Chinese hackers have successfully breached contractors for the U.S. Navy, according to WSJ report.

The years-long Marriott Starwood database breach was almost certainly the work of nation-state hackers sponsored by China, likely as part of a larger campaign by Chinese hackers to breach health insurers and government security clearance files, The New York Times reports. Why would foreign spies be so interested in the contents of a hotel’s guest database? Turns out “Marriott is the top hotel provider for American government and military personnel.” The Starwood database contained a treasure trove of highly detailed information about these personnel’s movements around the world.

Chinese hackers didn’t stop there. According to a report published in the Wall Street Journal last week, nation-state hackers sponsored by China have successfully breached numerous third-party contractors working for the U.S. Navy on multiple occasions over the past 18 months. The data stolen included highly classified information about advanced military technology currently under development, including “secret plans to build a supersonic anti-ship missile planned for use by American submarines.” The WSJ noted that hackers specifically targeted third-party federal contractors because many are small firms that lack the financial resources to invest in robust cyber security defenses.

In testimony before a Senate Judiciary Committee hearing, FBI counterintelligence division head E.W. “Bill” Priestap Wednesday called cyberespionage on the part of Chinese hackers the “most severe” threat to American security, citing the country’s “relentless theft of U.S. assets” in an effort to “supplant [the United States] as the world’s superpower.”

Inconsistent security practices leave U.S. Ballistic Missile Defense System vulnerable to cyber attacks

While the Navy has been hit particularly hard, the entire U.S. government, including all branches of the military, are under constant threats of cyber attack from Chinese hackers and other nation-state actors – and they’re ill-prepared to fend off these attacks. Around the same time the Marriott Starwood breach was disclosed, the Defense Department Office of Inspector General (OIG) released an audit report citing inconsistent security practices at DoD facilities, including facilities managed by third-party contractors, that store technical information on the nation’s ballistic missile defense system (BMDS). The report described failures to enact basic security measures, such as:

• Requiring the use of multifactor authentication to access BMDS technical information
• Identifying and mitigating known network vulnerabilities
• Locking server racks
• Protecting and monitoring classified data stored on removable media
• Encrypting BMDS technical information transmission
• Implementing intrusion detection capabilities on classified networks
• Requiring written justification to obtain and elevate system access for users
• Consistently implementing physical security controls to limit unauthorized access to facilities that manage BMDS technical information

Cyber security problems abound among DoD and other federal contractors

The OIG report comes on the heels of another the office issued earlier this year, citing security problems specifically at contractor-run military facilities. The WSJ report on Chinese hackers implied that inadequate security is the norm, not the exception, at federal contractors and subcontractors, citing an intelligence official who described military subcontractors as “lagging behind in cybersecurity and frequently [suffering] breaches” that impact not just the military branch they work for, but also other branches.

In theory, military contractors shouldn’t be having these problems. Most federal contractors must comply with the strict security controls outlined in NIST 800-171, and DoD contractors must comply with DFARS 800-171. DoD contractors were required to, at minimum, have a “system security plan” in place by December 31, 2017. However, many small and mid-sized organizations missed the December 31 deadline, often because they felt they did not have the resources to comply. However, continued non-compliance puts these vendors’ contracts at risk of cancellation, as well as national security at risk from Chinese hackers and other cyber criminals.

It’s not too late to begin compliance efforts. If your agency starts working towards compliance now, you can demonstrate that you have a plan to comply and are making progress with it to your prime contractor, subcontractor, or DoD contracting officer.

Affordable DFARS 800-171 compliance services are available for small and mid-sized federal contractors

Continuum GRC’s IT Audit Machine (ITAM) greatly simplifies the compliance process and significantly cuts the time and costs involved, putting NIST 800-171 and DFARS 800-171 compliance within reach of small and mid-sized organizations. Additionally, Continuum GRC has partnered with Gallagher Affinity to offer small and mid-sized federal contractors affordable packages that combine cyber and data breach insurance coverage with NIST 800-171 and DFARS 800-171 compliance services.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

Hackers love it when businesses believe in these common cyber security myths. Let’s debunk them.

Like other criminals, hackers take advantage of people’s misconceptions regarding their risk of being victimized. Here are six common cyber security myths that could be putting your enterprise at risk.

Security Myth #1: Compliance Equals Cyber Security

Compliance with regulatory and industry standards such as HIPAA and PCI DSS can be complex, time-consuming, and costly, especially if companies must comply with multiple standards. Many organizations focus nearly exclusively on compliance, thinking that if they are compliant, they have done enough to protect against cyber attacks. This is a cyber security myth. Compliance standards outline only a minimum set of baseline procedures and protocols that provide a starting point for enterprise data security. They are not a substitute for comprehensive, proactive cyber security and integrated risk management.

Security Myth #2: Hackers Don’t Target Small Companies

Sometimes, small enterprises will skimp on cyber security, thinking that hackers are interested only in breaching very large companies. This cyber security myth is easily debunked: Nearly 60% of data breach victims are small businesses. There are several reasons for this, including:

• Hackers know that many small businesses don’t have robust cyber security and view them as easy targets.
• Many small businesses provide B2B services to large organizations, and hackers specifically target these third-party vendors to steal data belonging to their much larger business partners.
• Orchestrating a cyber attack no longer requires a great deal of skill or money. Inexpensive, easy-to-use malware-as-a-service and cybercrime-as-a-service offerings are a booming business. For example, DDoS attacks can be purchased for as little as $10.00. This low entry barrier means that cyber criminals don’t have to go after high-value targets to turn a profit.

Security Myth #3: “HTTPS” Means That a Website Is Legitimate

The HTTPS URL prefix, which some browsers denote with a green padlock, simply means that the site owner has procured an SSL certificate, and any data transmitted between your browser and the site is encrypted. Anyone can buy an SSL certificate or get one for free. Just because a site has an SSL certificate does not mean it is a legitimate website, or even that it’s secure. Unfortunately, many people don’t realize this (the green padlock doesn’t help), and hackers are capitalizing on the confusion: Half of all phishing sites now sport SSL certificates, up from only 25% just a year ago.

An SSL certificate is also not a guarantee of cyber security. HTTPS is much safer than HTTP, but it can still be hacked. Additionally, just like there’s a lot more to securing an enterprise than achieving compliance, there’s a lot more to securing a website than getting an SSL certificate.

Security Myth #4: Not All Employees Need Cyber Security Training

The average employee’s knowledge of basic cyber hygiene is severely lacking. Over 60% of working adults don’t know what ransomware is, and over half of workers whose employers provide them with IoT devices allow friends and family to use them.

Some organizations think that only certain employees need to be trained on cyber hygiene, such as IT employees or privileged users. The reality is that hackers frequently target lower-level employees, usually through social engineering schemes, to get a beachhead into a system, then work their way up to privileged users. Any employee who accesses a computer or an IoT device at work needs to be trained on basic cyber hygiene. In today’s digital world, that’s nearly everyone; even retail and food-service cashiers use POS systems.

Security Myth #5: Strong Passwords Provide Adequate Security Against Credential Theft

A major topic at tech giant Microsoft’s 2018 Ignite conference was getting rid of passwords; the company used the occasion to introduce a new tool to allow passwordless logins to Azure AD-connected apps. Passwords, even strong ones, are no longer enough to ensure enterprise cyber security. One-quarter of employees admit to using the same password for all their accounts, at home and at work, and stolen account credentials are hackers’ preferred way to break into enterprise systems. Enterprises need to switch to multi-factor authentication (MFA) whenever possible.

Security Myth #6: Air-Gapped Systems Don’t Need Additional Cyber Security

Air gapping, also known as “security by isolation,” is common in manufacturing facilities, other industrial environments, utilities, and critical infrastructure. Some compliance frameworks require operational technology (OT) systems to be air-gapped. However, air gapping alone does not sufficiently secure systems; the infamous Stuxnet virus is only one example of an air-gapped system being breached.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

The California Consumer Privacy Act may not be the “American GDPR,” but it’s a harbinger of data privacy laws to come.

As California goes, so does the rest of the country. While the California Consumer Privacy Act (CCPA), which was passed this summer and goes into effect in 2020, falls short of being an “American GDPR,” it clearly tore many pages from the far-reaching European data privacy law. Similar to the GDPR, the CCPA defines personal identifying information rather broadly, encompassing not just names and Social Security Numbers but things like IP addresses and browser cookies.

As the Feds Drag Their Feet on Data Privacy Laws, States Press On

Unlike the GDPR, the CCPA is not a national data privacy law. It applies only to residents of California, and only when they are physically present in California. If a California resident shares their data while on vacation in Florida, the CCPA does not apply. However, the state is an economic juggernaut that exerts influence far beyond its own borders. California is home to 12% of the U.S. population and is the world’s fifth-largest economy, surpassing the United Kingdom.

Additionally, the CCPA was passed in an era where massive data breaches occur daily, and consumers are growing increasingly concerned about what data companies are collecting on them, why, and what is being done with it. Nearly three-quarters of internet-using U.S. households have data privacy and security concerns, and at least one-third have been deterred from certain online activities due to these fears. The federal government has been slow to act on data privacy, so states have taken matters into their own hands. The CCPA, along with the GDPR, prompted a flurry of new and amended state-level data privacy legislation in 2018. All 50 U.S. states, along with Washington, D.C., Puerto Rico, the U.S. Virgin Islands. and Guam, now have data breach notification laws on the books.

If a patchwork quilt of state-level laws with varying requirements sounds like a data privacy compliance nightmare, consider this: It turns out California was only getting started with the CCPA. In September, it became the first state to pass a cyber security law specifically regulating IoT devices, requiring that all manufacturers of smart devices located in California, or those who have devices manufactured on their behalf for sale in California, equip their devices with “reasonable” security features.

Consumer anger over data privacy violations and organizational hand-wringing over the logistics of complying with dozens of different state laws (in addition to the GDPR, HIPAA, PCI DSS, and other mandates) appear to have finally lit a fire under the feds’ feet. In a September 26 Congressional hearing on data privacy, every member of the Senate Commerce Committee, Democrat and Republican, agreed with six major tech and telecom companies that a federal data privacy framework is needed. NIST has launched a collaborative project to develop a voluntary privacy framework, and in a separate project, the NTIA has published a request for public comment in the Federal Register on a set of data privacy principles to inform a domestic legal and policy approach to consumer data privacy.

Complying with Today’s Data Privacy Laws – and Tomorrow’s

Good data privacy is good business. When designing and implementing data privacy protocols and procedures, organizations shouldn’t try to skate by on the minimum requirements; look to go beyond them. Best practices to follow include:

• Develop and maintain clear, concise data governance, security, and privacy policies and procedures, and put them in writing. Because legislation, technology, and the cyber threat environment are in constant flux, periodically review your organization’s policies and procedures and update them as necessary.
• Practice proactive cyber security principles. Most data breaches and other cyber attacks can be prevented.
• Practice minimal data collection and storage. If you don’t absolutely need a piece of information about a customer or an employee, do not collect it.
• Develop clear, written processes and procedures to handle customer inquiries regarding their data, such as requests to opt out of data collection or data sharing.
• Build an organizational culture of security and privacy from the top down. Ensure that all employees are properly and continuously trained on data security, governance, privacy, and compliance.
• Develop a comprehensive incident response plan, including a data breach notification protocol.
• Don’t rely on spreadsheets or other manual processes for data security, governance, risk management, and compliance. Use a GRC automation solution such as Continuum GRC’s IT Audit Machine (ITAM).

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.