Last week, Microsoft reported that it detected six internet domains that were set up by cyberattack groups associated with the Russian government. According to Microsoft:
Last Week, Microsoft’s Digital Crimes Unit (DCU) successfully executed a court order to disrupt and transfer control of six internet domains created by a group widely associated with the Russian government and known as Strontium, or alternatively Fancy Bear or APT28. We have now used this approach 12 times in two years to shut down 84 fake websites associated with this group. Attackers want their attacks to look as realistic as possible and they therefore create websites and URLs that look like sites their targeted victims would expect to receive email from or visit. The sites involved in last week’s order fit this description.
The impact that foreign adversaries’ politically motivated cyberattacks have on US public and private sector organizations is nothing to downplay. It is important for private industry and government agencies to continue to work together to impede them. We should not let cloak-and-dagger intrigue divert us from remembering that politically-motivated attacks make up only a small portion of those taking place today and that for every domain identified and neutralized, there are thousands more that go unchecked.
It is encouraging to note that Microsoft has been able to find 84 attack domains over the past two years. It is equally comforting to know that Facebook, Twitter and YouTube are recognizing fake political attack and misinformation sites with greater accuracy and speed. Unfortunately, all of the sites and domains identified and neutralized add up to a relatively low number. As Dtex CEO Christy Wyatt told Infosecurity Magazine‘s Phil Muncaster in a related story, 84 is a ‘mere drop in the ocean.’
Dtex sees instances of vulnerable employees and other trusted insiders being fooled into visiting attack websites on a regular basis. Vulnerable humans that aren’t provided with protection needed actually make up the biggest segment of the insider threat today. As Phil reported:
‘Assessments we conducted as part of our 2018 Insider Threat Intelligence Report revealed that 67% of organizations had instances of employees visiting high risk websites, which is exactly what the sites Microsoft identified are,’ she (Wyatt) said.
California Consumer Privacy Act Faces Federal Challenge, Maybe …
Privacy and security continue to be the two most hotly debated and covered topics in the news media today. The GDPR, Supreme Court cell phone data decision, and passage of the California Consumer Privacy Act are the most recent items that are keeping the fires stoked. When the California legislation passed, tech giants did relatively little to stall it. Now we know why.
In a Sunday story by Cecilia Kang in The New York Times, she reported that Facebook, Google, IBM, Microsoft and ‘others’ are pushing the fed to nullify the act signed recently by Governor Jerry Brown. According to Kang:
In recent months, Facebook, Google, IBM, Microsoft and others have aggressively lobbied officials in the Trump administration and elsewhere to start outlining a federal privacy law, according to administration officials and the companies. The law would have a dual purpose, they said: It would overrule the California law and instead put into place a kinder set of rules that would give the companies wide leeway over how personal digital information was handled.
There will continue to be legal and political maneuvering around the issue of privacy for a long, long, long time to come. Whether or not the fed is able to pass a law that can circumvent the California act of course remains to be seen. Regardless of the outcome, the privacy cat is out of the bag and as more consumers and employees become conscience of how their data is used, businesses are going to have to find ways of satisfying regulators, the people who use their services and who power their companies. Many forward-thinking enterprises are already taking steps to protect employee and customer privacy that go beyond legal requirements. Others are starting to take up the cause. Organizations that want to know how they can ensure data security without violating user privacy should consider how Dtex shields trusted insiders against privacy violations and the results of our recent Harris Poll revealing Americans’ attitudes towards privacy and security in the workplace. To learn more, read: