WASHINGTON \u2014 West Virginia reported unusual cyber activity targeting its election systems. The Texas governor said the state was encountering attempted \u201cattacks\u201d at the rate of \u201cabout 10,000 per minute\u201d from Iran. Information technology staff in Las Vegas responded to an intrusion, though the city says no data was stolen. <\/p>\n\n\n\n
All told, state election officials in at least two dozen states saw suspicious cyber activity last week, although it\u2019s unclear who was behind the efforts and no major problems were reported. <\/p>\n\n\n\n
Long before a targeted U.S. strike killed a top Iranian general, there were already concerns about foreign efforts to hack American institutions and its elections. The conflict with Iran has only exacerbated those fears. <\/p>\n\n\n\n
Yet as the recent spate of reports makes clear, not all suspicious cyber activities are equally troublesome, the work of a foreign government or a precursor to the type of Russian interference seen in the 2016 election on behalf of President Donald Trump. <\/p>\n\n\n\n
A look at what kinds of cyber activities are worrisome \u2014 and what are not: <\/p>\n\n\n\n
What sort of activity is this?<\/b><\/p>\n\n\n\n
Generally speaking, what the states are reporting are efforts to probe their networks for vulnerabilities, or weaknesses that can be exploited for potential intrusion. <\/p>\n\n\n\n
\u201cThink of it in the real world as a bank robber walking by a bank \u2014 first thing they\u2019re going to do is case the joint, and the same thing happens in the digital space,\u201d said former FBI agent Anthony Ferrante, who served as director for cyber incident response at the White House\u2019s National Security Council. <\/p>\n\n\n\n
The culprits are doing the cyber equivalent of wiggling a doorknob, said Ferrante, the global leader of the cybersecurity practice at FTI Consulting. <\/p>\n\n\n\n
Scanning for network vulnerabilities is remarkably common. In fact, federal officials believe election officials in all 50 states were probably targeted during the 2016 election, though the number of known breaches \u2014 including in Illinois and a couple of counties in Florida \u2014 was significantly more modest. A Senate intelligence committee report found no evidence that votes or voting registration systems were altered. <\/p>\n\n\n\n
Is the activity worrisome?<\/b><\/p>\n\n\n\n
It can be, to the extent that it demonstrates that a hacker has set his sights on exploring \u2014 and possibly returning to \u2014 a particular network, and especially if a target is part of the country\u2019s critical infrastructure. <\/p>\n\n\n\n
Much depends as well on the volume and frequency, since repeated, unwanted contact with a website can overwhelm an internet-connected server, effectively shutting it down in what is known as a distributed denial of service, or DDoS attack. <\/p>\n\n\n\n
In general, though, when it comes to poking around a network, \u201cI would certainly put it in a less severe category of threat activity than, say, an intrusion,\u201d said Luke McNamara, a principal analyst at FireEye, a cybersecurity firm. <\/p>\n\n\n\n
It\u2019s \u201ccertainly not evidence that an intrusion has taken place or that they\u2019ve been compromised,\u201d he added. <\/p>\n\n\n\n
The threat of spearphishing<\/b><\/p>\n\n\n\n
Experts say many major hacks originate not with network scans but with spearphishing emails \u2014 messages that appear legitimate but that actually launch malicious software that, once opened, can give an intruder access to the network or trick a target into unwittingly surrendering a network password. <\/p>\n\n\n\n
It was a ploy used by Chinese hackers charged by the Justice Department in 2014 with hacking into the networks of major American corporations and stealing their trade secrets, and with Russian hackers who stole emails belonging to the Hillary Clinton campaign during the 2016 presidential election. <\/p>\n\n\n\n
\u201cThat might be evidence of a more targeted effort. It may be that one of those is going to get through, and all you need is one,\u201d said Suzanne Spaulding, former under secretary for the National Protection and Programs Directorate at the Department of Homeland Security. <\/p>\n\n\n\n
She said the first big question that organizations and governments have to confront is, \u201cDo you have evidence that your system was breached? That\u2019s what you\u2019re really worried about.\u201d <\/p>\n\n\n\n
The tactic is also significantly more subtle than pinging a network, and thus a preferred technique for sophisticated hackers loath to raise alarms. <\/p>\n\n\n\n
\u201cIf your attempt is to try to compromise an organization, you probably want to be a little more surreptitious about it,\u201d McNamara said. <\/p>\n\n\n\n
The threat to public confidence<\/b><\/p>\n\n\n\n
Practically speaking, there\u2019s a big difference between scanning a network for vulnerabilities and actually breaking into it and extracting sensitive information. <\/p>\n\n\n\n
But experts say even scans may nonetheless benefit Russia, or any other country looking to undermine faith in elections, particularly if unschooled officials sound unwarranted alarms. The American public may not appreciate the distinction between activities that may be fairly routine and full-blown cyberattacks. <\/p>\n\n\n\n
\u201cI believe that one of Russia\u2019s objects is to undermine public confidence in the legitimacy of the outcome just as a way of weakening us,\u201d said Spaulding, now a senior adviser at the Center for Strategic and International Studies. <\/p>\n\n\n\n
Associated Press writers Christina A. Cassidy in Atlanta and Frank Bajak in Boston contributed to this report.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
A look at what sorts of activity are most concerning …<\/p>\n","protected":false},"author":7,"featured_media":37749,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10],"tags":[],"coauthors":[5435],"class_list":["post-12227","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"SLF2D2ZUR5EBJOXLQMEYRX3NCU","arc_canonical_url":"\/critical-infrastructure\/2020\/01\/10\/explainer-not-all-cyberthreats-equally-worrisome\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n