Michael Wahl, MBA

Cybersecurity expert Jeremiah Fowler recently uncovered a concerning data breach involving over 4.6 million voter records and election-related documents. These sensitive files were discovered in 13 unprotected databases managed by a technology contractor based in Illinois. The databases were traced back to Platinum Technology Resource, a firm providing election technology and services to various counties across Illinois. Fowler revealed that by altering county names in the database URLs, he could access additional exposed databases, some of which had minimal security protections. The exposed records included critical personal information such as voter names, addresses, dates of birth, Social Security numbers, and driver’s licence numbers. Additionally, the databases contained documents with candidate information, including contact details and voter petitions with signatures. Although Fowler did not find any immediate misuse of the data, the potential risks are substantial. Malicious individuals could exploit this information for identity theft, voter intimidation, or spreading disinformation. Fowler noted that having access to such personal information could allow bad actors to send misleading information about voting procedures or use past voting history to harass voters. https://lnkd.in/gsTZR7DF

1

We really need to stop using FTP servers, especially for sensitive data 🛡️ Sensitive data on nearly 1 million Medicare beneficiaries in Wisconsin was compromised in 2023 due to a ransomware attack exploiting Progress Software’s MOVEit file-transfer service flaw. On September 6, The Centers for Medicare & Medicaid Services (CMS) announced that its contractor, Wisconsin Physicians Service Insurance Corp., was impacted by the MOVEit flaw. The compromised data includes names, Social Security numbers, dates of birth, addresses, hospital account numbers, Medicare beneficiary identifiers, and health insurance claim numbers. CMS began notifying nearly 950,000 affected individuals last week, following Wisconsin Physicians Service’s notification of the breach on July 8. The data breach is part of a larger wave of attacks in May 2023 targeting the MOVEit vulnerability. Organizations like the Texas Dow Employees Credit Union have also recently disclosed breaches related to the MOVEit vulnerability. https://lnkd.in/gP8t4E3C

3

Impactful cyber news today -- An important step in the direction that CISOs are treated more like a CFO, with the right level of accountability, transparency, as well as protection. Senator Wyden and Warner just proposed a new healthcare cybersecurity bill. This bill might be a watershed moment for the cybersecurity industry, an important step in codifying the practice of cyber security. It aims to regulate and document the official responsibilities of Cybersecurity leadership for a healthcare entity. This bill might do for the CISO what Sarbanes-Oxley did for the role of the CFO. If this bill passes, other industries may follow suit. The bill specifically calls out the - Establishment of a minimum cybersecurity standard for the health care industry - Public certification of compliance (The CISO must certify) - Annual security audit and stress test of incident recovery  - No Cap in Health and Human Services fine authority - Provides financial help to small and safety net hospitals Press release: https://lnkd.in/gqRS_ZMD One page summary:  https://lnkd.in/gQpszBrm For public companies today, the CFO and the CEO must certify the company's financial statements every quarter. This bill would have the CISO (and presumably the CEO) publicly certify its cybersecurity compliance annually. This step will allow the CISO to gain appropriate resources, take on proper accountability, and also receive much-needed protection for his/her job. Thank you to Joe Sullivan who brought this to my attention. Jim Higgins, Vitaly Gudanets, Kirsten Davies, Lakshmi Hanspal, Ariel Litvin, Confidence Staveley, Catherine A. Allen, Karissa A. Breen (KB), Jackie Bow, Gary Hayslip, Rinki Sethi, Matthew Rosenquist, Stephanie M. Shorter, PhD, Ross Haleliuk, Stephanie Domas, Heather Hinton, Chris Hughes, Tal Mozes

60

10 Comments

Cybersecurity is no longer solely an IT department’s concern; it's a company-wide responsibility. But with busy schedules and overflowing inboxes, getting employees to truly pay attention to cybersecurity training can feel like an uphill battle. Let’s start off with why too many staffers are apt to mentally tap out when taking an awareness course. Boring. Training tends to center on videos of staged events where actors sit around in a very far-fetched setting discussing their daily activities or another topic that is then somehow related to cybersecurity. Unimportant. Workers often don’t connect what might be poor cybersecurity decisions to actual outcomes. Security awareness training is crucial, but sometimes it can feel irrelevant. Impersonal: It certainly makes sense that cybersecurity training should focus on the business, but workers often tune out when the instruction does not include their concerns. Untargeted: Sitting through a session with lessons on topics that don’t concern the employee is an instant turn off. Punishment: Sometimes the lessons make the employees feel as if they have already done something wrong. Now, let’s look at how to design a cybersecurity awareness program that will keep employees engaged and informed...

22

3 Comments

Who let the CrowdStrike bugs out? Another bug, it turns out. Bloomberg reports: "CrowdStrike Holdings Inc., the cybersecurity company at the center of massive global IT outages, said that a bug in a quality-assurance tool the company uses to check updates for mistakes allowed flawed data to go out to customers, causing last week’s meltdown. On Friday, the company pushed through an update for Windows machines via a rapid-response mechanism, meant to respond quickly to changing threats. That update contained a critical flaw. CrowdStrike’s “content validator,” which is supposed to test updates for errors before they go out, malfunctioned and let the bug pass through, the company said in an incident report published on Wednesday." 🤔 Conspiring bugs? And so many think that code will save us all. Don't get me wrong, code and computers have revolutionised how we live our lives. But a panacea for all problems it is not. It may solve many problems but as CrowdStrike demonstrated, it can also cause spectacular ones: "That undetected error crashed Windows systems and kicked off one of the most spectacular rolling IT failures in history." Guess what part of the solution entails? "CrowdStrike said it’s working to improve Rapid Response Content testing in the future. A new check “is in process” in order to fix the faulty content validator. The company also said it would give customers greater control over how these updates are delivered onto their systems." Yup, give puny humans more control. "The company — which was criticized for mass-deploying the catastrophic update instead of starting with a smaller rollout that would’ve prevented widespread outages — also said it plans to stagger future updates via “canary deployments” which are tested piecemeal before bigger rollouts." Because it is almost impossible to ensure that any code is bug-free before rollout. In the course of researching my crypto paper "Pause the Blockchain Legal Revolution" (https://lnkd.in/f8qt-cU), I learnt that: “Industry average experience is about 1-25 errors per 1000 lines of code for delivered software." Those figures don't take into account crypto but refers to the more mature software industry. If you want to find out what the figures are for crypto smart contracts, you'll have to check out the paper, though admittedly the figures are outdated. I also found Mark Minasi's book, "The Software Conspiracy" (2000) (available to borrow on the Internet Archive: https://lnkd.in/giM2bQhU) fascinating reading. https://lnkd.in/gQ9Xw4Mz

32

11 Comments

🔐Strengthening America's Cybersecurity w/ Open-Source Collaboration🔐 White House Report: https://lnkd.in/gfx-NHqA Open-source software powers America’s national security and economic prosperity. The potential damage, disruption, and disorder can be significant when this software isn't secure and resilient. Preventing and mitigating these risks requires collaborating with the open-source software community. The Open Source Software Security Initiative (OS3I) exemplifies this ethos by working closely with the open-source community to develop policies that prioritize the "end user" and strengthen the security and resilience of our nation. #cybersecurity #opensource #collaboration #policy #innovation #nationalsecurity #Defcon

2

Tech monopolies in government aren't just bad business—they're a national security liability. Just look at the endless parade of cyber breaches making headlines. Sure, navigating government systems, procurement, and real innovation is complex. But defaulting to the same old vendors and solutions isn't the answer. Let's be real: we're not short on alternatives. There's a whole ecosystem of battle-tested solutions out there, proven in Fortune 500 companies and government agencies worldwide. The roadblock isn't a lack of options, it's our reluctance to break free from comfortable vendor relationships and familiar paper pushing processes. Putting all our eggs in one vendor's basket isn't just short-sighted, it's dangerous. Strong cybersecurity and innovation demand a diverse portfolio of solutions and healthy market competition. We already have robust alternatives at our fingertips. Using them isn't just good strategy it's crucial for protecting our nation. When are we going take this seriously and set the example at the Federal level so that SLT government and our allied countries can benefit from our true leadership.

9

2 Comments

What do unicorns and cybersecurity have in common? Why am I wearing a headband with blue streamers? Why is Justin wearing a pirate hat? Why is our guest wearing a unicorn hat? Listen and watch this week's She Said Privacy He Said Security podcast to find out! What's a podcast without some fun? Bryson Bort, CEO & Founder of SCYTHE and fellow IANS faculty member, joins Justin Daniels and I to discuss: 🔑 Bryson Bort’s career from military strategist to cybersecurity trailblazer (and he is recognized as a Top 50 in Cyber by Business Insider and SANS Difference Maker Awards’ Innovator of the Year) 🏹 Why he developed Project Crossbow 🦄 The significance of using unicorns as symbols 🛡️ The cybersecurity problems SCYTHE is designed to solve 🔄 Transforming static security training into dynamic processes 💰 The connection between cryptocurrency and ransomware 🚀 Actionable steps your organization can take now 📣 Learn how offensive cybersecurity strategies can amplify your defenses and turn security into your strategic asset. Listen and watch here: https://lnkd.in/e3wCd3Jz

11

6 Comments

Did you know that Screen capture applications could be a spyware risk to organizations? 💃🏽 Debbie Reynolds, "The Data Diva," explains how many apps, like PC Tattletale, operate covertly by taking screenshots of your computer or phone and sending sensitive information to the cloud without your knowledge. 😱 These apps are marketed for employee surveillance, parental control, or even monitoring cheating spouses, but their misuse can lead to far more harmful consequences. 🏨 Debbie highlights how security researchers discovered spyware installed on computers in three Wyndham hotels, capturing guest information such as partial credit card numbers during reservations and check-ins. This underscores the dual nature of technology, capable of both positive and negative impacts. 📊 Also, to add insult to injury, a misconfiguration in the app resulted in data leaking onto the open web, raising serious concerns about unauthorized access and potential data breaches. With the rise of spyware and surveillance tools like "Bossware," companies must be aware of the increased risks. Unsanctioned apps can compromise security, and even sanctioned ones can inadvertently expose sensitive data. 🔒 Debbie emphasizes that companies should regularly audit their systems to identify risky apps and ensure that customer or employee data isn't compromised. In this digital era, safeguarding data privacy and protecting against spyware is more critical than ever! 🔐 Data Privacy and cybersecurity experts, please give me your thoughts. Debbie Reynolds Consulting, LLC Data Diva Media #dataprivacy #datadiva #privacy #cybersecurity #Spyware #ScreenCapture #Bossware #EmployeeSurveillance #DataProtection #TechSecurity

90

24 Comments

Implementing zero trust in AI and LLM architectures: A practitioner’s guide to secure and responsible AI systems https://trib.al/9BbKN4y

5

In situations like the #Patelco ransomware attack, organizations face three main challenges: reputation, litigation, and business loss. We've seen the first two so far; the extent of the business loss will become clearer in the coming weeks as systems are restored. #CyberSecurity

2

Now that the dust is settling on the CrowdStrike/Microsoft debacle, I'd like to share three thoughts on how all of this applies to cybersecurity. 1) Human in the loop (or lack thereof). We've seen how a faulty update was pushed out quickly, but the remediation required a manual reboot of each system and deleting the problematic file. Shouldn't it be the other way around - i.e., fast and automatic remediation? Taking the human out of the loop and doing things faster has been one of the selling points of AI, and we continue trending in that direction. However, this can cause a lot of damage very quickly. I'm thinking back to early 2000s when the human-activated ILOVEYOU virus took about a week to spread, while early worms (no human interaction) spread in a matter of minutes. Human in the loop slows down a lot of things - but it also limits the damages. Remediation should be automated. 2) Diversity in defense. Yes, diversity of systems makes it more difficult to manage, but it also prevents a catastrophic failure. We've just seen that over-reliance on Windows/CrowdStrike pairing essentially produced a single point of failure. I'm all for the best product to win the market. However, with a larger market share, products from Microsoft/CrowdStrike become a part of critical infrastructure and should be treated with increased attention. If these fail, there should be backup systems not using these products. 3) Who's responsible? What we just witnessed is a familiar (and challenging) problem in the cloud infrastructure space. Who's responsible for data protection - the provider or the tenant? What about networks? Operating systems?... All of these should be contractually negotiated. In this case, CrowdStrike became a security service provider behind some Windows deployments. It appears that some clients didn't treat it as a service contract. This brings up the issue of cybersecurity supply chain and related attacks. In a way, this was similar to the Solarwinds case but with less malicious hacking and more public visibility. Supply chain attacks and proper vendor management should not be ignored. Pictured is Atlanta airport on the evening of July 23, 2024. I managed to compete my round trip, but the sad face from a crashed system is very symbolic. This may not have been a cyber attack but it was a cyber incident for sure - system availability was impacted. #cybersecurity #crowdstrike #windows #availability

81

7 Comments

AI agents are changing the game! Learn how to threat model these systems & stay ahead of the curve. 🛡️🤖 #AI #security #threatmodeling

2

🚨 ALERT: Cleveland Under Cyber Attack! 🚨 Another major US city has fallen victim to cyber criminals, and this time it's Cleveland, Ohio. What happened? How is the city coping? And most importantly, what does this mean for YOU? 👀 WATCH NOW: https://lnkd.in/eYmZWWUS Join us as we discuss the latest details of this massive cyber attack! #Cyberattack #Cleveland #ClevelandCity #CyberattackImpact #CyberThreats #cybersecurity #RansomwareAttack #DataBreach #CybersecurityNews #CybersecurityUpdates

3