This cyberwar will be a continuous marathon war that will only compound and hyper-evolve in stealth, sophistication and easy entry due to the accelerated evolution of “as a service” attack strategies for sale on the dark web.
The security theater we are witnessing in our election system boasting the illusion of security via ‘clunky as heck’ and air gap defense will do nothing against the real and sophisticated adversarial landscape that is zeroing in on our democracy
Many members of Isis are not sophisticated attackers. The majority of members do not have a technical background. The UCC is predominately capable of hacking soft targets, such as Twitter accounts, and spreading propaganda or defacing websites
America’s treasure troves of public and private data, IP, and critical infrastructure continues to be pilfered, annihilated, and disrupted, while an organizational culture of ‘Participation Trophy Winners” managed by tech neophyte executives continue to lose one battle after the next.
Between the black box proprietary code, barebones computers we call voting machines and a mass of completely unqualified election officials, our election system is up for grabs to anybody with even a modest interest and some script kiddie capability. The cyber-kinetic attack surface here is wide open.
The collaboration between secretaries of state, election officials and the voting system manufacturers on the matter of enforcing this black box proprietary code secrecy with election systems, is nothing less than the commoditization and monetization of American Democracy
Security-by-design is an indispensable prerequisite to the establishment of vital critical infrastructure resiliency. Each device vulnerable to adversarial compromise, inflates and bolsters the exploitable cyber-attack surface that can be leveraged against targets, and every enslaved device grants adversaries carte blanche access that can be utilized to parasitically entwine malware into organizational networks and IoT microcosms, and that can be leveraged to amplify the impact and harm inflicted on targeted end-users, organizations, and government entities
We’re talking about the fate of our economy and the questionable resiliency of our Nation’s critical infrastructure. Why are experts so polite, patient, and forgiving when talking about cybersecurity and National Security? The drama of each script kiddie botnet attack and Nation State pilfering of our IP has been turned into a soap opera through press releases, sound bites and enforced absurdity of mainstream media. It’s time for a cybersecurity zeitgeist in the West where cyber hygiene is a meme that is aggressively distributed by those who have mastered it and encouraged to be imitated by those who have experienced it.
You'll have the right to be angry about Vault 7 only after you boycott dragnet surveillance data providers like Google, Microsoft, Skype, Facebook and LinkedIn. The true threat is coming from the private sector surveillance profiteers.
A single spear-phishing email carrying a slightly altered malware can bypass multi-million dollar enterprise security solutions if an adversary deceives a cyber-hygienically apathetic employee into opening the attachment or clicking a malicious link and thereby compromising the entire network.
Few critical infrastructures need to expedite their cyber resiliency as desperately as the health sector, who repeatedly demonstrates lackadaisical cyber hygiene, finagled and Frankensteined networks, virtually unanimous absence of security operations teams and good ol’ boys club bureaucratic board members flexing little more than smoke and mirror, cyber security theatrics as their organizational defense.
If developed and implemented meaningfully, Cyber Shield Act could be a catalyst to incite responsible cybersecurity adoption and implementation throughout multiple manufacturing sectors."James Scott, Senior Fellow, Institute for Critical Infrastructure Technology
The two main problems with signature and heuristic based anti-virus is the mutating hash and the fact that you first need a victim in order to obtain the signature."James Scott, Senior Fellow, Institute for Critical Infrastructure Technology
Most IoT devices that lack security by design simply pass the security responsibility to the consumer, thus, treating the customers as techno-crash test dummies.James Scott, Senior Fellow, Institute for Critical Infrastructure Technology
This next president is going to inherit the most sophisticated and persistent cyber espionage cultures the world has ever seen, He needs to surround himself with experts that can expedite the allocation of potent layers of next generation defenses around our targeted critical infrastructure silos.