Cyber security update January 2017

Policy developments:

• The Parliamentary Joint Committee on the National Security Strategy launched an inquiry into cyber security, following the launch of the Government’s new National Cyber Security Strategy for 2016–21 in November 2016. The Committee is seeking submissions across a range of aspects including the types and sources of cyber threats faced by the UK, the effectiveness of the UK’s strategic leads on cyber security and ways in which the UK Government can work with the private sector to build cyber resilience and cyber skills. The closing date for submissions is 20th February 2017.
• Seven start-ups, focusing on online security issues and threats joined the new GCHQ Cyber Accelerator, powered by Wayra UK. The accelerator is part of a Government-funded cyber innovation centre that will help keep the UK secure online. The Accelerator is a key component of one of two innovation centres announced as part of the Government’s £1.9bn National Cyber Security Programme.
• The US Federal Communication Commission (FCC) published a new white paper on cybersecurity risk reduction, suggesting actions to reduce cyber risk in a manner that encourages competition, protects consumers and reduces significant national security risks.
• Network World reported on President Obama’s cyber security legacy, suggesting that while much effort was put into cyber security during his presidency the results are not encouraging. It also reported that President Trump is to sign an executive order that gives each cabinet official more responsibility for the safety of data within their agency, to be accompanied by a government-wide review of cyber security. The Washington Post published a draft of the order.
• The European Commission launched a public consultation reviewing the European Union Agency for Network and Information Security (ENISA) and a tender for a project assessing cyber security in the healthcare sector of Member States.
• ENISA published a study on taxonomies used for incident detection and prevention to inform good practice. 

Cyber security research and analysis:

• The Office for National Statistics statistical bulletin Crime in England and Wales: year ending September 2016 adults reported that adults aged 16 and over experienced an estimated 3.6 million incidents of fraud, with just over half of these being cyber-related. The most common types of fraud experienced were “Bank and credit account” fraud (2.5 million incidents; 68% of the total), followed by “Non-investment” fraud – such as fraud related to online shopping or fraudulent computer service calls (0.9 million incidents; 26% of the total). In addition, adults experienced an estimated two million computer misuse incidents; around two-thirds of these were virus-related and around one-third were related to unauthorised access to personal information (including hacking). This is the first time the survey has included cyber crime, a development welcomed by the National Cyber Security Centre.
• Risk Based Security published its annual Data Breach QuickView report: 2016 broke the previous all-time high, set back in 2013, for the number of records exposed from reported data breaches.  The 4,149 data breaches reported during 2016 exposed over 4.2 billion records.
• GreatHorn, which offers software that seeks out phishing attempts and can autonomously block them, reported on the challenges involved in addressing phishing emails in a study; also see coverage from Network World.

Ransomware:

• BBC News reported that UK schools had been targeted by ransomware by criminals claiming to be calling from the Department for Education (also see this related advice from Action Fraud) and also on a ransomware attack on public libraries in St Louis.
• Network World reported on a ransomware attack on Gurnick Academy, a California-based nursing school, the impact of which was limited by disconnecting the infected device from the corporate network; it also reported on Spora, a new ransomware program which can perform strong offline file encryption and brings several innovations to the ransom payment model.
• ComputerWorld reported that Los Angeles Valley College had made a $28,000 ransomware payment on the advice of outside security experts and law enforcement.
• In a blog post Malwarebytes predicted that targeted ransomware attacks will become the new norm: “In addition to encrypting files, ransomware attackers will soon be threatening to post data or information on social media, or to expose it in an equally destructive way. As with most cyber-attacks, ransomware will grow to take advantage of more human vulnerabilities.”
• Endpoint security company SentinelOne reported the 30% of NHS Trusts have suffered a ransomware attack, based on Freedom of Information (FOI) requests made by the company.
• Network World and BBC News reported on the sudden increase in ransomware attacks on unsecured MongoDB databases; MongoDB published guidance on securing MongoDB databases and advice on how to diagnose and respond to attacks. Network World also reported that over 600 Elasticsearch instances were subsequently targeted similarly; again the company published advice on how to respond to and prevent such attacks.
• Network World also offered guidance on how to recover from a ransomware attack and Out-Law described how a sound back-up strategy can help to reduce ransomware risks.

Password security:

• Keeper Security published a list of the most common passwords of 2016 based on analysis of 10 million passwords from data breaches in 2016, together with advice on choosing strong passwords. The occurrence of seemingly random passwords such as “18atcskd2w” and “3rjs1la7qe” on the list indicates that bots use these codes over and over when they set up dummy accounts on public email services for spam and phishing attacks. Keeper Security suggest that email providers could flag this kind of repetition and report the guilty parties. Also see commentary from the Telegraph and Network World.
• Splashdata published a similar list, with Network World offering a comparison between it and Keeper Security’s list.
• The National Cyber Security Centre published a blog post calling for websites to allow users to cut and paste passwords when logging in, on the basis that it improves security. It also published advice on password managers; these are seen as valuable interim tools but we should work towards “a future where we make greater use of better, more secure, more usable authentication mechanisms instead.”
• BBC Radio 4’s Money Box Live also discussed passwords, also see commentary from the National Cyber Security Centre.