onShore Security CEO Stel Valavanis recently joined a cybersecurity roundtable, organized by LeeShanok Network Solutions, to discuss cybersecurity strategies for businesses. Specifically, the group shared ideas about what to do to secure your company from ransomware attacks and what’s next in cybersecurity.
Greater Security Enforcement is Leading to New SEC Fines –
What You Need to Know Now…
– Stel Valavanis, CEO of onShore Security
Notable Ransomware Attacks are Prompting Increased Accountability
Announcements this past summer have made it clear that the US Government, and particularly the executive branch, is taking ransomware seriously. This move is unsurprising, as attacks such as SolarWinds and the Colonial Pipeline attack demonstrated the risk that hackers pose to our national security and infrastructure. Supply chain attacks proved that high profile targets mean high levels of risk and greater amounts of collateral damage upon attack. Executive orders issued by President Biden and announcements by the SEC should be inspiring corporate cybersecurity stakeholders to make real changes and additions to their security operation, especially as the SEC is expected to make important proposals in Q4, creating legal precedent for disclosure issues that are already proving to be a legal vulnerability to companies and their leaders.
The disclosure issues that companies are currently having are, most notably, ill-advised intentional non-disclosure. In August of 2021, the SEC announced 8 brokerage firms and business entities that would be subject to large fines for failure to disclose breaches. Specifically, the SEC found that the firms violated “ Rule 30(a) of Regulation S-P, also known as the Safeguards Rule, which is designed to protect confidential customer information.” Two of the firms were also found to be in violation of Rule 206(4)-7, a rule relating to notifying clients about a breach. Essentially, they were fined for doing what many companies have gotten away with in the past: failing to stop a breach and then trying to hide that fact from their clients (and investors). The firms were censured, ordered to pay fines, and warned to cease and desist from future violations. These enforcement measures will likely be only the opening salvo of enforcement action by the SEC and other new precedents will be set as violations are announced and prosecuted.
Corporate Leaders Being Held Responsible
Not only does this new enforcement put companies and their ability to do business at risk (of being noncompliant and facing enforcement), but also puts at personal risk the cybersecurity leaders responsible for making security decisions at the highest level. In the case I’ve referred to, fines are being levied specifically for failure to follow the companies’ own cybersecurity policies surrounding multi-factor authentication. Public record and information for investors included this policy, requiring MFA whenever possible, but it was found that MFA was not in place before or after the undisclosed breaches. As the information regarding cybersecurity policies in place at the firms are part of the information investors use to make their choices regarding the company, it frames the coverup and further inaction as either negligent or intentional fraud.
As a company faces actual enforcement, it will be in its interest to prove that the company itself is not at fault and to use its CISO as a scapegoat, whether or not they actually were negligent in the operation. CIOs and CISOs will have to protect themselves from their own organizations as well as from potential civil cases to be brought against them personally.
It will become clearer in Q4 and the future what the SEC will do to enforce transparency for public companies and accountability for the leaders of those companies. A distinction will be made between security that actually protects information and customers and security operations that merely give the impression of effort.
The Ransomware Economy is in the Spotlight and Hackers are Feeling the Heat
– Stel Valavanis, CEO of onShore Security
Ransomware is hot. In 2020, it grew by 336%, with more than 370 million dollars in cryptocurrency paid to hackers and the “vendors” that support them. Ransomware is driving the cybercrime economy and helping it to grow, but it might also be its biggest problem.
From Solitary Attackers to Enterprise Operations
Ransomware has historically had the benefit of a reputation as a cottage industry, with the image of an attacker still being that of a lone black hat in a dark basement, but in reality, cybercriminals have the capability of large, legal businesses, with access to a whole ecosystem of supporting vendors, franchise opportunity, and services specialized to allow what is being referred to as “ransomware as a service”. This empowers the criminals to target bigger organizations for bigger payouts and, while individuals may feel safer these days, it is actually even more likely to be hit by ransomware, and more likely to be affected when others get hit. The collateral damage, such as gas shortages, increases with the size (and importance) of the targets.
As ransomware gangs set their sights higher, attacking large organizations instead of individuals, their targets have begun to include assets that are under government protection and oversight. Government agencies have a vested interest in investigating and prosecuting such attacks. Ransomware is hot but, in fact, may be too hot.
Enormous Capacity to Wreck Havoc and Gain Unwanted Attention
The recent attack on the Colonial Pipeline by the group known as DarkSide, for example, had a major impact on US infrastructure, specifically our energy and oil supply, and opened many eyes to the real danger that ransomware attacks pose. The scale of the attack made it reasonable to categorize the attack as terrorist activity and attract the additional scrutiny and interest that the terrorism label carries. Criminal hackers, who assumed the safety of obscurity, feared the level of attention and response an attack such as this might bring on the entire cybercrime ecosystem. This event itself precipitated calls for “moderation” amongst cyberattacks and a quick ban on discussion of ransomware on the forums where cybercriminals meet, discuss tactics and targets, and trade illegal tools and stolen information, in an attempt to avoid the attention that ransomware attacks have started to garner.
Because suppliers represent exposure, many criminal gangs are moving to end their outsourcing and do everything privately, “in-house”. The current “affiliate” model, by which criminals franchise their operation, offering their tools for a cut of the profit, may soon go away as it poses too much risk as legal and governmental agencies develop their understanding of the ecosystem and adopt more direct tactics to shut the many different parts of the ransomware machine down.
Evolving Ever More Dangerously Underground
Cybercriminals survive by being willing to adapt and it’s policy they’re responding to. The ransomware industry has grown quickly because it has had the room to do so, making moves that would typically be too risky for a criminal enterprise. Ransomware has become big business, with many of the same organizational risks that legitimate businesses face as they grow their operation. As ransomware operations change, we must not presume their death. Even DarkSide survived their moment in the spotlight, turning to a classic public relations maneuver for a company faced with scandal: they rebranded. The new “brand”, Black Matter, is following the new rules of engagement that President Biden tried to set at recent meetings with Russian leader Vladimir Putin. Black Matter is reported to be avoiding targets that are part of the U.S. infrastructure, and so it seems some of Biden’s cyberdiplomacy is working.
A scarier shift is that some of these entities are testing out new technology as they change their focus. While criminal hacking gangs have historically been relatively unsophisticated in their technique, using lightweight, off-the-shelf (literally purchased) programs, the Hafnium attack and others display a potential for much greater attack capability, elevating the threat of many of these groups beyond petty cybercrime to cyberwarfare and cyberterrorism.
Putting Pressure on Nation State Support
Up to now, the majority of criminal hackers attacking the United States have done so from the safety of our adversaries, within Russia, China, and other countries, often unobscured, sometimes working in official capacities as government agents or members of the military, other times with less explicit support. The operations of these cybercriminal cells is covered up enough to offer their host country plausible deniability for anything that comes of out of the shop, and the hackers have historically been left alone or even protected by their home government, as long as they follow two simple rules: Don’t attack at home (often leaving the US as the main target) and don’t make too much noise.
As the US starts to do some of the more basic footwork to stop ransomware (as seen in the effort to recover the ransom from the Colonial Pipeline attack), there will either have to be a greater effort on host countries to police the cybercrime in their jurisdiction, or they will have to do a better job of covering up their connections to the criminals. The cybercriminal world leaves much of their work visible to the public, relying on the lack of scrutiny to operate in the open. As the US government turns its sights on cybercrime, the preparation and effort put into tracking threats, stopping attacks, and improving our security posture puts pressure on cybercriminal gangs, and the state actors behind them, to stop attacks on the US government and people. We shall see if what doesn’t kill them makes them stronger.
Photo credit: KELA
onShore Security CEO Stel Valavanis spoke with Fox 32’s Tia Ewing to discuss the ransomware attack on the Colonial Pipeline, the motivation behind the attack, and what we can and must do in in the future to protect our energy infrastructure.
See the full interview with Stel below.
“As long as there exists the false perception that ransomware can be waved away quickly by paying criminals’ demands, there will be organizations that see it as their best practice. In order to defeat it as a threat, the entire cybersecurity world, and the business world at large, must stand together and declare their complete unwillingness to negotiate with criminals.”
To Pay or Not To Pay Ransomware, That Is the Question…
By Stel Valavanis, CEO onShore Security
I’m beginning to think we should ban ransom payments to criminals or at least disallow insurance to cover them. I know that sounds extreme, but hear me out. It’s very worth exploring at this time, as the scope of the problem is exponentially growing in the wake of COVID-19. According to a new report by Emisoft, ransomware demand costs could reach new highs this year exceeding $1.4B in the U.S. in 2020. [Read more…]