Last week it was revealed the about 4 million former and current federal employees were impacted by a data breach at the Office of Personnel Management. Yesterday morning at a press conference in Germany, the President said, "We have known for a long time that there are significant vulnerabilities, and that these vulnerabilities are going to accelerate as time goes by, both in systems within government and within the private sector." As if acting on cue, a few hours after the President's prediction that things would get worse, things got worse. Brig. Gen. Malcolm B. Frost, U.S. Army, announced that the Army's official [...]

We attended the RSA Conference in San Francisco this week.  There are two giant convention halls filled with latest in information security.  In addition to the in-booth presentations, there are continuous presentations and panels discussing security.  Jeh Johnson, the Secretary of the Department of Homeland Security, was a keynote speaker. Yet, in this sea of the new, the most interesting thing was something patented almost a century ago. In the NSA’s booth (yes, that NSA) was this: A wooden box about the size of a toaster oven — an Enigma machine.  The Enigma machine was patented in 1919.  The Germans [...]

The personnel records of about 4 million current and former federal employees were compromised in a cyberattack on the Office of Personnel Management. This attack is being attributed to China.   Citing iSight Partners, the Washington Post attributes the attack to the group that compromised Anthem. This group uses spearphishing, highly targeted deceptive emails, to deceive people into compromising their systems. Deception takes place in the mind of the person who is being attacked. Users will decide which emails to trust. That decision can be guesswork or it can be guided by IT using SP Guard.

Carefirst, the health insurance company, reported on May 20 that approximately 1.1 million health care records were compromised in "a sophisticated cyberattack." What was the method used in the "sophisticated cyberattack"? Bryan Krebs has the details: Turns out, the same bulk registrant in China that registered the phony Premera and Anthem domains in April 2014 also registered two Carefirst look-alike domains — careflrst[dot]com (the “i” replaced with an “L”) and caref1rst[dot]com (the “i” replaced with the number “1”). Additionally, ThreatConnect has unearthed evidence showing the same tactics were used on EmpireB1ue.com (note the “L” replaced with a number “1”), a [...]

Verizon has released its Verizon 2015 Data Breach Investigations Report. We created this infographic from the report: At the conclusion of a comprehensive discussion of phishing, Verizon observes: Taking measures to block, filter, and alert on phishing e-mails at the gateway is preferred, but no technological defense is perfect, which leads us straight to…people. There is some hope in this data in that three-quarters of e-mails are not opened or interacted with. We wondered if there was a way to bump that number up (e.g., by giving users a quick way to flag potential phishes and become a detective control), so [...]

We attended the RSA Conference in San Francisco this week.  There are two giant convention halls filled with latest in information security.  In addition to the in-booth presentations, there are continuous presentations and panels discussing security.  Jeh Johnson, the Secretary of the Department of Homeland Security, was a keynote speaker. Yet, in this sea of the new, the most interesting thing was something patented almost a century ago. In the NSA’s booth (yes, that NSA) was this: A wooden box about the size of a toaster oven — an Enigma machine.  The Enigma machine was patented in 1919.  The Germans [...]

This week, FireEye released their latest APT report - APT30: The Mechanics Behind a Decade Long Cyber Espionage Operation.  The sub-title summarizes the findings: How a Cyber Threat Group Exploited Governments and Commercial Entities across Southeast Asia and India for over a Decade. What are the surprises in APT30? There are no surprises in APT30.  The bad guys engage in anti-forensics to avoid detection. APT30 tells us that the bad guys use spearphishing to make their initial infiltration: APT30 LEVERAGES MAJOR POLITICAL TRANSITION AS PHISHING LURE CONTENT IN CAMPAIGN GEARED TO KEY POLITICAL STAKEHOLDERS This is a sample of the lures used to [...]

Russian hackers used compromised systems at the Executive Office of the President to access the President's schedule. How could Russian hackers get to the President's schedule?  CNN reports: As in many hacks, investigators believe the White House intrusion began with a phishing email that was launched using a State Department email account that the hackers had taken over, according to the U.S. officials. All the advanced cyber-defenses used to protect the White House were defeated by tricking users with deceptive emails. Spearphishing is not a casual hit and miss activity, it is the precise application of Military Deception. This is the [...]

On April Fools' Day President Obama issued an executive order entitled, "BLOCKING THE PROPERTY OF CERTAIN PERSONS ENGAGING IN SIGNIFICANT MALICIOUS CYBER-ENABLED ACTIVITIES." This was not an April Fools' prank. In the executive order the President observes that cyber-enabled threats "constitute an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States." In the executive order, the President declares a national emergency to deal with this threat. It is well-known that the most common method used by foreign powers to infiltrate U.S. Government systems is spearphishing.

Writing in TechCrunch, Tom Chapman, director of cyber operations of Edgewave, describes how terrorists can apply the same techniques used against Anthem, Sony and many others to engage in cyberterrorism. What could these technique be? Spearphishing. Chapman writes: As groups like ISIS become more tech-savvy and recruit members from Western countries, they will gain the ability to conduct effective spear-phishing attacks. What they will attempt to do inside corporate or government systems is hard to say. Hacking the controls for nuclear power plants, traffic systems and other vital infrastructure after a spear-phishing breach requires significant skill, but that skill level [...]