Daily headlines highlight the latest ransomware attacks, data breaches and new phishing techniques, bringing to light an epidemic that has resulted in financial, operational and reputational damage for businesses, governments and the general public alike.

Today, cyberattacks put a lot more than just our personal data at risk – threat actors have increased the regularity at which they target the infrastructure that supports mission critical systems, such as power grids, water utilities, healthcare systems, nuclear facilities and emergency services.

A report from the Ponemon Institute revealed a steady rise in cyberattacks against critical infrastructure, stating that “Nation-state attacks are especially concerning in the [original technology] sector because they’re typically conducted by well-funded, highly capable cyber criminals and are aimed at critical infrastructure.”

These critical infrastructure sectors – of which there are 16 – ultimately impact how our daily lives function and when attacked could have lasting global effects.

Just last month E&E News reported on the first cyberattack on the U.S. power grid as identified by the North American Electric Reliability Corp (NERC). While nation state reconnaissance has occurred for years, this attack is unique in that it is the first to facilitate “minor impact.” In contrast, other critical infrastructure sectors like healthcare and financial services have suffered the consequences of cyberattacks for over a decade, as personally identifiable information regularly sought can rake in millions on the Dark Web in addition to the many benefits associated with intellectual property theft.

Critical infrastructure cybersecurity training today

As mentioned, cybersecurity is not unknown to critical infrastructure sectors. In response to the integration of information technology systems with operational technology systems and the emergence of the industrial internet of things, an increased focus on risk mitigation and industry and federal regulatory compliance emerged. At the same time, a new challenge came to light – there simply aren’t enough cybersecurity workers to fill the number of open jobs.

To limit risk, most critical infrastructure organizations provide some level of security awareness training company-wide, but it’s often limited to very basic information, such as how to identify and report a phishing email. Advanced training is not typically given to ordinary workers, and many critical infrastructure stakeholders are never properly briefed on how to handle suspected cyber threats.

This is a serious problem in today’s connected world where vulnerabilities and cyberattacks can come from anywhere at any time including a remote worker, a contractor, a device or even technology that appears on its surface to be begin, like a smart thermostat.

To put it into perspective, most of today’s CI organizations remotely monitor the status and location of trains, buses and trucks; they can adjust the flow of crude oil and natural gas through pipelines remotely; water and electricity consumption can be monitored and changed from a centralized location and medical devices can be monitored from half a world away. These conveniences cut costs, increase efficiency and overall make our lives easier – but as the number of interconnected systems continues to rise, so does the attack surface. As a result, more employees across a CI ecosystem are a threat, whether they know it or not.

Training needs to go beyond phishing

Critical infrastructure organizations can no longer go through the motions of cybersecurity awareness training thinking their technology and security teams are enough to maintain control. Instead, all employees must begin to understand that any interaction with technology can play a role in a cyberattack. This represents a change to both culture and strategy – which is never easy to deploy despite its necessity.

Ultimately, CI organizations must begin to teach every employee and stakeholder that every person – no matter their role – plays an important part in protecting mission critical infrastructure. And not just with scare tactics, but with the knowledge and understanding of how cyberattacks operate and how to handle them.

Leaders should consider some of the following steps:

• Prioritize practical, hands-on CIP cybersecurity workforce training rather than just relying on theories and concepts that are difficult to visualize.
• Set up the right incentives, performance management, training, processes, procedures and other systems to ingrain the mindset and cultural changes needed.
• Train OT professionals in technologies and processes that are valuable to making CI stronger and more resilient. 
• Lead by example – have all managers and leaders in CI take in-depth CIP cybersecurity training courses to become knowledgeable in cybersecurity for CI and to understand how to communicate that information to everyone involved. 

Protecting critical infrastructure against cyberattacks is a two-part problem. We must put in place better protections, more advanced security protocols and better incident response plans, but that starts with better cybersecurity knowledge across the entire CI workforce. Ultimately, we need to change the way everyone in the CI ecosystem thinks about cybersecurity. The success of critical infrastructure protection relies on the steps taken by the workforce to mitigate risks – and that starts with the knowledge and understanding of the nuances that make up CIP cybersecurity. In today’s world, you cannot afford to not train every CIP stakeholder in cybersecurity.

Dan Lanir is vice president of customer success at OPSWAT, a San Francisco based software company.

The U.S. electricity grid is hard to defend because of its enormous size and heavy dependency on digital communication and computerized control software. The number of potential targets is growing as “internet of things” devices, such as smart meters, solar arrays and household batteries, connect to smart grid systems.

As researchers ofgrid security, we believe that current security standards mandated by federal regulations provide sufficient protection against observed threats. But recent incidents demonstrate the ongoing challenge of ensuring everyone follows the guidelines, which themselves must change over time to keep up with technological shifts.

The threat is real: In late 2015 and again in 2016, Russian hackers shut down parts of Ukraine’s power grid. In March 2018, federal officials warned that Russians had penetrated the computers of multiple U.S. electric utilities and were able to gain access to critical control systems. Four months later, the Wall Street Journal reported that the hackers’ access had included privileges that were sufficient to cause power outages.

Specific technical details have not yet been made public, so it’s hard to know exactly what the hackers did or gained access to. What has been revealed is that these breaches were accomplished with common hacking techniques, such as sending spearphishing emails to specific employees. Apparently, and reassuringly, the U.S. attacks didn’t involve more advanced techniques seen in the Ukraine incidents, including custom-made software to target specific systems.

In addition, human errors will inevitably lead to mistakes that will weaken the security of some of the thousands of digital devices needed to protect the grid. And more sophisticated attackers may still find and exploit currently unknown vulnerabilities. Therefore, it’s important for electric utilities, grid operators and vendors to remain vigilant and deploy multiple layers of defense.

Major players have some protections

There are two main aspects to grid architecture that need defending in different ways. The first element is the bulk power system, often referred to as the “transmission grid.” It connects high-capacity power plants, transmission wires and substations that collectively generate and transport huge quantities of electricity over hundreds or thousands of miles. The rest of the grid is made up of smaller distribution grids – connected with the bulk power system – delivering electricity to homes and businesses around the country. The strongest standards for protection apply only to the bulk power system; though many distribution systems follow the same guidelines, they remain optional.

U.S. federal rules, as well as those set by the agency that governs the North American grid – which also includes large parts of Canada – require companies operating elements of the bulk power system to follow certain basic cybersecurity measures, including monitoring their networks to detect intrusions and mandating two-factor authentication for user logins.

Many large utilities do even more, assessing their risks in standardized ways and practicing responses to computer intrusions. These exercises often include hundreds of companies and organizations rehearsing how to collaborate to detect and confine attacks and restore service to customers.

Smaller companies are more vulnerable

Because transmission grid utilities should already have some protections against network intrusions, it is likely that the Russian hackers looked elsewhere, infiltrating smaller distribution utilities. If that’s so, any potential power shutdown or other problems in those systems would be confined to smaller areas – like towns or cities. That, in turn, means fewer customers would be affected, with less work needed to get power back on.

But it highlights a worrying reality: Smaller and midsized companies that operate electricity distribution systems often have inadequate resources to invest in full cybersecurity protections. The more than 3,000 utilities in the U.S. have trouble finding sufficiently skilled workers who understand how the computerized and physical components of the grid work together and how to protect them.

In addition, utilities rely on complex supply chains to provide equipment, software, maintenance and other business functions. These external contractors and vendors may not implement protections as rigorous as the utilities. And their computer systems often have connections to the utilities’ networks, which may be considered trusted and safe, rather than potential avenues of attack.

Stepping up defenses

Fixing all these potential problems is complex. First, all utility companies – even the smallest – should adopt basic security protections like those required of large utilities. Some states are moving to require this of the power companies serving their residents, but many aren’t yet. Further, we recommend all companies that are part of the grid participate in coordinated grid exercises to improve cybersecurity preparedness and share best practices.

In addition, all utility companies need to take steps to ensure the hardware and software they use are from trustworthy sources and have not been tampered with or modified to allow unauthorized users in.

It won’t be enough to protect against today’s threats. Adversaries are likely to employ increasingly sophisticated techniques that exploit both computer and human vulnerabilities. Companies need to ensure they engage in what might be called sustainable cybersecurity – ongoing processes that let systems and staff adapt over time, to stay ahead of the threats.

Researchers have an important role too, exploring ways that emerging technologies like cloud computing, blockchain and big-data analytics could help reduce risks without introducing any additional weaknesses. Further, researchers should identify more advanced ways to secure the grid, and reduce these systems’ complexity, which would limit both current risks and future unknowns.

This article was originally published on The Conversation. Read the original article here: http://theconversation.com/as-russians-hack-the-us-grid-a-look-at-whats-needed-to-protect-it-100489.

The methods exploited what cybersecurity experts call the “insider threat,” a term for the various ways authorized users can let an attacker inside a network, either by mistake or malice.

“They’re basically playing on things that influence the weakest link inside your enterprise – people,” said Josh Douglas, chief strategy officer for Raytheon Cyber Services. “Their desires and their will their social interaction, their reading habits, etcetera. The behavioral aspects of employees are a direct link to the weakness of the security of an organization.”

The methods were common and well-documented, suggesting the attackers focused less on technological sophistication and more on knowing what energy company employees were likely to do – a hacking principle known as “social engineering.”

For example, Symantec reported, the attackers:

• Disguised malware as an invitation to a New Year’s Eve party – a method known as “spearphishing,” then followed up with messages containing “very specific content related to the energy sector;”
• Planted malware on websites frequented by utility employees, a technique known as a “watering hole” attack;
  
• Hid malware inside what appeared to be a legitimate software update, or “Trojanization.”
  

Symantec attributed the attack to a group known as Dragonfly 2.0, the same party responsible for a cyber-spying operation on energy companies uncovered in 2014. It did not speculate on the group’s origins, but did call it “an accomplished attack group” and said it used one piece of what appeared to be custom-built malware.

Just as the attackers used human behavior to build their offensive, companies can use it to design their defense, said Richard Ford, chief scientist for Forcepoint, a commercial cybersecurity company jointly owned by Raytheon.

For example, he said, the company found that while people going to a website commonly click out of pop-up security warnings, they respond better to an intermediary webpage that tells them clicking through might be a bad idea.

“By changing the context of the interaction, the overall click-through rate was dramatically lowered,” he said.

The trick, Ford said, is “to steer people, as opposed to direct them,” and close the same types of security gaps the power-grid hackers exploited.

“People are great. We’re awesome. And we’re also very focused on what we’re doing, and we don’t think about the consequences for that,” Ford said. “There’s no patch for people. At least, if there is, I’m not sure I want to install it.”

Josh Douglas is the chief strategy officer for Raytheon’s cyber services business. Richard Ford is the chief scientist for Forcepoint, a commercial cybersecurity company jointly owned by Raytheon.

Accepting that mission, these resourceful undergraduates spent 10 weeks painstakingly working to intimately understand and respond to the U.S. government’s toughest national security challenges. Using Silicon Valley innovation methods based on the premise that true innovation comes from grasping a customer’s problem better than they do, the students iterated threat-busting artificial intelligence algorithms, hunter drones, and augmented reality glasses, among other products.

Merging lessons learned from leading technology engineers, entrepreneurs, executives and investors, the Hacking for Defense movement is gaining momentum on campuses nationwide amid a growing recognition that status quo defense acquisitions are increasingly being outpaced by new national security challenges. After kicking off last year at Stanford University, the class has now expanded to seven universities. With support from the Defense Department’s MD5 tech accelerator, the Georgetown students applied Silicon Valley-style lean startup methods to acute (and unclassified) national security challenges put forth by government agencies keen for a fresh perspective. The problem statements and results aren’t academic exercises; these are real-world problems. As course mentors, we expected students to develop actual prototypes for “minimum viable products” (or MVPs as they’re often called) over the 16-week class. Think of it as show-and-tell from a future battlefield, all broadcast live on social media.

Each “product” is more than the sum of its parts. It starts with government sponsors pitching students on their problems. The students then conduct hundreds of sponsor and expert interviews, countless product iterations, and many late nights. Just like a real-world startup would, students received “relentlessly direct” feedback from their instructors and “customers” (problem sponsors) and “investors” (instructors). This forged their approach into an entrepreneurial mindset. Survival depended on real-time technological and business-plan adaptation as well as acceptance of failures along the way. Along with other mentors from across the national security community, our role was to give advice and otherwise support students along the way. This could mean helping to structure problems, understand market developments, and identify potential partners.

What the four student teams ultimately produced was impressive. For example, working a problem posed by the Army’s Asymmetric Warfare Group (AWG), Team Spyglass developed an AI algorithm that in real-time identifies threats – including images – posted on social media. To their credit, the students recognized that identifying the threats alone wasn’t enough. They then created a messaging service that within seconds notifies relevant military users that a threat exists.

The Hacking for Defense approach is about more than technology, something that can be overlooked given its Silicon Valley origins. The students discovered that what truly mattered was solving the right problems. While AWG originally asked for a way to monitor broad trends on social media that could indicate unrest, after several dozen interviews the team had its a-ha moment. They realized the Army’s real problem was actually protecting individuals and units from being photographed and geotagged for potential ambushes or flash-mob style attacks. With that revelation, Team Spyglass rapidly adapted its approach.

This type of ongoing discovery is essential to Hacking for Defense. And it applies to more than students.

The broad lessons are applicable to pretty much anyone in the public and private defense sector, from executive-level leadership to strategic planning groups and technology development organizations. For DoD, one of the most important benefits is a process that hones in on placing innovation where it matters most: in the hands of warfighters. From a defense industry perspective, we believe these approaches can help large corporations stay nimble and truly understand a customer’s often unspoken priorities.

Consider these takeaways from the course:

1. Start with the mission problem. It’s not uncommon for us to see people build technology solutions first and then try to figure out mission applications.  A more effective approach is to invest in deeply understanding the operator (or customer) and the mission problems these people face. Only then does it make sense to develop a technology solution that addresses their needs. Even better, identify the problems they didn’t even know existed. Deeply understanding mission problems, however, is not a casual endeavor. Follow the lead of Hacking for Defense students: conduct scores of interviews and collect in-depth data about technology beneficiaries and partners. Then integrate this ongoing, detailed discovery into development planning. When mission challenges are clearly understood, it’s far more likely the solutions created will be the correct ones.

2. Live your vision. Too often – but not always – strategy in the defense sector is the result of periodic process, perhaps annually or every three to five years. The reality is that technologies and threats are evolving too quickly for a rigid planning process alone to be a highly effective approach. Instead, turn strategic planning into a real-time activity.  Hacking for Defense students do this by constantly iterating a “Mission Model Canvas” throughout the semester as they collect new information on beneficiaries and partners. For those involved in crafting industry or government strategy, build this type of living dashboard to augment or supplant a strategic plan. Constantly revisit customer or operator knowledge, market data, internal portfolios, and goals.

3. Ditch the static roadmap. Like highways, technology roadmaps can accelerate progress, but they also give people fewer choices to exit when it makes the most sense rather than what a planner once envisioned as the optimal outcome. Hacking for Defense teams recognize this reality by presenting weekly updates on their MVPs that reflect their daily inputs. Therefore keep planning dynamic by conducting real-time research into beneficiary needs and the broader marketplace. Based on findings, quickly update roadmaps – even before milestone reviews if possible. Some organizations should even consider setting up small rapid innovation cells propelling development efforts outside normal R&D procedures.

The first Hacking for Defense classes in Washington may be over, but the work of some students continues as they look to get their ideas into the hands of warfighters. Given the speed and intensity with which the students worked, and the eagerness of their sponsoring agencies, that could even be sooner than they ever believed possible when they first signed up for the class.

Joshua Pavluk is a principal at Avascent, where he advises clients across the global aerospace and defense technology sector. His commentary has appeared in TechCrunch, VentureBeat, and War on the Rocks.

Jim Tinsley is a managing director at Avascent, specializing in major defense platforms and subsystems.

Needless to say, the IRS is never going to earn the title of most popular agency with U.S. citizens. As the nation’s lead tax collector, the agency has the difficult job of processing the tax returns, payments and collections of tax-filing businesses and individuals across the country. While this leads to pop culture jokes like the one referenced above, it is a very important role as those funds go to pay for government services like defense, education and healthcare.

Those funds, as we know, are under constant attack from fraudsters looking to penetrate the system. But these attacks aren’t always coming from the outside … insider threats are becoming more commonplace.

The Insider Threat for Tax Agencies

According to a survey from the CERT Division of the Carnegie Mellon Software Engineering Institute (SEI), 47 percent of respondents reported an insider incident has been committed against their organization. They also said 27 percent of all cyberattacks come from insiders.

While these numbers look at the private sector, they surely translate to the government environment as well. Government agencies are incredibly prone to insider threats, especially employees that may have become unhappy with political changes or are approached with a lucrative opportunity from an outside source. This is especially true at tax agencies that have access to large amounts of financial and personal information – information that can generate significant financial and personal gain.

What Should Tax Agencies Do?

First and foremost, leaders at tax agencies must familiarize themselves with the insider threat industry, including considering the most modern insider threat detection solutions. For instance, advanced analytics that can reveal threats automatically.

Advanced analytics provide agencies with visibility into their networks that they did not have before. This enables administrators to have a better understanding of how, and where, data is being used, allowing them to establish baselines that can lead to easily identifying suspicious behavior. Analytics can work without human intervention as well, constantly monitoring networks for suspicious activity and then automatically sending alerts. This type of insight can allow administrators to learn about potential issues and pick up on patterns that human analysts miss.

Advanced analytics systems can use data already available to identify:

• File downloads which are excessive for the employee’s peer group.
• Atypical privileged account access (e.g. VIP taxpayers).
• Abnormal viewing/modification of taxpayer accounts.
• Excessive web activity.
• Sentiments (i.e. feelings) expressed in work email that are highly correlated with insider threat.
• Unusual time-of-day access.
• Employees’ connections and sphere of influence in the organization.

Advanced analytics, more than anything, can identify out-of-the-norm behavior. Most employees are hired to fill certain tasks, so their work tends to follow certain patterns. When those patterns are disrupted, that’s when the analytics engine can raise a red flag. Sometimes those activities might be nothing more than a mistake by an employee, but other times they can signal nefarious behavior.

It’s Not Always Malicious

Fighting insider threats has been one of the government’s top priorities, but also one of the most difficult to achieve. To succeed, the government needs to have both a trust that employees are doing the work they were hired to do with the best intent, but also enough caution to monitor their work.

That is, of course, for insider threats that are intentionally malicious. There is another category of insider threats made up of employees that mean well, but do not follow information security best practices. These types of employees are not trying to put information at risk, but end up doing so. Advanced analytics can track the behavior of all employees and how they use data, flagging potential risks and dangerous behavior.

Tax agencies already face a difficult job. They must collect trillions of dollars each year in taxes, process returns and watch for fraud, waste and abuse in the process. Insider threats make this difficult job that much harder. With a proper analytics program, though, federal technology leaders can minimize the impact of insider threats and keep data, and important financial information, safe at all times.

Deborah Pianko has 20 years of experience building technology solutions for tax and revenue agencies. As a systems engineer, Deborah helped build the systems used by many tax agencies, including D.C., Tennessee, Arizona, Maryland, Ohio, Nevada, Puerto Rico, Detroit, Australia and others.

. It’s perhaps unsurprising, given both history and the entertainment industry, that

of a cybernetic takeover that forces us to live locked away, “Matrix”-like, as

.

And yet it is hard for me to look up from the evolutionary computer models I use to develop AI, to think about how the innocent virtual creatures on my screen might become the monsters of the future. Might I become “the destroyer of worlds,” as Oppenheimer lamented after spearheading the construction of the first nuclear bomb?

I would take the fame, I suppose, but perhaps the critics are right. Maybe I shouldn’t avoid asking: As an AI expert, what do I fear about artificial intelligence?

Fear of the unforeseen

The HAL 9000 computer, dreamed up by science fiction author Arthur C. Clarke and brought to life by movie director Stanley Kubrick in “2001: A Space Odyssey,” is a good example of a system that fails because of unintended consequences. In many complex systems – the RMS Titanic, NASA’s space shuttle, the Chernobyl nuclear power plant – engineers layer many different components together. The designers may have known well how each element worked individually, but didn’t know enough about how they all worked together.

That resulted in systems that could never be completely understood, and could fail in unpredictable ways. In each disaster – sinking a ship, blowing up two shuttles and spreading radioactive contamination across Europe and Asia – a set of relatively small failures combined together to create a catastrophe.

I can see how we could fall into the same trap in AI research. We look at the latest research from cognitive science, translate that into an algorithm and add it to an existing system. We try to engineer AI without understanding intelligence or cognition first.

Systems like IBM’s Watson and Google’s Alpha equip artificial neural networks with enormous computing power, and accomplish impressive feats. But if these machines make mistakes, they lose on “Jeopardy!” or don’t defeat a Go master. These are not world-changing consequences; indeed, the worst that might happen to a regular person as a result is losing some money betting on their success.

But as AI designs get even more complex and computer processors even faster, their skills will improve. That will lead us to give them more responsibility, even as the risk of unintended consequences rises. We know that “to err is human,” so it is likely impossible for us to create a truly safe system.

Fear of misuse

I’m not very concerned about unintended consequences in the types of AI I am developing, using an approach called neuroevolution. I create virtual environments and evolve digital creatures and their brains to solve increasingly complex tasks. The creatures’ performance is evaluated; those that perform the best are selected to reproduce, making the next generation. Over many generations these machine-creatures evolve cognitive abilities.

Right now we are taking baby steps to evolve machines that can do simple navigation tasks, make simple decisions, or remember a couple of bits. But soon we will evolve machines that can execute more complex tasks and have much better general intelligence. Ultimately we hope to create human-level intelligence.

Along the way, we will find and eliminate errors and problems through the process of evolution. With each generation, the machines get better at handling the errors that occurred in previous generations. That increases the chances that we’ll find unintended consequences in simulation, which can be eliminated before they ever enter the real world.

Another possibility that’s farther down the line is using evolution to influence the ethics of artificial intelligence systems. It’s likely that human ethics and morals, such as trustworthiness and altruism, are a result of our evolution – and factor in its continuation. We could set up our virtual environments to give evolutionary advantages to machines that demonstrate kindness, honesty and empathy. This might be a way to ensure that we develop more obedient servants or trustworthy companions and fewer ruthless killer robots.

While neuroevolution might reduce the likelihood of unintended consequences, it doesn’t prevent misuse. But that is a moral question, not a scientific one. As a scientist, I must follow my obligation to the truth, reporting what I find in my experiments, whether I like the results or not. My focus is not on determining whether I like or approve of something; it matters only that I can unveil it.

Fear of wrong social priorities

Being a scientist doesn’t absolve me of my humanity, though. I must, at some level, reconnect with my hopes and fears. As a moral and political being, I have to consider the potential implications of my work and its potential effects on society.

As researchers, and as a society, we have not yet come up with a clear idea of what we want AI to do or become. In part, of course, this is because we don’t yet know what it’s capable of. But we do need to decide what the desired outcome of advanced AI is.

One big area people are paying attention to is employment. Robots are already doing physical work like welding car parts together. One day soon they may also do cognitive tasks we once thought were uniquely human. Self-driving cars could replace taxi drivers; self-flying planes could replace pilots.

Instead of getting medical aid in an emergency room staffed by potentially overtired doctors, patients could get an examination and diagnosis from an expert system with instant access to all medical knowledge ever collected – and get surgery performed by a tireless robot with a perfectly steady “hand.” Legal advice could come from an all-knowing legal database; investment advice could come from a market-prediction system.

Perhaps one day, all human jobs will be done by machines. Even my own job could be done faster, by a large number of machines tirelessly researching how to make even smarter machines.

In our current society, automation pushes people out of jobs, making the people who own the machines richer and everyone else poorer. That is not a scientific issue; it is a political and socioeconomic problem that we as a society must solve. My research will not change that, though my political self – together with the rest of humanity – may be able to create circumstances in which AI becomes broadly beneficial instead of increasing the discrepancy between the one percent and the rest of us.

Fear of the nightmare scenario

There is one last fear, embodied by HAL 9000, the Terminator and any number of other fictional superintelligences: If AI keeps improving until it surpasses human intelligence, will a superintelligence system (or more than one of them) find it no longer needs humans? How will we justify our existence in the face of a superintelligence that can do things humans could never do? Can we avoid being wiped off the face of the Earth by machines we helped create?

The key question in this scenario is: Why should a superintelligence keep us around?

I would argue that I am a good person who might have even helped to bring about the superintelligence itself. I would appeal to the compassion and empathy that the superintelligence has to keep me, a compassionate and empathetic person, alive. I would also argue that diversity has a value all in itself, and that the universe is so ridiculously large that humankind’s existence in it probably doesn’t matter at all.

But I do not speak for all humankind, and I find it hard to make a compelling argument for all of us. When I take a sharp look at us all together, there is a lot wrong: We hate each other. We wage war on each other. We do not distribute food, knowledge or medical aid equally. We pollute the planet. There are many good things in the world, but all the bad weakens our argument for being allowed to exist.

Fortunately, we need not justify our existence quite yet. We have some time – somewhere between 50 and 250 years, depending on how fast AI develops. As a species we can come together and come up with a good answer for why a superintelligence shouldn’t just wipe us out. But that will be hard: Saying we embrace diversity and actually doing it are two different things – as are saying we want to save the planet and successfully doing so.

We all, individually and as a society, need to prepare for that nightmare scenario, using the time we have left to demonstrate why our creations should let us continue to exist. Or we can decide to believe that it will never happen, and stop worrying altogether. But regardless of the physical threats superintelligences may present, they also pose a political and economic danger. If we don’t find a way to distribute our wealth better, we will have fueled capitalism with artificial intelligence laborers serving only very few who possess all the means of production.

This article was originally published on The Conversation.

” ransomware attack

, it’s making clear how important it is for everyone – and particularly corporations – to take cybersecurity seriously. The

include

. Their customers are now left without power and other crucial services, in part because the companies did not take action and make the investments necessary to better protect themselves from these cyberattacks.

Cybersecurity is becoming another facet of the growing movement demanding corporate social responsibility. This broad effort has already made progress toward getting workers paid a living wage, encouraging companies to operate zero-waste production plants and practice cradle-to-cradle manufacturing – and even getting them to donate products to people in need.

The overall idea is that companies should make corporate decisions that reflect obligations not just to owners and shareholders, customers and employees, but to society at large and the natural environment. As a scholar of cybersecurity law and policy and chair of Indiana University’s new integrated program on cybersecurity risk management, I say it’s time to add cyberspace to that list.

Online security affects everyone

The recent WannaCry ransomware attack affected more than 200,000 computers in 150 nations. The results of the attack made clear that computers whose software is not kept up to date can hurt not only the computers’ owners, but ultimately all internet users. The companies hit by the NotPetya attack didn’t heed that warning, and got caught by an attack using the same vulnerability as WannaCry, because they still haven’t updated their systems.

Some policymakers and managers are taking notice around the world. In the U.S., the Department of Homeland Security, the chief federal agency dealing with cybersecurity, has highlighted businesses’ “shared responsibility” to protect themselves against cyberattacks. Consumers can’t protect their utility services, banking systems or even their personal data on their own, and must depend on companies to handle that security.

Cybersecurity is an effort that not only protects – and even benefits – a company’s bottom line but also contributes to overall corporate and societal sustainability. In addition, by protecting privacy, free expression and the exchange of information, cybersecurity helps support people’s human rights, both online and offline.

Vaccinating cyberspace

If more companies get serious about cybersecurity, the internet ecosystem will be safer for everyone. The concept is much like vaccinating people against disease: If enough people are protected, the others benefit too, through what is called “herd immunity.”

In terms of deterring hackers, the number of vulnerable targets will drop, making it harder for hackers to find them, and less worthwhile to even look. And more companies will have defenses ready when cyber attackers come calling. This isn’t a perfect solution: With enough time and resources, any system is vulnerable. But this change in corporate perception is an important step in developing a global culture of cybersecurity.

Customers can get involved in this effort, demanding better cybersecurity from companies they do business with. These can include online retailers, whether small specialized sellers or giants like Amazon. But local bricks-and-mortar stores with customer loyalty programs that have built their brands on trust can also be susceptible to consumer pressure.

To date, it’s been hard to know which companies have the best cybersecurity practices. The product and service reviewers at Consumer Reports have made a start: In March they started evaluating devices, software and mobile apps for privacy and cybersecurity.

Advocacy groups like the Internet Society and many others should ask companies to discuss cybersecurity efforts in their reports to shareholders. And they should urge government agencies to develop voluntary programs like the U.S. Environmental Protection Agency’s Energy Star appliance-efficiency rating system. The U.K. has a certification like this for cybersecurity, called Cyber Essentials. These efforts don’t require executives or managers to make different decisions, but help inform them – and the public – about how the choices they make affect consumers.

Ultimately, companies will play a huge role in shaping the future of our shared experience online. Cybersecurity and data privacy are key elements of this, and it’s time consumers demand corporations treat them as the 21st-century social responsibilities they are.

This article was originally published on The Conversation.

In this article, I will discuss what companies should avoid doing once they realize their systems have been breached. I spoke to several experts from security companies and industry analysis firms to better understand the potential pitfalls and disaster scenarios that develop in the wake of cyberattacks.

1. Do Not Improvise

In the event of an attack, your first instinct will tell you to begin the process of rectifying the situation. This may include protecting the endpoints that have been targeted or reverting to previous backups to close up the entry point used by your attackers. Unfortunately, if you hadn’t previous developed a strategy, then whatever hasty decisions you make after an attack could worsen the situation.

“The first thing you should not do after a breach is create your response on the fly,” said Mark Nunnikhoven, Vice President of Cloud Research at cyber security solution provider Trend Micro . “A critical part of your incident response plan is preparation. Key contacts should be mapped out ahead of time and stored digitally. It should also be available in hard copy in case of a catastrophic breach. When responding to a breach, the last thing you need to be doing is trying to figure out who is responsible for what actions and who can authorize various responses.”

Ermis Sfakiyanudis, President and CEO of data protection services company Trivalent, agrees with this approach. He said it’s critical that companies “do not freak out” after they’ve been hit by a breach. “While unpreparedness in the face of a data breach can cause irreparable damage to a company, panic and disorganization can also be extremely detrimental,” he explained. “It is critical that a breached company not stray from its incident response plan, which should include identifying the suspected cause of the incident as a first step. For example, was the breach caused by a successful ransomware attack, malware on the system, a firewall with an open port, outdated software, or unintentional insider threat? Next, isolate the effected system and eradicate the cause of the breach to ensure your system is out of danger.”

Sfakiyanudis said it’s vital that companies ask for help when they’re in over their heads. “If you determine that a breach has indeed occurred following your internal investigation, bring in third-party expertise to help handle and mitigate the fallout,” he said. “This includes legal counsel, outside investigators who can conduct a thorough forensic investigation, and public relations and communication experts who can create strategy and communicate to the media on your behalf.

“With this combined expert guidance, organizations can remain calm through the chaos, identifying what vulnerabilities caused the data breach, remediating so the issue doesn’t happen again in the future, and ensuring their response to affected customers is appropriate and timely. They can also work with their legal counsel to determine if and when law enforcement should be notified.”

2. Do Not Go Silent

Once you’ve been attacked, it’s comforting to think that no one outside of your inner circle knows what just happened. Unfortunately, the risk here isn’t worth the reward. You’ll want to communicate with staffers, vendors, and customers to let everyone know what has been accessed, what you did to remedy the situation, and what plans you intend to take to ensure no similar attacks occur in the future. “Don’t ignore your own employees,” advised Heidi Shey, Senior Analyst of Security & Risk at Forrester Research. “You need to communicate with your employees about the event, and provide guidance for your employees about what to do or say if they asked about the breach.”

Shey, like Sfakiyanudis, said you may want to look into hiring a public relations team to help control the messaging behind your response. This is especially true for large and expensive consumer-facing data breaches. “Ideally, you’d want such a provider identified in advance as a part of your incident response planning so you can be ready to kick off your response,” she explained.

Just because you’re being proactive about notifying the public that you’ve been breached, it doesn’t mean that you can start issuing wild statements and proclamations. For example, when toymaker VTech was breached, photos of children and chat logs were accessed by a hacker. After the situation had died down, the toymaker changed its Terms of Service to relinquish its responsibility in the event of a breach. Needless to say, customers were not happy. “You don’t want to look like you’re resorting to hiding behind legal means, whether that’s in avoiding liability or controlling the narrative,” said Shey. “Better to have a breach response and crisis management plan in place to help with breach-related communications.”

3. Do Not Make False or Misleading Statements

This is an obvious one but you’ll want to be as accurate and honest as possible when addressing the public. This is beneficial to your brand, but it’s also beneficial to how much money you’ll recoup from your cyber-insurance policy should you have one. “Don’t issue public statements without consideration for the implications of what you’re saying and how you sound,” said Nunnikoven.

“Was it really a ‘sophisticated’ attack? Labeling it as such doesn’t necessarily make it true,” he continued. “Does your CEO really need to call this an ‘act of terrorism’? Have you read the fine print of your cyber-insurance policy to understand exclusions?”

Nunnikhoven recommends crafting messages that are “no-bull, frequent, and which clearly state actions that are being taken and those that need to be taken.” Trying to spin the situation, he said, tends to make things worse. “When users hear about a breach from a third party, it immediately erodes hard-won trust,” he explained. “Get out in front of the situation and stay in front, with a steady stream of concise communications in all channels where you’re already active.”

4. Do Not Close Incidents Too Soon

You’ve closed your corrupted endpoints. You’ve contacted your employees and customers. You’ve recovered all of your data. The clouds have parted and a ray of sunshine has cascaded onto your desk. Not so fast. Although it may seem as if your crisis has ended, you’ll want to continue to aggressively and proactively monitor your network to ensure there are no follow-up attacks.

“There is a huge amount of pressure to restore services and recover after a breach,” said Nunnikhoven. “Attackers move quickly through networks once they gain a foothold, so it’s hard to make a concrete determination that you’ve addressed the entire issue. Staying diligent and monitoring more aggressively is an important step until you’re sure the organization is in the clear.”

Sfakiyanudis agrees with this assessment. “After a data breach is resolved and regular business operations resume, do not assume the same technology and plans you had in place pre-breach will be sufficient,” he said. “There are gaps in your security strategy that were exploited and, even after these gaps are addressed, it doesn’t mean there won’t be more in the future. In order to take a more proactive approach to data protection moving forward, treat your data breach response plan as a living document. As individuals change roles and the organization evolves via mergers, acquisitions, etc., the plan needs to change as well.”

5. Do Not Forget to Investigate

“When investigating a breach, document everything,” said Sfakiyanudis. “Gathering information on an incident is critical in validating that a breach occurred, what systems and data were impacted, and how mitigation or remediation was addressed. Log results of investigations through data capture and analysis so they are available for review post-mortem.

“Be sure to also interview anyone involved and carefully document their responses,” he continued. “Creating detailed reports with disk images, as well as details on who, what, where, and when the incident occurred, will help you implement any new or missing risk mitigation or data protection measures.”

If your company is too analog to conduct this analysis on its own, you’ll probably want to hire an external team to conduct this investigation for you (as Sfakiyanudis mentioned earlier). Take notes on the search process as well. Note what services you were offered, which vendors you spoke to, and whether or not you were happy with the investigation process. This information will help you determine whether or not to stick with your vendor, choose a new vendor, or hire in-house staff who’s capable of conducting these processes should your company be unlucky enough to suffer a second breach.

This article originally appeared on PCMag.com.

According to Investopedia, a cryptocurrency is a digital or virtual currency that uses cryptography for security. A cryptocurrency is difficult to counterfeit because of this security feature. A defining feature of a cryptocurrency, and arguably its most endearing allure, is its organic nature; it is not issued by any central authority, rendering it theoretically immune to government interference or manipulation.

You can track the cumulative total U.S. dollar value of each individual cryptocurrency and the sum of all 863 individual cryptocurrencies using this online source.

About six weeks ago, the delivery of a cryptocurrency training webinar attracted a few thousand professional participants worldwide and was highly rated. That is a clear indicator of the interest in this subject matter, for sure. It is extremely difficult to calculate the military and intelligence ramifications.That being said, one has to wonder how much human trafficking, illegal drugs sales, arms sales, militia financing and terrorist activity support is represented in the figures above. One has to wonder about the cryptocurrency dollar value on the dark web. It is surely a national security issue!

Let’s face it, there are not too many things that are as ever-changing as the internet and all the devices and equipment that gets connected to it! It is worth noting that several commercial and research organizations are hard at work integrating artificial intelligence into cyber defense. While that is an indicator of the complexities of the environment, it should also be worth noting the complexities that come with most cyber defense solution sets.

Estimates suggest that each month, 328 million new devices get connected to the internet. Each one of those devices could be a new sensor or other information-gathering mechanism. Now for the dark side: Each one of those devices becomes a potential point of attack; and worse, they become a potential weapon in a distributed denial-of-service attack. Another important aspect of the complexity of this topic is the segmentation of the environment. Analysis of this problem set produced the following segments, each with its own unique characteristics that add to the complexity and require somewhat of a different cyber defense strategy.

The private sector business side

• Small businesses
• Midsize businesses
• Large businesses

The complexity of dealing with private sector aspects of complexity are due primarily to their role in critical infrastructure and their influence on other essential service/contributions.

The private sector not-for-profit organizations

• Small
• Medium
• Large

The complexity of dealing with not-for-profit organizations’ aspects of complexity are due primarily to their role in influential aspects of our country, such as political parties as a recent example.

Government organizations

• Federal
• State
• Local

Defense Department

• Combat units: offensive and defensive
• Support services
• Intelligence