“Ransomware Attacks Saddle Biden with Grave National Security Crisis.” That’s a CNN headline for June 7, as the nation begins a new week and continues to take stock of what’s been a string of ransomware attacks against various elements of our supply chain infrastructure. There’s an old saying: “If you aren’t feeling paranoid, you aren’t paying attention.” Those of us who work 24×7 in cybersecurity have long been wary of not just the continual onslaught of cyberattacks, but of a more recent trend toward hacking supply chains and other elements of critical infrastructure. If one were looking for a silver lining, it would be that the rapid succession of attacks—from the recent hacking of JBS, the world’s largest meat packer, to the Colonial Pipeline attack, which happened just a few weeks before, to the massive SolarWinds breach—has finally caused a widespread awakening across government and the private sector. CNN quotes U.S. Department of Energy Secretary Jennifer Granholm as saying: “Even as we speak, there are thousands of attacks on all aspects of the energy sector and the private sector generally … it’s happening all the time.” CNN notes: “Alarmingly, the former Michigan governor said that foreign hackers have the capability to shut down the US power network.”
“You Really Have to Treat Russia Like it’s Virtually a Criminal Enterprise” – Sen. Roy Blunt. The tough words from a U.S. Senator, as quoted in The Hill, are welcome, and, I believe, long over due. Sen. Blunt, a Missouri Republican, said: “I think to some extent … you really have to treat Russia like it’s virtually a criminal enterprise. You know, they harbor criminals, they don’t appreciate the rule of law or any kind of level of personal freedom. And I do think we have to push back.” Going back to the silver lining, Sen. Blunt added: “I’m glad this is getting the attention it’s now finally getting. It took gasoline and beef for us to think this is really a serious problem.” The Hill article went on: “Recent attacks on critical infrastructure in America such as oil and gas, food supply and banking have led U.S. officials to warn that the country could be teetering on the brink of a massive security breach that could cause chaos if bad actors seek to disrupt society. Last week, FBI Director Chris Wray drew what he called ‘parallels’ between recent ransomware attacks on the U.S. and 9/11. The article quoted Wray as saying: “Time and time again, a huge portion of those traced back to actors in Russia. And so, if the Russian government wants to show that it’s serious about this issue, there’s a lot of room for them to demonstrate some real progress that we’re not seeing right now.”
This Problem Isn’t Going Away … It Will Likely Get Worse. President Biden meets with Russian President Vladimir Putin June 16 for a summit meeting, and the White House has said the recent hacking incidents will be at the top of the agenda, as per a recent Fortune headline “Biden Will Ask Putin to Take Action Against Russia’s Ransomware Criminals at Upcoming Geneva Summit.” However, few are expecting immediate resolution (and there are plenty of state actors beyond Russia, including North Korea, China, and Iran). Meanwhile U.S. Commerce Secretary Gina Raimondo is quoted in Politico as saying “businesses should assume, that these attacks are here to stay and, if anything, will intensify.”
“Pharmaceuticals, Hospitals, Healthcare, Public Companies … Getting Sucker Punched.” The Wall Street Journal, reporting on a cybersecurity conference it hosted, quotes Kevin Mandia, Chief Executive of cybersecurity firm FireEye, as saying: “Pharmaceuticals, hospitals, healthcare, public companies, organizations that don’t have the talent and skills to defend themselves—they’re getting sucker punched.” The article also quotes Eric Goldstein, Executive Assistant Director for Cybersecurity at the Cybersecurity and Infrastructure Security Agency, a part of the Department of Homeland Security, as saying: “The threat of ransomware continues to be severe. Ransomware can affect any organization in any sector of the economy. All organizations should urgently review our available resources and implement best practices to protect their networks from these types of threats.”
Good Advice from the White House: Securely Backup Your Systems. As a cybersecurity professional, one of my ongoing mantras is to please backup your systems, and to do so redundantly and securely, meaning at least some of your backups should be untouchable from your main network. Otherwise, if your network is locked by a ransomware attack—so will be your backups. So it was good to see The New York Times coverage “White House Warns Companies to Act Now on Ransomware Defenses” point to a recent White House memo titled “What We Urge You to Do Now.” Summarizing the memo, in part, The New York Times writes: “It encouraged them to regularly back up data and segregate those backup systems from the rest of their networks so that cybercriminals cannot easily find them. It urged companies to hire firms to conduct ‘penetration testing,’ essentially dry runs in which an attack on a company’s systems is simulated, to find vulnerabilities. And … asked them to think ahead about how they would react should their networks be attacked and held hostage with ransomware.” That’s good advice that every organization should embrace and put into regular practice.
Clinton A. Pownall is the President & CEO of Computer Business Consultants and has been in the IT field since 1990. Pownall served in the U.S. Navy for six years as a Weapons Systems Technician and has a Bachelor of Science in Computer Engineering. Through Computer Business, he was one of the first to pioneer VoIP technology using satellite communications. He is a member of the Florida Police Chiefs Association, and advises law enforcement agencies on cyber security. Pownall serves on several boards and committees and has a strong affiliation with various arts and education groups, local school districts, and served in regional efforts of the Bill & Melinda Gates NextGen Foundation. He’s served as a Vice President of the Board of Director for the Orlando Shakes Theater and is heavily involved in the South Lake Chamber of Commerce, West Orange Chamber of Commerce, and the Orlando Economic Partnership.