Cyber security news roundup December 2016

Policy developments:

The Department for Culture, Media and Sport (DCMS) announced the Academic StartUp initiative, part of the Government’s £1.9 billion National Cyber Security Strategy, to help academics form product teams to market test new ideas with guidance from commercial experts and turn research ideas into commercial products. Innovate UK, working the SETsquared Partnership, will receive £500k funding from DCMS to extend its existing ICURe (Innovation to Commercialisation of University Research) programme to include a cyber security strand.

At the same time DCMS published conclusions from its review of regulation and incentives around cyber security. This found that no new specific legislation is required, but set out new measures to encourage businesses to improve their cyber security, particularly in relation to the forthcoming General Data Protection Regulation (see Andrew Cormack’s Regulatory Developments blog for more on the GDPR). DCMS also published findings from research into industry perceptions of the government’s Cyber Essentials scheme and how it could be improved.

The National Cyber Security Centre published a blog post on email security as part of its campaign to improve confidence in the authenticity of emails, which will include applying anti-spoofing mitigations across all UK public sector domain names. It also published posts on supporting developers to improve the security of their products and services and on password expiry policies, suggesting that it is a “blunt instrument” and that “if regular password expiry really looks like a good idea, that's a sign that your organisation has bigger problems and needs to look for correspondingly bigger solutions”.

In the US, the Commission on Enhancing National Cybersecurity, established by President Obama to develop recommendations to strengthen cybersecurity in both the public and private sectors, published its final report (also see this White House statement and press release from the National Institute of Science and Technology, NIST). Its findings are encompassed by six major imperatives:

1. Protect, defend, and secure today’s information infrastructure and digital networks.
2. Innovate and accelerate investment for the security and growth of digital networks and the digital economy.
3. Prepare consumers to thrive in a digital age.
4. Build cybersecurity workforce capabilities.
5. Better equip government to function effectively and securely in the digital age.
6. Ensure an open, fair, competitive, and secure global digital economy.

The Commission determined that most of its recommendations can and should begin in the near term, with many meriting action within the first 100 days of the new US administration.

More on DDoS:

Further to last month’s update, Network World, Reuters, the Telegraph, BBC News and Computing all reported that the Mirai attack on Deutsche Telekom was part of a global attack, affecting domestic Zyxcel routers provided by TalkTalk, Kcom and the Post Office in the UK.

Ars Technica reported on a new botnet which could soon rival Mirai (more background here); whilst the attacks it has generated so far are not as powerful as the recent Mirai attacks they are nevertheless significant: peak volumes have reached 400 Gbit/s and 200 million packets per second.

Network World and BBC News reported that 34 people, including teenagers, were arrested in 13 countries including the US and UK after an international police operation involving EU and US authorities targeting users of DDoS attack tools.

Ransomware update:

Kaspersky Lab reported that ransomware attacks on business increased three-fold between January and the end of September 2016. One in five small and medium-sized business who paid the ransom never got their data back. Network World also reported on 2016 as the year “ransomware became one of the top threats to enterprises” and also on the growth of ransomware as a service.

A new study by IBM Security found that 70% of businesses infected with ransomware have paid the ransom to regain access to business data and systems, with half paying over $10,000 and 20% paying over $40,000. In comparison, over 50% of consumers surveyed said they would not pay to regain access back to personal data or devices aside from financial data. According to IBM X-Force research, ransomware made up nearly 40% of all spam emails sent in 2016.

The No More Ransom project, an initiative by the National High Tech Crime Unit of the Netherlands’ police, Europol’s European Cybercrime Centre and Kaspersky Lab and Intel Security, announced more than 30 new partners from both the public and private sectors and the addition of 32 new decryption tools (see press releases from  Europol and the European Commission). The project’s goal is to help victims of ransomware retrieve their encrypted data without having to pay.

Network World reported on a new strain of ransomware which gives victims the option of forwarding the attack to others; if two or more additional victims pay up as a result, the original victim’s files are decrypted for free. See this previous post for further background on ransomware.

Other cyber security news:

• Computing and ComputerWorld Australia published overviews of cyber security incidents in 2016 and lessons learned as a result.
• Network World reported that a cyber attack is suspected as the cause of a power outage that affected parts of the Ukrainian capital, Kiev, and the surrounding region; it also reported on the rise of malicious activities which don’t rely on malware to succeed: attacks that exploited applications and processes legitimately running on systems rose  from around 3% of all attacks in January to about 13% in November 2016; more detail here.
• Out-Law and BBC News (more here) reported on the court case involving the teenagers arrested following last year’s cyber attack on TalkTalk; one was also responsible for targeting a DDoS attack at a Welsh further education college, Coleg Sir Gar, where he was a student.
• The Conversation published an article on the challenge of balancing cybersecurity and academic freedom on university campuses, while EdTech Magazine described three tools that can help protect colleges against sophisticated cyber threats: next generation firewalls, unified threat management (UTM) and intrusion detection and prevention systems (IDS/IPS), and security information and event management (SIEM) systems.
• ITV News reported that the West Yorkshire Police and Crime Commissioner has joined forces with the University of Bradford and the North East Counter Terrorism Unit to carry out an in depth study into online radicalisation.
• DCMS published advice for families on staying safe online over Christmas, in the light of the many new internet-enabled devices that will be unwrapped on Christmas Day.