BSidesLV Information Security Conference Provides Useful Job Information

Published with Permission by:
Lint, James R., “BSidesLV Information Security Conference Provides Useful Job Information”, In Cyber Defense, 27 July 2017, Web, http://incyberdefense.com/james-lint/bsideslv-information-security-conference-provides-useful-job-information/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

In addition to learning more about information security, the BSidesLV Information Security Conference in Las Vegas is a target-rich environment for gaining information about jobs. In some cases, you might even have the chance to interview with potential employers as well.

Amazon Offers Jobs to Military, Military Spouses and Dependents

I saw someone at BSidesLV wearing a shirt that read “Warriors@Amazon.” He was a former Marine who now works for Amazon. He talked about how Amazon offers some of the same camaraderie that most military members miss after getting out of the service.

In fact, Amazon has three job websites that relate to the military. One website discusses the military community within Amazon. It states that “Amazon Warriors is made up of Amazonians who have served in their respective country’s military forces, those who are still serving and all Amazon employees who support them. The group’s mission is to provide its members a professional network and a means to organize community outreach programs, to aid veterans during their transition into the Amazon workforce and to be a resource for recruiting top military talent.”

The second website is about jobs for service members transitioning out of the military, veterans and military spouses. The website includes a quote from owner and founder Jeff Bezos about the military needs of Amazon. Bezos says, “We actively seek leaders who can invent, think big, have a bias for action and deliver results on behalf of our customers. These principles look very familiar to men and women who have served our country in the armed forces, and we find that their experience leading people is invaluable in our fast-paced work environment.”

Amazon’s third website offers support to military dependents, often called military brats. In Amazon’s Career Choice program, Amazon pre-pays up to 95 percent of tuition for courses related to in-demand fields, regardless of whether the skills are relevant to a career at Amazon. The website also states, “Investing in our employees is one of the many reasons Amazon is an employer of choice for military families.”

#brainbabe – Advocating and Supporting Women in Cyber Jobs

Cyber or information technology conferences often lack many female participants. One organization that supports bringing women into the information security profession is the nonprofit #brainbabe.

Its mission statement notes that “#brainbabe is directly impacting three statistics:

10% of the cyber security workforce [are] women, 1% of the cyber community are women leaders, 53% of women end up leaving the industry.”

#brainbabe supports changes that will attract and utilize women in cyber security. On #brainbabe’s website, Deidre Diamond, #brainbabe’s founder and CEO, discusses her background and states, “As a woman who was hired as an entry-level employee with a liberal arts degree and trained to lead sales teams for tech companies, who has been the CEO of a software company, and who is currently the Founder and CEO of a cyber security company, I have a lot of content and enthusiasm to offer the tech community about training people — specifically, women.”

Diamond is a motivated person who strongly believes in training. She and her crew often attend conferences such as BSidesLV and speak about how to increase the cyber workforce by training and bringing more women into cyber security.

She says on the website, “We can attract more women into cyber security while fostering the interpersonal and communication skills needed to retain them.” The training and improved communication skills may be a solution for growing our future cyber workforce in both the corporate world and government sector.

New People You Meet at Conferences Are a Rich Source of Industry Information

Attending conferences such as BSidesLV is more than just about learning in a conventional manner as you listen to scheduled talks. It is also about meeting people in the booths, on the floor or at lunch tables.

By meeting others at the conference, you sometimes learn just as much information as you do at formal presentations. Conferences show that learning happens everywhere, if you keep your eyes and brain open to new ideas.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

First Day at BSidesLV Information Security Conference Offers Insightful Lessons

Published with Permission by:
Lint, James R., “First Day at BSidesLV Information Security Conference Offers Insightful Lessons”, In Cyber Defense, 26 July 2017, Web, http://incyberdefense.com/james-lint/first-day-bsideslv-information-security-conference-offers-insightful-lessons/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

The BSidesLV Information Security Conference was filled to capacity on the first day of the show. This free conference has grown in popularity over the years, generating lots of interest because of its excellent speakers and topics.

Both the speakers’ pool and the various interest tracks enlighten experienced professionals as well as young people looking to break into the information security field.

Security Innovator Urges Business to Involve CSOs in Their Operations

Allison Miller delivered one of the opening addresses. Miller has worked at the intersection of cybersecurity, human behavior and predictive analytics for almost two decades.

She is an innovator in the security industry’s data-driven detection technology, specifically within security, anti-fraud/anti-abuse and payments/commerce systems. In her talk, “Something Wicked: Defensible Social Architecture in the context of Big Data, Behavioral Exon, Bot Hives and Bad Actors,” Miller urged companies to integrate their chief security officers (CSO) into their business operations.

A CSO pushed to the side or not in the boardroom often does not have the full picture of the organization, she said. That results in the CSO not having enough knowledge to protect all organizational assets or to understand what targets would attract hackers.

Miller noted that with so much new and expensive technology on the market, CSOs must understand that their purchasing decisions have a cost. Miller said CSOs must know how to communicate new technologies’ return on investment (ROI) to the board members.

Today’s cyber defenders must design architectural systems that operate in real time at Internet speeds, while also protecting millions of customers, transactions, end points and actions on any given day. As scale and complexity grow exponentially, manual intervention must be the exception and not the expectation, Miller noted. The future is new design-driven approaches infused with data and artificial intelligence to bolster cyber defenses.

Penetration Tester Recounts How He Accidentally Got a Job in Information Security

Johnny Xmas is a penetration tester for Chicago-based MMS and security assessment firm Redlegg International. Xmas shared his story of weaving through many career beginnings, but never gaining traction on a career path.

His passion for computers and technology led to many short-term contract jobs. Xmas became the man people called to solve computer problems, but no one ever wanted him for a full-time job.

His career path changed one evening while he and his roommates were having their weekly board game night. One of the new players, who turned out to be a senior information security professional at Office Max, said he was looking for someone to hire who was well versed in information security. Xmas spoke up and got the job.

Xmas told the audience to take advantage of social events because you never know who is attending. You won’t get a job if you don’t network and let people know you are interested in working for them, he added.

Security Mentor Explains What a Career in Public Service Is All About

Bobbie Stempfley has been a mentor to many aspiring security professionals. She reviewed her career in the Hire Ground Track of BSidesLV. Hire Ground gives job seekers resume reviews and interview practice.

Stempfley said her engineering degree wasn’t much use when she started her career as an intern shredding documents for the Army. However, she gained skills and a good deal of knowledge by observing how information security professionals went about their jobs.

That internship launched her decades-long career in public service with the Army, Department of Energy and the Department of Homeland Security. In 2015, Stempfley resigned as DHS Deputy Assistant Secretary of the Office of Cybersecurity and Communication to take a position with The MITRE Corporation.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

BSides Las Vegas Information Security Conference Opens

Published with Permission by:
Lint, James R., “BSides Las Vegas Information Security Conference Opens”, In Cyber Defense, 26 July 2017, Web, http://incyberdefense.com/james-lint/bsides-las-vegas-information-security-conference-opens/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for In Cyber Defense and Contributor, In Homeland Security

BSidesLV, a non-profit organization designed to advance information security knowledge, opened its annual two-day open conference in Las Vegas on Tuesday, July 25.

BSidesLV includes discussions and debates for security engineers and their affiliates. But what makes this conference unique is that admission is free; costs are covered by donors and sponsors.

As the 2017 handbook states, “The technical and academic presentations at BSidesLV are given in the spirit of peer review and advanced knowledge dissemination.”

BSidesLV Offers Multiple Specialized Presentations to Suit Needs of Attendees

BSides LV offers a multitude of presentation tracks to help attendees improve their knowledge. The various tracks are indicative of the scope of the convention – everything from new research and password protection to hiring opportunities.

Breaking Ground Track

In the Breaking Ground Track, speakers present new and ongoing research and solicit attendees’ feedback, insight and opinions.

Ground 1234! Track

The Ground 1234! Track is all about password security. Its sessions include topics such as why people need to entirely rethink the use of passwords, as well as how to make passwords easier for end users without compromising security.

Proving Ground Track

In the Proving Ground Track, first-time speakers have a platform to make their voices heard in a welcoming environment, supported by mentors who assist them in their preparation and practice runs. First-time speakers give BSidesLV attendees an opportunity to hear about new topics and new research.

Ground Truth Track

Ground Truth focuses on innovative computer science and mathematics as applied to information security, natural language processing, machine learning, statistics and all manner of big data manipulation and analysis.

I Am The Calvary Track

This track features presentations from a group of information security advocates called “I Am The Cavalry.” This group examines IT issues and how they affect human life and public safety.

Job Hunters Track

Besides being a rich environment for learning and networking with information security professions of all skill levels, BSidesLV is also an event of interest to organizations looking to hire additional staff.

Hire Ground is a series of talks devoted to the hiring process – everything from resumes to interviews. For this track, a large conference room is reserved for human resources employees and hiring managers, who review job seekers’ resumes and conduct interviews.

One of the more interesting companies in Hire Ground is ClearedJobs.Net. According to its website, “ClearedJobs.Net is a veteran-owned career site and job fair company for professionals seeking careers in the defense, intelligence and cyber security communities.”

The success of the conference is dependent on the effort attendees put into learning and networking. There is something for everyone to learn at BSidesLV, and even the possibility of finding new employment opportunities.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

Cybersecurity Hazards Abound in Airports, Parking Lots and Conventions

Published with Permission by:
Lint, James R., “Cybersecurity Hazards Abound in Airports, Parking Lots and Conventions”, In Cyber Defense, 19 July 2017, Web, http://incyberdefense.com/james-lint/cybersecurity-hazards-abound-airports-parking-lots-conventions/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

With so much public attention to viruses, ransomware and cyberattacks, you might think that you’ve heard all the possible ways someone can attack your computers or mobile devices. But there are many bad actors who have devised devious ways to get your data through public charging stations, USB hub power stations and thumb drives.

Public Wi-Fi Poses a Cybersecurity Risk

Watch out for Wi-Fi hotspots that are not sponsored by an airport or your hotel. If you notice that the airport or hotel’s Wi-Fi service has a slight variance in the service’s name or has a #2 added to the actual name of the hotspot, that is a fake hotspot used by scammers. Others can access your computer or phone and use it as a launch pad for other activities.

Public Charging Stations Can Collect Your Private Data

For the convenience of travelers, airports offer free charging stations. However, “free” is not always good and it is easy for a tired traveler to make security mistakes.

A new way for hackers to access your data is through phone data cords plugged into “free” USB charging stations. These phone data cords can also be used to connect your phone to a USB port on your laptop. When you transfer data or pictures from your phone to your laptop, for example, that data or those images are vulnerable to a hacker.

Unfortunately, some USB charging hubs have more than just a charging capability. They can contain a hidden hard drive that can suck in your personal photographs, an important PowerPoint presentation or Word documents relating to your company’s business. This type of data is valuable and eagerly sought by hackers.

USB Hub Power Stations Could Also Be a Cybersecurity Risk

Be wary of public USB hubs with eight plug-in ports. When you plug your USB device into one of these ports, do you know the people around you who are also plugged into the ports? Your company’s competitors or your government’s enemy could be using those same ports.

That same hub could be configured to allow one port to pull data from the other ports by introducing a new motherboard or modifying the existing motherboard in the USB hub power station. Most of us have no idea of that potential for hacking when we blindly plug in our devices and are happy to get free power. Depending on the data loss you could incur, maybe that power is not really “free.”

USB Thumb Drives ‘Lost’ in Parking Lots

Penetration testers, hackers and espionage agents have another way to collect your data through what appear to be “lost” thumb drives. They will drop a couple of USB thumb drives in company or government parking lots. This process is called “seeding.”

Unwary employees pick up these thumb drives, take them into their office and plug them into their computer. Most of these people are Good Samaritans simply trying to identify the owner and return the thumb drive. Sadly, the thumb drive could contain a virus that attacks the organization’s networks and allows outsiders in to steal data.

This same seeding technique has worked at conventions and conferences. Convention display booth workers often hand out thumb drives that ostensibly feature their company’s products. But the same thumb drives can contain vulnerabilities that are a hazard to your network and data.

Cybersecurity Precautions to Take When You Travel

  • In airports or other public facilities, do not trust free USB hub power stations. Carry a second power pack, power cord or battery to power up your devices.
  • Be wary of Wi-Fi hotspots that have additional numbers or misspellings in their names.
  • Never pick up a “lost” USB thumb drive and stick it into your computer or mobile device. Turn it into your organization’s security office. If you have no other alternative, plug it into a stand-alone machine, not one that is connected to your organization’s network.

The common link to all of these types of cyberattack is the lure of getting something for free. As someone once said, nothing in life is free. Sometimes in cyber, free can be a hazard and cause disruption.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016, “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017, Secrets to Getting a Federal Government Job.”

Fileless Malware: A New Threat in the Cybersecurity Field

Published with Permission by:
Lint, James R., “Fileless Malware: A New Threat in the Cybersecurity Field”, In Cyber Defense, 29 June 2017, Web, http://incyberdefense.com/james-lint/fileless-malware-new-threat-cybersecurity-field/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

Currently, threats to your computer often involve some type of virus or hostile file. But fileless malware is a new and growing hazard in cybersecurity. Consequently, it presents a danger to companies and individuals.

Fileless Malware Leaves Few Traces on Your Computer

What is fileless malware? Zeltser Security Corporation defines fileless malware as “malware that operates without placing malicious executables on the file system. Though initially fileless malware referred to malicious code that remained solely in memory without even implementing a persistence mechanism, the term evolved to encompass malware that relies on some aspects of the file system for activation or presence.”

The fact that there is no file to detect, similar to a virus, makes fileless malware difficult for your antivirus software to find. It also makes protection against malware more difficult, now and in the future.

Cybersecurity Community Becoming Aware of Fileless Malware Threat

In June, the Cyber Security Awareness Lunch and Learn event in Las Vegas hosted by MJ Computer Concepts featured a speaker from the US Secret Service (USSS).  This was the same Special Agent  who also hosted the USSS Electric Crimes Task Force (ECTF) in Las Vegas.  The speaker at the Task Force meeting was Dr. Anthony J. Carcillo on the topic of fileless malware.

The U.S. Secret Service has two major areas of responsibility. The traditional and best-known mission is the protection of senior executive branch leaders. The older mission for the USSS is financial crimes, which include the prevention and investigation of counterfeit U.S. currency, U.S. treasury securities and the investigation of major fraud. This second mission has the modern USSS involved with modern cybercrimes.

During the Lunch and Learn, by MJ Computer Concepts and the ECTF meeting with Dr. Cardillo both discussed the need to protect your computer system. Both of these speakers had similar comments on the criticality of software updates and backups. The information from Dr. Carcillo was thought-provoking because there is very little information in the public domain about fileless malware.

Staying Informed Is Your Best Protection against Fileless Malware

The United States Computer Emergency Readiness Team (US-CERT) regularly publishes information about cybersecurity threats. Reviewing the US-CERT website is a useful way to learn about current threats. Also, you can sign up for tips and emails on new cyber vulnerabilities.

Failing to Update Software Increases Vulnerability to Attack

Discussions at recent cybersecurity events have shown that there is a common reason why victims are selected and attacked. Hackers commonly exploit security weaknesses in computers with outdated software, because those computers are more vulnerable to attackers. In some cases, computer owners neglected to install software updates to protect their computers and data.

What You Can Do to Improve Your Security

There are simple measures you can take to protect your computer. CNN Money Tech stated, “First, install any software updates immediately and make it a regular habit. Turn on auto-updaters where available (Microsoft offers that option). Microsoft also recommends running its free anti-virus software for Windows.”

Another way to protect your files is to use a cloud-based storage service. Cloud storage companies normally keep all their systems updated with the newest software protection and backups in case of a problem.

There are other ways to protect your computer from an attack:

  • Use a backup program for your personal or business computer.
  • Buy two or more USB hard drives and use them to run incremental backups. Use one USB hard drive at a time and set it to back up your computer files for a week. Then, change to a different hard drive and conduct backups.

If you use multiple drives for backups, valuable files and pictures will remain safer, even if your current drive gets corrupted or attacked by ransomware. The more hard drives you have in your rotation, the more likely it is that your earlier files will not become corrupted.

  • Do not click on a link that you do not recognize or download files from sources you do not know.

Although updating your systems and backing up your files is time-consuming, these computer tasks are necessary to protect you from cyberattacks. With all of the problems that viruses, ransomware and malware create, simple protective measures are worth your time and money.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

Cyber Security Professionals Must Prevent Attacks or Be Terminated

Published with Permission by:
Lint, James R., “Cyber Security Professionals Must Prevent Attacks or Be Terminated”, In Cyber Defense, 14 June 2017, Web, http://incyberdefense.com/james-lint/cyber-security-professionals-must-prevent-attacks-terminated/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

My recent article, “Cyber Defenders Are Often Not Fired, When Others Would Be” stirred responses from many physical security professionals. The common theme was that there are standards in physical security, but the cyber security problem is too difficult to solve. Cyber defenders, however, know standards and solutions are available.

Cyber Defense Standards Can Be Found

The National Institute of Standards and Technology (NIST) has created a cyber security framework for private sector organizations to assess their ability to prevent, detect and respond to cyberattacks.

The “The Framework, which was created through collaboration between industry and government, consists of standards, guidelines, and practices to promote the protection of critical infrastructure.”

Also, on May 11, 2017, the White House released a Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure.

The United States Computer Emergency Readiness Team, a division of the Department of Homeland Security, (US-CERT) website states that US-CERT “strives for a safer, stronger Internet for all Americans by responding to major incidents, analyzing threats, and exchanging critical cybersecurity information with trusted partners around the world.”

The US-CERT website has numerous publications, alerts, tips, and resources. It is updated daily, and has many ways to be contacted.  Any cyber defenders who have not signed up for the alerts and tips email list are missing good professional development and also timely protection information for their organizations.

Comparisons of Physical Security and Cyber Security

Many physical security personnel are not trained in cyber security, just as many cyber security personnel are not trained in physical security. Training helps both.

Physical security specialists are trained for many different sectors such as government security, security for intelligence facilities, shopping centers, banks, and hospitals. No one is an expert in all of those sectors. The security standards for a Top Secret intelligence facility are much different from those of a hospital. In turn, a hospital security is different than that of a bank.  With all the knowledge needed in these sectors, why would some people think they can also be experts in cyber security/defense?

Cyber Defenders Must Install Updates

Companies that do not upgrade their software are as derelict as those companies that leave a door open to thieves.

On Friday, May 12, the BBC reported an international ransomware attack involving hackers using ransomware called WanaCrypt0r 2.0. As many as 74 countries, including the U.K., U.S., China, Russia, Spain, Italy and Taiwan, were affected. Thousands of computers were locked by a program that demanded $300 in Bitcoin for each hacked computer. But in March Microsoft had issued the first patch to prevent the WannaCry attack.

That means all those companies and officials who were affected by WannaCry Ransomware could have prevented the attack if they had installed Microsoft’s update and upgrades two months earlier.

Why are boards of directors not firing CIOs and senior IT managers who fail to take steps to prevent cyberattacks?  Why are they not firing CEOs who did not ensure that their CIOs and IT managers implemented the Microsoft update patches? Why do they treat cyber security personnel so cavalierly but do not reprimand or fire physical security personnel who make similar errors?

Visual Comparison of Security Physical Holes and Unpatched or Upgraded Networks

If a company does not repair a large hole in its building for two months, wouldn’t that be cause for termination of its security manager? Would that business’s insurance company continue to insure a firm with a large hole in its building?

If you don’t patch a hole in your fence, people will think you are incompetent or lazy. If you leave a large hole in your building you should be fired for cause. Why do we not hold CIOs to the same standard of responsibility? It really is that simple. There will be new innovative hacks in the future. But any security professional who does not deal with existing vulnerabilities should be fired.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

WannaCry Ransomware Leads to Discovery of Earlier Hack

Published with Permission by:
Lint, James R., “WannaCry Ransomware Leads to Discovery of Earlier Hack”, In Cyber Defense, 06 June 2017, Web, http://incyberdefense.com/news/wannacry-ransomware-leads-discovery-earlier-hack/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

There is a new attack related to the recent international WannaCry (also known as WanaCrypt0r 2.0) hack that occurred between May 12 and May 14. As of May 14, this hack had affected more than 70,000 computers and netted the hackers at least $15 million.

Yahoo Tech News reported that “The new attack targets the same vulnerabilities the WannaCry ransomware worm exploited but, rather than freeze files, [it] uses the hundreds of thousands of computers believed to have been infected to mine virtual currency.”

Bitcoin and other cyber currencies can be mined by allowing your computer to be used to solve math problems. In the past, it has been something that people volunteered to do to earn cybercurrency.

Filipino news source Agence France-Press states, “virtual currencies such as Monero and Bitcoin use the computers of volunteers for recording transactions. They are said to “mine” for the currency and are occasionally rewarded with a piece of it.”

WannaCry Hack Led Researchers to Discover Earlier Malware Attack

ABC News reported that “While investigating the WannaCry ransomware attacks, researchers at the cybersecurity firm Proofpoint stumbled upon another ‘less noisy’ form of malware called Adylkuzz that, the firm says, has likely generated millions of dollars in cryptocurrency for the unknown attackers.” Monero, a cybercurrency, has been named as a target for Adylkuzz.

“I would say the real-world impact of this attack is going to be more substantial than WannaCry,” Ryan Kalember, the senior vice president for cybersecurity at Proofpoint, told ABC News. “Ransomware is painful, but you can restore operations relatively quickly. Here, you have a huge amount of money landing in some bad people’s hands. That has geopolitical consequences.”

Proofpoint identified Adylkuzz attacks dating back to May 2. Those attacks predate the WannaCry attacks, making Adylkuzz the first known widespread use of the leaked NSA hacking tools. It remained undetected for so long, Kalember says, because its impact on users is far less noticeable than ransomware.

“It takes over your computer, but you probably don’t notice anything other than that the system runs really slow,” Kalember said. “Your computer might be mining cryptocurrency for some very bad people.”

Does the US Dominate the Strategic Cyber Battlefield?

The U.S. Army has published doctrine for Army Field Manual 3-12, “Cyberspace and Electronic Warfare Operations.” This manual notes that the U.S. may not dominate the cyber battlefield. The doctrine seeks to upgrade tactics and techniques for cybersecurity, while realizing that cybersecurity is a domain of combat, just as air, land and sea are domains.

Ryan Kalember at Proofpoint and many others have indicated that North Korean-backed hackers called the Lazarus Group might be responsible for the WannaCry hack. This group has been linked to a similar cryptocurrency mining attack in late 2016. However, no final attribution for the WannaCry hack has been determined, because attribution often takes months to complete.

North Korea Could Be Earning Funds from Cyber Attacks

North Korea has suffered sanctions for decades. Pyongyang’s recent actions of increasing construction of nuclear and missile facilities and missile tests have caused other countries to call for increased sanctions.

How is North Korea able to afford its nuclear program? The country could be behind cybercurrency mining.

The cyber battlefield is level with many countries focusing on cyber tools. Some of these countries are experiencing financial difficulties due to sanctions and embargoes.

By turning to cybercurrency, these countries are attempting to solve their financial problems through cybercurrency mining or ransomware. Their actions could be solutions to the diplomatic actions against them. While diplomatic and military tactics controlled rogue nations in the past, they are less effective in today’s cyber environment.

How to Protect Your Computer from Ransomware Attacks

To better protect your own computer, update your operating system often. Microsoft issued the first patch to prevent the WannaCry attack in March 2017.

A second update has been issued to block Adylkuzz. If you do not take care of your computer, you will be at risk. You will be vulnerable to ransomware and other attacks. If your computer’s operating system is running slowly, be sure to update it and your antivirus software at the same time.

Stay secure!

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

Cyber Defenders Are Often Not Fired, When Others Would Be

Published with Permission by:
Lint, James R., “Cyber Defenders Are Often Not Fired, When Others Would Be”, In Cyber Defense, 01 June 2017, Web, http://incyberdefense.com/news/cyber-defenders-often-not-fired-others/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

If a security guard does not make his rounds at night and a door is left open, should he get in trouble with his superiors? Should he be reprimanded? If a robbery occurs because of the open door, should he be fired?

Is it fair then that cyber defenders or information technology security specialists are not fired after a cyberattack?

Cyber defense used to be a safe job after a crisis, if the IT specialists had documented what the company needed to protect itself from a cyberattack and management did not act on those recommendations and purchased the products or services that could have enhanced security.

Cyber Security Is Still Undefinable

Yahoo, LivingSocialFacebook and Twitter spent millions of dollars to protect their networks and data. Yet all were victims of massive cyberattacks. They discovered the truth in the security managers’ words of wisdom that “there really is no such thing as perfect security.”

Any system, building or company can be penetrated. No set of security measures will completely protect against determined cyber hackers. Security continues to evolve based on the threat actors.

If any company used the same security and firewalls today as it did in 2005, even amateurs in the security field would laugh. It would probably be smarter to invest in a welcome mat instead of a 2005 firewall. (There is a possibility that they would cost the same.)

What Cyber Defense Managers and CIOs Need to Do to Protect Their Jobs

In 2013, a credit card breach at Target put 40 million shoppers at risk. In the end, the CEO and the chief information officer lost their jobs. The incident illustrated how a cyber security incident can affect cyber leaders and managers.

The IT Security for Managers website noted that “Target, in fact, passed their compliance requirements several months before the breach occurred, but as evidence now clearly shows, they were not secure.”

To prove its point that compliant does not mean secure, the website recalled a historic tragedy. “[T]he Titanic was actually compliant with the British Board of Trade, which required all boats over 10,000 metric tons to have 16 lifeboats. It didn’t matter how many passengers were on board. Just put 16 lifeboats on. So was the Titanic compliant? Yes. Did compliance avoid a tragedy? No.”

Law360, a LexisNexis company website, reported on an internal probe of Yahoo’s “trio of data breaches believed to have affected at least 1.5 billion users.” The probe concluded that certain senior executives failed to adequately respond to the incident. As a result, Yahoo‘s general counsel resigned and CEO Marissa Mayer’s annual bonus for 2016 was withheld.

Protect Yourself and Your Organization

Documenting company safeguards is critical when corporate executives have to go to court for a breach of contract dispute or for a management hearing for termination. Here is a brief checklist that can help to protect you and your organization:

  • Know where your security response plans and procedures are located.
  • Can you prove you exercised those plans?
  • Did senior managers participate so they knew their responsibilities and can support you?
  • Alternatively, were senior managers notified of the exercises?
  • If not, why not?

Not involving senior managers in cyberattack plans, procedures and resolutions can be a career-ending decision. Cyber defenders should have written documentation to that effect. Every exercise should have a post-action report that shows what was learned, what was performed well, and where the weaknesses in training, equipment and processes were.

Free Information and Government Readiness

The Department of Homeland Security’s “Ready” program has information on before, during and after a cyber incident. The DHS also has information and a monthly newsletter at its Stop. Think. Connect. campaign.

A more technical email list is from the United States Computer Emergency Readiness Team (US-CERT) provides a more technical mailing list.

The information is out there to protect your organization. So stay secure!

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

Hacking Assistance for Social Oversharing

Published with Permission by:
Lint, James R., “Hacking Assistance for Social Oversharing”, In Cyber Defense, 30 May 2017, Web, http://incyberdefense.com/news/happy-birthday-hacking-assistance-social-oversharing/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
 In Cyber Defense and Contributor, In Homeland Security

For some 40 years, the U.S. military has required all service personnel to wear identity tags, also known as dog tags, which include each soldier’s Social Security Number (SSN). In the recent years, dog tags provide a name, SSN, blood type and religion. All are essential items when soldiers are injured or worse.

Now the Army is changing the dog tag to protect soldiers’ data. It will switch to a 10-digit, randomly-generated number on an as-needed basis, said Michael Klemowski, Soldiers Programs Branch chief, U.S. Army Human Resources Command. The first to get the new dog tags will be those units being deployed into hostile locations.

One reason for the change is that in today’s battlefield, being captured wearing a dog tag with the soldier’s name and SSN could create trouble for the soldier and his family. The enemy is savvy and could use the SSN and the Internet to exploit bank accounts and other personal data.

Even in an organization as tradition-bound as the U.S. Army, change is possible. This switch to a 10-digit dog tag should be an example to other organizations that use or require more privacy data than needed on identification badges or other forms of ID.

Avoid an Un-Happy Birthday by Keeping Certain Data off the Internet

When people post their birthday on social media such as Facebook or LinkedIn, they expect to receive many Happy Birthday greetings for a couple of days before and after their birthday.

There is also the possibility they could have an unhappy birthday, too. Posting a birth date can be used by hackers to reset passwords on email accounts, bank accounts and other personal apps.

Sadly, some websites will ask for your birthday as an identity check. Often, they are not looking to know someone’s age, just what is stated as that person’s age for their inquiry verification. But that information is now in a database.

Cyber Security Defenders Call Birthday Data Vulnerabilities

Professor Herbert H. Thompson asked some of his acquaintances for permission to break into their online banking accounts. The goal was to access their online accounts using the information about them, their families and acquaintances that is freely available online.

He described his hack into a bank account in an article in Scientific American: “In a rare moment of clarity, I simply searched her [university email server] for ‘birthday.’ She made a reference to it on a post that gave me the day and month but no year.”

Thompson’s guess of her birth year turned out to be off by only one year. That was enough to successfully change her passwords, because of the number of attempts allowed on the email system.

Hackers call these attempts guesses; cyber security defenders call them vulnerabilities.

“A birth date, along with a name and hometown, can be used in a formula to recreate your Social Security information,” cyber security expert John Sileo told ABC News. “And, those are three defaults on Facebook.”

Your Birthday Can Lead To Your SSN

“[M]ost of the SSN-related ID theft problems have resulted from institutions that were careless with their record keeping, allowing SSNs to be harvested in bulk,” says ARS Technica. But a “pair of Carnegie Mellon researchers has now demonstrated a technique that uses publicly available information to reconstruct [individual] SSNs with a startling degree of accuracy.”

This came from a 2009 article. Most of us would readily agree that technology has changed a lot since then. The hackers too are much more advanced.

Industry Must Adopt Data Protection Methods Like the Army Has Done

We see the U.S. Army make improvements in data protection. Now we need to see similar improvements in industry. The future is bright for cybersecurity engineers, innovators and inventors. There is a wide-open race to build security safeguards into the programs and devices we use.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.”

Ransomware Escalates To a Near Nation-State Attack in the UK

Published with Permission by:
Lint, James R., “Ransomware Escalates To a Near Nation-State Attack in the UK”, In Cyber Defense, 15 May 2017, Web, http://incyberdefense.com/james-lint/ransomware-escalates-near-nation-state-attack-uk/

By James Lint
Faculty Member, School of Business, American Military University
Senior Editor for
In Cyber Defense and Contributor, In Homeland Security

On Friday, May 12, the BBC reported an international ransomware attack involving hackers using ransomware called WanaCrypt0r 2.0. The BBC stated, “There have been reports of infections in as many as 74 countries, including the U.K., U.S., China, Russia, Spain, Italy and Taiwan. Computers in thousands of locations have apparently been locked by a program that demands $300 in Bitcoin.”

CNET reported, “The ransomware attack that hit 16 National Health Service (NHS) hospitals in the U.K. and also hit up to 52,000 devices across other countries using an exploit called the WanaCrypt0r 2.0 ransomware. The majority of the new malware was targeting Russia, Ukraine and Taiwan, Avast Threat Lab team lead Jakub Kroustek said.”

WanaCryptor 2.0 Attack’s Impact on UK Hospitals

Multiple hospitals in the NHS pushed information via social media to the local population to contact their hospitals before traveling to determine if those hospitals were open for operations. The NHS is the government-run, major medical system in the U.K., so hackers have only one system to breach and install ransomware.

The advantage to the American healthcare system is that we have multiple hospital systems. While there have been major hacks against a few major U.S. hospitals and insurance companies, it is more difficult to penetrate all of these unconnected systems.

If the U.S. healthcare system were to migrate to a single health system like the NHS, the security of our healthcare system would require more safeguards. But these multiple healthcare systems provide some additional security for patient data; the competition provides some additional security.

Ransomware Could Escalate into Strategic Attacks on the US

It is possible that the use of ransomware could escalate and ransomware could be used for strategic attacks against the United States. Imagine the potential of ransomware that attacks an entire sector of a country, such as healthcare and hospitals.

For example, what if there was a ransomware attack that affected both a hospital’s computer system and its interconnected phone system? In the U.K., you must contact the hospital before bringing in a patient for treatment. Patient care would be unnecessarily delayed as the problems with that hospital’s computers and phone system were solved.

Although a hospital’s managers could theoretically shut down uninfected computer and phone systems to prevent ransomware infections, that security measure would be self-defeating and would replicate the impact of a ransomware attack. Without access to phones or health records, hospital employees would have difficulty doing their jobs properly.

Ransomware Attacks Could Impact Strategic Actions and Confidence in Government

Taking major hospital systems offline and causing hospitals to tell their patients not to go to specific hospitals causes a public lack of confidence in government systems. Patients become worried and uneasy when they are told that their health data records are unavailable and “the hospital is not in control of your personal health records at this time.”

In Latin American insurgencies in the 1980s, the goal of insurgents was to destabilize countries and make the population unsure that the government can protect them. The same type of impact could happen with a strategic cyberattack or strategic ransomware.

Potential Solution to the WanaCrypt0r 2.0 Ransomware Attack

Microsoft released a patch in March for the vulnerability that the WanaCrypt0r 2.0 ransomware exploits. Unfortunately, many computer systems have not been updated. This lack of action could leave a legal avenue for customers to sue for damages caused by the company’s negligence in performing software updates.

Long-Term Impact of WanaCryptor 2.0 Ransomware Attack

The WanaCrypt0r 2.0 ransomware attack that impacted so many countries could end in a multitude of ways. As the attack is investigated, we may see that the attack was caused by criminals trying to make money. But if the attack involved a nation-state intent on destroying other countries’ computer systems and holding systems for ransom, this situation could become more serious and potentially lead to war.

The news that some of the ransomware demands payments in small sums of $300 to $600 to restore access indicates this attack is a criminal matter. The scope and impact of the WanaCrypt0r 2.0 attack is wide.

But the WanaCrypt0r 2.0 ransomware attack may have one positive outcome. With the number of countries involved in this latest ransomware attack, there may be an increase of cooperation between law enforcement agencies across the world on cyber crimes.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 45th scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. In 2017, he was appointed to the position of Adjutant for The American Legion, China Post 1. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” a book published in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea,” and a new book in 2017 Secrets to Getting a Federal Government Job.