Following up on Briefs’ last post on cyber crime, here, from Wired magazine, are “The Worst Cybersecurity Breaches of 2018 So Far”.

Wired’s warning: “Corporate security isn’t getting better fast enough, critical infrastructure security hangs in the balance, and state-backed hackers from around the world are getting bolder and more sophisticated.”

The examples range from Russian power grid hacking to, again from Russia, spying on computer routers.

Barrier Briefs has been noting how cyber-based crime is increasing, along with the need for security vigilance. Here’s an example, provided by Bruce Schneier on his security blog.

“Police in Detroit,” Schneier writes, “are looking for two suspects who allegedly managed to hack a gas pump and steal over 600 gallons of gasoline, valued at about $1,800. The theft took place in the middle of the day and went on for about 90 minutes, with the gas station attendant unable to thwart the hackers.

“The theft, reported by Fox 2 Detroit, took place at around 1 P.M. local time on June 23 at a Marathon gas station located about 15 minutes from downtown Detroit. At least 10 cars are believed to have benefitted from the free-flowing gas pump, which still has police befuddled.”

The two thieves were able to take control of the gas pump away from the gas station’s employees. When have you heard of that happening? Well, this is a new era of cyber-based crime. Be wary.

Perish the thought, but the reality is that security disruptions – digital disasters – can be caused by insiders in an organization as well as faceless hackers.

As proof, DarkReading.com discusses “The 6 Worst Insider Attacks of 2018 – So Far” in which “stalkers, fraudsters, saboteurs, and all nature of malicious insiders have put the hurt on some very high-profile employers.”

The listed attacks were at
– Tesla, where “a trusted insider was deliberately sabotaging software systems that control the car company’s manufacturing processes.”
– Punjab National Bank, which was the victim of “a $1.8 billion insider swindle.”
– Facebook, where “a security engineer, of all people,…invaded the privacy of Facebook users to stalk women online.”
– Coca-Cola, where a former employee garnered “personal information about 8,000 Coca-Cola workers.”
– Speech-recognition software firm Nuance “was hit with an insider attack that ended up leaking patient records for 45,000 individuals that were hosted on one of its medical transcription platforms.”
– Suntrust Bank, which alleged that “a former employee sold the names, addresses, phone numbers and account balances of 1.5 million bank clients.”

We keep saying it, but here’s proof indeed – Computer complacency can be greatly mistaken.

Don’t count on the Department of Homeland Security to insure protection against cyber-attacks on U.S. businesses and government agencies, the Homeland 411 blog advises.

“Chronic under staffing, insufficient resources, and a lack of cyber-prioritization has left government systems and critical infrastructure vulnerable to attacks and has placed DHS’s cyber goals far from reach, according to former top cyber officials, members of Congress, and cybersecurity experts Homeland411 spoke with.”

“Currently,” Jackson Barnett on Homeland 411 continues, “DHS has 2,500 civilian vacancies, a DHS official said. Lawmakers have shown bipartisan disappointment in DHS’s pace of recruitment, retention, and attrition. Issues are not unique to workforce shortages. Deadlines have been missed, progress inflated, and cross-agency cyber assessments have not been completed, according to multiple Government Accountability Office (GAO) reports. The strategy itself came in behind schedule, released more than a year past its federally mandated deadline.”

Clearly, this doesn’t appear to be a happy setting for U.S cybersecurity. Let the users of your own machines beware.

Computer hackers with access – granted or created – to a business file can do great harm to the business involved. A security truism these days? Of course.

But Joe Granitto on Security InfoWatch follows up with practical suggestions on protecting your data. “Defending your operations and reputation,” he writes, “requires a holistic cybersecurity plan, and physical security has become an increasingly important factor in protecting your network and data.”

The elements of such a plan can be fairly complex and we refer you to Granitto’s piece on them. But the underlying reality is that a protection plan, starting with awareness and fleshed out in software and other steps, is called for.

Granitto’s closing guidance: “Limiting or controlling access with an efficient and secure key management system can provide the crucial physical layer to a holistic cybersecurity plan. With these tools at hand, your physical security team is well-equipped to become an essential part of your cybersecurity program.”

The nation’s security agenda is growing increasingly crowded, as a post by Rachel Schultz on Homeland 411 makes clear. “Cyber and border security, immigration, refugees, military readiness, and capabilities,” she writes, “headlined the second annual Capitol Hill National Security Forum on June 21.”

There are, primarily, border and immigration issues confronting the U.S. and it’s not entirely clear who has the most authority for solving them, Congress or President Trump.

Of the two immigration bills before the House, the one considered to be the most conservative was voted down, 231-193, as the National Security Forum and a vote on a more moderate “compromise” bill was postponed.

“[W]hat we don’t need to do as Americans is pit the enforcement of law against our humanitarian ideas,” Homeland Security Secretary Kristjen Nielsen said, insisting that President Donald Trump is not the one to come up with a lasting solution to the immigration problem. “I want to be very clear on this; Congress has the authority and responsibility to make the law of the land and to fix the immigration system.”

She added that ““I want to be very clear here, of the 12,000 [unaccompanied children] that are currently housed within [Health and Human Services] facilities…10,000 of those kids were sent here without a parent, without a legal guardian, in the hands of smugglers, in the hands of traffickers…”

The security sector has been steadily changing over the past decade. While controls over physical entry, such as barriers, remain essential, security has become a digital enterprise, too, with the threats coming from “out there,” that is the Internet.

A blog post by SIA, the Security Industry Association, is helpful in grasping the new context.

“One of the methods the corporate world has devised to deal with rapid, frightening transitions is risk management. Risk professionals are needed whenever a big change is imminent because they strategize how to best adopt change, implement a process that takes account of the risks and adjust the organization’s commitment and exposure according to the developing landscape. Recent examples of such processes include the adoption of cloud and mobile technologies. Organizations that operate in non-regulated environments have been forced to consider these technologies, assess the risk embodied in each one and plan a cautious route towards slow and gradual adoption.

“The sheer speed at which IoT is moving, however, will not allow organizations such time to stop and think before implementation.” This is a troubling thought, because most of us need exactly that – “time to stop and think.” That’s something Barrier Briefs aims to help with – pointing to security avenues where it would be well to “stop and think”. Thanks SIA!

With the best of intentions, SecurityInfoWatch has a post discussing how schools and businesses are turning to “non-lethal solutions for active shooter mitigation.” That’s all very well, but a shooter with a gun has it over anyone else in terms of range. The shooter can stand-off in a deadly manner, protected by a distance advantage from pepper spray, Tasers or whatever.

We don’t want to get into a deadly tactical discussion, but once shooters become aware of the non-lethal alternatives against them, guns, it would seem, become even more menacing than before.

A bill introduced in the Michigan legislature that would enable teachers to arm themselves wth pepper spray or Tasers seems to be over-stating the non-lethal defense. “A school employee who is armed with pepper spray or a Taser has the potential to save countless lives by quickly and efficiently incapacitating the gunman,” State Rep. Beau LaFave, who is sponsoring the legislation, told the Holland Sentinel. “This is a simple plan that offers non-lethal options many teachers will feel comfortable using.”

“Simple” in the face of a gun wielding assailant? Wouldn’t the non-lethal defenses cause him to pull the trigger sooner than later? We aren’t demeaning the bravery of teachers when we suggest that guns in the wrong hands are the problem.

Computer passwords, those that provide reasonably assured protection, are becoming an art form, as this post by John E. Dunn on the naked security blog indicates.

Here, Dunn is touting a new tool by Microsoft – if you’re a Premium 1 account customer of Microsoft’s Azure AD cloud service or Windows Server Active Directory – to block “password spraying” attacks.

“Called Azure AD Password Protection, the tool prevents users from setting a password from the company’s list of the 500 most common and easily-guessed examples, including around one million of the most frequent character substitutions.”

Anything that lets you use your computer, rather than just sitting and wondering if it’s really safe to use, is worth getting to know about. So give Mr. Dunn’s piece a read.

Who’s the biggest provider of unwelcome spam e-mail messages these days? If you say China, our experience has been that it used to be China, but now is the “Russian Federation”, by far, although we’ve been falling behind in sorting through our spam messages.

Yet, interestingly enough, the Homeland 411 blog is saying that China and North Korea pose the greatest cyber threats to the United States, referencing a Brookings Institution conference on June 14.

Well, of course, there is more to “cyber threats” than e-mail intrusions. But we thought we’d provide this post from Homeland 411 as something for you to ponder on who, or whom, might be crossing your cyber doorstep in an unwelcome manner.