California Consumer Privacy Act of 2018 Applicability

California recently passed an aggressive data privacy law. The California legislature passed AB375 (The California Consumer Privacy Act of 2018), which by most accounts, is a strong push for consumer privacy. The law, in summary, requires companies collecting consumer data to disclose to the consumer the types of data collected and allowing the consumer the option of opting out from allowing the companies to sell the consumer’s data.

The new California law is a step towards the GDPR. This has much of the same intent, however, does not have the like exact goals, parameters, or negative reinforcement for not complying. Interestingly, the law requires the company to disclose the “category” of the third party receiving the consumer’s data, versus the name of the third party.

Consumers in California will, beginning on January 1, 2020 (the point at which the law takes effect), have the right to know all the data that has been collected for the individual consumer, to not allow their data to be sold, know what type of companies are receive the data, have their data deleted, the sources of the consumer data being sold, and other pertinent, germane facets of their data.

The headlines do indeed portray this as a far-reaching and direct victory for consumer rights. The general consumer thought is of this bringing the Google, Yahoo, and other internet-oriented companies to comply and be more transparent with their wishes. One should actually read the statute to garner a better understanding of the statute’s parameters. The California Consumer Privacy Act of 2018 does indeed affect businesses. As an example, section 1798.105 references a consumer’s right to request a business to delete any of the consumer’s personal information. On the initial reading, this would appear to affect all businesses collecting the personal information of a California citizen.

With this law, in general as it pertains to consumer’s data privacy, a business “...collects consumer’s personal information” (1798.140(c)(1)), has annual gross revenues greater than $25M (1798.140(c)(1)(A)), buys or receives the personal data of at least 50K consumers, households, or devices (1798.140(c)(1)(B), or derives 50% or more of the annual revenue from selling consumer’s personal information (1798.140(c)(1)(C)). As the statute is presently written, the “or” is important. Although this does narrow the potential field of companies having to comply to the statute, this would include the massive companies that comprise most of the work done in this endeavor. This statute also covers any device, which is any equipment that may connect to the internet or another device.

Embedded Devices
Embedded devices are throughout many industries and utilized with many devices consumers are in contact with daily, including vehicles. The connected vehicles have many opportunities to collect a consumer’s private information. If the person were to connect their cell phone to the vehicle with an app, the person’s contact list, smartphone call history, locations visited previously, credit card numbers, and other relevant data could be collected or in the least pass through the modules. With IoT devices, there may be present a portion of this data and other data points deemed confidential. These are only two examples of the many possible scenarios. In the present capacity, there is no legal advice and this is my opinion only, however, seemingly this new statute would apply to the embedded systems in vehicles, IoT devices, and other like devices collecting, processing, or managing a consumer’s private information and data in California. At this junction, this point is more of conjecture and to begin the thought process.

Is this were to be applicable to these systems, there would need to be completed much updating to the code for the present and future hardware, the affected policies, and noticing functions for the consumers.


Resources
California Legislative Information. (2018). Bill text - AB-375 Privacy: personal information: business. Retrieved from https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375

California Privacy. (n.d.). Californians for consumer privacy applauds successful passage of groundbreaking legislation. Retrieved from https://www.caprivacy.org/

Lecher, C. (2018, June 28). California just passed one of the toughest data privacy laws in the country. Retrieved from https://www.theverge.com/2018/6/28/17509720/california-consumer-privacy-act-legislation-law-vote

Please analyze third party vendors with computer or network access

Over the last five years, there have been many, many corporate data breaches. These have been published and republished numerous times. The targets as of late have been hospitals, law firms, and the businesses with mass amounts of customer data. The hospital and doctor’s office targeted data includes the electronic health and medical records (EHR/EMR), including the patient’s name, address, medical information, insurance information, and other germane, relevant data. The attorney officers have their files continuing evidence data, intellectual property, lawsuit strategy, their client’s private data, and other relevant information.

One target not specifically or significantly targeted has been third-party recruiters. This appears to be a natural progression as these firms likewise hold and manage the person’s personally identifiable information (PII).

Incident
Whitbread is a multinational hotel and coffee shop business headquartered in the UK. The organization employee and application data were compromised and a portion of this, the number is unknown, was accessed by unauthorized parties. This breach occurred in June 2018. In this instance, the targeted data was for current and prospective employees. This included but was not limited to the employee and applicant’s name, email address, telephone number, gender, date of birth, and employment. This list is moderately inclusive of everything an attacker would need to “borrow” the person’s identity and perform a rather in-depth phishing campaign, which would probably be at least moderately more successful than the generic version. After Whitbread was notified of the issue, the organization sent an email to the potentially affected parties.

The attack vector with this compromise was Whitbread’s third-party vendor PageUp. PageUp’s role in this issue was the business provided an online recruitment platform. Unfortunately, the details regarding the specific method, and outdated configuration and other data the industry could have learned from or used as a lesson have not been provided.

Due to the issue, Whitbread is not using the service and platform at this time.

GDPR
The GDPR was passed into law a few years ago, and the organizations managing, processing, holding, etc. the EU’s citizen’s information and data have been on notice and given the opportunity to prepare to comply with this law, as it came into full force and effect a few months ago. In short, the compromise affected up to 50K employees and applicants in the UK working under Costa Coffee and Premier Inn. If the issue were to be adequately addressed, the fines, in theory, could be rather impressive.

Lessons to be Learned/To Still be Learned
The numerous compromises have various causes, based on loose network controls, lack of proper cybersecurity controls, and other various issues. In this case, the issue revolves around the third party vetting process. The situation indicates a thorough vetting did not occur for the third-party vendor. In the past for other organizations, this has created a rather significant issue and led to massive national breaches repeatedly.

Although we have not learned from history, there are still actions to follow in an effort to resolve the issue. At times the third-party vendor may balk at the scrutiny of a review. The organization may always remind the third party there are many other vendors present who would be willing to do the work. This may also be an introspection for the business to review their own cybersecurity processes and stance. Looking forward, the organization could include a clause in the contract mandating an annual vetting process.


Resources
Jowitt, T. (2018, July 3). Costa coffee owner whitbread suffers data breach. Retrieved from https://www.silicon.co.uk/security/cyberwar/whitbread-data-breach-234585

Muncaster, P. (2018, July 3). Whitbread sounds breach alarm after page up incident. Retrieved from https://www.infosecurity-magazine.com/news/whitbread-breach-pageup-incident/

Targett, E. (2018, July 2). Costa coffee applicant details hacked-owner whitbread-”very sorry”. Retrieved from https://www.cbronline.com/news/whitbread-job-applicant-data-stolen

Another tool to assist with the insider threat

Given the nature of the issue, the admins and InfoSec staff have implemented various tools and processes to monitor potential insider issues. The organization may use logs or other analytic tools to detect any of these and the myriad of other issues.

Recently, UNSW Sydney, Macquarie University, and Purdue University have created a new process to assist with securing the enterprise. The researchers have named this Gargoyle. This tool, as with a portion of the others, is network-based. The tool works with four primary actions, to evaluate the user’s access requests, uses the software-defined network (SDN) capabilities, maximizes network controller uses, and instead of a binary approach for authorizations, the new process reviews the context.

The new process has been tested and shown to be viable and a better measure than other role-based access control (RBAC), function-based access control (FBAC), and usage control (UCON) methods. The tests were completed on a limited scale. For the follow-up to measure the scalability, the testing will continue, however with larger networks.

Resources
Shaghagni, A., Kanhere, S.S., Kaafar, M.A., Bertino, E., & Jha, S. (2018). Gargoyle: A network-based insider attack resilient framework for organizations. Retrieved from https://arxiv.org/pdf/1807.02593.pdf

Zorz, Z. (2018, July 13). Gargoyle: Innovative solution for preventing insider attacks. Retrieved from https://www.helpnetsecurity.com/2018/07/13/gargoyle-preventing-insider-attacks

Temper Technology with Cybersecurity

Technology is advancing at such a fantastic rate. The pace at time is difficult to manage. These advances have the distinct possibility of vastly improving society. This has been prevalent in the medical field. These have led to improvements in diagnosing illnesses, treatments, machinery, and other attributes.

An issue with this involves the pace itself. As a society, we are prone to run before we can walk. This may be fine in certain instances but not all, including technology. As technology has been advancing at this great pace, the pace has not allowed cybersecurity to adequately develop and be applied at the same pace.

We then have the most cutting-edge technology applied to its subject matter, yet this may not be secure. For instance, over the years there have been numerous advancements with diabetic devices and pacemakers. These have certainly assisted with improving our life, however, there have been multiple issues with these over the years.

In order to ensure the vulnerabilities are free from the equipment, and unauthorized parties are not able to access them, cybersecurity needs to be a requirement as these move through the development gates. 

Keep the InfoSec Team in the Loop

With any project involving IT assets, there is a process to have the plan/process approved. This procedure is in place to keep the appropriate parties knowledgeable of on-going projects, vetting the projects for applicablility, alternatives that may be better suited, and to ensure InfoSec is applied early on. Without the review and approval process in place and utilized, there can be relatively serious issues. This is especially the case where the jurisdiction has privacy and breach laws, such as in New York, California, and the EU.

Greenwich University experienced this issue recently. One of the University's departments decided to create a website, without the University's knowledge, review, oversight, guidance, and approval. Although this in itself is an issue, the issue became much worse. The department decided it was fine to post, without applying InfoSec, the affected party's name, addresses, date of birth, phone number, signature, and in a portion of the instances, the person's physical and mental health issues.

The intent was to use the data for a training conference. This affected 19,500 students. This website should not have been created and personal data put on this without having the request and implementation reviewed through the process. Unfortunately, as a direct result of this, there was a security breach, and data was compromised. The University, located in the UK, was fined 120K British Sterling or $160K USD (http://www.ehackingnews.com/2018/05/greenwich-university-fined-120000-for.html)

Lessons Learned

When an organization collects data from third parties, the collector becomes the steward of the data and is responsible for its security. When approved processes aren't followed, generally significant issues follow. THe standard operating procedures have been put in place for a clear, rationale reason.

These should be followed and apply InfoSec as part of the SOP.

InfoSec Shortage Continues

There is a mass shortage of InfoSec personnel. The shortage has been well published through many different outlets, academic articles, magazines, and blogs alike. There was a study conducted by Intel Security with the Center for Strategic and International Studies (CSIS). There were 775 IT decision makers in eight countries in the public and private entities.82% of the respondents noted a shortage of cybersecurity skills. Symantec in a recent study estimated the number of open position to 500K to 1M, increasing to 1.5M by 2020 . The global shortage is expected to increase to 1.8M by 2022. InfoSec job postings have also increased by 74%.
Banks have also experienced difficulties in this area in finding cybersecurity personnel to hire. With the finance industry, there may be more of a focus on complying with lending and credit guidelines, in comparison to auditing the cybersecurity processes.
The demand for the people is outstripping the supply. One factor driving the need is the number of black hat attackers. This number while vague continues to grow. The attackers have operationalized the methods to the point where this is a business, following a business model. As the amount of data continues to grow, this gives the attacker yet more targets to focus their attention on. The network and connected devices in place presently produce 277x greater amount of data than people do. The data increasing, along with more devices and IoT, provides an abundance of crown jewels or places to attack. It is simply just difficult for the staff in place to complete the necessary work to ensure the network, data, enterprise, and embedded systems are safe. This is a bit of circular reasoning. There is a massive amount of data, devices, and networks to protect, which continue to increase. This gives the attackers more targets. The already stretch InfoSec teams are not able to adequately review the InfoSec, which gives the attackers more of an opportunity to successfully attack targets.
Diversity appears to be an issue in this industry (Perez, 2016). Diversity is important in that a diverse group brings new ideas, work ethics, processes, experiences, which all lead to better ideas and implementations to better secure the enterprise and specific embedded devices. In 2015, women held 25% of computing roles. In the InfoSec workforce, women only comprise 11%. This ratio is lacking and indicative of the issues that continue.
Methods to Remediate the Issue
The problem is well-known and increasing at an alarming rate, unfortunately for the industry. To again repeat the issue and its underlying driving points would be a disservice for the industry and non-productive. There are many actions to take in order to begin to alleviate the issue. These steps are not a panacea, however, the endeavor will take time and effort.
One action item to implement is to begin cybersecurity education and training earlier. This may begin even in junior high school, if not earlier for the students. The introduction and subsequent materials would need to be age and maturity specific, however the earlier the better. The students are exposed to electronics and learn from these devices in the elementary school systems. This exposure to InfoSec and computer systems may be enough at this age to spark the interest and a life-long career. This allows for a greater level of accessibility in the school systems.
The colleges, universities, and corporations should be present and active at recruiting events. Recruiting events are differentiated from career fairs in that the recruiting events are held in conjunction with other like events. For instance, the organization could use a cybersecurity event as a recruiting grounds with the organization's table. The table would be set up with SWAG to hand out. This gives the business representative the opportunity to meet people and nonchalantly speak with them regarding their background to understand if it may be a good fit and to gauge the person's interest. This allows the entity to look at the person's skills, and not just if they have a degree. These recruiting events, updated for the new workforce, certainly have the potential to assist with the shortages.
The entities experiencing the labor issues in this IT and InfoSec areas may also conduct specialized events to draw the attention and attendance. Overall, these entities may provide the facilities, and operate practice sessions and camps. These may encompass various topics. Banks have been a bit creative and have held coding events.
The workforce in the present cycle looks at different attributes for the workplace. This is a natural progression as the demographics have changed. To reach this stratum of potential, qualified employees, the entities should openly publicize these facets. The new workforce coming up into the ranks is seeking flexible hours. This, when implemented, allow the staff to accomplish other tasks and interact with others.
Within the subject field, which is presently understaffed, the level fo females in the field are drastically low. Although the ratio is terrible, with this subfield there are also targeted actions to take. To assist with this, more females should attend hack-a-thons. With these, the attendees would be able to mentor and teach each other along with being able to assess the knowledge base and skill level.
THere are InfoSec conventions throughout the year, through the US and remainder across the globe. Of these, there is a subset directly related to increasing the number of women in InfoSec. One of these in prior years was TiaraCon, which was focused on increasing the number of females in cybersecurity. Related to this are the camps. Females should attend these to learn from others, as they are mentored if needed. BYU has hosted these in the past.
Looking Forward
The lack of qualified personnel leading to the present and future increasing shortage of persons, there are a number of action items to work on to assist with the issue. The organizations have to be creative in their efforts. The upcoming workforce needs to be attracted to the position, not just a job.

RadRAT will give you an interesting day!

Remote access tools (RATs) are an interesting tool to maliciously have placed on a
system. When these initially were created years ago, the focus was to gain access
to the target’s computer and turn on the webcam and/or microphone to record the
unsuspecting user. The next iteration was coded so the “On” light was toggled off,
even though this was on. As time passed the technology improved, and this class of
malware likewise improved to increase its functionality, performance, and malicious antics.

Background

The new iteration is powerful malware. This has substantially increased the functions
involved. This, in its intended use, is an all-in-one-malware. This particular malware has
been in use since at least 2015.

Operations

This has been coded, simply, to take over the target’s computer. The end goal is to
exfiltrate data and/or monitor the network. The RadRAT connects to the attackers C&C servers,
which is a normal SOP. This allows for the complete control of the compromised system. This
also allows the malware to move laterally through the target’s network. To make things
interesting, this is coded with rootkit-like methods to evade detection. Two of the areas
this focuses in on are credential and NTLM hash harvesting. There are other areas where
this is working, including retrieving Windows passwords, however, these are the primary thrust.

The malware is exceptionally problematic in that it will, during the infection stage, checks
the flag values to expedite the attack and increase the areas it may traverse.

In Closing

Any malware on a system is not beneficial and provides for problematic issues. Of the
malware present in the wild, there are less intrusive samples to be infected with. This
malware had been coded to complete its due diligence with the network and files while
continuing with its mission.

Resources

Budaca, E. (2017). RadRAT: An all-in-one-toolkit for complex espionage ops.

E Hacking News. (2018, April 16). Romanian cybersecurity firm reveals all-in-one
espionage tool: RadRAT. Retrieved from
http://www.ehackingnews.com/2018/04/romanian-cybersecurity-firm-reveals-all.html