware attacks highlighting the dangers of growing internet connectivity across the world, Japan is looking toward Israel’s military-linked expertise in cybersecurity to protect its networks ahead of the 2020 Tokyo Olympics. Hiroshige Seko, Japan’s minister of economy, trade and industry, signed an agreement with Israel in early May for greater cooperation on cyberdefenses. This marks the first cabinet-level deal between the two countries on cybersecurity.”
“NATO plans to bolster its ability to respond to cyberattacks and cybercrime by developing tools that can deter attacks on critical military and civilian network infrastructure. The development of NATO defensive and offensive cyber weaponry is tasked to the Western alliance’s dedicated cyber unit, which forms part of NATO’s Supreme Headquarters Allied Powers Europe, or SHAPE.”
“A new consortium of six Dutch cyber security companies promised to not be taken over by foreign parties in order to best protect the cyber-side of important Dutch infrastructure. They feel that Dutch national interests and state secrets are best protected by Dutch companies. With this strategy the cyber security companies are taking advantage of controversy that arose when Fox IT was bought by a British investor in 2015, Financieele Dagblad reports.”
“The UK’s Trident submarine fleet is vulnerable to a “catastrophic” cyber-attack that could render Britain’s nuclear weapons useless, according to a report by a London-based thinktank. The 38-page report, Hacking UK Trident: A Growing Threat, warns that a successful cyber-attack could “neutralise operations, lead to loss of life, defeat or perhaps even the catastrophic exchange of nuclear warheads (directly or indirectly)”.”
“Nearly a third of UK firms have no cybersecurity insurance, according to a new study. The study, conducted by FICO and Ovum, found that 31% of UK executives said their firm had no cybersecurity insurance. The UK is doing slightly better than other countries surveyed, where an average of 40% of firms lacked cyber coverage.”
“British cyber security start-up Panaseer has raised $3.25m (£2.5m) in the wake of the global WannaCry ransomware attack to develop its product and make further inroads into the US. Panaseer uses data analytics to look for risks within companies’ computer systems and mitigate them before they can be used by cyber criminals.”
“According to Duff & Phelps’ “Global Regulatory Outlook,” 86 percent of professionals in the financial services industry say their companies have plans to put more time and resources into cybersecurity in the coming year. The truth is, financial services organizations aren’t alone when it comes to taking cybersecurity very seriously. Governments and other regulatory organizations have also put financial services cybersecurity in the spotlight over the past year. Let’s take a closer look at a few of these instances.”
“Worldwide healthcare cyber security market volume was evaluated at nearly about 5.48 million US dollars in the year 2014 and is predicted to observe good market growth during the forecasted span. Key aspects contributing to the fast expansion and growth of the industry includes growing threats of cyber crimes, security compliance and regulatory control issues as well as issues pertaining to leaking of confidential information from within the firm caused by the internal aspects as well as external aspects. Further, few of the growing examples such as patient intrusion, intellectual property thefts, confidentialities of business, loss & damage of electronic records of patients, medical identity fraud, social security records and health records of patients are also predicted to enhance the product utilization in the area of healthcare sector during the estimated period.”
“Hackers use many different methods to invade your computer, so you’ll want to approach the problem from several angles. Think of it like a rancher leaning on the fence to make sure it’s still sturdy. Here are some ways to keep that fence from falling over.”
“With ransomware like “WannaCry” sowing chaos worldwide and global powers accusing rivals of using cyberattacks to interfere in domestic politics, the latest edition of the world’s only book laying down the law in cyberspace could not be more timely. The Tallinn Manual 2.0 is a unique collection of law on cyber-conflict, says Professor Michael Schmitt from the UK’s University of Exeter.”