The Cyber Element – Nov 2017

Cyber Crime summary for small business.

In the News

(From reports in CNN Money, The Hill, CNBC, and ZDNet)

In mid-October a bill was introduced to Congress that would allow a company to effectively “hack back” against cybercriminals. The Active Cyber Defense Certainty (ACDC) Act amends the Computer Fraud and Abuse Act anti-hacking law so a company can take “active defensive measures” to access an attacker’s computer or network to identify the hackers, as well as find and destroy stolen information.

Companies who decide to take action would be required to alert the National Cyber Investigative Joint Task Force, an organization led by the FBI, before trying to hack their hackers. The agency would review the planned active defensive measures before they’re taken.

One benefit of the legislation is that companies that are already engaging in counter-attacks would longer be committing felonies.

What This Means for You

Experts warn that a majority of organizations who would want to hack back are not qualified to do so. In addition, it can take a long time to correctly identify who was responsible for a hack, as cyber criminals often try to trick analysts into thinking their attack came from somewhere else. (They do this by inserting code into their malware that comes from other known hacking groups, or even innocent third parties.)

Another issue is that these “active defense measures” could only be taken inside the U.S., but the majority of attacks are either based outside the country or are routed through overseas servers.

Small businesses are probably better off investing in their existing infrastructure to prevent hacks in the first place. This year’s most serious hack, which compromised data on 145.5 million Equifax customers, was possible because Equifax simply failed to patch a software hole.

Most anti-hacking measures are simple, such as keeping software updated and removing non-essential computers from direct internet access. If something cannot be updated or fixed, it should be separated from other networks.

Don’t Let this Happen to You

(From reports in PCWorld and Security Focus)

Most companies that engage in counter-hacking keep quiet about it, perhaps because it is still illegal. However, a notorious case from 2006 serves as a cautionary tale of the risks involved in this type of action. A company called Blue Security created a way to spam back at spammers, clogging their systems and preventing them from sending out more spam. The spammers fought back, unleashing attacks on the Blue Security website and its clients that caused collateral damage on the internet, knocking out a blog hosting service and several internet service providers. The company eventually closed down operations.

 

Adam Anderson

Adam Anderson is the author of Built to Survive: A Business Person's Guide on How to Recover and Thrive After a Cyber Attack. Adam’s 15 years of entrepreneurial startup experience and his knowledge Enterprise Cyber Defense gives him a window into what’s wrong with communication between large and small companies. He combined this knowledge and the good works from the National Institute of Standards and Technology’s Cyber Security Framework to co-author the book “Small Business Cyber Security”. This book was later turned into an online class by Clemson University. Adam has been active in peer advisory boards for small business CEOs. He took this experience and co-founded a peer advisory board for Chief Security Officers of fortune 500 companies. This mix of small and large businesses has positioned Adam as one of the few people in the world to understand the complete supply chain of cyber security.
Posted in