Category: Safeguards

Jul 11 2017

DHS and FBI – Hackers Are Targeting US Nuclear, Energy, and Manufacturing Facilities

According to a new joint report issued by the US Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI), hackers have been penetrating the computer networks of companies that operate nuclear power stations, energy facilities, and manufacturing plants in the US since May 2017. The joint report carried an urgent amber warning, which is the second-highest rating for the sensitivity of a threat. The report was publicized by the New York Times last week.

According to the report, an “advanced persistent threat” actor was responsible for the attacks, which has included thus far:

  • Hackers writing targeted email messages containing fake resumes for control engineering jobs and then sending them to senior industrial control engineers who have access to critical industrial control systems. The resumes were Microsoft Word documents that contained malicious code. Once the recipient clicks on the document, the attackers copy the recipient’s credentials and access the network.
  • Hackers compromising websites they know their victims visit (watering hole attack).
  • Hackers redirecting the victims’ internet traffic through their own machines (man-in-the-middle attack).

The report does not say whether the cyber intrusions are an attempt at espionage, or part of a plan to cause physical damage. Nor is there any indication as to how many facilities were compromised. The report does state, however, that the hackers appear to be mapping out computer networks for future attacks.

In a joint statement issued by the DHS and FBI, a spokesperson for the DHS said “There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks.” John Keeley, a spokesperson for the Nuclear Energy Institute (which works with the 99 utilities that operate nuclear plans in the US), said nuclear facilities are required to report cyber attacks that relate to their safety, security and operations. None have reported any cyber attacks thus far.

On May 11, as the attacks were ongoing, President Trump signed an executive order to strengthen the cybersecurity of federal networks and critical infrastructure.

If you or your enterprise is engaged in the energy or manufacturing sectors, cyber threat preparation and monitoring is your first line of defense against bad actors. Dentons’ team of cybersecurity experts can assist you in establishing and implementing an effective and compliant incident response plan and set of programs to monitor internal and external threats, including threat intelligence and access control and vulnerability assessments.

Dentons is the world’s largest law firm, a leader on the Acritas Global Elite Brand Index, a BTI Client Service 30 Award winner, and recognized by prominent business and legal publications for its innovations in client service, including founding Nextlaw Labs and the Nextlaw Global Referral Network. Dentons’ global Privacy and Cybersecurity Group operates at the intersection of technology and law, and was recently singled out as one of the law firms best at cybersecurity by corporate counsel, according to BTI Consulting Group.  

May 23 2017

President Trump’s Budget Requests $1.5B For Homeland Security Cyber Unit

President Trump’s new budget includes a request to increase cybersecurity personnel and funding across several federal departments, including $1.5 billion for the Department of Homeland Security’s (DHS) National Protection and Programs Directorate (NPPD). The NPPD is a DHS unit responsible for protecting US infrastructure from cyber threats. The DHS is responsible for protecting critical infrastructure and federal networks from cyber intrusions.

The budget document, released by the Office of Management and Budget earlier this morning, states: “The Budget supports the President’s focus on cybersecurity to ensure strong programs and technology to defend the Federal networks that serve the American people, and continues efforts to share information, standards, and best practices with critical infrastructure and American businesses to keep them secure[.]” The budget document also proposes to increase law enforcement and cyber personnel at DHS, the FBI and Department of Defense.

The President’s budget comes on the heels of his recent Executive Order aimed at strengthening cybersecurity across federal networks, critical infrastructure, and the nation writ large. It also comes in the wake of federal departments and agencies, such as DHS, Health and Human Services, and the Securities and Exchange Commission, focusing their efforts on cybersecurity in medical devicesmobile devices, financial services, and the Internet of Things (IoT).

 

May 19 2017

US Government Accountability Office Releases New Report On The Internet of Things (IoT)

On May 15, 2017, the US Government Accountability Office (GAO) released a new report entitled “Internet of Things: Status and implications of an increasingly connected world.” In the report, the GAO provides an introduction to the Internet of Things (IoT), describes what is known about current and emerging IoT technologies, and examines the implications of their use. The report was prepared by reviewing key reports and scientific literature describing current and developing IoT technologies and their uses, concentrating on consumers, industry, and the public sector, and interviewing agency officials from the Federal Trade Commission (FTC) and Federal Communications Commission (FCC). The GAO also convened a number of expert meetings during the drafting process, bringing together experts from various disciplines, including computer science, security, privacy, law, economics, physics, and product development.

Technological Advancements Leading To IoT Surge

The GAO identified four technological advancements that have contributed to the increase in IoT devices:

  • Miniaturized, inexpensive electronics. According to the GAO, the cost and size of electronics are decreasing, making it easier for the electronics to be embedded into objects and to be enabled as IoT devices. For example, the price of sensors has significantly declined over the past decade. One sensor called an accelerometer cost an average of $2 in 2006. The average price of the unit in 2015 was $.40.
  • Ubiquitous connectivity. The GAO notes that the expansion of networks and decreasing costs allow for easier connectivity, and for IoT devices to be used almost anywhere. The proliferation of Wi-Fi options and Bluetooth creates a more expansive space for IoT to operate.
  • Cloud computing. Cloud computing allows for increased computer processing. Because IoT devices create a large amount of data, they require large amounts of computing power to analyze the data. The increase and availability of cloud computing is helping IoT devices expand.
  • Data analytics. New advanced analytical tools can be used to examine large amounts of data to uncover hidden patterns and correlations. According to the GAO, advanced algorithms in computing systems can enable the automation of data analytics, and allow for valuable information to be collected by IoT devices.

Common Components Of IoT Devices

The GAO identifies three major components that make up nearly all IoT devices: (1) hardware, (2) network connectivity, and (3) software. The hardware used in IoT devices generally consists of embedded components, such as sensors, actuators, and processors. Sensors generally collect information about the IoT environment, such as temperature or changes in motion. Actuators perform physical actions, such as unlocking a door. And processors serve as the “brains” of the IoT device. The network component of an IoT device connects it to other devices and to networked computer systems. And the software in IoT devices perform a range of functions, from basic to complex. These three components are common across the IoT industry, and serve as the bedrock foundation for understanding the security challenges facing the IoT space.

Benefits and Uses

According to the GAO, the benefits and uses of IoT for consumers, industry and the public sector are widespread. From wearable IoT devices, such as fitness trackers, smart watches and smart glasses, to smart homes, buildings and vehicles, IoT is changing the landscape of consumer products and how people interact with their space. IoT is also impacting supply chain and agriculture industries, enhancing productivity and efficiency.

Potential Implications

With these benefits comes potential risk. The GAO report identifies five risk categories presented by the onset of new IoT technology: (1) information security; (2) privacy; (3) safety; (4) standards; and (5) economic issues.

  • Information security. The IoT brings the risks inherent in potentially unsecured information technology systems in homes, factories, and communities. IoT devices, networks, or the cloud servers where they store data can be compromised in a cyberattack.
  • Privacy. Smart devices that monitor public spaces may collect information about individuals without their knowledge or consent.
  • Safety. Researchers have demonstrated that IoT devices, such as connected automobiles and medical devices, can be hacked, potentially endangering the health and safety of their owners.
  • Standards. IoT devices and systems must be able to communicate easily. Technical standards to enable this communication will need to be developed and implemented effectively.
  • Economic issues. While impacts such as positive growth for industries that can use the IoT to reduce costs and provide better services is a beneficial outcome, economic disruption is also possible, such as the need for certain types of businesses and jobs that rely on individual interventions, including assembly line work or commercial vehicle deliveries.

As IoT technology increases, so too will the regulatory landscape governing its use. Although there is no single US federal agency that has overall regulatory responsibility for IoT, various agencies oversee or regulate aspects of the IoT, such as specific sectors, types of devices, or data. If you or your business is operating, or plans to operate in the IoT space, the Dentons’ global Privacy and Cybersecurity group can help you navigate this fast-paced, and shifting environment.

Dentons is the world’s largest law firm, a leader on the Acritas Global Elite Brand Index, a BTI Client Service 30 Award winner, and recognized by prominent business and legal publications for its innovations in client service, including founding Nextlaw Labs and the Nextlaw Global Referral Network. Dentons’ global Privacy and Cybersecurity Group operates at the intersection of technology and law, and was recently singled out as one of the law firms best at cybersecurity by corporate counsel, according to BTI Consulting Group.  

May 19 2017

SEC Issues Cybersecurity Alert For Brokers And Financial Advisers

On May 17, 2017, the US Securities and Exchange Commission (SEC), through its National Exam Program, issued a “Risk Alert” to broker-dealers, investment advisers and investment firms to advise them about the recent “WannaCry” ransomware attack and to encourage increased cybersecurity preparedness. The purpose of the alert, according to the SEC, was to “highlight for firms the risks and issues that the staff has identified during examinations of broker-dealers, investment advisers, and investment companies regarding cybersecurity preparedness.”

Based on a 2015 survey of 75 SEC registered broker-dealers, investment advisers and investment firms, the SEC National Exam Program staff recognized certain firm practices that registrants may find relevant when dealing with threats such as the WannaCry ransomware attack:

  • Cyber-risk Assessment: Five percent of the broker-dealers, and 26 percent of the investment advisers and investment companies examined “did not conduct periodic risk assessments of critical systems to identify cybersecurity threats, vulnerabilities, and the potential business consequences.”
  • Penetration Tests: Five percent of the broker-dealers, and 57 percent of the investment companies “did not conduct penetration tests and vulnerability scans on systems that the firms considered to be critical.”
  • System Maintenance: All broker-dealers, and 96 percent of investment firms examined “have a process in place for ensuring regular system maintenance, including the installation of software patches to address security vulnerabilities.” And only ten percent of the broker-dealers, and four percent of the investment firms examined had a significant number of critical and high-risk security patches that were missing important updates.

The SEC recommends registrants undertake at least two separate tasks: (1) assess supervisor, compliance and/or other risk management systems related to cybersecurity risks; and (2) make any changes, as may be appropriate, to address or strengthen such systems. To assistant registrants, the SEC highlights its Division of Investment Management’s recent cybersecurity guidance, and the webpage of the Financial Industry Regulatory Authority (FINRA), which has links to cybersecurity-related resources.

The SEC cautions that the recommendations described in the Risk Alert are not exhaustive, “nor will they constitute a safe harbor.” Factors other than those described in the Risk Alert may be appropriate to consider, and some factors may not be applicable to a particular firm’s business. Moreover, future changes in laws or regulations may supersede some of the factors or issues raised in the Risk Alert. Ultimately, the “adequacy of supervisory, compliance, and other risk management systems can be determined only with reference to the profile of each specific firm and other facts and circumstances.”

The SEC recognizes that it is not possible for firms to anticipate and prevent every cyber-attack. However, “appropriate planning to address cybersecurity issues, including developing a rapid response capability is important and may assist firms in mitigating the impact of any such attacks and any related effects on investors and clients.”

Dentons is the world’s largest law firm, a leader on the Acritas Global Elite Brand Index, a BTI Client Service 30 Award winner, and recognized by prominent business and legal publications for its innovations in client service, including founding Nextlaw Labs and the Nextlaw Global Referral Network. Dentons’ global Privacy and Cybersecurity Group operates at the intersection of technology and law, and was recently singled out as one of the law firms best at cybersecurity by corporate counsel, according to BTI Consulting Group.