Plaintext: We Need Transparency Around Cyberattacks
Welcome to Dark Reading in Plaintext, brought to your inbox this week by Deloitte . In this issue of Plaintext, we look at why reporting cyberattacks is so important, and why holding information back benefits the attackers. We also consider the prospect of a supply chain attack as a result of a ransomware attack against a hardware manufacturer. If you enjoy the Plaintext newsletter, please share with your friends!
Defenders Benefit When Victims Speak Out. An organization that has been the victim of an attack may be reluctant to report it because they don't want to deal with possible reputational damage and negative publicity if the attack becomes public knowledge. In actuality, transparency is a good thing . Open discussion means victims get access to support and advice, and other organizations can improve their awareness of the threat . Defenders can learn what clues to look for, how to shore up their defenses, and how to respond .
"Keeping your cyber incident a secret doesn't help anyone except the criminals," Eleanor Fairford, deputy director of incident management at the United Kingdom National Cyber Security Centre (NCSC), and Mihaela Jembei, director of regulatory cyber at the UK Information Commissioner's Office, wrote in a joint article this week . Fairford and Jembei addressed six common misconceptions that may lead to organizations avoid reporting an attack, such as hoping that paying off the attackers (as in an ransomware attack, for example) may be enough to make them go away. They may also think that they don't have to say anything if they haven't uncovered evidence of a data breach because existing regulations focus only on exposed consumer data.
There are many regulations and laws requiring organizations to report data breaches, but in a recent Bitdefender survey , 42% of the more than 400 IT and security professionals surveyed — and 71% of those in the United States — said they were instructed to keep a data breach confidential . Keeping quiet about breaches is not new. A similar survey in 2018 found that?84% of cybersecurity professionals ?expected timely notification of a breach, but only 37% of the same group emphasized speed when it came to notifying their own customers of a breach.
BROUGHT TO YOU By Deloitte
“But we are increasingly concerned about what happens behind the scenes of the attacks we don’t hear about, particularly the ransomware ones. They are the attacks that aren’t reported to us and pass quietly by, pushed to one side, the ransoms paid to make them go away. And if attacks are covered up, the criminals enjoy greater success, and more attacks take place. We know how damaging this is.” (UK NCSC’s Eleanor Fairford and UK ICO’s Mihaela Jembei)
Supply Chain Attack Targeting MSI Firmware? A ransomware attack against hardware manufacturer Micro-Star International (MSI) may have exposed private encryption keys used to sign MSI firmware updates and the keys for the Intel BootGuard firmware-verification technology. Binarly researchers discovered the private firmware signing keys for 57 separate MSI products and Intel BootGuard keys for 116 products. These keys, if in the wrong hands, could be used to sign malicious software to make it seem as if they are legitimate MSI firmware updates. ?This kind of supply chain attack could cause widespread damage as users will not realize they are installing malicious code on their machines. Consider what happened when attackers compromised the software build and distribution for SolarWinds and distributed malicious software – more than 18,000 customers are believed to have been infected. More recently, telephony company 3CX disclosed a breach of its build system, which was the result of a supply chain attack on a financial trading program used by 3CX and made by Trading Technologies. While there are no reports of a supply chain attack targeting MSI customers at the moment, addressing this leak would be a challenge because MSI doesn’t have an automated firmware update mechanism or a key revocation process.
领英推荐
What We Are Reading
What We Heard On-Air
?Tune in to our on-demand webinar?“How Supply Chain Attacks Work " for insights and recommendations for harnessing user and machine identities in the cloud and among hybrid environments.
"I can't stress this enough — all security starts with knowing what you have." (Jeffrey Martin, VP of product management, Mend)
From Our Library
Check out some of the latest reports from our?Dark Reading Library .
On That Note
Principal Security Consultant
1 年The problem with transparency is it has a negative effect on the company being transparent. Saying things like "Transparency helps enterprise defenders while silence aids cybercriminals." is that it lacks an understanding of second-order effects. If a company discloses an event; it can be negative to reputation and potentially lead to litigation or government fines/enforcement. For this idea to work, transparency needs to have anonymity. The premise here is quite wrong. "In actuality,?transparency is a good thing. Open discussion means victims get access to support and advice, and other organizations can?improve their awareness of the threat." That is useless if your stock takes a 50% reduction and wipes out everyone's end-of-year bonus. You will need counseling for the financial losses as well. This is written from the perspective of someone that does not understand the real ramifications of negative press. (Like Anheuser-Bush losing 7 billion in valuation in 6 days not related to Cyber but a great example of damage). Sharing attack information and required reporting is a good thing. Most states have required reporting for breaches so this article does not address that either.