Tag: Cyber Security

Modern Information Warfare Hits Hard

2016 was just the latest in #cyberwar; and #informationwarfare attacks where even bills were introduced in Congress. It has been ongoing as long as there have been digital mediums and technologies; and information distribution technology. My company saw it happening last year and got more and more concerned as the election grew closer. We literally wrote letters to people in government, people at the DNC and elsewhere, basically yelling as loudly as we could that the #USA was being cyber and information warfare attacked.

 

As a cyber security, and weaponized information expert – it was all too clear what was happening. It has left a feeling of being sick in the stomach for a year now, and this feeling has not abated. Because it has not ended. For millions of Americans and millions of people around the world too.

 

The Unites States is witnessing both the worst and best it can show at once. The worst by all the traitors amongst us: those pretending we were not just victims of a non lethal act of war.

 

The best by all those in and out of government banding together to excise the cancer from the nation; regardless of the risks and dangers.

 

Some cyber and information warfare players have been better than others. Some have taken a longer term perspective than others. Nation states that have invested heavily into cyber technologies and offensive information warfare technologies are multiplying every year.

 

It is not just the domain of: Russia, Iran, North Korea, China, Ukraine, the UK, France, USA and other large or technologically advanced countries. It is now the domain of any country who decides to invest in the people and the technology and take a longer term view than the average hacker for hire.

 

Sun Tzu believed that “all warfare is deception,” — but where does that leave the average person; who does not understand they are caught up in forces through control of information; that they can neither understand or ever hope to control?

 

I spoke at the US Army CyberTalks in NYC in 2016 on “Global Cyber Security on Earth and in Space.”

One of the points I made; was that almost all of our lives are not just locked up in databases in offices or on the cloud somewhere. But indeed, flying through the ether every millisecond of our lives. Hundreds of companies; and dozens or more countries have the capabilities to hack into it, to manipulate it, change it and even delete. 24 hours a day, with lots and lots of ways for data to be intercepted, changed, made into FUD. (Look it up – means F*#$ed Up Data) – or just simply deleted. Not to mention when the data flying through the ether becomes weaponized by either a Nation State or a Company or a bad actor group or individual with ill intent.

The implications on the types of information warfare that Russia is enacting on the US and the Western Coalitions; is that it is multi level, persistent, and consistent. It is coming in through a combination of weaponized social media, fake websites, fake news, automated bots as well as hacking, intrusions and exfiltrations of data that then become weaponized. It is happening in multiple countries, with a huge budget and thousands of people behind the execution of it. This was the path the Russians took in 2016: a multi pronged effort, all across the United States, focused on Federal, State, and Local authorities. This included national and state political leaders, parties and their allies, as well as election vendors and election technology across the spectrum.

To be extremely clear, the efforts that Russia leveraged as non lethal acts of War against the USA – are still ongoing. They never stopped. Indeed, 2016 was just a continuation of Russia’s long game in cyber and information warfare.

So now we need to take action steps as a country to come together. We need to put aside political partisanship and simply deal with what we have to deal with in terms of investigations and cleaning house. Of all those who played a role in the greatest act of treason since Benedict Arnold tried to give West Point to the King’s Army. All of the people in the United States who played any part in supporting this treasonous Act of War should pay.

Just like General Arnold did.

This is a time for the decision to be made. Are you Partisan, and metaphorically selling out West Point by supporting those who sold out the USA to Russia?

Or are you a Patriot — and going to fight for your country to not disappear by virtue of some digital exhaust of ongoing, persistent information warfare + cyberwar?

Nathan Hale was America’s first spy to be killed in action. When being hanged by the British – he is reported to have said this most famous quote: “I only regret that I have but one life to lose for my country.” Hopefully none of us have to be in such a dangerous position. But we are in a place in history where Patriots are already at work, saving our country.

What are you?

 

*When your kids ask you what you did to stop this non lethal act of war, what will you say?*

Digijaks CEO Speech at US Army CyberTalks NYC

 

#CyberSecurity #DigitalDiplomacy 2017

#Digitaldiplomacy and #Cybersecurity on a Rough Patch in 2017.

The last several years have seen an explosion of digital diplomacy tools and techniques. This is driven by an ongoing growth in technology platforms; and social media combined with the increased numbers of world Governments adopting open data and open government principles. There has also been a parallel explosion in fake social media, fake news and fake information being propagated globally.

The effect of the combined forces is that cybersecurity is now playing an even more vital role in digital diplomacy. Where digital diplomacy just a few years back was between recognized principals of Governments, now there are lots of other players trying to make that communication much more failure prone.

Additionally we now have leaders using Twitter and other tools to communicate directly with each other and or to directly go around the news media.  Just in the first few months of 2017 alone, we have witnessed multiple world leaders using Twitter to speak in ways that are different from the stated policies of their countries, or to put pressure on other countries through this most public of mediums.

There have been recent successes and failures. I wrote about some of these a few years back. We have also seen a tremendous growth in what I call “anti digital diplomacy” thru the concerted use of fake social media accounts, fake news websites, and fake statistics designed to make the role of real diplomats much harder.  While some of this is innocuous, much of it is organized and part of larger cyber deception plots being run by larger nation states.

Western European countries are currently experiencing the same types of digital attacks on their electoral systems, including the use of selective leaking of compromised materials that the US experienced in 2016. Which means that hacking, and hackers have been deeply involved too. One does not get compromised materials without someone first doing the exfiltration of the information from its original home.

Which brings the question of what role cybersecurity needs to play in digital diplomacy? It is a dynamic situation now with asymmetrical threats and increased attack surface area affecting the very direct communications that digital diplomacy allows.

Governments, Diplomats and the media alike need to be trained and continually updated on how to spot fake accounts, fake news, fake websites, and how to ensure only officially verified information is being transmitted through the digital diplomacy channels. Additionally steps need to be taken on dealing with constituents and the news media to ensure that fake information is put down quickly with the truth and facts to back it up.

Diplomats across the globe have already been caught up in re-tweeting fake news or getting trolled by fake accounts. But there needs to be a verification role too, that is played with the public, especially in terms of proving the falsity of fake information being purposely distributed.

Further, steps need to be taken to lock down accounts with two factor authentication, very strong passwords and strict internal organizational controls on who uses the digital diplomacy tools and how.  Cybersecurity needs to be incorporated into every decision and every level of communications, both internally and externally.

Finally, Governments and Companies around the world need to adopt a rapid response routine to deal with both fake news and fake information coming from non-official sources, as well as from official sources or official twitter accounts. The World now has several leaders who seem to want to try to use Twitter to go around their local politics and news media and or tell the world an un-true or incoherent story. If Diplomats are not ready to respond to falsities or cyber-attack driven leaks quickly, then they will be playing a constant game of catch up. True for the news media and global citizens alike.

Reputation Control = Personal Cyber Security

20160530_113758

The Internet can be an upside down, sideways kind of place when your own Reputation is at stake. Topsy-turvy doesn’t even begin to cut it when your personal cyber security has been breached, leading to a reputation loss, disaster or ongoing problems.

2016 has shown how vulnerable every person who uses the internet, social media, online banking, email, websites, mobile apps and even IoT devices. Almost daily we hear about this company or that corporation getting hacked, even government agencies. But how often do you think about your own personal digital space? Your online reputation? Your personal cyber security with regard to online banking, social media, emails, and all the other information you are generating?

Reputation Control and Reputation Management
Cyber Security, Social Media, You.

The current popular mythology that most hacking of reputations is caused because of 3rd party cyber breaches or loss of information not in the control directly of each person. While this is a big driver, there is an equally big driver of small players, disgruntled individuals, and just plain mean people.

These nasty people who delight in doxxing people, in revealing what was previously not revealed, and at the higher levels, ex spouses, former business partners, parties in lawsuits, and even corporate trolls can take down someone’s reputation, often hard earned over year, in a matter of seconds.

Digijaks CEO Alan W. Silberberg has written and gives speeches about the crucial link between personal cyber security, social media and search.

Most people think they are just sitting ducks, waiting around till some hacker or some angry person goes after them, and then will deal with it after the fact.

This is 100% the wrong approach. You need to be pro-active, and this is true for your reputation, that of your business, and that of your family all at the same time.

Below are some simple steps to protect your own reputation online and simultaneously practice good personal cyber security hygiene.

  • Own two cellphones. One on a carrier plan, and pre-paid burner phone. The reason is to separate important login information from your main email account and phone and have a second way to authenticate with two factor authentication. This helps to prevent the trap of one phone, one email, multiple two-factor authentications flowing to them. If the one device gets compromised so does your whole life. With two combined with strategically breaking it up; it becomes much harder for a criminal or bad actor to mess up your entire life all at once.
  • Use two factor authentication on email, online banking, important logins like Apple or Google or Microsoft or Yahoo or Paypal etc.
  • Separate the financial and other important information and create a second email address and use a pre – paid burner phone to keep the important two factor authentication requests separate from those for social media, or Iot devices.
  • Own your own name. Buy a domain name in your name, lock it down so it cannot be transferred without your approval.
  • Own your own name. Register on social media in your own name, and use the accounts at least semi regularly.
  • Set up google alerts in your name, in the name of your family and business. This will automatically alert you when your name pops up in search. This helps to have early notification of what may be an indicator of something being wrong.
  • Be 100% assured that if you are in a legal action, or a dispute, that the other parties can and will try to harm you with release of information.
  • Be 100% assured that if you are in a high profile job, position, or have been in the media recently, that someone, somewhere is trying to figure out how to get money from you, to embarrass you, or even stop you.
  • The reality of the ever on 24×7 digital world we are find ourselves occupying in 2016 is it really is just a matter of when, and not if, something is going to happen. It may be a hack of a 3rd party who has your information, or it may be someone deciding to take you down a notch or several. It is not if, but when.

 

Talk at GEOINT 2016 by DIGIJAKS CEO

 

#panamapapers + Reputation Control + Cyber Security

Reputation Control and Reputation Management
Cyber Security, Social Media, You.

The Panama Papers as released this past week are a really huge data dump, in fact one much larger in scale than that of Wikileaks, and the largest to date in history.

The project that resulted in this massive public disclosure, was essentially a cyber security lapse leading to a breach.  Following the breach, data exfiltration was executed through leveraging a long known critical failure in the operating system and email servers that were used by the law firm, Mossack Fonseca.

Not only are the Panama Papers a stunning example of a hack that resulted in massive  data exfiltration; thus consequently leading to a global reputation breach. But they are also representative of a slow to change cyber security environment in law firms, corporations and organizations globally.

Drupal, a widely used language for databases and other programs has been constantly been providing critical updates since it’s inception. Users of Drupal have to make the choice to keep their systems up to date, or as in this case, not.

The utter lack of cyber security protocols like updating a server, or dealing with over 25 issued critical updates to the operating system/servers bring to mind other major hacks like the Target Corporation hack where 60,000 alerts were ignored by corporate IT staff. This is the opposite of what cyber security protocols would dictate.

Law firm IT staff need to be amongst the first to adopt these basics; but often times are not, and many international law firms have mediocre to poor network security. In that area, the Panama Papers could be any law firm, anywhere. The reputation loss suffered by the cyber security lapse and breach could be any law firm’s clients, anywhere.

Digijaks has been working with clients for years to address the undeniable link between cyber security and reputation control. The Panama Papers simply serve as one more reason why these issues are so connected and so important to both people and organizations.

 

Reputation Control and Reputation Management

Cybersecurity Dilemna -A Conundrum-

 

co·nun·drum
kəˈnəndrəm/
noun
noun: conundrum; plural noun: conundrums

a confusing and difficult problem or question.
“one of the most difficult conundrums for the experts”

This is the conundrum of the digital age.

One one hand executives of a company will be the first to state they think their systems are secure, and if there are any problems they are small.

or

Maybe they think their information, data and business relationships are not important to hackers because, “too small”, “not on radar screen”, or “we have nothing worth taking.”

But both of these are clearly conundrums:

  • The first is pretty basic, if you think you are secure but have not brought in outsiders to test your systems and people and facilities, then how do you know?
  • The second is also pretty basic, if you think you have nothing to lose, then you might not take stringent security steps necessary, thus making your organization ever more vulnerable.

But- and this is actually more like a because — Organizations have to think and act pro-actively when it comes to cyber security and privacy. True for people too. If you think you have no cyber weaknesses than you do. If you think you have nothing to lose, than you do. If you think no one is interested in your organization because it is too small or not on the radar screen, than you are wrong, and they are.

Now is actually the time to assess your organization’s situation, and that of your people too. Do it now before you get hacked or breached. Because you will get hacked or breached. Be prepared. Don’t be caught behind a truck that just ran over your business and people.

My company Digijaks sees a lot of these types of issues with clients. Preventive medicine works, in healthcare and cyber security. Both need daily hygiene and maintenance and both also need updates, checkins and repair work too.

Reputation Cyber Security of IoT.

Ah, the Internet of Things.

Just the sound of it sends thrills, chills and huge question marks through both technologists and regular people alike.

Just think, you can already do the following:

  • Track your health.
  • Track your kids.
  • Track your home.
  • Talk to your fridge.
  • Talk to your car.
  • Have your fridge, oven, and tv connected to your smartphone, not to mention the video doorbell.

I could go on with this list. But why bother?

The Internet of Things, or IOT as it is called in the media, by analysts and techies alike is an amorphous concept and does not easily translate into everyday speak for the average person.

There are cybersecurity concerns with the overlapping inter-connectedness that are growing exponentially by the month; as more and more devices come on line, get connected to the Internet. Many if not most have little to zero security protocols built in.

There is no current “IOT cybersecurity standard” or anything close. As a result, the apps and tools that seemingly make your life so easy, are in most probability leaking, if not pouring personal information about you or your family onto the internet in ways you may or may not be aware of.

There are reputation control and reputation management issues arising from both the above mentioned inter-connectedness as well as from some basic common sense things that come from having devices connected to the Internet and talking to “home” or each other in ways that also reveal identity, location and other personal information. Some of these IOT apps and tools even tweet or post other social updates for you as reminders, alerts and other pushed out information into public or semi public arenas.

So ask yourself 5 Major IOT for Reputation Questions:

  1. Does everything have to be connected to everything and what happens with a point of failure or with multiple points?
  2. Even if you want to track your whole life, does it need tracking?
  3. Does the good of the device in your life outweigh the bad of the cybersecurity or reputation risks?
  4. Do your kids’ need this tracking on them and beyond knowing where they are, do you want your kids’ information in companies with weak or zero cybersecurity protections?
  5. Do you want your kids’ information broadcast out to the Internet because of auto update or bot tweeting something?

Global Cybersecurity + Venture Capital

We live in a hyper-connected world that brings the globe to you; and you and your family to the globe at equally fast speeds. While on one hand, any one of us can access the internet, through any number of tools, platforms, technology and software and almost any combination too. But on the other hand the internet can and does access us, and all of our information, every minute of every day. Probably more than you and your family access the internet.

One thing that is growing in need and in reality is the international and cross cultural aspects of Cybersecurity. For example, businesses and governments alike in the US and in Israel face similar challenges within similar robust telecom and economic environments. 15 years ago the idea of US and Israeli Cybersecurity companies working together seemed remote or exotic. Speak to anyone in Cybersecurity, and it won’t take long for the Israeli Cybersecurity community to come up. True for Venture Capital in Israel too.

Dr. Orit Mossinson, a Venture Capitalist + founder of Dalai VC – A VC firm that specializes in Cybersecurity – had this to say: “Bringing Israeli Cybersecurity companies through capitalization to becoming the leading edge of how to combat cyberwar efforts, is just beginning. Over the next few years there is going to be massive growth in this unique space.”

My company Digijaks is constantly working with businesses and governments on Cybersecurity. What applies to big business or governments applies to people and families mostly too. That is true in the USA, Israel, UK, Canada, Japan, Singapore, etc,  or any nation considered 1st world with full internet access.

Within as long as it takes to blink an eye, you or your family can get caught up in a Cybersecurity breach leading to a Reputation and search breach. It does not take much, and is not the sole domain of big companies being targeted. Ask yourself, do you have wifi? Is it secure? Do you have devices? Run a business? Pay taxes? Do Online Banking? Any of the above could be the entry into your life by a hacker.

This might sound hard to believe in the era of downloadable feature films in a few seconds and the huge amounts of data coming “down” the “pipes” to our devices. But for every bit of data coming in; we are pouring it right back through apps, games, web browsing, file uploading, liking, tweeting, sharing, and videos and not to mention the IoT — as in your tweeting fridge and internet sharing toaster. Don’t even get started on the lack of cybersecurity for IoT globally. Because there is none. Or very little of note.

There just is not any in most of those devices or apps yet. Don’t kid yourself or mistakenly think you or your families are not being monitored and watched through the IoT. The more devices you have connected, the scale of magnitude of potential monitoring and watching is exponential.

Several years ago the digital exhaust of the average first world person with access to the internet was less than 1000 data points per person roughly. Now scale upwards and it is closer to 20,000 data points per person in their digital exhaust. How many companies are tracking these, and or reselling them to other groups? How many governments? How many hacking groups? Extortionists? Kidnappers? Digital Money Robbers?

When we get invited to address groups about Cybersecurity, they always want to know about their specific devices. Is this safe? Is that dangerous? Cybersecurity is one part hardened data, encrypted data and secure data transport. It is also one part human. Increasingly so, with socially engineered attacks such as phishing and drive by malware hosted on social media or in apps. The human element is about training employees, about families working with each other to be private and safe online and is about the fact that humans will and can get tricked by their own emotions and desires. This is what makes social engineered attacks so pernicious.

They are not about weak data points or lack of encryption. They are about our human frailty and how it gets exploited by digital tormenters.

Think about it. What if a Stuxnet-like custom designed cyber war tool; were to take out all the SCADA devices in a particular city? Or take out a particular industry like oil and gas or electrical generation; or at 50 hospitals at once? The problem is every unsecured SCADA device is also listed in multiple places to be publicly found on the internet, not even the dark web. 7 million + devices, terminals, industrial control centers, power plants, factories, utility grids and transportation and information networks are to be found just by searching.

Bring the best of the best together and create new environments in which they can work together to stop a global scourge of cybersecurity breaches and the resultant reputation and search breaches that follow every attack.  True in the USA and true in Israel. The world is looking at the very beginnings of a 3rd World War. This one is invisible mostly, harms people in real life sometimes, yet is being conducted by numerous countries, companies, and criminals all at once against each other. Now is the time to start combining the best of the best and the brightest.

Emergency Social Media and You in Crisis

Many people must feel the 2015 holiday break could not have arrived soon enough what with terrorism, crazy weather and other events that get covered rightly or wrongly in social media. While these can be scary and confusing times, they can also be times to educate, learn and help one another to understand a new reality we are all living in now.

There are specific tactics and strategies for understanding how live events unfold in social media and these can be instructive to the general public about what you are seeing and when, during events like these past weeks that we have all experienced. Real life events almost always flow to the internet in a micro second. Knowing how to tell the difference between truth and fiction could be critical to saving your own life of that of your family in a real life emergency that is also happening on social media.

So below are general truths about live events that unfold in a digital realm and in real life.

General Truths:

  • In any emergency in the digital age, there are three things that happen. The first is the incident itself. The second is the round of rumors, untruths and outright lies that get spread at the speed of email, phones, sms and of course social media. The third is the round of truth, where all the earlier rumors, untruths and outright lies now have to be dispelled.
  • The fear factor is something we all face. Some deal with it better than others. This fear factor only gets enhanced by constant updates, notifications and of course, people checking social media non stop during emergencies/crisis/terrorist attacks.
  • Truth and Veracity in information sharing, whether in person, on the phone, through email and on social media are paramount in times like this. Do not be the one spreading false or unverified rumors. Do not be the one sharing non-verified *news*. These actions can cause panic, can cause a response from authorities in the wrong place and more importantly can add to the sense of fear that already exists in events like these.
  • As members of a community it is extra important for us to not be sharing false information, to be extra calm and careful with facts and to have vigilance with the news and information; and especially that our kids are getting access to. Help them. Make sure they are both understanding the facts, and not mis-truths; and that they are not responsible for sending or sharing false information.
  • Even the media can rush to judgement in a situation like this and often times reporters will start referencing tweets and other social media. Many times the sourced social media is not a verified source, so even the news media will get it wrong in these situations. So it is up to you to take the extra couple of minutes to *verify* information, especially any information being provided to your kids or others’ kids.
  • Just because you heard/saw/read something *DOES* not make it a fact, especially in a crisis situation. DO NOT JUST SHARE ANY RUMOR OR ANY STORY. CHECK. INVESTIGATE. THIS IS FOR THE SAFETY OF YOUR FAMILY AND THE COMMUNITY.
  • Be aware that your kids may be getting wrong information/scary information from the internet, from social media, from the chats in games and from their friends. Work with your kids to understand the importance of getting to the facts, and not sharing what could be dangerous information. Same is true for the adults in your lives. Social media during emergencies can make normally calm people get very nervous and then they spread that nervousness by posting wrong or misinformed information in their zeal to make themselves feel better about the situation,.
  • Be aware that not all technology will always work the way it should. Sometimes you may get called, sometimes you may not. Sometimes you may get an email, sometimes you may not. So build up a quick reference of social media accounts that you trust and are verified. Create a list of these, and keep it on your computer or device.
  • Be prepared. We have all hopefully created safety plans for our businesses, community groups and families in case of emergencies. Do the same for digital emergencies. Know where to look. How to find what you need. How to dispel rumors that can be dangerous. Create a digital emergency family plan, and teach it to your kids. Practice it before something happens so it is not something to worry about, but rather something that becomes instinctive and instructive.

I created an emergency social media list on twitter with accounts that are both trusted and real. I suggest you do the same and keep that list handy.

Make a list of your local real life emergency providers websites, twitter accounts and other social media tools. Use them to verify information and dispel rumors.

%d bloggers like this: