Blog Post Archives

What You Need to Know About FTC’s Privacy Rule and How to Comply

April 6, 2023/in Blog Post Brittany Demendi/by Ellen Loughlin

By: Brittany Demendi, Corporate Communications Manager

Auto Dealerships Must Comply with the Federal Trade Commission

The Federal Trade Commission (FTC) recently announced new cybersecurity regulations for auto dealerships offering financial services to comply with the Gramm-Leach-Bliley Act and the FTC’s Privacy Rule. In 2021, the FTC amended the 2003 Rule to provide concrete guidance for businesses to implement critical security measures to protect customers’ sensitive data.

This applies to any dealership considered a financial institution if it engages in financial activity and must comply with Section 312.1(b) in the Code of Federal Regulations. To determine if your dealership is subject, the Rule defines ‘financial institution’ in a broader sense that may not be how you or others categorize your business. Focus on the types of activities your business undertakes rather than categorization.

What Auto Dealerships Need to Comply?

The FTC states that the Privacy Rules apply to auto dealerships that:

Extend credit to someone (for example, through a retail installment contract) when purchasing a car for personal, family, or household use.
Arrange for someone to finance or lease a car for personal, family, or household use; or
Provide financial advice or counseling to individuals.

If your auto dealership is trying to determine if you’re considered a financial institution and must comply under GLBA, reference the Code of Federal Regulations 16 CFR 314.2 (h). For example, if an organization maintains under 5,000 customers, it may be exempt.

The new Rule goes into effect on June 9, 2023, and emphasizes the need for auto dealers to implement appropriate safeguards, respond effectively to cyber incidents, and conduct regular risk assessments. It represents a critical step in reinforcing customer confidence and trusts in the financial sector while reducing the risks associated with cyber threats.

How can Adlumin Help Your Auto Dealership Comply?

Auto dealerships are prime targets for cybercriminals who are eager to exploit weak security and access a large amount of financial data and gain access to third-party vendor supply chains. This is why they must now become Personally Identifiable Information (PII) compliant, meaning the private information held by auto dealerships needs to be properly protected by a specific set of standards.

For example, in a report, Researcher Eaton Zveare broke into Toyota’s C360 CRM, bypassing the corporate login screen and breaking into the web app used by Toyota to manage Mexican customers, exposing their information. He found the customer’s name, address, email address, phone number, tax ID, and service/vehicle/ownership history.

Adlumin is here to help your auto dealership comply with mitigating cyber risks. Under the new requirements, according to the FTC, auto dealerships and financial institutions must comply with the following:

Designate a qualified individual to implement and supervise your company’s information and security program: The individual can work directly for your company or a service provider. If the person works for a service provider or affiliate, that provider also must maintain an information security program that protects your business.
- Solution: Choose an individual who understands cybersecurity, not just information technology, so they have the proper knowledge to lead the security program with a team and Managed Detection and Response services.

Conduct a periodic risk assessment: An effective plan can be formulated after you know what information you have and where it is stored. After the inventory is completed, an assessment will determine foreseeable internal and external threats and risks to the customer’s integrity, security, and confidentiality.
- Solution: A Security Operations Platform continually assesses compliance with the National Institute of Standards and Technology (NIST) and the Federal Financial Institutions Examination Council (FFIEC) frameworks.

Implement safeguards to control risks identified through periodic risk assessments: According to the FTC, the Safeguards Rule requires your company to encrypt customer information, assess your apps, implement multi-factor authentication, review access controls, keep proper data and asset inventory, dispose of customer information securely, anticipate and evaluate change to your network, and maintain a log of authorized users’ activity.
- Solution: A Security Operations Platform ingests security data from your environment and applies a multi-layered detection approach to illuminate threats.

Train employees on cybersecurity proactive awareness: Your employees are your first line of defense, and your security program is only as effective as the weakest chain in the link.
- Solution: Implementing a Proactive Security Awareness Program empowers employees to report suspicious activity. In addition, it provides robust security awareness training and automatically enrolls users who need additional training.

Maintain oversight of third-party service providers: Evaluate and select providers with security experience and skills to maintain the appropriate safeguards.
- Solution: A Security Operations Platform paired with Managed Detection and Response services monitors vendor account access, privilege, and event logs.

Complete regular vulnerability scanning and penetration testing to identify weak points in your IT environment: It is required to conduct system-wide scans every six months through penetration testing and vulnerability scans for publicly known security risks and vulnerabilities.
- Solution: Vulnerability Scanning is a perimeter defense that monitors your external network for vulnerabilities and port changes. In addition, Progressive Penetration Testing simulates different vantage points to see if your critical data can be accessed.

Keep information security programs current: The best programs are flexible mainly because the only constant in information security is when changes are consistently made. For example, changes to your operations, changes due to emerging threats, what is learned during your risk assessment, and more.
- Solution: A Security Operations Platform provides live data on your network health, at-risk programs, and compliance.

Develop a written incident response plan: In case of a cyberattack, your dealership or financial institution needs a ‘what if’ plan. This plan should be documented along with practicing tabletop exercises so everyone involved knows what steps to take. The incident response plan must cover the goals of your plan, clear responsibilities and roles, and a process to fix any identified threats and attacks.
- Solution: Virtual Chief Information Security Officer (vCISO) services assist auto dealerships with building their security programs.

Provide an annual security program report to your Board of Directors: The report must include an overall assessment of your company’s compliance with its security program and cover specific topics like risk assessment, risk management, control decisions, test results, security events, recommended changes, service provider arrangements and more.
- Solution: Board and IT Steering Committee Report and One-Touch Compliance Reporting provide all the details to share as frequently as needed.

What are the Benefits of Compliance?

Despite the challenging compliance regulations, they drive many organizations’ security success. Complying with industry standards is the first step to setting the foundation for cybersecurity. There are many benefits for auto dealerships to comply; here are a few:

Avoid Fines and Penalties for Being Non-Compliant
- GLBA non-compliance penalties include:
  - Fines of USD $100,000 per violation for financial institutions found in violation
  - Fines of USD $100,000 per violation for individuals found in violation
  - Criminal penalties include imprisonment for up to 5 years for individuals found in violation

Build Customer Trust and Loyalty
- Trust is affected when an auto dealership experiences a breach. When customers know their information is secure, they may be more willing to conduct business with a dealership from a financial services perspective.

Improve Capabilities and Data Management
- The Privacy Rule expects auto dealerships to revamp their data management plans to track better customers’ sensitive information, assets, and files. This helps auto dealerships increase operational and management efficiency when they are more organized and can easily find what they want.

Illuminate Threats and Eliminate Risks

The importance of cybersecurity goes beyond the FTC’s regulations. If your auto dealership’s network is breached, you risk losing customers’ trust and could potentially fold due to the fines and money lost. Time is of the essence to get your cybersecurity plan in place, and there are resources to help.

Adlumin provides all the necessary solutions in one place, including 24×7 monitoring and one-touch compliance reporting, in a cost-effective package designed for upholding and maintaining security. June will be here before you know it, and it’s best to get ahead and avoid any potential repercussions for non-compliance.

Learn more about how Adlumin’s Managed Detection and Response Services and Security Operations Platform can empower your team to illuminate threats, eliminate cyber risk, and command authority. Contact us today, schedule a demo, or sign-up for a free trial.

Why Compliance is Not Security: The Sinking of the Titanic

March 30, 2023/in Blog Post Mark Sangster/by Adlumin Staff

By: Mark Sangster, VP, Chief of Strategy

About the Author

Mark Sangster, author of No Safe Harbor: The Inside Truth about Cybercrime and How to Protect Your Business, has appeared on CNN Newshour and is a go-to subject matter expert for leading publications and media outlets, including The Wall Street Journal and Forbes, covering major data breach events. Before joining Adlumin, Sangster established his 25-year InfoSec career at industry giants like Intel Corporation, BlackBerry, and Cisco Systems. His experience unites a strong technical aptitude and an intuitive understanding of regulatory agencies, shifts risk trends, and influences thought leaders.

Regulatory compliance is often considered synonymous with security. Compliance is a close relative of security. Yet compliant organizations across financial, healthcare, and other industries fall prey to cybercriminals daily. You can be 100 percent compliant and 100 percent pawned simultaneously.

As we approach the anniversary of the sinking of the Titanic, the greatest maritime disaster illustrates that compliance does not equal security. The historic ship was compliant with contemporary maritime law. And it sank, killing 1,500 people. More than a century later, the great ship’s legend offers warnings and lessons for those of us practicing even cybersecurity.

This post is dedicated to keeping the memory of this great ship ever present, honoring those that perished, and learning as much as we can from the tragic disaster.

What Happened: The Titanic Sinking

On April 10, 1912, the second of three Olympic-class Ocean liners, the RMS Titanic, the largest manmade object on the ocean, set sail from Southampton to New York with an estimated 2,224 passengers and crew. The luxurious ship was the pride of the White Star line with “unrivaled extent and magnificence.” Her designers considered her “practically unsinkable.” Five days into her journey, on Sunday, April 14, 1912, and received six warnings of sea ice, the Titanic struck an iceberg off the Grand Banks. Two hours and forty minutes later, she sank, resulting in the deaths of more than 1,500 people, still considered one the deadliest peacetime maritime disasters in history.

For many reasons, the celebrity passengers, the magnificence of the ship, or the hubris of a ship labeled “unsinkable,” the story of the Titanic remains resident in our history books and repeatedly immortalized in popular culture. Her sinking is often attributed to the damage caused by the collision with the iceberg, blamed on the captain recklessly sailing too fast for the conditions, or an insufficient number of lifeboats needed to rescue all onboard that night. But there is far more to the story. And these overlooked factors play out in an eerily similar chain of decisions that all too often lead to a massive cybersecurity incident like a crippling ransomware outage or sweeping data breach.

Along with the captain’s judgment, the number of lifeboats, and an iceberg, other factors contributed to the disaster. Unusual climatic conditions, crew changes, another maritime accident, economic pressures, cost-cutting, profits from at-sea services, contemporary construction materials and designs, and maritime regulations all played a part. The notion of a chain of factors rather than a single failure in accident causation was coined “the Swiss Cheese Model” by University of Manchester researcher James T. Reason after the notion of holes in slices of Swiss cheese aligning to create a straight path to disaster. Of all the factors, perhaps the simplest and most tragic was a misplaced locker key.

Factor #1: Financial Pressure

Under competitive pressures from the rival line, Cunard, that boasted the fastest ocean liners of the time, the Lusitania and Mauretania, the White Star line commissioned three massive ships with unparalleled luxury. This new Olympic class included three sisters. The first of the class in service, the RMS Olympic, collided with the Royal Naval ship, the HMS Wasp. The subsequent investigation ruled the RMS Olympic at fault, invalidating insurance coverage and leading to massive financial losses for the White Star line. Economic pressure and repairs to the RMS Olympic delayed the completion of the Titanic. She was now destined to sail in April, the height of the iceberg season.

Factor #2: The Arctic Antagonist

About the same time as the Titanic’s keel was laid1, a glacier from 10,000-year-old snow broke free from Greenland, along with an estimated 40,000 icebergs. Carried by the Greenland and Labrador currents, the iceberg started a journey north around Baffin Bay and then circled south along the coast of Newfoundland.

Most icebergs become trapped in Baffin Bay and melt. Only 1-4 percent make it to more southerly shipping lanes, south of the 48th Parallel North. The iceberg made its way south to the Grand Banks. As it crossed into shipping lanes, the iceberg had melted considerably but was still ten times the size of the Titanic, at a mass of 500,000 tons.

Factor #3: Patents, Profits, and People

Although the Titanic boasted of its luxury and modern conveniences, it was equipped with a Marconi wireless radio system, no longer the most sophisticated of its time. Patents and monopoly power had trumped innovation backed by a brand recognized by the wealthy passengers who would pay for its services.

The primary purpose of the radio was to send and receive passenger messages, for which the owner, the Marconi Company, was compensated. Passengers paid fees to send communications during the Atlantic crossing and updates such as the morning news and stock report to keep passengers informed.

Weather and marine communications were secondary to privately paid messages which funded both these services and wages of the radio operators, Jack Phillips and Harold Bride, employees of the Marconi Company, not the White Star Line. The Radio operators received six ice warnings from surrounding vessels. The first came on April 14 at 9:00 pm from the RMS Caronia, reporting “bergs, growlers1, and field ice.” Over the following hour, following transmissions provided multiple warnings of ice dangers.

At 11:00 pm, radio operator Phillips was rushing to send passenger messages as the ship moved out of the range of a radio receiver in Cape Race, Newfoundland. Repeatedly interrupted by ice reports from the SS Californian and failing to grasp the significance of the reports, Phillips angrily told the SS Californian to cease transmissions: “Shut up! Shut up! I’m working Cape Race.” In response, the SS Californian’s radio operator, Cyril Evans, turn off its radio for the night. The Californian was the only ship close enough to the Titanic to rescue passengers in the two-hour window between striking the iceberg and sinking.

Factor #4: Lack of Crisis Response Plan

Before sailing, Captain Edward Jones Smith was transferred from the RMS Olympic to her sister ship, the Titanic. He was known as “the millionaires’ captain” since the likes of JP Morgan and Guggenheim wanted to sail with him. On that fateful night, Captain Smith had plotted a southerly course but changed direction from southwest to west around 5:00 pm, assuming they were far enough south to avoid the reported ice region. They remained at full speed, believing he was navigating away from the danger. Three hours later, he retired for the night, leaving officer Lightoller as an officer on watch.

As the Titanic approached her fatal collision, Reginald Lee and Frederick Fleet were stationed in the two lookouts, crow’s nest, about 100 feet above the water line—the same height as the iceberg. Temperatures were near freezing, but the Atlantic was calm. One survivor later wrote, “the sea was like glass, so smooth the stars were reflected.” Given the meteorological conditions, potential icebergs were extremely difficult to make from a distance. At 11:30 pm, the Fleet spotted the iceberg in the Titanic’s path. He rang the lookout bell and telephoned the bridge, “Iceberg, right ahead!”

When the lookouts rang the alarm bell, Lightoller ordered engines reversed and turned away from the iceberg. Confusion over direction orders (changed recently from old tiller navigated ships) and the reversing of engines only hindered the eclectic rudder’s ability to turn the massive ship in time to avoid a collision. When the captain returns to the bridge, he orders the engines to stop to assess the damage. Recognizing the rapid on-take of water, he ordered bulkhead doors closed, trapping 500 crews in the watertight compartments below decks, ultimately sentencing them to death.

Factor #5: Convenience

Cybersecurity policies and controls are often seen as opposite ends of a spectrum, with convenience paying the price for enhanced security and vice versa. In the case of the Titanic, a significant compromise was made by the Chairman of the White Star Line to accommodate one of the Titanic’s most iconic features.

The hull of the Titanic was divided into sixteen watertight compartments to E deck, 11 feet above the waterline. The bulkheads were not sealed at the top because that would cause significant inconvenience to passengers traversing the ship. The watertight compartments stopped at E deck to accommodate the Grand Staircase. The iconic staircase that graced Edwardian celebrities and was immortalized by Kate Winslet as Rose in James Cameron’s epic movie Titanic (1997), in no small part, added to the ship’s rapid sinking.

While the iceberg collision damaged the four forward compartments, the ship’s bow settled lower once water filled the compartment, allowing water to spill into the next compartment, dooming the ship to sink. Within twenty minutes, the captain realized the “practically unsinkable” Titanic was doomed, yet he delayed lowering lifeboats to avoid passengers’ exposure to the weather while awaiting rescue from nearby ships.

By 1:00 am, realizing all was lost, Captain Smith ordered Lightoller to man the lifeboats with the infamous “woman and children first.” Lightoller misunderstood and considered that only women and children should be loaded in lifeboats, leading to further loss of life.

Factor #6: Life Boats

Harland and Wolf, the builders of the Titanic, called for 48 lifeboats, enough for the full complement of passengers and crew. The Chairman of the White Star Line, Bruce Ishmay, reduced the number of lifeboats to 20. Pronouncing the ship “practically unsinkable” was his lesser sin than his boast that “people don’t pay to look at lifeboats.” If that hubris was not enough, Bruce Ishmay was one of the few male survivors who made it to the lifeboats.

Lessons From the Abyss

The discovery and subsequent explorations of the shipwreck over 12,000 miles down at the bottom of the Atlantic Ocean not only stimulated the public’s imagination and led to one of the most profitable movies but also gave a clue to a lingering mystery: why did the Titanic sink so quickly?

Over 80 years later, researchers from Johns Hopkins began a forensics investigation into the material and methods used to rivet the 1.5-inch-thick steel plates together. First, evidence from the wreck showed an advanced breakdown of the ship’s hull that impurities could only explain in the iron used to make the steel plates and rivets.

Records from the shipbuilder documented the order of iron for the rivets was demoted from No. 4 “Best Best” iron ore to NO. 3 “Best” iron, confirming part of their theory. The White Star Line approved lower-quality iron to save money during financial pressure.

Researchers reproduced some hull steel plates and subjected the replica to various stress levels, simulating the Collison. They found that the plates moved during impact and that a movement of 5.0-mm caused the rivets to fail and literally “pop” like a zipper opening. That’s why a glancing blow with the iceberg was fatal. The hull plates separated under the force of the collision and exposed more than four watertight compartments to the ocean. Ironically, a head-on collision would have done less damage and likely been survivable (or at least delayed sinking to allow rescue ships to arrive on the scene).

Regulations are No Substitute for Self-Governance

The British Board of Trade governed maritime operations during the sinking. Under the pressure of competing lines, White Star and Cunard, the Board consented to larger, grander ships, increasing passenger capacity. Yet, as ships quadrupled in size, regulations remained the same. For example, the number of lifeboats and lifesaving equipment required was predicated on the vessel’s cargo, not its passenger capacity. It seemed technical know-how outpaced our notion of safely operating cutting-edge technology—sound familiar?

Further, there were no procedures for navigating through ice in the North Atlantic. Some captains, such as the SS Carpathian, elected to stop for the night with limited visibility of proximal icebergs. Captain Edward Smith elected to steam at 21.5 knots (700 yards/minute) through the field to reduce the time spent in the risk area. Both approaches were considered sound by experienced seafarers.

Outraged by the loss of life, the Americans and British convened their board of inquiry. Each found the ship traveling excessively in the ice region but did not hold the crew to blame since this was standard procedure. Outdated regulations, the low number of lifeboats, nor maritime regulations were considered. Bruce Ishmay, the Chairman of the White Star line, was exonerated, and his decisions that impacted the vessel’s safety were overlooked. No maritime rules were called into question.

As the highest-ranking surviving officer, Charles Lightoller gave witness at both the American and British boards of inquiry. As a footnote, his autobiography made his feelings about subsequent investigations. He labeled the American inquiry as a “farce,” and of the British inquiry, he wrote, “it was necessary to keep one’s hand on the whitewash brush.” It seems that no matter the generation, or the circumstances, nothing changes. Evolving technology, competing interests, and waning focus mean we move the ball up the field but always seem short of a touchdown. Nonetheless, several significant changes came in response to the Titanic sinking and the resulting loss of life.

The first International Convention for the Safety of Life at Sea (SOLAS) convened in late 1913 to establish minimum safety standards for the construction and operation of merchant ships. These standards persevere today, with additions to modern technology and maritime laws. For example, ships must carry enough lifeboats for everyone onboard and mandatory lifeboat drills. Red rockets are a sign of distress, requiring immediate response and standardization of distress communications. Ship radios must be operated 24 hours a day to maintain constant contact, powered by a secondary, independent power source.

In the wake of the Titanic tragedy, the ice patrol was established to monitor for iceberg danger in the North Atlantic after the first International Conference on the Safety of Like at Sea in London in late 1913. The International Ice Patrol continues today, with 13 nation members. Albeit, they use modern ships, aircraft, and satellites.

The Key to Understanding Compliance

Oh yes, the key. At the beginning of this article, I mentioned a locker key. Before departure, Captain Smith’s trusted first officer William Murdoch was transferred to the RMS Titanic from her sister ship, the RMS Olympic. Titanic’s equivalent rank, Charles Lightoller, was demoted to second officer and was responsible, amongst other functions, for the lookouts.

The lowest-ranking Titanic officer, David Blair, was asked to leave the ship. In haste, he accidentally kept the only key to a storage locker that was believed to contain the binoculars intended for the crow’s nest lookouts. The night of the sinking, a flat-calm sea was darker than usual on this moonless night. The lack of wind, waves or swells, and dark conditions made it more challenging to spot icebergs using the phosphorescent line created by waves breaking over them.

Since Lightoller took charge of lowering lifeboats, he survived the sinking. As the highest-ranking surviving officer, he later testified during a public inquiry by the Board of Trade that he was aware of the locker key oversight but did not supply lookouts with glasses assigned to other crew members, such as spare binoculars on the bridge. He also admitted that binoculars would have certainly increased the ability of the lookouts to spot the iceberg sooner. Perhaps in time to evade the collision.

A key. A three-inch, one-ounce piece of brass potentially cost the loss of a ship over 900 feet long and weighing over 46,000 tons. Not to mention the lives of 1,500 people on that freezing night, and none of these factors were considered material in the findings of both investigations.

And that’s the point. Regulations result from macro issues and often miss minor oversights or micro details. Regulators walk a line between operators and those affected by those operators. Regulations like emergency signals, lifeboat requirements, and so on come from disasters. While not life-threatening, cybersecurity regulations lag cyber risks and current threats, requiring a material stimulus to instill change. In other words, regulations are the consequence of events rather than designed to prevent them in the first place, and that’s why cybersecurity regulations won’t necessarily save you.

We’re not all sailors. So, here’s a metaphor that’s closer to home. You can’t drive your car safely by focusing 100 percent on the rearview mirror. Imagine people in the 70s thinking you could use a phone to steal billions from banks and organizations on the other side. Now look forward and predict how we live, interact, and work 50 years from now.

The point is that we are better at looking at history than predicting the future. As Warren Buffet said, “In the business world, the rearview mirror is always clearer than the windshield.” So why would we expect regulators to future-proof industries against yet-to-be-experienced cyberattacks?

Meeting Cybersecurity Compliance is Not Enough

I am not proposing that because regulations lag risk that we should ignore jettison compliance entirely, far from it. It’s not good enough to assume that you are safe from today’s cyber threats because you meet today’s compliance, designed for yesterday’s risks. (Follow me? *Time machine not included.)

Take the Security Exchange Commission’s (SEC) latest cybersecurity rules, for example. The rules were proposed in March of 2023, with a call for comments from industry constituents, and are scheduled to go into rule sometime in 2024. These rules came as a response to the increase in ransomware attacks and fraudulent wire transfers over 2020-2021. That was over two years ago, and ransomware is again morphing as law enforcement infiltrates ransomware gangs, insurance coverage gets tougher and more expensive to purchase, and geopolitical invasions and trade wars take the gloves off a cyber cold war.

Healthcare compliance rules (HIPAA Security) were introduced in 1998 and heavily modified through 2013. Major manufacturing operates without broad regulations. Even government agencies operate under Cybersecurity Maturity Model Compliance (CMMC), proposed in 2021, which is in its second iteration and scheduled for publication around mid-2023. CMMC was supposed to replace the older Federal Acquisitions Regulations (FARs) regulations years ago and verify CMMC-certified operators’ compliance. The point is that regulations are hard to establish given the time it takes to come to an industry accord, normalize standards, and give organizations enough time to update their operations. All the while, criminals keep on attacking organizations. In financial jargon, criminals have a first-mover advantage. They innovate, and we try to be fast followers.

So, what do we do? How do we secure our organizations?

The Lesson: Illuminating Cyber Threats in the Darkness

Coming back to the Titanic, here is the lesson. You must navigate a digital ocean full of cyber icebergs. You are the captain and designer of your ship and determine your own cyber rules of operation. Consider regulations and compliance as the baseline. Remember, while Information Sharing and Analysis Centers (ISACs), Cybersecurity and Infrastructure Security Agency (CISA), and others are, to some degree, the corollary of the International Iceberg Patrol (IIP), you still need your shipboard lookout and to know how to take evasive action when a threat appears on the horizon.

And that’s what Adlumin does. We light a moonless night. Our job is to provide air cover to identify icebergs with plenty of time to avoid them. We are your iceberg patrol. We ensure your cybersecurity program can withstand a collision. If you strike a small one, our job is to patch the hull and ensure the organization remains afloat.

Our platform and MDR services are built on today’s threats, as our threat intelligence team works to predict when the criminal icebergs will enter the cyber shipping lanes tomorrow.

On April 14, spare a moment to think of those lost at sea. Years back, I visited the Titanic grave site in Cobh, Ireland. It was a reminder of human loss. But that’s the problem with most breach stories. There aren’t memorials, only eroding headlines. It lacks personal context. Having witnessed numerous companies fall victim to cybercriminals, I’ve learned it’s not about statistics in the history books. It’s emotional. It’s about people. And loss. So, ask yourself: will compliance keep your organization afloat in a cyberattack? If you do, I hope you have enough lifeboats for all involved.

Illuminate Threats. Eliminate risks. Command Authority.

See how Adlumin’s Security Operations Platform and 24/7 Managed Detection and Response Services can become your IT team’s foundation. Schedule a demo, experience a free trial, or contact an expert for more information.

References:
[1] Laying the keel is the first stage in the construction of the ship.
[2] Growlers was a term used to describe small, low-to-the-surface icebergs that are difficult to spot.

How to Choose a File Integrity Monitoring Solution: Four Must-Haves

March 23, 2023/in Blog Post Brittany Demendi/by Adlumin Staff

By: Brittany Demendi, Corporate Communications Manager

Knowing that the cybercriminal could’ve been in your IT environment for an average of 277 days or nine months can be unsettling for two reasons. One is that your environment was infiltrated, and two is that you don’t know what has been tampered with. To know if your critical assets have changed, it takes 24×7 monitoring. And when security teams are already stretched to their limits, it is best to seek tools that can do it for you, like file integrity monitoring (FIM).

This blog covers file integrity monitoring, how compliance can be solved, and how to find the right tool for your organization.

What is File Integrity Monitoring (FIM)?

File integrity monitoring is a simple and easy security process to monitor critical assets, registry paths, directories, and files. It analyzes the solidarity of the assets and operating systems to determine if anything has been tampered with or corrupted. Monitoring customer data, information, and health records are just a few examples.

Additionally, FIM validates and verifies if files have been tampered with by comparing them to the latest versions as a trusted baseline. If there are any signs of manipulation, file integrity monitoring generates alerts for Continuous Vulnerability Management teams to investigate and, if needed, remediate the intrusion.

When cybercriminals enter your organization’s network, they can wreak havoc on your files by changing everything from configuration files to application data. To make things worse, they can delete event logs to hide their tracks, so you never would know.

What does File Integrity Monitoring Detect?

FIM notifies security teams of unauthorized changes to all files within an environment, which speeds up threat detection, response, and remediation. This critical layer of security is required for many industries, including healthcare, manufacturing, financial institutions, education, and more. File integrity monitoring adds valuable security layers detecting the following:

Infrastructure Weakness: File integrity monitoring can monitor if files have been patched with the latest version by continuously scanning all versions across multiple machines and locations.
Cybercriminal Activity: If an intruder accessed your network, you must know if any files critical to your applications and operating systems have been tampered with. File integrity monitoring can detect changes to critical parts of your entire IT ecosystem, allowing you to monitor and protect the security of your data, operating system, and files.
Accidental Employee Changes: Often, an employee or designated admin can make file changes inadvertently, and the ramifications of these changes can be overlooked. The worst case scenario is these changes can create backdoors resulting in potential exposure disruption to business operations.
Unmet Compliance Regulations: File integrity monitoring is required within almost every industry dealing with sensitive data and files. Organizations are required to maintain compliance regulations and report on whether or not they are being met.

Solving Compliance Regulations with File Integrity Monitoring

File integrity monitoring is an essential part of security as it provides a layer of protection specific to devices, applications, and files by verifying the integrity of the files. Law and regulatory standards like PCI DSS, NERC CIP, FISMA, SOX, NIST, HIPPA, GDPR, and CIS controls require knowing who is accessing and modifying sensitive data files.

Fortunately, meeting those standards with a Security Operations Platform and Managed Detection and Response Services has become simple. FIM kick-starts your compliance efforts by offering detailed progress on compliance initiatives, which can provide a broad synopsis of your overall compliance. This allows you to create executive reports, analyze trends in events detected, look at graphical reports, and in-depth details about your network’s file integrity.

How to Find the Right File Integrity Monitoring Tool

Security solutions must include tracking activity and behaviors in addition to stopping incidents from happening. This gives complete visibility into your network, leaving no gaps in your security posture. When searching for the right file integrity monitoring tool to fit your organization’s industry, size, and compliance requirements, here are a few things to keep in mind:

Four File Integrity Monitoring Must-Haves:

Customization: When evaluating FIM solutions, you must ensure they are compatible with the rest of your cybersecurity architecture and support your organization’s file integrity policies. For example, will the specific solution meet all your compliance requirements? Also, it is good to remember that all-in-one Security Operations Platforms paired with Managed Detection and Response Services help manage all the solutions needed to secure your organization and customers properly.
User-Friendly Interface: FIM can be delivered with reporting capabilities, compliance regulation integration, and easy deployment, all within pre-defined dashboards for easy access. With a dashboard specific to file integrity monitoring and widgets the user might require.
Centralized Location: FIM can be delivered from one platform, in one place, by the same Security Operations Platform where other activities are monitored. When there is one centralized location to view all events detected across all assets, it becomes easier to quickly find events matching specific criteria.
Scalability: Find a solution to scale any size environment, even the largest, without purchasing additional storage, hardware, or software server. FIM should work when changes occur across your diverse on-premises and cloud environments, in addition to coverage of various Linux and Windows platforms.

Illuminate Threats and Eliminate Risks

See how Adlumin’s Security Operations Platform and 24×7 Managed Detection and Response Services can become your IT team’s foundation. Schedule a demo today or contact an expert for more information.

Malware Incident Step-by-Step Guide from Detection to Resolution

March 16, 2023/in Blog Post Brittany Demendi/by Adlumin Staff

By: Zach Swartz, Senior Data Scientist

The Adlumin Security Operations Platform recently detected a user in a customer’s network running multiple variations of a very suspicious PowerShell command on a single host. The command first decoded a suspicious-looking file from the user’s directory (using base64) and then unencrypted the result using an AES key in the initial command. Finally, the malware was executed after loading the resultant data into memory.

The detection offers an excellent use case of how Adlumin’s Security Operations Platform and Managed Detection Services protect client resources via automated detection and human response. The initial alert was generated by an Artificial Intelligence model activated on all PowerShell execution logs in our client data. Adlumin’s Managed Detection Response and Threat Research teams then collaborated to map the attack vector and track the incident down to its malicious roots.

This four-step breakdown dives into how Adlumin uses artificial intelligence and human judgment to secure customers.

Step 1: AI Detection for Malicious PowerShell

Adlumin Data Science has designed this alert to evaluate each PowerShell command in a series of automated steps. The malicious command was first tokenized into its fundamental components, which included using:

security.cryptography.aescryptoserviceprovider
frombase64string
assembly
createdecryptor()
transformfinalblock

The usage pattern of these tokens did not match any patterns seen in historical data, so the command was passed into phase two of the detection pipeline.

Step 2: Character Level Comparison

Since the tokenization step of the detection can often produce false positives, the next step is to perform a more computationally expensive but precise comparison between the suspicious command and historical commands. This is done using a combination of string tokenization and what is known as the Levenshtein distance, which makes character-level comparisons between strings. In the Illustration below, the distances between dots represent the string comparison score between commands.

The red dots (representing malicious commands) stand out significantly from the rest of the benign historical commands (blue dots), earning them an “anomalous” designation.

This comparison yielded an extremely high score, leading the AI to conclude there was an insufficient match against the pool of historically benign instances. The command was therefore passed to the final phase of detection.

Step 3: Minimize False Positives

The last step involves scoring the command using a large set of regex rules designed to minimize false positives further. Due to multiple suspicious PowerShell methods and a long base64 string, the command scored well above the detection threshold, and an alert was sent to the customer with a ‘High’ severity. Since both the pipeline’s anomaly detection and scoring portions are likely to produce false positives, the intersection of these two steps is required to reduce noise and maintain fidelity.

Step 4: Response and Remediation

An Adlumin Managed Detection and Response team member responded to the alert and initiated correspondence with the customer after determining that the behavior was likely malicious. The customer confirmed that this behavior was unexpected and quarantined the host involved. Meanwhile, Adlumin Threat Research initiated an investigation and found that the involved user had downloaded an executable associated with a known trojan virus which was determined to cause the incident. After further investigation, Adlumin Threat Research concluded that the malware did not attempt to pivot throughout the network, and after quarantining the machine, the incident was considered resolved.

Are your Security Defenses Ready?

For more information, contact one of Adlumin’s cybersecurity experts for a demo to get started.

What is a Spoofing Attack? How Financial Institutions are Being Targeted

March 9, 2023/in Blog Post Brittany Demendi/by Adlumin Staff

You’ve most likely seen messages or heard of well-known financial institutions, like Bank of America, SunTrust, and JPMorgan Chase, falling victim to cybercriminal impersonations to steal funds, credentials, identities, and more. Yet, the problem is not isolated to large financial institutions. We’re seeing an increase in small regional banks and credit unions as the target of brand impersonation or website spoofing.

It is easy to think these financial institutions are small and, therefore, not a prime target. Instead, they are the perfect target for cybercriminals for financial gain. Smaller companies, like these banks and credit unions, tend to have smaller cybersecurity budgets which can lead to gaps in their security posture. For financial institutions to protect themselves, it’s important to understand how customers are targeted and what they can do about it.

What is Spoofing?

A popular way cybercriminals target smaller financial institutions is through spoofing. Spoofing is a scam where cybercriminals impersonate a company with a fake email address, display name, text message, or website URL to convince a target that they are a trusted, well-known source from the company. It can be as simple as changing one letter, symbol, or number in a communication that is difficult to spot. The benefit of spoofing for cybercriminals is that customers will likely disclose financial and personal information, download malware, wire funds, and more. To better defend against these attacks, it is important to understand how customers are targeted.

Here are several types of spoofing attacks:

Email Spoofing: This technique is one of the most common types where cybercriminals send an email posing as a trusted source. They usually ask for an urgent request or attempt to lure the target to click a malicious link or attachment.
IP Spoofing: Cybercriminals alter IP addresses to hide their identity or impersonate a user. This technique is typically used to flood a target’s website with traffic to limit access for real users.
Domain or Website Spoofing: These attacks aim to lure users into logging into their accounts on the fake website or exposing other personal information about themselves. The cybercriminals then can use the stolen credentials to log into the actual account on the real website.
Caller ID Spoofing: Similar to email spoofing, caller ID alters the phone number to show up as someone familiar to the target they are calling. For example, they can pose as a customer service representative from their bank and attempt to gather personal information like their banking credentials, social security number, etc.
Text Message Spoofing: This technique targets a person via text message posing as a trusted source like their bank or a friend. They substitute the sender ID with a recognizable source and use the text message as a springboard for data theft, spear phishing, and scams.
GPS Spoofing: The act of altering a device’s GPS, so it registers within a different location. This technique can redirect navigation systems in any type of vehicle, including commercial airplanes, public buses, or passenger cars.
Facial Spoofing: This relatively new type of spoofing allows cybercriminals to exploit vulnerabilities within technology requiring facial recognition to unlock a device or app.

The reality is that financial institution customers are being targeted, as well as employees. Implementing a Proactive Security Awareness Program aims to empower users with skills to identify and report suspicious activity, including emails, texts, or website links. People are the first line of defense for any organization, and when they are equipped with cybersecurity awareness, it will only propel their security posture.

Domain Spoofing for Financial Institutions

Cybercriminals are still targeting financial institutions’ IT environments and are going after their customers by making fraudulent copies of websites and setting up domains that look close to the original institution. Customers are targeted mainly because they are likely to fall victim, and it is an easier tactic for cybercriminals. They drive traffic to the dupe website by targeting the customers of that financial institution via phishing emails, text messages, or social media.

Cybercriminals will even invest in paid advertisements to display their fake websites at the top of search results to appear as legitimate companies. Once a customer is tricked into visiting a fraudulent website, they will be prompted to log in with their username and password.

For example, Adlumin’s Threat Research Team recently saw an incident where a small regional bank based in southeast Texas was the victim of domain spoofing. The cybercriminal created a dupe website of that regional bank and lured customers to it via social media. They reached out to customers letting them know that they won a prize in hopes that they to click on the link and fill out their information.

Threat Intelligence for Financial Institutions

Implementing a comprehensive security operations platform with threat intelligence from a team monitoring attacker trends and tactics can help with spoofing. Threat intelligence enables organizations to stay one step ahead of malicious actors by providing the latest spoofing trends and techniques.

With a threat intelligence team, they hunt for abnormal activity indicating network compromise. They can also assist with remediating spoofing attacks by identifying the fraudulent domains and working with web host providers to remove the websites to minimize the damage.

In addition, they can help you understand who your adversary is to defend against threats better coming your way. This solution can help elevate strains on internal teams and proactively extend security surveillance.

Preparation is Key: Incident Response Plan

The cybersecurity landscape has evolved, and smaller financial institutions that thought their small size would bypass being a target now face the same security challenges as more prominent institutes. IBM recently reported that in 2022, the financial industry spent an average of $5.72 million on responding to and recovering from a breach. As you can imagine, these high costs put a lot of financial strain on banks and credit unions.

One way to prepare for these threats against your financial institute is to develop and practice your incident response plan. Conducting tabletop exercises clarifies the roles and responsibilities of your incident response team. Knowing who makes decisions is vital during a cyber crisis. Here are a few tips for what to plan for before an incident occurs:

Create a written plan and review it with an attorney. As a financial institution protecting significant amounts of assets, you are a target and must plan for when an attack occurs, not the if.
Develop an incident stakeholder and staffing plan.
Review plans quarterly.
Prepare press release templates in advance.
Assign roles and responsibilities to team members.
Conduct simulation exercises and test your defenses.
Take the learnings from the exercise to strengthen your cybersecurity efforts.

Although it is important to have a response plan, it is even more vital to position yourself ahead of cybercriminals with full visibility into your environment, understand your risks, and implement changes to improve your security program.

Contact an expert or request a demo for more information about extending your security team 24/7.

To Catch a Cybercriminal: Honeypot Usage Considerations and Benefits

March 2, 2023/in Blog Post/by Adlumin Staff

By: Kevin O’Connor, Director of Threat Research

We returned to the basics in our most recent blog, Honeypots 101: Origin, Services, and Types covering the evolution of honeypots, how organizations are deploying them, and the different types that can help lure away cybercriminals from key assets. Deception tools, like honeypots, add another layer of defense to protect your system while drawing attackers away from where you don’t want them.

We are diving deeper into usage considerations and why deception technology expands security defenses.

Business and IT Systems Benefits

Honeypots are beneficial inclusions in an IT System’s Security Plan for many reasons, including^[1]:

Early warning and detection of attacks: Honeypots can detect attacks before they reach critical systems allowing security personnel to respond quickly and minimize damage.
Intelligence gathering and analysis of attack methods: By observing attackers’ behavior on a honeypot, businesses can gain insight into attackers’ methods and techniques to compromise the system. They can provide valuable information about the TTPs used by attackers, which can be used to develop more effective security measures and assist in incident response.
Detecting new threats: Honeypots can detect new and emerging threats as attackers leverage new TTPs, which the honeypot may observe in detail.
Improving security posture and reducing risk: Honeypots can improve an organization’s security posture by better understanding the TTPs used by attackers and developing more effective security solutions. Luring attacks on a decoy system can help reduce the risk of an actual attack on the organization’s networks and systems.

Honeypots can also be used to help meet industry-specific compliance requirements. For example, the Payment Card Industry Data Security Standard (PCI DSS) requires merchants who accept, process, store or transmit credit card information to implement security measures to protect sensitive purchase-related data. While honeypots are not explicitly mentioned by PCI DSS or any other compliance requirements, Adlumin tracks, they can be used as part of a comprehensive and broader security strategy to detect and respond to security threats.

Similarly, the Health Insurance Portability and Accountability Act (HIPAA) requires that healthcare organizations implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronically protected health information (ePHI). Again, while honeypots are not explicitly mentioned in HIPAA, they can be used as part of a comprehensive security strategy to detect and respond to security threats to ePHI.

Honeypot Usage and Deployment Considerations

When deciding as an organization to implement and use honeypots as part of a layered security defense, some key considerations can help ensure the honeypot is safe and effective^[2].

Placement – a honeypot’s placement is critical to its effectiveness. Honeypots must be strategically positioned within the network to offer potential attackers a target while appearing as legitimate services. Placement also needs to consider the network space in which you are allowing the attacker to gain a foothold. Additionally, decisions to deploy the honeypot on external vs. internal facing infrastructure will determine the types, frequency, and severity of detected attacks. External-facing honeypots are subject to frequent scanning, rogue exploitation by botnets, and attacks of convenience by many different threat actors. This can increase the noise in the logging signals and make it hard to separate real and targeted threats.
Isolation – the honeypot should be isolated from the rest of the network and not contain any sensitive information. This minimizes the attacker’s risk of leveraging access to the honeypots to continue their attack throughout the network using the honeypot as an initial foothold. Honeypot configurations must ensure the attacker is trapped and actions monitored appropriately.
Monitoring – the honeypot should be monitored closely to gather information about the attacker’s TTPs which can be fed into the network and security defenses. It’s not enough to just deploy a honeypot – the honeypot’s logs must be analyzed and used to create detections for malicious activity to warn the organization of potential attacks.
Management & Maintenance– the honeypot should be managed by experienced security personnel who can effectively configure, monitor, and maintain it to ensure its effectiveness in detecting and responding to attacks. Additionally, the honeypot should be regularly updated to ensure that it continues to mimic real-world systems and applications and remain attractive to attackers.
Integration with other Security Measures – the honeypot should be integrated with other security measures such as firewalls, intrusion detection systems, incident response plans, SIEMs, MDRs, and detection alert management, investigation, and response systems. This ensures that the honeypot contributes to the network’s security and helps increase its value by generating detections and alerts to activity. Some honeypots can be used to build detections dynamically based on attacker compromise.
Legal Considerations – the legal implications of using a honeypot must be considered, as some countries have strict laws regarding the monitoring and interception of communications. Organizations should comply with relevant laws and regulations when using a honeypot. There is also the potential to attract and trap innocent users, which should be carefully considered before deploying a honeypot.

Honeypots and Zero Trust

Zero Trust is a cybersecurity approach that assumes all network traffic is untrusted and consequently subject to strict security controls and monitoring. The Zero Trust model assumes that every user, device, and application is a potential threat and should be verified and authenticated before being granted access to sensitive data or systems.

In a Zero Trust model, network access is never automatically granted, even if a user or device is within the network’s perimeter. Instead, all access requirements are subject to multi-factor authentication (MFA) and monitored for suspicious activity. The Zero Trust approach protects against various threats, including malware, phishing attacks, and unauthorized access. By verifying and monitoring all network traffic, organizations can more expediently detect and respond to security incidents, reducing the risk of data breaches and more severe attacks.

Zero Trust and honeypots are security measures used to protect against security threats. While Zero Trust focuses on identity verification and attestation of all users, devices, and applications before allowing access to sensitive data and systems, honeypots detect unauthorized access to sensitive data by creating decoy targets that appear valuable and vulnerable to attackers.

Honeypots can be part of a multi-layered, defense-in-depth security strategy to detect threats to the organization and its networks. If a honeypot is accessed, it can trigger an alert which can be used to investigate potential incidents which complement other Zero Trust security measures such as MFA, continuous monitoring, and network segmentation. Honeypots can highlight where Zero Trust measures have failed and provide early warning against attacker operations and compromise.

Expand Your Security Defenses

The evolution of honeypots is a testament to the creativity and ingenuity of cybersecurity professionals and their commitment to staying ahead of the ever-evolving threat landscape. Honeypots can provide deep insight into attackers’ methods and motivations. However, thought needs to be given to what type of honeypot is best for an organization, what services should be simulated, and how to maximize value through proper deployment and usage.

Visit the Adlumin for Honeypots resource page for more information on expanding your defenses with deception technology.

References

Andress, J., & Andress, J. (2015). Chapter 10 – Network Security. In The Basics of Information Security: Understanding the fundamentals of infosec in theory and Practice (pp. 151–169). essay, Syngress.
Sanders, C., Randall, L., Smith, J., & Sanders, C. (2014). Chapter 12 – Using Canary Honeypots for Detection. In Applied Network Security Monitoring: Using Open Source Tools (pp. 317–338). essay, Syngress, an imprint of Elsevier.

Beauty is in the Eye of the Deceiver: Deception Technology for Your Zero-Trust Arsenal

March 1, 2023/in Blog Post/by Adlumin Staff

By: Brittany Demendi, Corporate Communications Manager

Register for Adlumin’s Upcoming Webinar:

Beauty is in the Eye of the Deceiver: Deception Technology for Your Zero-Trust Arsenal

Date: March 16, 2023

Time: 5:00 PM EST

Attendee Link: https://adlumin.com/webinar/beauty-is-in-the-eye-of-the-deceiver/

As cyberattacks become more frequent and sophisticated, traditional security measures are no longer enough to keep organizations safe. To help businesses stay ahead of cybercriminals, Adlumin’s VP, Chief of Strategy, Mark Sangster, and Director of Threat Research, Kevin O’Connor, discuss zero trust and complementing detection and response capabilities with deception technology.

By deploying deception technology, businesses can detect cyberattacks early, reducing the impact of any breach. It also gives businesses insight into criminal tactics and techniques, allowing them to better protect themselves against future attacks.

Tune in to learn:

How zero trust applies to cyber risk management.
How to use deception technologies to detect threats quickly and gain threat intelligence into criminal tactics and techniques.
Ways to complement detection and response capabilities with deception technologies to strengthen your security posture.

Honeypots 101: Origin, Services, and Types

February 23, 2023/in Blog Post/by Adlumin Staff

By: Kevin O’Connor, Director of Threat Research

The Origin of the Honeypot

In the 1980s, honeypots became a permanent fixture in cybersecurity, riding the lines of defensive and deception technologies. The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage, published by Clifford Stoll in 1989, details the hunt for a computer hacker (later identified to be Markus Hess) who digitally broke into Lawrence Berkley National Laboratory (LBNL) in 1986^[1]. Stoll provides one of the first descriptions of what is known today as a honeypot.

To catch the hacker, Stoll set up an elaborate ploy by inventing a fictitious department under an imaginary contract within a real organization under LBNL that Stoll suspected the hacker was targeting. Creating a fake user working for the faux organization, Stoll filled the user’s digital assets with attractive-looking documents designed to gain the hacker’s attention and lure them into grabbing the files. His efforts would ultimately lead to discovering the hacker’s identity as Hess and the following arrest in Germany.

After Stoll flew to Germany and testified against Hess, it became public that Hess had been selling the bounty of his hacking operations against organizations like LBNL to the Soviet Union’s KGB intelligence agency. They would also work out that a Hungarian agent had contacted the fictitious LBNL department using information that could have only been sourced from Hess. This was part of the KGB’s standard routine to verify Hess’s information.

Later, in 1991, Bill Cheswick, considered one of the pioneers of computer security, published An Evening with Berferd in Which a Cracker is Lured, Endured, and Studied^[2]. The Chronicle, one of the earliest technical descriptions of a honeypot, details leading a hacker on a “merry chase” to trace his location and learn his techniques. It details the bait and traps used to lure him and is the work that first applied and popularized the terminology of “jail” in cyber security. Cheswick had created a digital jail to trap the actor and watch their actions in detail^[3].

The concept of a honeypot has come a long way since its first use in the 1980s. Pioneers like Stoll and Cheswick were instrumental in laying the foundation for what has become an essential component of modern cybersecurity strategies. With the advancements in technology and the increasing sophistication of cyber-attacks, the use of honeypots has evolved over the years. Today, honeypots are used for defense, research, threat intelligence gathering, and incident response. Let’s explore the current usage landscape of honeypots in the field of cybersecurity and some considerations in deployment and usage.

What is a Honeypot?

Honeypots are security systems that lure cyber attackers and track their activities in a secure, isolated, and monitored environment. Honeypots can distract potential attacks from a target’s critical resources; act as an intelligence-gathering platform about attacks and their tactics, techniques, and procedures (TTPs); and strengthen security overall. Information collected by honeypots can also be used to identify vulnerabilities in a system, software, or protocol. They are, in essence, a decoy computer system meant to attract, trap, and expose potential attackers. As attackers are drawn to the honeypot and focus their efforts there, more valuable systems and data are protected by the attacker’s exposure through the honeypot. A well-designed and implemented honeypot is isolated from the rest of the network. It does not contain any sensitive information, so there is no risk of the attacker compromising it and accessing sensitive data.

Common Honeypot Services

Modern honeypots will typically work to provide “jailed” access to systems over specific protocols and their related applications, such as email, web services, and network administration services. These targeted applications may present high-value access to the target, data collection, theft opportunities, or an easy way to compromise and pivot through an organization’s and network’s systems.

Common services that are often developed into honeypots include:

File Transfer Protocol (FTP)
Telnet
Secure Shell (SSH)
HTTP Web Services
MySQL or Database Specific Applications
Administrative Applications
Other Remote Access Methods (VPNs, Remote Desktops, and remote support apps)

Most network and computer services can be adapted into a honeypot with the proper modifications. Which honeypot services your organization deploys will depend on its legitimate services, attack surface, and known attacker motivations.

Types of Honeypots

Honeypots come in various forms and have evolved to meet the changing threat landscape. Several types of honeypots are designed to cater to specific security needs.

Low-interaction honeypots are designed to simulate a limited number of services and are less complex to implement, making them ideal for small-scale organizations. On the other hand, high-interaction honeypots offer a much more realistic and complex environment and are designed for organizations with larger security teams^[4].
Another type of honeypot is a hybrid honeypot, which is a combination of low-interaction and high-interaction honeypots. This honeypot balances complexity and ease of deployment, making it ideal for medium-sized organizations.
Virtual honeypots simulate a network environment and lure attackers into a virtual and often restricted or more heavily monitored network enclave.
Honeypots can also be combined to create a honeynet or honeyfarm, a network of honeypots used to monitor and track attacker activities. Honeynets are often used to gather information about and monitor large-scale attacks, such as distributed denial-of-service (DDoS) attacks.

Through pioneers like Stoll and Cheswick, honeypots have evolved from simple traps used to study and track hackers to complex security solutions that detect, prevent, and respond to cyber threats. The term “honeypot” has become synonymous with deceptive security technologies, and the concept is widely used in various industries, from financial services to healthcare, to protect against cyberattacks. And regardless of the type, honeypots are an indispensable tool in any cybersecurity arsenal that is crucial in detecting and mitigating cyber-attacks.

Visit the Adlumin for Honeypots resource page for more information on expanding your defenses with deception technology.

References

Stoll, C. (1989). The Cuckoo’s Egg: Inside the world of Computer Espionage. Doubleday.
Cheswick, B. (n.d.). Biography. Bill Cheswick’s bio. Retrieved January 30, 2023, from https://www.cheswick.com/ches/bio.html
Cheswick, B. (1992). https://cheswick.com/ches/papers/berferd.pdf. Winter USENIX Conference, San Francisco, 20–24. https://doi.org/https://cheswick.com/ches/papers/berferd.pdf
Edgar, T. W., & Manz, D. O. (2017). Research methods for cyber security. Syngress, an imprint of Elsevier.

Adlumin Promotes Miguel Hablutzel to Vice President of Managed Security Services

February 17, 2023/in Blog Post/by Ellen Loughlin

By: Brittany Demendi, Corporate Communications Manager

Adlumin announced the promotion of Miguel Hablutzel as Vice President of Managed Security Services. Hablutzel brings a wealth of experience and expertise to Adlumin, and his efforts speak volumes through Adlumin’s continued growth and expansion.

Before his time at Adlumin, Hablutzel served as the President and CEO of a Cybersecurity Consulting company based in Tampa, Florida, and a Vice President of Product Strategy for a large security management company in North Carolina. He oversaw solutions ranging from developing and managing a 24×7 Security Operations Center (SOC) to Virtual Information Security Officer Program (vISO).

Please join Adlumin in congratulating Hablutzel on his outstanding contributions to his department and his promotion.

Six Cybersecurity Solutions to Protect Higher Education and K-12 School Districts

February 16, 2023/in Blog Post/by Ellen Loughlin

By: Brittany Demendi, Corporate Communications Manager

Usually, when we think of primary targets of cyberattacks, finance, banking, healthcare, and even municipalities come to mind., But, in reality, higher education and K-12 schools are also key targets. From sensitive student information to financial and research data, cybercriminals have plenty of temptation to target education. The most disturbing aspect of these attacks is that higher education and K-12 schools are tremendously behind in their cybersecurity efforts. The secret is out, and cyber criminals are showing no mercy. Microsoft reported that education recently accounted for 80% of enterprise malware.

Challenge: The Education Industry is Lagging in Cybersecurity

The education sector is struggling to keep up with cyber threats, and technology alone is not enough to protect schools. Education, like cybersecurity, evolves and requires people and products to do the same. If not, there is a lot at stake.

For example, school districts use specialized software to track students’ progress records, highly sensitive and confidential information on children. The New York Times reports on a recent cyberattack where the personal information of over 1 million former and current students was affected. Intimate information was breached, including descriptions of disabilities, behavior incidents, migrant status, ethnicities, names, birth dates, and more. This data breach violates student privacy laws that schools must abide by.

This cyberattack propelled the school district to up its cybersecurity and come out with multiple press releases to reassure students, employees, and parents that they are doing everything possible to secure sensitive data. The goal is not to let it get to this stage, but how can higher education and K-12 school districts mitigate risk and not fall behind?

Six Solutions to Eliminate Risk and Illuminate Threats

Tech Funding Reevaluation: Addressing current and rising risks when assessing your cybersecurity budget is key. See if there is an opportunity to reallocate the budget to a platform that provides visibility and services with greater value in the long run rather than a security or anti-virus program. Unlike large corporations, education tends to operate on a smaller budget, so every dollar must provide the most value possible.
Incident Response Plan: As an educational organization, you are consistently in the spotlight, especially for your reactions to challenging situations. The same goes for when an attack occurs. The media, parents, and students are watching to see the response plan with their personal opinion on deck. Put together a response plan where you have steps in place if a data breach or security incident happens.
In addition, conduct a tabletop exercise to clarify the responsibilities and roles of your incident response team. Knowing who makes what decision during a cyber crisis and how your team works together is ideal, which we have identified previously in The Ultimate Guide to Managing Strong Personalities During a Cyber Crisis.

The tabletop exercise highlights team members and any gaps within your plan resulting in an action plan for an emergency. They are vital to business operations and help mitigate further reputational damage that schools cannot afford

Invest in a Security Operations Platform: Cybercriminals are evolving their tactics and strategies, and so should educational organizations. IT teams are stretched thin, especially when the budget is low. Finding a security operations platform that includes risk management is built to assist in taking command of security and compliance—streamlining data ingesting, compliance, and analysis workflows throughout the enterprise. This illuminates system vulnerabilities, unseen cyber threats, and IT operations, so the path to visibility is clear.
Implement Managed Detection and Response (MDR) Services: MDR services deliver 24×7 benefits scaled for higher education and K-12 school districts of all sizes. These services extend your security team without being too costly, offering around-the-clock coverage and access to one platform with everything in view. Many organizations opt for MDR services because their teams gain time back in their day and peace of mind knowing they are covered. A dedicated team continuously identifies critical vulnerabilities, rapidly remediates risks, and prioritizes threats and dangers.
Test Your Defenses with Microsoft 365 Business Email Compromise Simulation: Business Email Compromise (BEC) is a critical method cyber criminals use target faculty, students, and administration. One of the primary types of a BEC attack is account compromise, when a cybercriminal gains access to the target’s account and uses it maliciously. Due to a lack of cybersecurity awareness, many attacks are successful and could’ve been avoided in most situations. Testing your defenses, specifically the Microsoft 365 (M365) environment, with an M365 BEC Simulation tool will not only identify how your security stacks up to top tactics used to compromise accounts, but it will also identify where all the gaps are in your protection.
Make Security Awareness a Culture: Your students and employees are the first lines of defense against cybercriminals. They must feel empowered with the knowledge of reporting suspicious activities when they are targeted. Cybersecurity culture is essential to higher and K-12 education resilience to reduce the risk associated with human error. Thus, this culture needs to be a part of a broader organizational culture of daily actions encouraging faculty and students to make mindful decisions that align with educational security policies. A Proactive Security Awareness program does just that. Implementing fully managed security awareness testing and training is proven to reduce the risk posed by the human component.

Cyberattacks in the education sector are a growing trend. Most concerning is that the schools lag in their cybersecurity efforts due to limited budgets, lack of awareness, and more remote students. Fortunately, there is a light at the end of the tunnel and affordable resources to help illuminate these attacks. It is essential to seek out these resources and find experts that can assist with acting as an extension to your security team for 24×7 surveillance. Managing cyber risks becomes easy when everything is in one place from one platform.