When a Hack Occurs, Is It a True Cyber Attack or Cyberespionage?

Published with Permission by:
Lint, James R., “When a Hack Occurs, Is It a True Cyber Attack or Cyberespionage?”, In Cyber Defense, 20 March 2018, Web, https://incyberdefense.com/featured/hack-occurs-true-cyber-attack-cyberespionage/

By James Lint
Senior Editor for InCyberDefense and Contributor, In Homeland Security

The cyber community needs to get its nomenclature settled with regard to the word “cyber attack.” The term “cyber attack” is popular; it creates good headlines and gets good clicks on search engines.

Cyber professionals, however, need to agree on what a cyber attack actually is. That will help cyber defenders to identify priorities and focus on actual problems.

Lists Such as the ‘Biggest Cyber Attacks’ Need to Be More Precise

Some of the more famous “Biggest Cyber Attacks in 2017” lists can be found on Google and other search engines. But these lists often describe events, not actual attacks.

The lists compiled by CNN, Calyptix, TechRepublic and others mostly include the same cyber events. But are these events really attacks? None of the articles mention permanently damaged systems.

Equifax Hack Was a Theft, Not an Attack

CNN Tech states, “Cybercriminals penetrated Equifax (EFX), one of the largest credit bureaus, in July [2017] and stole the personal data of 145 million people. It was considered among the worst breaches of all time because of the amount of sensitive information exposed, including Social Security numbers.”

CNN used a more accurate description: “Cybercriminals penetrated Equifax.” But other media sources put this event on their list of attacks.

Equifax stock is still listed on the New York Stock Exchange and doing business. The company had to upgrade some of its computers, but it did not appear to suffer permanent damage.

Calyptix said that this cyber event could have been prevented by applying an available software patch months before the attack. But the Equifax hack was probably a robbery of opportunity because the unpatched system was vulnerable to hackers. It’s safe to say the Equifax crime happened because hackers wanted to steal information that could be resold.

Office of Personnel Management Database Hack Was Espionage

On June 15, 2015, the Office of Personnel Management (OPM) reported that it had suffered a data breach. Hackers were able to penetrate an OPM database that contained decades of security clearance information and files. The theft of this data affected 21 million current and former government employees and contractors.

Beth Cobert, Acting Director of the Office of Personnel Management, said, “Millions of individuals, through no fault of their own, had their personal information stolen and we’re committed to standing by them, supporting them, and protecting them against further victimization. And as someone whose own information was stolen, I completely understand the concern and frustration people are feeling.”

Writing on the Rand Blog, international policy analyst Larry Hanauer said, “The theft of personal information regarding millions of government employees and their associates from an Office of Personnel Management database — which cybersecurity experts have attributed to China — represents an enormous intelligence threat that is still not fully understood.”

Hanauer said the real threat is that “China’s intelligence services could use the data to identify people with financial difficulties, learn potentially embarrassing personal information (such as drug use or mental health issues), or tap into lists of contacts and organizational affiliations to develop seemingly innocuous communications designed to elicit information.”

The OPM hack was clearly espionage. It is definitely a different type of espionage from the days of dead drops and spies grabbing information captured by miniature cameras.

However, today’s counterintelligence workforce may not need photography skills. Instead. cyber skills will be increasingly in demand to prevent events such as the OPM hack from occurring again.

Titan Rain: A Continuing Cyberespionage Effort to Target US Government Secrets

Since 2003, Chinese hackers have been targeting U.S. computer systems in an attempt to gain U.S. secrets. These hackers are part of a wider espionage ring called “Titan Rain.” In 2005, Time magazine described this Chinese cyberespionage conducted against the U.S. government.

ZDnet reported, “The hackers…are thought to have stolen U.S. military secrets, including aviation specifications and flight-planning software. The U.S. government has coined the term ‘Titan Rain’ to describe the hackers.”

The attackers allegedly grabbed specs from the Redstone Arsenal for the mission-planning system for Army helicopters. Unfortunately, the problem with cyberespionage is you often never know what was stolen until much later.

Cyberespionage Is a Better Term Than Cyber Attack

The proper word we should use to better describe some of these hacks is “cyberespionage.” The Oxford English Dictionary defines cyberespionage as “The use of computer networks to gain illicit access to confidential information, typically that held by a government or other organization.”

To avoid further confusion, cyberespionage is the word that should be taught to future cyber defenders and espionage professionals.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 49th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

Iranian Hackers Charged with Hacks of 144 U.S. Universities

Published with Permission by:
Lint, James R., “Iranian Hackers Charged with Hacks of 144 US Universities”, In Cyber Defense, 28 March 2018, Web, https://incyberdefense.com/featured/iranian-hackers-charged-hacks-144-us-universities/

By James Lint
Senior Editor for InCyberDefense and Contributor, In Homeland Security

Many cyber defenders watch for Chinese and Russian hackers. However, we must not forget that smaller countries are also in the cyber attack game.

The U.S. Department of Justice and the Department of the Treasury’s Office of Foreign Assets Control determined that nine Iranians hacked the computer systems of 144 American universities, ZDNet reported.

The Iranian hackers worked in cooperation with the Islamic Revolutionary Guard Corps, the Mabna Institute (an Iranian hacker network) and the Iranian government to steal 31.5 terabytes of valuable data.

“In all, 320 universities around the world were attacked along with several U.S. government entities, including the Department of Labor, [the] United Nations, and the Federal Energy Regulatory Commission,” ZDNet added.

Wide-Ranging Impact of Iranian Hackers

The “massive and brazen cyber assault” was “one of the largest state-sponsored hacking campaigns ever prosecuted by the Department of Justice,” U.S. Attorney Geoffrey Berman of the Southern District of New York told a news conference on March 23.

According to the indictment cited by Sciencemag.org, “3,768 of the hacked professors were at 144 U.S. universities, and the attackers stole data that cost these institutions about $3.4 billion to ‘procure and access.’” Data stolen by the Iranian hackers includes scientific research, dissertations and journals.

The hack was intended to help Iranian universities gain access to foreign scientific resources. The indictment notes that the stolen data will also assist scientific and research organizations in Iran.

The FBI website reported that “the hackers stole more than 30 terabytes of academic data and intellectual property—roughly three times the amount of data in the print collection of the Library of Congress.”

Iranian Hackers Used Password Spray Attacks to Penetrate Other Computer Systems

According to the FBI investigation, a group of malicious cyber actors working for the Iran-based Mabna Institute conducted coordinated and broadly targeted password spray attacks against organizations in the United States and abroad. Victims of Mabna attacks often lack multi-factor authentication (MFA) and preventative network activity alerts. The lack of security measures allowed the Iranian hackers to easily guess passwords such as “Winter2018” and “Password123!”

Unlike a brute force attack, in which a would-be penetrator will obtain a single email account’s password by trying all possible combinations in sequence, spray attacks search for accounts with the easiest passwords. This attack method does not trip safety lockouts because the hacker tries only a few simple passwords before moving on to someone else’s account.

An FBI alert offers a good description of spray attacks: “During a password spray attack, a malicious actor attempts a single password against a population of accounts before moving on to attempt a second password against the accounts, and so on.” In other words, a spray attack searches multiple accounts for simple passwords.

Defendants Cannot Leave Iran without Fear of Capture and Extradition to US

The nine defendants in the U.S. university hack scheme are believed to be in Iran. “These defendants are no longer free to travel outside of Iran without the fear of being arrested and extradited to the United States. The only way they can see the rest of the world is through their computer screen, but not stripped of their greatest asset, anonymity,” Berman said.

Tips on Improving Your Cyber Defense

  • Review password policies to ensure they align with the latest NIST guidelines. Never use easy-to-guess passwords, which is the key to defense against this type of cyber attack.
  • Review IT Helpdesk password management of initial passwords, password resets for user lockouts and shared accounts. IT Helpdesk password procedures may not align with company policy, creating a security gap that hackers can exploit.

Cyber Defenders Need to Constantly Learn about New Cyber Attack Methods

Cyber defenders should stay current about new attack methods and older techniques. By keeping your end users informed, you can prevent simple cyber attacks from happening.

In addition, cyber defenders should use government resources to keep their knowledge up to date. One key tool could be Infragard, which is run by the FBI and has chapters in all 50 states. Your local FBI Liaison can help you access the Infragard portal.

Another good resource is US-CERT.gov. This site does not require a signup, but it does hold various events for cyber defenders. Its current activities and announcements show both system vulnerabilities and announcements on system threats.

Cyber defenders who stay current on various cyber threats are force multipliers for their organizations. They are much less likely to be surprised by people targeting their computer systems.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 49th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

Social Media Security: Follow Basic Safety Rules to Protect Your Home from Intruders

Published with Permission by:
Lint, James R., “Social Media Security: Follow Basic Safety Rules to Protect Your Home from Intruders”, In Cyber Defense, 22 February 2018, Web, https://incyberdefense.com/james-lint/social-media-security-basic-safety/

By James Lint
Senior Editor for InCyberDefense and Contributor, In Homeland Security

Although it’s fun to post pictures and messages on social media about trips you take, you are also vulnerable to household theft at the same time. For example, imagine that you take your family on a week-long trip.

Your kids post a message on Facebook that they are happy to be on vacation. Your wife takes an interesting picture at a rest stop and posts it to her Instagram account. Also, you send out a tweet upon arrival that you are at the convention hotel and plan to see your work friends tonight.

Unfortunately, all of this information tells a social media-savvy thief that your house is empty. As a result, you might receive a late-night text from your home security company that your home alarm went off, but you missed the text because you were away.

Social Media Gives Thieves Good Data about Houses to Target

We give social media a lot of information. We tell thieves when we are not home. We tell thieves when we leave, when we hit rest stops, when we go to airports and when we go to parties.

But we need to maintain some privacy to prevent others from misusing social media information. Consider the following questions:

  • Do you know your current privacy settings on each of your social media accounts?
  • Do you know the last time each of your social media sites changed its privacy settings?
  • Do you know if your privacy setting really did port over to your new phone?
  • Are you sure that no unintended visitors are looking at your sites and content?

Compromise between Social Media Security and Entertainment

It takes work to maintain a balance between your privacy and the public nature of social media. Here are some potential solutions:

Solution #1: Wait Until You’re Back Home

Take your pictures, write your content, and place the written content in a Word doc or Google Docs file. Then, post the images and written content AFTER you get home. While some people will say this defeats the purpose of social media, it is a safer way to protect your home and belongings.

Another possible option is to post only if you’re a short distance from home. For example, if you’re only out for the day and it’s a quick 20-minute drive to get home, it might be an acceptable risk to post from your location just before you leave.

Solution #2: Use a Social Media Management Tool such as Hootsuite or Buffer

There are online tools such as Hootsuite and Buffer that allow you to schedule social media posts at times you prefer. Both of these tools have free plans for individuals. Also, both tools are available as mobile apps.

Solution #3: Ask Social Media Companies to Add in a ‘Send Later’ Feature to Personal Accounts

Ideally, social media companies should build in a “send later” feature into their platforms. This feature does not currently exist for personal accounts (although Facebook administrators can pre-schedule posts to appear on pages for an organization).

The ability to send posts at a later time would be a useful social media security feature for personal accounts. In addition, it would be a proactive measure that would provide security even if your privacy settings had not been recently updated.

Consider sending a message to your social media companies’ feedback email or “contact us” pages. This information could be easily found through a Google search.

Stay secure!

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 49th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

InfraGard: Helping the Nation’s IT Security Professionals

Published with Permission by:
Lint, James R., “InfraGard: Helping the Nation’s IT Security Professionals”, In Homeland Security, 12 Oct. 2016, Web, https://inhomelandsecurity.com/infragard-helps-nations-security/

By James R. Lint
Faculty Member, School of Business, American Military University
Contributor, In Homeland Security

On August 25, InfraGard Las Vegas had an interesting event where they discussed a report about current threats to information technology. InfraGard is an organization that serves the security community.

New or old security managers and intelligence professionals may desire to join InfraGard. InfraGard not only provides networking opportunities, but it also helps members to learn current information and threats outside of the normal information flow in organizations.

InfraGard is a non-profit organization and federal information sharing program dedicated to protecting national cybersecurity by sharing information among businesses, academic institutions and law enforcement agencies, including the FBI. In addition to cybersecurity, InfraGard members also review the big picture of security threats, threat movements and the impact of threat actors in areas outside of members’ organizations.

InfraGard was founded by the FBI in 1996 and has more than 80 chapters in the U.S. This organization is led by local industry leaders with support from the local FBI office.

Careful Screening Process Ensures Members Receive Quality Information

Membership in InfraGard is free, but, participants must go through a screening process in order to join this association. Prospective members must be U.S. citizens and work in the security field. For example, they can work in a security company or in the security office of a corporation.

FBI Special Agents often have security briefs during the meetings, so the FBI does a background check (including a criminal history check) on all members to ensure that the sensitive information they provide remains confidential. All members have a requirement to protect information as “business confidential” and not disclose it beyond the intended scope. In turn, federal agencies exercise care to protect sensitive information they receive from InfraGard members.

InfraGard has subcommittees pertaining to 16 critical infrastructure sectors, as defined by President Obama. Protecting these sectors advances a national policy to strengthen and maintain secure, functioning and resilient critical infrastructures. Since most members’ parent organization aligns with one of the sectors, the sector subcommittees are a method for members to learn from their peers in their sector.

InfraGard Membership Encourages Knowledge Development and Growth

Membership into InfraGard also has a web portal used for sharing information. Contributors to the web portal include the FBI and the Department of Homeland Security (DHS). Information provided by the FBI and DHS is both timely and official, allowing corporate members to gauge threats.

The portal also provides access to many sector publications, allowing security professionals to access information that can be used to protect their own organizations. InfraGard also holds webinars to encourage the professional growth of its members.

InfraGard’s main value comes from the ability to learn and share quality information with other security professionals. InfraGard also allows professionals to give back to the organization by mentoring each other, further encouraging the growth of its members.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded their 43rd scholarship for national security students and professionals. He has 38 years of experience in military intelligence within the U.S. Marine Corps, U.S. Army, contractor and civil service.

James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. In 2016 he was accepted as a member of the Military Writers Guild. He has served in the DHS Office of Intelligence and Analysis and at the Department of Energy’s S&S Security Office. James had an active military career in the Marine Corps for seven years and also served 14 years in the Army. His military assignments include South Korea, Germany and Cuba in addition to numerous CONUS locations. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” and a new book in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea.”

Espionage against the US Continues, Even After the Cold War

Published with Permission by:
Lint, James R., “Espionage against the US Continues, Even After the Cold War”, In Homeland Security, 21 July 2017, Web, https://inhomelandsecurity.com/espionage-against-the-us-continues-even-after-the-cold-war/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

This article is the first in a series on espionage.

There are still people who think of espionage as part of the old Cold War and in the past. The reality is that espionage is all around us.

It’s widely assumed that foreign espionage is focused solely on the U.S. military and State Department to gain insight on military actions and foreign policy. Sadly, that thinking is also incorrect.

Foreign espionage agents not only target the military’s current actions and future movements, but also military research and development (R&D) to learn what emerging technologies are a potential threat to their hostile countries. R&D information is stolen to protect or strengthen the countries that steal it.

Spying Is a Way to Understand Foreign Politics and Increase Wealth

Espionage is also a way for nation-states to understand the current geopolitical situation and to prevent wars. Some countries, however, commit economic espionage to increase their wealth by targeting information that can expose national or industrial intentions and capabilities.

The FBI reports that “as a result of a string of high-profile espionage arrests by the FBI and its partners, the press dubbed 1985 as the ‘Year of the Spy.’” With a string of apprehensions, hostile nations were put on notice that espionage against the United States would not be tolerated; spies who were caught would be sentenced to long prison terms or deported.

The string of arrests in 1985 was a blow to those hostile countries – mainly China and the Soviet Union – because the apprehensions shut down some of their intelligence gathering into U.S. intentions.

At the same time, it is often counterproductive to arrest espionage agents because U.S. intelligence agencies then have the always difficult task of identifying and capturing their replacements. It’s no wonder that U.S. counterintelligence agents often prefer to leave foreign agents in place and provide them with false intelligence or, even better, turn them against their own country.

The “Year of the Spy” was a good reminder to the public and to our enemies that we know espionage agents operate against the United States. The publicity surrounding the spies’ arrests helped educate the next generation of homeland security, military and intelligence professionals and provided memorable case histories for instructors to use as real-world espionage examples.

What Is the Current Espionage Situation in the US?

In a March 2016 speech to the conservative Heritage Foundation, Mike Rogers, former head of the House Intelligence Committee, stated that there are more spies in the United States today from foreign nation-states than at any time in our history — including the Cold War. “And they’re stealing everything. If it’s not bolted down, it’s gone,” Rogers said. “And if it’s bolted down, give them about an hour — they’ll figure out how to get that, too.”

In 2012, Foreign Policy magazine reported that several thousand foreign intelligence officers operate openly in Washington, D.C., from dozens of embassies and international organizations.

What few people realize is that we have little privacy or rights from foreign intelligence agencies. The Russians have targeted U.S. political and military intelligence organizations for many decades. Chinese spies target intellectual property in addition to political and military intelligence. While the Russians send skilled intelligence officers, China often relies on people untrained in espionage, but who have access to targeted information or to those who know how to gain that access.

Recent Successes in Hostile Espionage

The Chinese intelligence service created what is known in spycraft as a “honey trap” for 59-year-old Benjamin Bishop, a married defense contractor with a top-secret security clearance. Bishop was a retired lieutenant colonel working at the U.S. Pacific Command in Hawaii when he met a 27-year-old Chinese national in the U.S. on a student visa. Bishop provided her with numerous classified documents during their three-year affair.

“In court, Bishop’s attorney, Birney Bervar, characterized the couple’s exchange of secret information as an act of love, not espionage,” Foreign Policy reported.

But in 2014, a military court in Honolulu sentenced Bishop to more than seven years in prison “for passing national defense secrets to his Chinese girlfriend and illegally keeping numerous classified documents at his home,” according to the Reuters news agency.

Similarly, former NSA contractor Edward Snowden and U.S. Army soldier Chelsea Manning conducted espionage or participated in the loss and distribution of classified information to non-cleared actors, including foreign intelligence services. Distributing classified information to the public or anyone without proper security clearance is a crime. Some people call this action the “insider threat,” but it mostly falls under theft and espionage.

This article was adapted from my article, “The Espionage Threat Is Real: Strategies for the Next Insider Task Force.” That article placed second in the Military Writers Guild 2017 Competition.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

No Holiday Season Break for CES Tech Show Preparations

Published with Permission by:
Lint, James R., “No Holiday Season Break for CES Tech Show Preparations”, In Cyber Defense, 14 December 2017, Web, https://incyberdefense.com/featured/no-holiday-break-ces-preparations/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 InCyberDefense and Contributor, In Homeland Security

CES, the gathering convention for people thriving in the consumer technology business, begins in 30 days’ time in Las Vegas.

This annual trade show has been the proving ground for innovators and breakthrough technologies for 50 years. CES introduces next-generation innovations to the marketplace. Hosted by the Consumer Technology Association (CTA), CES collects the world’s business leaders and pioneering thinkers.

This year’s show starts on January 9, 2018, and runs for a full week. Last year, CES attracted 184,000 attendees from all over the world, including global technology industry leaders from 150 countries.

In 2017, CES drew a wide variety of attendees, including:

  • Fortune 500 company executives
  • Manufacturers
  • Retailers
  • Venture capitalists
  • Engineers
  • Government officials
  • Advertising and marketing executives
  • Media sources

Size of CES Requires Ample Preparation

You do not get 184,000 attendees into one convention center without a lot of preparation and planning. Tech firm exhibitors and event planners begin preparations long before the show opens because the logistics involved are extensive.

To assist participants get ready for the show, CES provides a checklist for exhibitors that includes pages of requirements that need to be met starting in October.

The Reach and Breadth of CES

CES is a platform for innovators to build their brands. Almost every major technology company participates in CES in some way — by exhibiting, speaking, sponsoring, attending or holding co-located events and business meetings.

Show Content Spotlights Diversity of Technology

At CES, content and learning opportunities are available regarding diverse elements of technology, including 3D printing, digital imaging/photography, robotics and drones. Attendees can also pick up new information on sensors, augmented and virtual reality, electronic gaming, smart homes, audio, fitness and sports.

There are booths and displays for startup companies, as well as for major manufacturers whose names have become household words. Visitors will see innovations in:

  • Communications infrastructure
  • Health and biotech
  • Vehicle technology
  • Computer hardware/software/services
  • Internet
  • Video
  • Content creation and distribution
  • Cybersecurity
  • Wireless and other devices

Cybersecurity Industry Expected to Provide More Employment Opportunities

As CES has grown, so too has the cyber defense industry. So today’s cyber defenders in government and industry must continue to learn. Some of the products at CES are newly created, first versions.

Cyber defenders are the ones looking for the problems that may occur. They must look at, assess and determine if there are vulnerabilities that will affect other systems. Frequently a program or app is created that has no security problems. But when it is combined with other systems unforeseen vulnerabilities might appear.

Talks and demonstrations at CES allow professionals to see new cyber devices. CES also is the global stage where startups can get funded, new partnerships formed, and new acquisitions mergers and acquisitions take place.

In the future, we will need more and smarter cyber defenders who can keep up with the rapid evolution of technology. A formal college education and a continuing situational awareness of changes and vulnerabilities in technology are standard requirements for most cyber defender positions today.

What is new this year will likely be redundant in the not-too distant future. Events like CES offer an opportunity to glimpse the future of our ever-changing world of technology and its needs.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 49th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 “Secrets to Getting a Federal Government Job.”

Kasparov Urges DEFCON Participants to Use AI More and Kaspersky Security Software Less

Published with Permission by:
Lint, James R., “Kasparov Urges DEFCON Participants to Use AI More and Kaspersky Security Software Less”, In Cyber Defense, 3 August 2017, Web, http://incyberdefense.com/james-lint/kasparov-urges-defcon-participants-use-ai-kaspersky-security-software-less/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

Between July 27 and July 30, the annual DEFCON Hacker Conference celebrated its 25th anniversary in Las Vegas.

DEFCON began in 1992, when Platinum Net, a Fido protocol-based hacking network, held a party in Las Vegas for members of Bulletin Board Systems (BBS) and their users. The party was organized by Jeff Moss, an American hacker, computer and Internet security expert.

Since then, the DEFCON community has grown to more than 20,000 attendees. The talks and skills of the presenters have grown over the years along with technology.

Featured Speaker Garry Kasparov Says AI’s Power Should Be Harnessed for Cybersecurity

Garry Kasparov, a chess Grand Master who was beaten at his own game by IBM’s Deep Blue supercomputer, spoke on the first day. He called for using artificial intelligence (AI) for cyber security. Kasparov’s new book, “Deep Thinking,” forecasts a bright future once we use the full power of computing and AI.

Kasparov acknowledged that machines and computers likely will eliminate some jobs in the future. However, technology also will create new jobs for people with an understanding of how to harness and expand AI.

He also called for banning Kaspersky Internet security software from U.S. government offices. Kasparov wants the new administration to ban the software because he believes Eugene Kaspersky is connected to Russian intelligence, a statement backed up by U.S. intelligence services and news reports.

Safe-Cracking Robots Discover Combinations in Less than One Hour

DEFCON also featured a 45-minute demonstration of how a robot could open a security container or safe. It was so successful that the exhibition ended early. The robot opened the secure container in about 30 minutes.

Originally, it took the robot three hours to break into the safe. But through applied mathematics, the robot’s creators, first-time DEFCON participants, solved the combination manipulation process. The demonstration also made the federal employees in the audience worry if government security systems could be defeated in such a short time.

25 Years of Continued Education

I’ve attended DEFCON since 2005 and I’ve found each year’s gathering was a learning event. Attendees return home smarter employees.

DEFCON is where you can see new threats to security and solutions to some security issues. The admission price is low, the networking is impressive and learning happens every year.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

Cyber Security Professionals Must Prevent Attacks or Be Terminated

Published with Permission by:
Lint, James R., “Cyber Security Professionals Must Prevent Attacks or Be Terminated”, In Cyber Defense, 14 June 2017, Web, http://incyberdefense.com/james-lint/cyber-security-professionals-must-prevent-attacks-terminated/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

My recent article, “Cyber Defenders Are Often Not Fired, When Others Would Be” stirred responses from many physical security professionals. The common theme was that there are standards in physical security, but the cyber security problem is too difficult to solve. Cyber defenders, however, know standards and solutions are available.

Cyber Defense Standards Can Be Found

The National Institute of Standards and Technology (NIST) has created a cyber security framework for private sector organizations to assess their ability to prevent, detect and respond to cyberattacks.

The “The Framework, which was created through collaboration between industry and government, consists of standards, guidelines, and practices to promote the protection of critical infrastructure.”

Also, on May 11, 2017, the White House released a Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure.

The United States Computer Emergency Readiness Team, a division of the Department of Homeland Security, (US-CERT) website states that US-CERT “strives for a safer, stronger Internet for all Americans by responding to major incidents, analyzing threats, and exchanging critical cybersecurity information with trusted partners around the world.”

The US-CERT website has numerous publications, alerts, tips, and resources. It is updated daily, and has many ways to be contacted.  Any cyber defenders who have not signed up for the alerts and tips email list are missing good professional development and also timely protection information for their organizations.

Comparisons of Physical Security and Cyber Security

Many physical security personnel are not trained in cyber security, just as many cyber security personnel are not trained in physical security. Training helps both.

Physical security specialists are trained for many different sectors such as government security, security for intelligence facilities, shopping centers, banks, and hospitals. No one is an expert in all of those sectors. The security standards for a Top Secret intelligence facility are much different from those of a hospital. In turn, a hospital security is different than that of a bank.  With all the knowledge needed in these sectors, why would some people think they can also be experts in cyber security/defense?

Cyber Defenders Must Install Updates

Companies that do not upgrade their software are as derelict as those companies that leave a door open to thieves.

On Friday, May 12, the BBC reported an international ransomware attack involving hackers using ransomware called WanaCrypt0r 2.0. As many as 74 countries, including the U.K., U.S., China, Russia, Spain, Italy and Taiwan, were affected. Thousands of computers were locked by a program that demanded $300 in Bitcoin for each hacked computer. But in March Microsoft had issued the first patch to prevent the WannaCry attack.

That means all those companies and officials who were affected by WannaCry Ransomware could have prevented the attack if they had installed Microsoft’s update and upgrades two months earlier.

Why are boards of directors not firing CIOs and senior IT managers who fail to take steps to prevent cyberattacks?  Why are they not firing CEOs who did not ensure that their CIOs and IT managers implemented the Microsoft update patches? Why do they treat cyber security personnel so cavalierly but do not reprimand or fire physical security personnel who make similar errors?

Visual Comparison of Security Physical Holes and Unpatched or Upgraded Networks

If a company does not repair a large hole in its building for two months, wouldn’t that be cause for termination of its security manager? Would that business’s insurance company continue to insure a firm with a large hole in its building?

If you don’t patch a hole in your fence, people will think you are incompetent or lazy. If you leave a large hole in your building you should be fired for cause. Why do we not hold CIOs to the same standard of responsibility? It really is that simple. There will be new innovative hacks in the future. But any security professional who does not deal with existing vulnerabilities should be fired.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

Ransomware Is Everywhere, So Protect All of Your Electronic Devices

Published with Permission by:
Lint, James R. & Kim, Dr. Yoohwan, “Ransomware Is Everywhere, So Protect All of Your Electronic Devices”, In Cyber Defense, 23 Mar. 2017, Web, http://incyberdefense.com/news/ransomware-everywhere-protect-electronic-devices/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

Co-Authored by Yoohwan Kim, Ph.D. 
CISSP, CISA, CEH, CPT Associate Professor Computer Science Department University of Nevada Las Vegas

This is the third in a series of articles on ransomware.

Ransomware attacks have been on the rise in recent years. In 2016, these attacks increased 6,000% over 2015.

“Ransomware targeting Android users has increased by over 50 percent in just a year, as cybercriminals increasingly take aim at what they view as an easy ecosystem to penetrate,” ZDNet reports. Author Danny Palmer says the increase “comes as users increasingly turn to mobiles as their primary devices, storing more and more valuable data on them.”

Increased use of cloud storage also contributes to the explosive growth of ransomware attacks. As InfoSec Institute notes, “Cloud storage ransomware usually self-propagates after being installed on cloud servers. Virlock is a typical example of cloud storage ransomware. It impersonates FBI authorities and requests victims to pay the fine of $250 due to alleged misconduct on behalf of the victims.”

Many ransomware programs impersonate the FBI in an attempt to make their demands for payment look legitimate. However, no police department or federal investigative organization will ever request payment, especially via the Internet.

Ransomware and the Internet of Things = Jackware?

Between 2015 and 2016, there were at least 15 major industrial incidents involving ransomware attacks, according to a Booz Allen Hamilton Industrial Cyber Security Threat Briefing. These incidents included the following:

  • In April 2016, cybercriminals delivered ransomware via phishing to the corporate network of Board of Water & Light (BWL), a Michigan-based public electric and water utility. Administrators shut down the corporate network to isolate the ransomware and prevent it from potentially moving into the operations-technology environment.
  • In June 2015, a cybercriminal advertised the sale of SCADA access credentials on a Dark Web forum dedicated to selling stolen data. The post included a screenshot of a SCADA graphical user interface, IP addresses and virtual network computing passwords for a SCADA system managing a hydroelectric generator.

Also in 2015, hackers demonstrated that they could control a Jeep Cherokee from 10 miles away. They were able to cut the Cherokee’s engine and apply the brakes, sending the Jeep into a spin.

Future Ransomware Targets Could Include Household Devices

There are also many potential targets that could be exploited in the future. Think of the electronic devices in a smart home, part of the Internet of Things (IoT). Lights, alarms, music systems and even electric coffeemakers offer hackers potential targets.

Because all manner of IoT devices are linked to the Web, your lights could be turned on at 1:30 in the morning, followed by music from your iTunes collection. If you were asked for a small payment of, say, $30 by 2:30 a.m. that same day, would you pay? What if the payment demands were to increase each hour?

What if your home security system was turned off remotely and you were susceptible to an increased risk of theft or home invasion? How much would you be willing to pay to restore your peace of mind and security?

The future could include the destruction of data from wearable devices (such as Fitbits) or the sale of tracking data. Hostile attackers could turn on your electric coffeemaker while you are away and perhaps cause a house fire if you do not meet their demands for payment.

Protect Yourself from Ransomware by Increasing Your Electronic Security

One way to increase your personal security is to protect the electronic devices that run your life. Your computer serves as your IoT central control and your smartphone is often synchronized with your computer files, so both devices need protection from ransomware.

First, update your antivirus software on your computer, tablets and mobile devices. All devices have patches for your operating system. And be sure to check for updates on any mobile devices.

Second, make your passwords long and difficult to decipher. The days of the eight-character password are gone. The 12- or 14-character password is now the way to help protect your devices and data. Use a hard-to-guess password with numbers, uppercase and lowercase letters, and special characters.

Third, back up your files often. Keep those backups separate from your system, so they will not be compromised if your devices are attacked.

Fourth, always be aware of what you download. Downloading programs from unknown sites is risky. Always use only the sites you know or trust.

Similarly, opening attachments in emails or clicking on URLs in email increases your system’s vulnerability to attack. These practices can permit the downloading of ransomware.

Carefully examine unexpected emails from known or unknown senders. If you know the sender, check with him or her about the email and its attachment before you open it. Also, hover your cursor above a URL in an email to see if it actually goes to a legitimate source and double-check the sender’s email address for accuracy.

Future Protection Against Ransomware

The hope is that future new technology will have better security built into it. Currently, that hope is not realized. The potential for hostile actors to disrupt our life is increasing. It is our job to look for ways to make disruption a bit harder and hope attackers move to an easier target.

[Related: Ransomware Targets Continue to Pay Hackers and Ransomware: Its History and Evolution]

About the Authors

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.

Dr. Yoohwan Kim is an Associate Professor in the Department of Computer Science at the University of Nevada Las Vegas (UNLV). He received his Ph.D. degree from Case Western Reserve University in 2003 in the area of network security (DDoS attack mitigation). His research expertise includes secure network protocols, unmanned aircraft systems (UAS) communications and cyber-physical system (CPS) security. He has published over 90 papers in peer-reviewed journals and conferences, and has six patents granted or pending. His research has been sponsored by Microsoft Research, the U.S. Air Force, Naval Air Warfare Center, Oak Ridge National Laboratory, National Security Technologies and the National Science Foundation. Before joining UNLV, he had broad experience in the IT industry as a management information system consultant at Andersen Consulting (now Accenture), a database programmer at Cleveland Clinic Foundation, a software engineer at Lucent Technologies, and his own start-up company.