The WannaCry ransomware attack was the end result of years of ignorance on the part of governments, private-sector firms, and the public regarding how serious cyber threats have become.

The 2016 Shadow Brokers NSA hack came home to roost in a big way last week, when a code execution vulnerability contained in the Shadow Brokers WikiLeaks dump was used to launch the largest ransomware attack in history. The WannaCry ransomware strain, also known as WannaCrypt, Wana Decryptor, and WCry, hit hundreds of thousands of computers in 150 countries before it was halted – temporarily – when a security analyst stumbled upon a “kill switch” in the code. However, even the analyst who discovered the kill switch emphasized that the fix was, indeed, temporary; reports of new variants are emerging, and the kill switch does nothing to help the armies of machines that have already been infected.

WannaCry wreaked havoc on companies in numerous industry sectors, including French car manufacturer Renault and Spanish telecommunications giant Telefonica, but perhaps the most stark illustration of the damage was what it did to Britain’s National Health Service (NHS). The Guardian reports that 45 NHS facilities were infected, forcing hospitals to redirect ambulances, postpone treatments for cancer patients, and warn patients of delays overall.

Organizations in the U.S. were fortunate; a Department of Homeland Security spokesperson told NPR that the number of WannaCry ransomware victims stateside was “very small.” But that’s only because of luck – and luck eventually runs out.

WannaCry Ransomware Took Advantage of Old, Unsupported Systems

The WannaCry ransomware nearly exclusively impacted enterprise machines, not home computers, because the latter are more likely to be running updated operating systems, and WannaCry exploits a vulnerability in Windows XP up through Windows Server 2012. Microsoft released a patch for the newer end of that range in March, but the company stopped supporting some of the older systems in the group, including Windows XP and Windows 2000, years ago. After the WannaCry attack, Microsoft took the highly unusual step of issuing an “emergency patch” for Windows XP, Windows 8, and Windows Server 2003.

As soon as WannaCry hit, the buck-passing commenced. The British media attacked the government for not sufficiently funding the NHS. Microsoft criticized the NSA for not properly securing its cyber-weaponry. Meanwhile, Microsoft itself came under fire for not issuing security updates for legacy systems that it knew were still in wide use. Security experts reiterated the age-old warnings to organizations about keeping their systems updated and engaging in proactive measures to prevent attacks like WannaCry.

Do We Have Your Attention Now?

The WannaCry ransomware attack shouldn’t have surprised anyone. Cyber security experts have been warning about large-scale attacks on critical infrastructure for years, and there have been numerous smaller-scale ransomware attacks on U.S. emergency services. The only surprising things are that it took so long for something like this to happen, and that the United States was not hit as hard as the rest of the world, particularly since preliminary evidence indicates that WannaCry may be the work of the same North Korean hackers who were behind the Sony Pictures email hack and last summer’s SWIFT network attack on a bank in Bangladesh.

American healthcare facilities are plagued with the same cyber security problems as the NHS, including antiquated legacy systems and an unwillingness on the part of organizations to invest in proactive cyber security measures. Other industries aren’t doing that much better, including the government. After all, the exploit that started all of this was stolen from an American spy agency. If the NSA cannot properly secure its systems, what does that say about everyone else?

The WannaCry attacks are the natural end result of the government, private-sector organizations, and the public engaging in reactive cyber security at best, and remaining ignorant of cyber security at worst. Mere days before WannaCry hit, the Trump Administration issued an executive order commanding the federal government to get its cyber security house in order. Private-sector organizations and, yes, individuals need to do the same. Everyone needs to be aware of the seriousness of engaging in proactive cyber security best practices and the severe potential consequences of not doing so.

Thanks to WannaCry, everyone now knows what ransomware is and what it’s capable of doing. The question is, what are we going to do with this information?

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

The 2017 Verizon Data Breach Report Reveals that Hackers Aren’t Just After Payment Cards and Identities Anymore

Cyberespionage is a growing problem, especially in the manufacturing industry, professional services, education, and the public sector, according to the 2017 Verizon Data Breach Report, which was released last week. While hackers are still after credit card numbers, employee tax data, health records, and other sensitive personal information, they’ve discovered that targeting intellectual property, company secrets, and even state secrets can be quite lucrative.

Almost as if on cue, around the same time the Verizon Data Breach Report was released, online entertainment provider Netflix fell victim to intellectual property theft. A hacker or group identifying itself as “TheDarkOverlord” demanded a ransom and threatened to publicly release episodes of the upcoming season of the Netflix original series Orange Is the New Black, which had been scheduled to be released [to paying subscribers] on June 9. Netflix refused to pay up, and TheDarkOverlord dumped 10 episodes (or at least, what appear to be 10 episodes) online. Because the hacker or group accessed the material by compromising a post-production facility utilized by several major television studios, other networks will likely be targeted in the weeks and months to come; in fact, TheDarkOverlord has already Tweeted as such:

https://twitter.com/tdohack3r/status/858893194297315328

Intellectual Property Especially Vulnerable in the Digital Age

In the digital age, companies are in possession of more intellectual property than ever before. In addition to product prototypes, patents, market research data, and sales lists, many companies develop proprietary software and mobile apps to gain a competitive edge. Casinos, for example, pour millions into the development of gaming software, and as consumers demand to watch television series and movies online, entertainment companies are investing heavily in content-delivery technologies.

The Verizon Data Breach Report notes that 90% of cyberespionage attacks are launched by “state-affiliated groups.” While most people might assume these groups are primarily targeting the public sector in search of state secrets, private-sector companies are not immune from cyber spycraft; cyberespionage is the top cyber threat facing the manufacturing industry, far eclipsing all other forms of hacking, and 90% of the data stolen consists of company secrets.

Why would state actors be interested in hacking a manufacturing company? Private-sector firms have long been targets of spycraft on the part of foreign agents who wish to steal cutting-edge technology for use in their own countries. A recent plotline on the FX spy drama The Americans, which is set during the Cold War, involved Soviet spies infiltrating an agricultural company to steal samples of a new pest-resistant wheat crop for the KGB. The Verizon report implies that not much has changed since the series’ fictional spies’ time, noting that education institutions are increasingly being targeted by state actors and theorizing that this is because “[c]olleges are centers of innovation and are building technologies” that are of great interest to foreign governments.

While intellectual property theft by disgruntled current or former employees or competitors isn’t as common, it’s costly when it happens. It’s estimated that the Houston Astros MLB team lost $1.7 million after an employee of a competing team hacked their database, stealing confidential scouting and trade information. While it’s unknown at this juncture how much Netflix stands to lose from the theft of Orange Is the New Black, industry experts are already wondering if the company will be forced to release the next season early just so they can hope to compete with the “free” version provided by TheDarkOverlord.

How Are Hackers Getting In, and How Can Companies Stop Them?

The Verizon Data Breach Report found that the typical cyberespionage attack starts like most others do: An unsuspecting employee clicks on a malware-infected file attached to a phishing email. Once the malware is installed, a cyber spy can use it to steal legitimate login credentials and get into the organization’s system, where they can remain undetected for days, weeks, even months.

The best defense against phishing emails is to implement proactive cyber security procedures to prevent employees from being phished in the first place. The Verizon report suggests installing anti-malware protection at the email gateway, keeping software and operating systems up to date, implementing network segmentation and multi-factor authentication, security awareness training for all employees, and having a system in place where employees can immediately report suspected phishing emails to security personnel.

Any company that owns, or is perceived to own, useful or valuable intellectual property or competitive information is at risk of having it stolen. Verizon’s report illustrates that it’s just as important to protect intellectual property data as it is to protect payment card, customer, and employee data.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

Yahoo Is Trying to Pass the Buck, but Data Breach Responsibility Starts at the Top

Who should be held responsible when a company’s systems get breached? Historically, the CIO, the CISO, or both have shouldered the lion’s share of data breach responsibility; well over half of security decision-makers expect to lose their jobs if a hack happens at their organizations. However, breaches don’t happen in vacuums, and CIOs and CISOs don’t operate in them, either. Many CIOs report directly to the CEO, and some security experts feel that CISOs should be elevated to the same reporting level.

Whatever an organization’s reporting structure, the bottom line is the same: the responsibility for everything that happens within the organization, positive or negative, ultimately falls on the CEO and the board of directors. This includes data breach responsibility. This has been reflected in the numerous CEO firings (or “resignations”) that have followed bad breaches over the past few years, including those at Target, Sony Pictures, and the Democratic National Committee.

Apparently, Yahoo didn’t get the memo about this. After years of poor cyber security practices caught up with them, resulting in multiple breaches affecting over a billion user accounts, putting its acquisition by Verizon into question, and making the Yahoo brand name synonymous with the phrase “data breach,” the company decided to fire … its General Counsel, Ron Bell. Shockingly, CEO Marissa Mayer remains in place, albeit with a pay cut.

In Yahoo’s case, the CISO and the rest of the security staff couldn’t be fired. Fearing that a major security incident would eventually happen, they’d already run for the hills. The New York Times reported that former CISO Alex Stamos and his team had spent years warning Mayer of potential security issues, but Mayer insisted on putting “the user experience” ahead of cyber security and even cut the team’s budget.

Preventing Breaches Is Everyone’s Responsibility

Cyber security isn’t just an IT issue. It impacts every individual and department in an organization, from the board of directors all the way down to minimum-wage clerical and retail employees. The overwhelming majority of data breaches originate inside an organization, either because a negligent or untrained employee makes a mistake or a malicious insider decides to strike back against the company. No cyber security policy is complete unless it addresses the human factor behind data breaches by promoting a culture of cyber security awareness. This culture must start at the top of the organization; if the board, the CEO, and the rest of the C-suite do not take security seriously, front-line employees certainly won’t.

Yahoo’s firing of Ron Bell has shaken up the legal community and is causing much debate over where data breach responsibility ultimately lies. While this may serve to light a fire under organizations with questionable cyber security practices, the focus should not be on whose heads will roll if a breach happens; it should be on implementing proactive cyber security and compliance measures to prevent hacks from happening in the first place.

As for Yahoo, the company is now looking at a possible worldwide class-action lawsuit alleging security issues dating back as far as 2003. Should the suit proceed, we’ll see what the courts have to say about data breach responsibility.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.