The NSA Hack Proves that Much More Needs to Be Done to Protect Enterprise Data

In the hit USA Network series Mr. Robot, a rogue group of hacktivists target major corporations and the government. In a recent episode, the group enlisted the help of a malicious insider to hack the FBI. Sound far-fetched? Maybe not: Around the same time this episode aired, an anonymous group of hackers known only as the “Shadow Brokers” leaked 300 megabytes of information from the U.S. National Security Agency (NSA).

The NSA hack compromised highly sophisticated hacking tools used by the spy agency to conduct cyber espionage, including zero-day vulnerabilities that can be exploited to breach corporate firewalls. The Washington Post reports:

The file contained 300 megabytes of information, including several “exploits,” or tools for taking control of firewalls in order to control a network, and a number of implants that might, for instance, exfiltrate or modify information.

The exploits are not run-of-the-mill tools to target everyday individuals. They are expensive software used to take over firewalls, such as Cisco and Fortinet, that are used “in the largest and most critical commercial, educational and government agencies around the world,” said Blake Darche, another former TAO operator and now head of security research at Area 1 Security.

The NSA hack has rattled the nerves of cyber security professionals across the nation and around the globe. Not only was one of the most secure systems on the planet compromised, but the release of elite hacking tools and a list of existing vulnerabilities has put numerous private-sector corporations at risk – including at least two major cyber security providers.

It is widely believed that the Shadow Brokers are Russian nation-state hackers, but this theory has not been proven, nor does anyone know how they managed to get their hands on the NSA’s hacking toolbox. However, since nearly all data breaches result from the misuse of legitimate login credentials, the leak very well may have originated from within the NSA, either through a malicious insider (as portrayed in the Mr. Robot story arc) or through a careless or negligent employee clicking on a phishing link or sharing their password.

The NSA hack also has everyone asking, if a covert government spy agency’s data isn’t safe from hackers, what about everyone else’s? So far, 2016 has seen, among other major cyber security incidents:

• Numerous ransomware attacks on the healthcare industry, including the infamous Hollywood Presbyterian attack
• An epidemic of tax data spear phishing schemes, including one that compromised an NBA team
• The hijacking of the SWIFT Network bank messaging system by a team of international cyber bank robbers
• The Wendy’s POS data breach, which resulted in a class-action lawsuit against the fast-food chain
• A former St. Louis Cardinals employee being sentenced to prison for hacking the Houston Astros – using crude techniques to get past weak cyber security barriers
• Information security providers themselves being compromised due to the NSA hack

What’s next? It can be scary to think about. The hacks just keep coming, and both public and private sector organizations in all industries seem ill-prepared to defend against them.

However, now is not the time to panic. Instead, the NSA hack should be a wake-up call for organizations to reevaluate their information security procedures from top to bottom. A cyber security plan is never “finished.” It must be continuously reassessed and rewritten as new technologies and threats emerge. Further, a proactive approach is always better than reacting after a breach has happened. The NSA hack did not have to happen, and neither did any of the other hacks mentioned above. Proactive security measures, from employee training to network monitoring, could have prevented all of these hacks.

Today’s information systems are increasingly complex, and so are cyber attacks. Unless you are an expert in the industry, you’re probably struggling just to wrap your head around it, and you’re not alone. Many organizations simply do not have the resources to handle all of their cyber security needs in-house, and they find that attempting to do so leaves them with security vulnerabilities while taking away time and resources from their core competency.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from internal threats and external security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization secure its systems and keep hackers out.

[bpscheduler_booking_form]

PCI DSS compliance is serious business for anyone who processes or accepts major payment cards. Retailers or payment processors who are found to be in violation of PCI DSS can be fined millions of dollars, and they may even be stripped of their ability to accept major credit cards.

However, PCI DSS compliance standards are highly complex, and achieving compliance can be an expensive, tedious process. Not surprisingly, many organizations – already facing budget and staffing constraints – feel that once they have achieved compliance with PCI DSS, they have done everything they need to do to secure their customer data. Their cyber security begins and ends with PCI DSS compliance.

After these same organizations are breached, their spokespeople often tell the media (and the cyber security firms they hire to clean up the mess), “We have no idea how this could have happened. We were compliant.”

PCI DSS Compliance Alone Does Not Guarantee Data Security

While PCI DSS compliance reduces the risk of data breaches, it does not eliminate them. Both Target and Home Depot were compliant with PCI DSS when their POS systems were breached, exposing tens of millions of consumer credit card numbers. Target had just gotten its PCI DSS compliance certification only two months prior to the hack.

Unlike HIPAA, the healthcare compliance standard that is heavy on documentation and procedures and light on technical specifics, PCI DSS goes into quite a bit of detail regarding best practices that retailers and payment processors must adopt. For example, PCI DSS compliance requires changing default passwords on system components. However, all of these technical details can provide organizations with a false sense of security. PCI DSS does not cover every single security measure every organization must take to protect its data, nor could it do so. Technology is advancing too quickly for any set of standards to keep up. Mobile technology, cloud applications, and Internet of Things (IoT) devices are exploding in popularity, and with each new application and gadget comes a whole new set of vulnerabilities for hackers to exploit. By the time a new set of technical standards was issued, they’d already be out of date.

PCI DSS also cannot address the specific risks in every data environment at every organization, and it cannot account for the weakest link in every organization’s cyber security: its people. Human error, negligence, and purposeful malicious activity account for nearly half of all data breaches. That’s why social engineering techniques are so popular among hackers. An organization can be PCI DSS compliant – and then, an employee clicks on a link in a spear phishing email and inadvertently unlocks the front door to the company’s system.

Customer Data Security Begins, But Does Not End, With PCI DSS Compliance

PCI DSS compliance and data security work together to protect your organization’s data. A compliant organization has the foundation to build out a cyber security plan that addresses the specific risks in its data environment. At the same time, a proactive cyber security plan helps organizations achieve and maintain compliance.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from internal threats and external security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization.

[bpscheduler_booking_form]