Cybersecurity Incident Forces Manual Operation at Kansas Water Treatment Facility

 

Cybersecurity Incident Forces Manual Operation at Kansas Water Treatment Facility

On the morning of September 22, a small water treatment facility in Arkansas City, Kansas, was hit by what officials have described as a “cybersecurity incident.” The town of around 12,000 people, located two hours north of Oklahoma City at the convergence of the Walnut and Arkansas Rivers, relies on the Arkansas River for its drinking water. The Environmental Services Administration, responsible for the city’s water systems, released a statement shortly after the incident confirming the breach and outlining the steps being taken to protect the town’s water supply.

In response to the breach, the treatment plant transitioned to manual operations as a precautionary measure. According to city manager Randy Frazer, the decision to go manual was made “out of an abundance of caution,” and officials have been closely monitoring the situation ever since. “Despite the incident, the water supply remains completely safe, and there has been no disruption to service,” Frazer reassured residents in a written notice. “Residents can rest assured that their drinking water is safe, and the City is operating under full control during this period.”

Although no further technical details have been disclosed about the nature of the cyberattack, the administration noted that cybersecurity experts and government authorities have been called in to assist with the investigation and resolution of the incident. Enhanced security measures have already been implemented to protect the facility from any further attacks, and no changes to the water’s quality or availability are expected for residents.

The Transition to Manual Operations: A Serious Step

The decision to shift the plant to manual mode is notable, as it indicates the severity of the situation. Manual operation of industrial control systems (ICS) is often considered a last-resort measure, typically reserved for moments when there is a high risk of further compromise or damage to automated systems. According to Shawn Waldman, CEO and founder of Secure Cyber, the move to manual mode in this case might point to significant concerns on the part of the facility’s operators.

“In an incident we investigated last November, we never had to go to manual operations,” Waldman recalled. “We were able to isolate the human-machine interfaces (HMIs) and keep the Russian malware contained, allowing the plant to continue operating as normal. There’s a lot of strain on employees when you put a plant in manual mode. That’s the last case scenario—you don’t want to go into manual mode unless you have to.”

Waldman’s insight highlights the operational burden that manual mode can impose on workers. Water treatment plants, like many industrial facilities, rely on automated systems to monitor and manage various processes, such as chemical balancing, filtration, and pressure control. When these systems are forced offline, plant operators must take over manually, introducing the risk of human error and requiring round-the-clock attention to maintain stability. This approach is unsustainable for long periods and can lead to increased stress among the staff.

The Growing Threat of Cyberattacks on Critical Infrastructure

This incident is the latest in a string of cybersecurity breaches targeting critical infrastructure across the United States. From energy grids to healthcare systems, the threat of cyberattacks on essential services has been growing steadily over the past decade. In the case of water treatment plants, these threats are particularly alarming given the vital role clean water plays in public health and safety.

The U.S. Department of Homeland Security has long warned of the vulnerabilities present in the nation’s critical infrastructure, and water treatment facilities are often regarded as particularly susceptible to cyberattacks. A report by the U.S. Government Accountability Office (GAO) published in 2021 found that many water utilities lacked the resources and expertise necessary to defend against cyber threats, and were using outdated systems that could easily be compromised.

Industrial control systems (ICS), like those used in water treatment facilities, are a prime target for cybercriminals. These systems have historically struggled to balance the demands of modern cybersecurity with the functionality of older, legacy equipment. In many cases, facilities are still operating on outdated hardware and software that may not have been designed with cybersecurity in mind. As more facilities move towards greater connectivity and automation, the attack surfaces available to hackers grow wider.

Arkansas City’s New Facility: Balancing Innovation with Security

Arkansas City’s water treatment facility is relatively new, having opened in February 2018 at a cost of $22 million. Designed to process up to 5.4 million gallons of water per day, the facility was constructed with the goal of increasing efficiency and cutting down on operational and maintenance costs. The plant’s advanced technology is estimated to save the city as much as 20% annually.

However, while the new facility boasts state-of-the-art systems, questions remain about its cybersecurity posture. Cybersecurity experts warn that the integration of modern technology into industrial processes must be accompanied by robust cybersecurity measures. Without the proper defenses in place, even the most advanced facilities can become vulnerable to attack.

“Just because a city comes out and says, ‘We just upgraded everything, and it’s all new, and we should be good’—well, that’s great, but what about cybersecurity?” Waldman asked. “Some cities are not making a proper investment into securing their critical infrastructure. My city did that exact thing: I know for a fact that they did not upgrade cybersecurity, but they spent around $14 million or more to upgrade all the infrastructure.”

Cybersecurity: An Afterthought in Municipal Budgets

The issue of underinvestment in cybersecurity is not unique to Arkansas City. Across the country, municipal budgets often allocate significant funds for infrastructure improvements without providing an adequate amount for cybersecurity. This can leave newly upgraded facilities vulnerable to attack, as was seen in this case.

The reason for this is multifaceted. Many municipal governments are working with limited budgets and may not fully understand the importance of cybersecurity. Others may assume that the new systems they are purchasing come with built-in security, without realizing that specialized cybersecurity measures are needed for critical infrastructure.

Waldman believes that stronger regulatory standards are needed to address these gaps. He has called on Congress and the Environmental Protection Agency (EPA) to pass new cybersecurity requirements for water treatment facilities and other critical infrastructure. “The EPA and Congress need to step up and get that new EPA standard for cybersecurity passed,” he said. “They tried to do it before, and then they got sued. And what did we give up? Weeks after that, Iran launched a bunch of attacks on water systems in the United States. Because, big surprise, Iran reads the U.S. news.”

In recent years, there have been several high-profile cyberattacks on water systems in the U.S., including an attempted poisoning in Oldsmar, Florida, in 2021. In that case, hackers breached the city’s water treatment plant and tried to increase the levels of sodium hydroxide, a dangerous chemical, in the water supply. Fortunately, the attack was thwarted before any harm was done, but it underscored the real-world dangers of these kinds of cyberattacks.

The Path Forward: Strengthening Cybersecurity in Critical Infrastructure

Incidents like the one in Arkansas City highlight the urgent need for more robust cybersecurity in critical infrastructure. The consequences of a successful attack on a water treatment facility could be catastrophic, potentially leading to widespread illness or even loss of life.

To address this growing threat, experts recommend a multi-layered approach to cybersecurity. This includes not only investing in the latest technology, but also conducting regular security assessments, implementing real-time monitoring, and training staff to recognize and respond to potential threats.

Additionally, collaboration between the public and private sectors is essential to improving the security of critical infrastructure. Many cities and towns lack the resources to develop and implement comprehensive cybersecurity strategies on their own. By working with cybersecurity firms, municipalities can gain access to the expertise and tools needed to protect their facilities.

Manual Mode: A Temporary Fix

As of now, Arkansas City’s water treatment plant remains in manual mode while experts work to resolve the issue and restore normal operations. The transition to manual mode may have prevented further damage, but it is not a long-term solution. Manual operation places significant strain on workers and increases the risk of human error. As such, returning to fully automated systems will be a top priority once the facility is deemed secure.

The incident serves as a stark reminder that no system is immune to cyberattacks, and even small cities and towns must take cybersecurity seriously. While Arkansas City was fortunate that no harm came to its water supply, the next town might not be so lucky.

The Role of Federal Oversight

Federal oversight and regulation could play a crucial role in strengthening cybersecurity at water treatment facilities. In addition to passing new cybersecurity standards, the federal government could provide funding and resources to help municipalities implement these standards. This could include grants for cybersecurity upgrades, as well as technical assistance in developing and maintaining security protocols.

Currently, the EPA has limited authority to regulate cybersecurity in water systems, but experts believe that expanding this authority could help prevent future attacks. By working together, municipalities, federal agencies, and cybersecurity firms can ensure that critical infrastructure remains safe and secure.

As Arkansas City’s water treatment facility works to return to normal operations, the incident will likely serve as a case study for other municipalities across the country. The lessons learned from this breach could help inform future cybersecurity efforts and prevent similar incidents from occurring elsewhere.

For now, residents of Arkansas City can take comfort in knowing that their water supply remains safe, and city officials are doing everything in their power to protect it. But the incident has revealed a vulnerability that will need to be addressed not only in Arkansas City, but in communities across the United States. As cyber threats continue to evolve, so too must the defenses protecting our most critical resources.

Understanding Artificial Intelligence

By Wayne Nordstrom August 13, 2024

CEH, CPENT, PENTEST+, A+, NETWORK+, SECURITY+, LINUX+, MCP

Wayne Nordstrom has extensively researched Artificial Intelligence (AI) and found that it has become a ubiquitous term, influencing discussions across various fields, from technology and business to ethics and society. While AI's potential benefits are profound, the risks and dangers associated with its development and deployment are also significant. This comprehensive analysis explores what AI is, its various types and applications, and why it is considered dangerous, highlighting key concerns and considerations.

1. What is Artificial Intelligence?

Artificial Intelligence (AI) is a branch of computer science focused on creating systems capable of performing tasks that typically require human intelligence. These tasks include learning from experience, understanding natural language, recognizing patterns, solving complex problems, and making decisions. AI encompasses a broad range of technologies, including machine learning and natural language processing.

1.1 Types of AI

AI can be categorized based on its capabilities and functionalities:

1.1.1 Narrow AI (Weak AI):
Narrow AI refers to systems designed to handle specific tasks. Examples include virtual assistants like Siri and Alexa, recommendation algorithms on streaming platforms, and spam filters in email systems. While these systems excel in their designated functions, they lack general intelligence and cannot perform tasks outside their programmed scope.

1.1.2 General AI (Strong AI):
General AI, also known as Artificial General Intelligence (AGI), refers to systems with the ability to understand, learn, and apply intelligence across a wide range of tasks, much like a human. AGI remains largely theoretical and is the subject of ongoing research and debate.

1.1.3 Artificial Superintelligence:
Artificial Superintelligence (ASI) is a hypothetical form of AI that surpasses human intelligence in all domains. It represents a point where AI could potentially outperform the best human minds in every field, from scientific creativity to social skills. ASI is a topic of significant concern due to its potential to dramatically alter or even endanger human civilization.

1.2 How AI Works

AI systems generally operate through the following processes:

1.2.1 Data Collection:
AI systems require vast amounts of data to learn and make informed decisions. Data is collected from various sources, including sensors, databases, and user interactions.

1.2.2 Data Processing:
Once collected, data is processed using algorithms to extract meaningful patterns and insights. This processing may involve statistical analysis, machine learning models, and neural networks.

1.2.3 Learning and Adaptation:
Machine learning, a subset of AI, involves training algorithms to improve their performance over time based on new data. The system adjusts its parameters to enhance accuracy and efficiency.

1.2.4 Decision Making:
After processing and learning, AI systems make decisions or predictions based on the patterns identified. This can involve recommending products, diagnosing medical conditions, or even driving autonomous vehicles.

2. Why AI is Considered Dangerous

Despite its vast potential, AI poses several risks and dangers. These concerns are amplified as AI technology becomes more advanced and integrated into various aspects of life. Here, we explore the key dangers associated with AI.

2.1 Ethical and Moral Concerns

2.1.1 Bias and Discrimination:
AI systems often learn from historical data, which can include societal biases. This can result in discriminatory outcomes, such as biased hiring practices or unequal treatment in criminal justice systems. For example, facial recognition technologies have been shown to exhibit racial and gender biases, potentially leading to unjust practices.

2.1.2 Privacy Invasion:
AI systems can process vast amounts of personal data, raising concerns about privacy and surveillance. The ability to analyze and interpret personal information can lead to unauthorized access and misuse, potentially infringing on individual rights and freedoms.

2.1.3 Autonomy and Decision-Making:
As AI systems become more autonomous, ethical questions arise regarding accountability and decision-making. For instance, if an autonomous vehicle causes an accident, determining responsibility can be complex. The delegation of decision-making to AI raises questions about human oversight and control.

2.2 Economic Impact

2.2.1 Job Displacement:
AI and automation have the potential to displace a significant number of jobs, particularly in sectors involving routine and repetitive tasks. This can lead to economic instability and increased inequality if affected workers are not adequately supported or retrained.

2.2.2 Economic Inequality:
The benefits of AI are often concentrated among technology companies and wealthy individuals who have the resources to develop and deploy AI technologies. This can exacerbate existing economic disparities, as those without access to AI technologies may fall further behind.

2.3 Security Risks

2.3.1 Cybersecurity Threats:
AI can be used maliciously to enhance cybersecurity threats. For example, AI-driven phishing attacks can create highly convincing fraudulent communications, making it more difficult for individuals to distinguish between legitimate and malicious messages. AI can also be used to automate and scale attacks, increasing their impact.

2.3.2 Autonomous Weapons:
The development of autonomous weapons systems, such as drones and robotic soldiers, raises significant concerns. These systems could potentially be used in warfare or terrorist attacks, leading to unintended casualties and escalation of conflicts. The ethical implications of autonomous weapons are profound, as they remove human judgment from critical decisions in life-or-death situations.

2.4 Existential Risks

2.4.1 Superintelligence:
The prospect of Artificial Superintelligence (ASI) presents existential risks. If AI surpasses human intelligence, it could act in unpredictable and uncontrollable ways. Aligning ASI's goals with human values is a significant concern, as misalignment could have catastrophic consequences.

2.4.2 Control and Safety:
Ensuring the safety and control of advanced AI systems is crucial. Uncontrolled AI systems with advanced capabilities could potentially act in ways that are harmful to humanity. Ensuring that AI behaves in accordance with human values and ethics is a fundamental challenge for researchers and policymakers.

3. Addressing the Dangers of AI

To mitigate the risks associated with AI, a multifaceted approach is required, involving technological, ethical, and regulatory measures.

3.1 Ethical and Regulatory Frameworks

3.1.1 Developing Ethical Guidelines:
Creating ethical guidelines and standards for AI development and deployment is essential. These guidelines should address issues such as bias, privacy, accountability, and transparency. Collaboration among stakeholders, including researchers, policymakers, and industry leaders, is crucial for establishing and enforcing these standards.

3.1.2 Regulatory Oversight:
Governments and regulatory bodies must develop and implement regulations to oversee AI technologies. This includes creating frameworks for data protection, ensuring transparency in AI decision-making processes, and setting standards for the safe development and use of AI systems.

3.2 Research and Development

3.2.1 Safe AI Research:
Promoting research focused on ensuring the safety and robustness of AI systems is essential. This includes developing methods to prevent unintended behavior, ensuring that AI systems are aligned with human values, and creating mechanisms for effective control and oversight.

3.2.2 Collaboration and Knowledge Sharing:
Encouraging collaboration and knowledge sharing among researchers, developers, and policymakers can help address the challenges associated with AI. Sharing best practices, research findings, and lessons learned can contribute to the development of safer and more ethical AI technologies.

3.3 Public Awareness and Education

3.3.1 Raising Awareness:
Increasing public awareness about AI and its potential risks is important for informed decision-making and responsible use. Education campaigns and public discussions can help individuals understand the implications of AI and advocate for responsible practices.

3.3.2 Training and Retraining:
Providing training and retraining opportunities for workers affected by AI-driven job displacement is crucial. Supporting workforce transitions and helping individuals acquire new skills can mitigate the economic impact of AI and promote a more equitable distribution of benefits.

Conclusion

Wayne Nordstrom has concluded that Artificial Intelligence represents a transformative technology with the potential to significantly impact various aspects of society. While its benefits are substantial, including improved efficiency, enhanced decision-making, and innovative solutions to complex problems, its potential dangers are equally significant. Addressing these dangers requires a comprehensive approach involving ethical considerations, regulatory oversight, and collaborative efforts among stakeholders. By understanding and proactively managing the risks associated with AI, society can harness its potential while mitigating its threats, ensuring that the technology contributes positively to human well-being and progress.

The Basics of Digital Forensics

 The advent of the digital age in the 1980s revolutionized how people and industries used and accessed data. The digital automation of previously traditional systems, such as paperwork and analogue autonomous systems being replaced by smart devices and the Internet, however, exposed users to data breaches, identity theft, and data loss. The digital revolution required solutions to counter and address the risks. This led to the birth of digital forensics.

The objective of digital forensics is to address digital risks, which are classified into four categories. A cybersecurity risk refers to unauthorized persons gaining access to sensitive information with malicious intent such as fraud or extortion. The second, compliance risk, refers to organizations being targeted through technology to expose shortcomings like standard security controls and data privacy requirements. Closely related to compliance risk, third-party risk is associated with outsourcing tasks to third-party vendors and disclosing customer information, intellectual property, or financial information. The absence of or weak security controls in a third-party company’s system may affect the outsourcing organization. Last, identity risk covers the risk to credentials and accounts, especially prominent people, corporate user accounts, or affiliates. Mitigating or addressing the risk requires a robust digital forensic system and team.

As a branch of cybersecurity, digital forensics focuses on identifying, preserving, analyzing, recovering, investigating, and presenting digital material found in devices, cyber activity, and electronic evidence. Initially referred to as computer forensics, the term’s meaning broadened to encompass all digital devices, especially with the increase in the smartphone and Internet use.

Identification entails observation of the material evidence present, the storage area, and the storage format. Second, preservation involves isolating and securing the data to prevent tampering or theft. After this, the investigators reconstruct the collected data to seek patterns and draw conclusions. Easily the most intensive part of the process, some investigations require extensive research to generate a feasible theory. The last stages involve the documentation and presentation of the evidence to the relevant party.

The functionality of the highlighted digital forensics process requires equally robust tools. Before the availability of the tools, investigators used the system’s default admin to troubleshoot and attempt to track the breaches alongside live analysis. During the process, regardless of the team’s adeptness, common secondary risks merged, including evidence tampering and modified disk data. Such consequences, especially for sensitive information, saw the introduction of best practices and national legislation.

The Federal Law Enforcement Training Center created SafeBack and IMDUMP in 1989. These two programs provided backup options for federal data before, during, and after the forensics exercise. Next, a program named DIBS, available to the public, created copies of the digital media for testing, investigation, and verification purposes. In the following years, the increased data breach occurrences accelerated the availability of paid and opensource digital forensic tools like FTK, EnCase, WindowsSCOPE, Wireshark, and HashKeeper. To determine the most feasible tool, one should consider integration with system-embedded forensic capabilities, support for different file formats, ease of use, features, and possible configurations.

The evidence from digital forensics is applicable in various areas, especially in system testing, investigations, and legal proceedings. In cases of data theft and network breaches, the evidence aids in understanding how the breach occurred and the attackers went about it. This is common in industries with personal data-intense systems such as financial institutions and phone companies. The evidence also forms the primary mode to gauge the impact of online fraud and identity theft on an organization and the customers, and thus dictates the subsequent decisions and actions.

Also, digital forensics assists with serious crimes by examining data in smartphones and vehicles associated with the crime. In addition, one can use the evidence to prosecute white-collar crimes like embezzlement, extortion, and corporate fraud. Evidence traditionally lost through burning or shredding paperwork can now be retrieved through digital footprints stored on various databases.

A Brief Look at Risk-Based Vulnerability Management

 A cybersecurity and IT industry professional, Wayne Nordstrom has held professional roles in cybersecurity over the last decade. As an IT security and vulnerability program manager with Blue Cross Blue Shield, Wayne Nordstrom develops the vision and plans to improve the vulnerability management program consistently.

One efficient way to remedy system and network vulnerabilities in companies is through risk-based vulnerability management. In risk-based vulnerability management, security weaknesses are addressed according to priority. For instance, a security weakness that poses the highest level of danger if exploited can be prioritized and addressed before the next high-priority weakness is identified. Priority can also be based on the probability of an attack.

Some benefits of risk-based vulnerability management are fast-tracked remediation of immediate and critical risks, broader visibility of the health of digital assets, and real-time protection against threats. Large companies with multiple systems and networks can manage vulnerabilities efficiently through this approach.

An Overview of the Medical Device Discovery Appraisal Program

 Wayne Nordstrom is an IT security expert with a broad range of experience in information security technologies, methodologies, and tools. His expertise includes threat/vulnerability management, remediation planning, and infrastructure penetration testing. In addition to working in various IT security roles, Wayne Nordstrom is a member of ISACA (formerly the Information Systems Audit and Control Association; the organization now goes by its acronym).

ISACA ensures that technology professionals receive the skills, education, and community support they need to advance their careers and organizations. ISACA, the FDA (Food and Drug Administration), and the MDIC (Medical Device Innovation Consortium) unveiled the Medical Device Discovery Appraisal Program (MDDAP) to improve patient safety and device quality. The program helps manufacturers of medical devices understand, measure, and boost their operations to reach best practices.

The MDDAP framework is a customized Capacity Maturity Model Integration (CMMI) - a model for guiding process improvement - tailored for the medical device industry. Because of MDDAP, medical device manufacturers are evaluated on the CMMI appraisal framework to help them identify opportunities for process improvement.

Brief History of The Boston Red Sox

 Based in Boston, Massachusetts, Wayne Nordstrom is a licensed cyber security analyst who works at Blue cross Blue shield as the IT security and Vulnerability program manager. Outside of work, Wayne Nordstrom enjoys playing basketball.

The Boston Red Sox is one of the first teams in major league baseball. Upon their founding in1901, they were initially named the Boston Americans, and in 1907 they adopted their current name. In their founding years, the team played at the Huntington Avenue grounds until 1912, when they moved to Fenway Park.

Cy Young brought his team a lot of success as the premier pitcher. In 1903, the team won their first world series, thus setting them on the path of success. After selling a key player, Babe Ruth, in 1920 to the New York Yankees, the team experienced a series of setbacks. Also, a rivalry was set against the Yankees, who seemed to flourish after the player's purchase.

After many years of apparent drought, the Boston red sox had a breakthrough in 2004 when they won the World Series and defeated their decades-long rivals, the Yankees, in the American Championship Series. Although the team in consequent years suffered a good number of setbacks, like losing 95 games in 2012, it has also recorded a good number of successes.

The team continues to dominate the world of baseball through the years, forging on through the continuous support of fans across the globe, although most are Bostonians.

Ohio Takes Volunteer Approach to Election Hacking Threats

Serving as senior vulnerability risk manager with Blue Cross Blue Shield IT, Wayne Nordstrom handles a wide range of vulnerability issues. Having attended Champlain College, Wayne Nordstrom took advantage of a program that has been designated a Defense Cyber Crime Center (DC3) Air Force Office of Special Investigations’ National Center of Digital Forensics Academic Excellence.

One state that has taken a lead in the fight against cyberattacks is Ohio, which has created a volunteer team of private-sector professionals dedicated to preventing cyberattacks on voting systems. Including employees of companies such as Cisco Systems, the Ohio Cyber Reserve has 80 members and is ready for call up by the National Guard. As crime-fighting reservists, volunteers provide services one Tuesday per week, and on the weekend as necessary.

The state has the funds to increase to the Ohio Cyber Reserve to 200 members, and its creation is a proactive move to ensure that hacking attempts do not ruin the integrity of public elections. At stake is nothing less than American democracy, and a number of state and local governments currently lack the funding to prevent today’s sophisticated hacks. Several states are working to copy this volunteer-driven model and marshal forces against election interference and ransomware hacks.

A Brief Look at Penetration Testing and Web Application Security

 An experienced cybersecurity specialist, Wayne Nordstrom serves as an IT security and vulnerability program manager at Blue Cross Blue Shield in Boston, where he oversees the development of plans for the program's continuous improvement. Wayne Nordstrom possesses expertise in penetration testing.

Also called “pen test,” penetration testing evaluates software for vulnerabilities and hidden loopholes that can be exploited by a malicious party to degrade the efficiency of software, disable it, or gain unauthorized access to information and control. Penetration testing is performed to help strengthen a web application firewall (WAF), which acts like a security official for a website and prevents malicious data or commands from entering front-end or back-end servers.

A pen test simulates the types of attacks that malicious hackers would most likely use. If the simulated attack successfully bypasses the WAF, the firewall can then be improved to remove the vulnerability. For example, a pen test may subject the firewall to a code injection attack, which is a malicious program that changes the behavior or features of a website. If such an attack were able to bypass the firewall, the website would change or malfunction, depending on the injected code. The IT security team prepares the firewall to repel such attacks in the future.

Three Baseball Teams With the Most World Series Title

 Wayne Nordstrom is a cybersecurity expert based in Massachusetts. He works as an IT Security & Vulnerability Program Manager in Blue Cross Blue Shield, where he manages the entire lifecycle of vulnerabilities from discovery, triage, advising, and remediation. In his spare time, Wayne Nordstrom enjoys baseball.

Baseball is one of the most popular sports in the United States. Since its popularization in the 19th century, it has evolved from just a sport played in local towns to a national sport with two major leagues: the National League and the American League.

Major League Baseball is the umbrella body covering the two main leagues where the biggest teams play. Each of these teams competes every year for a chance to win the biggest trophy in Major League Baseball: the World Series Championship. Most of the biggest baseball teams today are recognized by the number of times they have won the Championship trophy.

An example of one of these leading teams is the New York Yankees, which have won the title 27 times since its creation in 1901. Another leading team is the St. Louis Cardinals, which have won the world series 11 times since its inception in 1882. The Boston Red Sox is a different prominent team with many world series titles (9).

A Brief Look at Information Security.

 Based in Greater Boston, Wayne Nordstrom worked as a lead network engineer at Suffolk University, where he was in charge of the campus' wide network infrastructure. In addition, Wayne Nordstrom earned his BS in cybersecurity and digital forensics at Champlain College, which the nation recognizes as a leading force in those fields of study.

As a discipline, cybersecurity deals with the procedures involved in safeguarding systems, networks, and sensitive information from digital attacks. And some of these attacks include phishing, malware, spyware, zero-day exploits, and man-in-the-middle. In addition, cybersecurity has vital components, including network security, operational security, disaster recovery planning, and information security.

Also known as infosec, information security refers to the techniques employed in shielding information from unauthorized access, use, modification, or destruction. The subject matter of this discipline (information) covers a person's intellectual property, personal details, login details, and social media profile, among other aspects. Information security consists of three fundamental principles; confidentiality, integrity, and availability (CIA triad).

Confidentiality means protecting sensitive information, which the owner restricts to a few people. This includes professional information, bank account details, social media profile, family information, and email details, to mention a few. On the other hand, integrity means keeping the accuracy and entirety of any information intact.

Finally, availability helps the owners of specific pieces of information in accessing them whenever they desire. However, attackers can attempt to carry out a denial of service (DoS) attack to take down a web server if they fail to jeopardize the confidentiality and integrity principles. As a result of the attack, an authorized website owner can lose access to their site due to unavailability.

About the National Centers of Academic Excellence in Cybersecurity

 The IT Security and Vulnerability program manager at Blue Cross Blue Shield in Boston, Massachusetts, Wayne Nordstrom, earned his BS in cybersecurity and digital forensics from Champlain College in Burlington, Vermont. Wayne Nordstrom’s alma mater is a designated National Center of Academic Excellence in Cyber Defense Education (NCAE-CD), a component of the National Centers of Academic Excellence in Cybersecurity (NCAE-C) program.

The Department of Homeland Security and the National Security Agency (NSA) sponsors the NCAE-C program. The NSA’s National Cryptologic School manages the program with federal partners, including the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the National Science Foundation, and US Cyber Command.

The program aims to shepherd a participatory cybersecurity educational program with institutions of higher learning that sets yardsticks for academic excellence and cybersecurity curriculum, incorporates student and faculty competency development, and ardently participates in addressing issues confronting cybersecurity education. The promotion of expertise and higher education in cybersecurity intends to lessen vulnerability in the country’s national information infrastructure.

Phishing Attacks and Defenses

A Cape Cod Community College graduate, Wayne Nordstrom is pursuing a bachelor’s degree in cyber security from the University of Maryland. A former security engineer at CVS Health, Wayne Nordstrom is a senior vulnerability risk manager at Blue Cross Blue Shield. He specializes in phishing attacks defense.

Phishing attacks aim to steal important data from a person, such as credit card numbers or login credentials from important websites. In a phishing attack, the hacker tries to disguise themselves into a trustworthy source of entity such as a university, for example, or a bank, and make a person send their credentials. Typical phishing attacks can be sent through e-mail or messages. A person is then tricked into entering a fake link that creates problems in the computer and delivers data to the hacker.

There are ways for companies to defend against phishing attacks and prevent damage caused by them. One of them is two-factor authentication. It adds an extra layer that checks whether or not a website is safe for a person to log in to it.

from WordPress https://ift.tt/30eyBUf
via IFTTT

Three Trends in Cybersecurity to Watch

At Blue Cross Blue Shield, Wayne Nordstrom performs infrastructure and applications vulnerability scanning. He was previously the senior desktop engineer at Suffolk University in Boston. Wayne Nordstrom has an AS in cybersecurity from Cape Cod Community College and is currently studying for a BS in networks and cybersecurity at the University of Maryland.

As technology continues to evolve, so does the global cyberthreat landscape that businesses must navigate. Here are three areas worth watching in the years ahead.

Attacks on cloud services
Embracing cloud-based computing technology has many benefits, such as increased efficiency and reduced operational costs. If not adequately maintained or configured, cyber attackers can exploit the vulnerabilities and disrupt business.

Artificial (AI) intelligence integration
As the frequency and intensity of cyberattacks grow, AI can help under-resourced or overstretched security teams cope. By helping to analyze massive quantities of data, AI supplies teams with threat intelligence and boosts response times.

More automotive hacking
Modern vehicles are loaded with automated software that aids in engine timing, cruise control, airbags, door lock, and communication technologies. Self-driving autos use even more complex systems. All these are opening the door for more automotive hacking.

from WordPress https://ift.tt/3G8nk81
via IFTTT

How to Spot a Deepfake

A senior vulnerability risk manager at Blue Cross Blue Shield, Wayne Nordstrom researches cybersecurity trends and emerging technology. Among others, Wayne Nordstrom focuses on coming up with solutions to fight cyber fraud.

One of the latest methods by which scammers and hackers commit cyber fraud is using the technology deepfaking, which can digitally manipulate a person’s appearance and identity. The most famous deepfakes belong to popular personalities, morphing their faces to someone else’s as they make an impression. A more sinister use of the technology has also emerged, with scammers using the algorithmic technology to produce more subtle deepfakes to manipulate victims.

These deepfake scams can take a variety of forms, from blackmail to extortion schemes. However, researchers have found a few ways to spot a deepfake, even with the naked eye. The tell-tale sign, studies show, is the pupils of a deepfaked image. While other features can be approximated by the algorithm, even high-quality deepfakes have trouble maintaining a clear, round shape for a person’s pupils, leading to said pupils having a distorted or ragged edge.

There are some issues with this detection method, not least that some real people have irregular pupils due to genetic factors but also that all the research on the signs of deepfakes is in the public domain. Like the readily available deepfake technology, the manual on how to spot them is in the hands of those who would use it to manipulate others. This has led some researchers to worry that deepfake algorithms could be improved by referencing research on their weaknesses, thus requiring new detection techniques to be discovered.

from WordPress https://ift.tt/3mzezLs
via IFTTT

How Scammers Are Using Deepfakes to Manipulate Victims

Wayne Nordstrom is a networks and cybersecurity graduate candidate senior vulnerability risk manager. Among other digital tools that hackers and scammers use, Wayne Nordstrom has researched the impact of emerging technologies, such as deepfakes, on scammer tactics.

Deepfakes are a digital imaging technique that allows anyone, not just computer experts, to use an algorithmic program to superimpose one person’s face onto another person’s body. This can be done in post-editing, such as when producing a video, but it can also be done in real-time for situations like video conferences.

Although the concern that deepfakes were going to be used during the 2019 presidential election to manufacture fake, disparaging videos of presidential candidates never materialized, deepfake technology has already made it possible for criminals to create fraudulent blackmailing material.

One story from The Indian Express tells of a man who spoke with a scammer on a video call, only to collect visual data from the live feed to create a deepfaked video. This video appeared to show the man on a live “sex chat” and was henceforth used to blackmail him and sent to his family and friends when he refused to pay. Cybersecurity experts warn that such stories could become more common as the technology becomes more widespread and easier to use.

from WordPress https://ift.tt/3CzkTce
via IFTTT

Cyberattacks and Cyberthreats Increase during Pandemic

A graduate of Cape Cod Community College, Wayne Nordstrom holds an associate of science in cybersecurity and penetration testing. Wayne Nordstrom works as a senior vulnerability risk manager at Blue Cross Blue Shield, where he helps the insurance provider defend against cyberattacks.

The coronavirus has made many people move from a typical workplace to an online setting, which opened the door to increased cyberattacks. According to the FBI, since the start of the pandemic, the number of cyberattacks has tripled, and Google reported that it has faced over 18 million phishing attempts in that time.

Most of the cyberattacks in 2020 were motivated by financial gain, with nearly 86 percent of the attackers requesting a ransom. The average cost of a ransomware attack in 2018 was only $5,000; in 2020, this number reached $200,000. This has made companies want to hire or contract with cybersecurity professionals to defend against any potential threats, with more than 500,000 open positions in the United States and over 3 million throughout the world.

from WordPress https://ift.tt/3tBcktV
via IFTTT

Most Common Cyberattacks, Phishing, and Malware

A cybersecurity specialist, Wayne Nordstrom is currently working toward a bachelor of science in networks and cybersecurity. He also holds an associate of science in cybersecurity and penetration testing. Wayne Nordstrom serves as a senior vulnerability risk manager of Blue Cross Blue Shield, where he performs vulnerability scanning and penetration testing to detect and protect the company from cyberattacks.

Phishing cyberattacks are some of the most common threats in the cyber world. In a phishing attack, the hackers try to trick a person or company into sending them important information such as passwords or documents that can be used by the hacker to extort the person or company for financial gain. Phishing attacks are typically e-mails or messages that look like they are coming from a safe and trustworthy source, such as a friend or institution. Another commonly encountered cyberattack is malware.

Malware can be used by hackers to spy on people and obtain valuable information, or can be used to gain access to a computer or network. One of the most common forms of malware attack is ransomware. After entering the system, a ransomware attack can encrypt a person’s files so that the person can no longer use them. Ransomware attacks typically demand a ransom in return for the decryption key that can enable the person to regain access to their information and documents.

from WordPress https://ift.tt/38eOgDm
via IFTTT

The Stages of a Penetration Test and Goal

A graduate of the Cape Cod Community College, Wayne Nordstrom holds an associate of science in cybersecurity and security penetration testing. Wayne Nordstrom is the senior vulnerability risk manager of Blue Cross Blue Shield, where he performs penetration tests.

A penetration test is a cyber-attack simulation that aims to detect the vulnerabilities of a computer system. The first stage of the penetration test identifies the system to attack and determines how to attack it. The second part is represented by an analysis of the system. The analysis can either be static or dynamic. The static analysis of the system involves the inspection of an app code to see how it will act when it runs. On the other hand, the dynamic focuses more on the active performance of the code when the system is already running.

The third stage of the penetration test involves attack simulations such as SQL injection or backdoor attacks that can reveal the vulnerabilities in the system. Then testers act upon the vulnerabilities and gain access to the system. Testers can then try to maintain access for a longer period of time to see if the vulnerabilities allow the attack to plant threats that can remain in the system and steal data. After the penetration test is done, the testers and the organization make reports to assess the vulnerabilities and improve the system to resist a real attack.

from WordPress https://ift.tt/3BoaFvp
via IFTTT

Benefits of Partnering with ISACA

Wayne Nordstrom is a cybersecurity professional with an extensive technical background who has worked in senior technical positions across multiple organizations. A senior vulnerability risk manager with Blue Cross Blue Shield, Wayne Nordstrom is a member of ISACA.

ISACA (short for “Information Systems Audit and Control Association”) helps business technology experts and their businesses fully harness the potential of technology. In its quest to encourage innovation, ISACA offers partnership opportunities that enable organizations or companies to build a global professional network. By partnering with ISACA, companies access exhibiting as well as sponsorship packages to help them make a noticeable impact.

Partner companies can exhibit their products to audiences at ISACA events around the globe, where they can interact with top decision makers and influencers keen to learn more about new product offerings that help boost enterprise productivity. ISACA sponsorship, meanwhile, provides companies with flexible and customizable packages that enable companies to attain their marketing goals and realize the best returns on investment. Learn more at www.isaca.org.

from WordPress https://ift.tt/3xX2yn7
via IFTTT

What Is Zero-Day Vulnerability?

Wayne Nordstrom has been working in cybersecurity for more than 10 years. With a keen interest in his cybersecurity, Wayne Nordstrom enjoys participating in extra-curricular cybersecurity activities, including capture the flag tournaments and zero-day vulnerability competitions.

In cybersecurity, zero-day vulnerability refers to an unknown flaw that has yet to be detected. It is an undiscovered exploit that can expose a vulnerability in hardware or software. When this vulnerability is detected by someone other than the developer, cyberattacks become a very real threat.

Cybercriminals will target these zero-day vulnerabilities and cause problems for unsuspecting users of the product. They will quickly develop malware and use it to gather personal data on businesses and individuals. Until this exploit is detected and patched by the developer, the hardware or software will be open to these types of attacks.

Users must always ensure that their cybersecurity software is up to date and any software installed on their computer. There is no way to stop zero-day vulnerabilities completely, so the user must be proactive and preventive.

from WordPress https://ift.tt/3yvtr2D
via IFTTT