If you aren’t one of the 4.5 million people who were directly affected by the Community Health Systems (CHS) Heartbleed data breach, then you’ve certainly heard about it by now. Unfortunately, cases like these and others have become commonplace in today’s business environment. In 2014, the threat landscape is more advanced than ever, with no single industry or organization completely immune from victimhood of cyber attacks.. Within the past two weeks alone, we have seen organizations within the healthcare, government, infrastructure and banking industries caught in the crosshairs of cybercriminals, state-sponsored entities and both malicious and accidental insider threats.
Foreign state-sponsored attacks on the rise
The recent hack of the Nuclear Regulatory Commission (NRC) illustrates the threat of state-sponsored hacking groups with punishing clarity. In a third hack in three years, it was alleged that anNRC employee unwittingly clicked on an email link that navigated them to a Google spreadsheet where they were instructed to enter sensitive data.
Armond Caglar, one of our threat specialists here at Secure Halo, speculated that the hacker campaign focused on two key areas: 1. gathering information on US nuclear reactors’ condition and health, and 2. assessing the cyber-readiness of the NRC workforce. This scenario likely could have been avoided through employee training and awareness programs highlighting the growing sophistication of targeted phishing campaigns such as what occurred here.
JPMorgan Chase and several other banks revealed they were also victims of a data breach believed to be perpetrated by Russia-sponsored hackers earlier this month. While the purpose of the attack and the extent of the data breached is still unclear, Secure Halo believes financial information was likely theinitial target, followed by intelligence data, such as corporate secrets, which could have been passed to security services once all the desired privacy data had been harvested.
Healthcare industry compliance is not enough
The CHS breach compromised the personally identifiable information of millions of patients. The attack, which resulted from the Heartbleed vulnerability, highlights a common issue among healthcare organizations, whichCaglar referred to as the dangers of the “compliance audit mentality.” The is because the single-minded pursuit of meeting compliance baselines could actually contribute to organizational complacency once an audit is completed.
No company is completely secure
Even companies that provide essential services to the U.S. government aren’t immune. U.S. Investigations Services, or USIS, is a company used by a variety of U.S. government agencies, including the U.S. Department of Homeland Security, U.S. Immigration and Customs Enforcement, and U.S. Customs and Borders Protection to perform background investigations on all employees. Nearly 25,000 of those employees had personal information such as Social Security numbers, birth dates, education and criminal history, and the names and addresses of family and friends compromised in a data breach earlier this month.
Caglar notes, “The implications of this attack are serious and highly concerning. An attack such as this is almost always intended for the purposes of identifying potential recruitment candidates [for intelligence purposes]. By collecting information such as this, attackers will now be able to systematically research which members of the security clearance population could be suitable for a potential approach by foreign [service].”
Implement a proactive security culture to defend against cyberattacks
We can cite compliance standards like HIPAA and various executive orders all day long, but what ultimately serves as the best defense is a good offense and a solid understanding of the evolving nature of cyber threat. In both the foreign intelligence and competitive intelligence world, there will always be motivation to target innovation, privacy data, and national security information. Safeguarding sensitive data – no matter what it is – begins with a proactive and panoramic approach to security that incorporates all possible threat vectors fused with proper training and awareness campaigns tailored to mutable nature of threat.
Contact us to learn how Secure Halo can help identify and prevent security risks before they damage your organization.
