CyberWeekly: APT Primer, NYCx Cybersecurity Moonshot, and the Advantages of Guest WiFi

CyberWeekly Newsletter: Weekly Edition

Dec 29, 2018

Advanced Persistent Threat Primer

We’ve all heard of Advanced Persistent Threats (APTs). However, for a lot of professionals in cybersecurity community dealing with APTs isn’t a significant portion of their job. Therefore, many people may not have that great an understanding of APTs.

Fortunately, Vice’s Motherboard provides a primer about APTs in their recent CYBER podcast. Motherboard interviewed Eva Galperin, the director of cybersecurity for the Electronic Frontier Foundation. I love the way in which Eva sums up the difference between nation-state and cybercriminal threat actors:

“One of the ways, in which state actors are considered to be very different from criminals, is that they’re harder to protect against. And the reason that they’re harder to protect against is not only, because of their fancier tooling and potentially willingness to spend more money on compromising a specific target, but also because you can’t just use the security posture of outrunning the other guy trying to outrun the bear. If you specifically are being targeted, you can’t just make yourself a harder target, than other activists or other journalists, and think that’s going to be enough.”

Eva makes a great point. While cybercriminal threat actors often pursue soft targets, nation-state threat actors have specified targets. Their mission is their mission. So whether they’re assigned a soft target or hard target is largely irrelevant.

She also points that APTs don’t need to be super sophisticated in order to compromise most targets. The most sophisticated nation-state threat actors (by reputation) likely won’t surprise you: the Five Eyes—United States, United Kingdom, Canada, Australia & New Zealand—plus China, Israel and Russia. Want to guess some less sophisticated, but effective nation-state threat actors that Eva named? Iran, Ethiopia, UAE, Saudi Arabia, Bahrain, and Mexico. I bet you didn’t see Ethiopia coming!

The podcast is worth a listen for new cyber professionals and seasoned veterans alike. Really, any opportunity to hear Eva Galperin speak is time well spent. After all, she was once introduced with the proclamation, “If ever there were gonna be sort of an Internet version of the Avengers, Nick Fury would probably approach [Eva Galperin] first.” Now that’s bold endorsement! Check out the How to Track Government Hackers and APTs episode on CYBER by VICE.

NYCx Cybersecurity Moonshot

The City of New York continues to advance its effort to develop a global cybersecurity hub. As part of that effort, NYCx has launched a cybersecurity moonshot competition meant to answer the question:

How might we make every small and midsize business in New York City and beyond as resilient to cybersecurity attacks as a Fortune 500 company?

This is a great goal for a couple of reasons.

Small- and medium-sized businesses (SMBs) typically don’t have the budgets to build state-of-the-art, information security programs. As well, SMBs struggle to recruit information security professionals amid the ongoing talent shortfall.
Securing SMBs will help improve the security of large enterprises and governments. It will decrease the number of compromised servers, which threat actors can use to launch wider cyber campaigns.

Oh yes… and there are prizes. They include:

A cash award of $80,000 will be split among up to 8 Finalists
Prize packages, including co-working space, support for international market expansion, and travel support will be offer to for up to 8 Finalists
Jerusalem Venture Partners will identify at least 1 company to receive a grand prize of at least a $1,000,000 investment

The Round 1 deadline is to Submit a Concept Description. Applicants submit a short response outlining their team, concept, and approach. Any company, nonprofit, individual, or global entity can apply. Submit all responses here by 11:59 PM ET on Friday, February 8, 2019.

Got an idea you’ve been noodling on for a while? Maybe you’re a cybersecurity student with more time to focus on a concept, than full-time professionals? Throw your hat in the ring. I’ll be curious to hear, if any CyberWeekly readers apply. It seems like a great opportunity to help benefit SMBs and the wider cybersecurity community.

Building a SMB InfoSec Program

Speaking of SMBs, a recent episode of the CISO/Security Vendor Relationship podcast asked the question, where should SMBs start to build effective information security program? This is a good question given that SMBs likely have little-to-no security staff and no CISO.

The short answer is that SMBs will likely need to lean on their IT staff in the absence of having a Information security team.

So where should SMBs start planning? Asset management. You can’t have effective patch management—thus protecting from entirely preventable breaches—if you don’t know what assets your organization has.

Also, check out the Center for Internet Security’s (CIS) Top 20 Controls for a simple framework to get started and build an information security program for an SMB. The CIS Top 20 focuses on three broad categories: Basic, Foundational, and Organizational CIS Controls.

To hear Mike Johnson, CISO of Lyft, and Darren Death, VP of InfoSec & CISO of ASRC Federal, explain where to start building a SMB information security program go to the 23:35 mark of the Real Housewives of Cybersecurity episode.

Advantages of Guest WiFi

This holiday season has likely included a few household visitors. When friends and family visit many of us get asked a question—which we’ve also asked at other people’s homes—Can I get your WiFi password?

It’s an understandable question. You’re likely to get faster download speeds via WiFi, than 4G. As well, people generally want to avoid burning through all their high-speed data on their cellular plan, if they can avoid it.

That leads to another question. Should I set up a guest WiFi network?

Let’s take a look at some of the advantages to setting up a guest WiFi network on your home router:

You can give guests a simple WiFi password, while keeping your private WiFi password much longer. (Passphrases generators are handy for creating easy to convey passphrases for your guests.)
You can turn off the guest network, when not in use. This can reduce the chance of your neighbors hacking your WiFi. (Is someone already stealing your WiFi? Here’s how to check).
It keeps guest users isolated from the Local Area Network (LAN), so they can’t see other devices on the private network.
It prevents guests from being able to access files on a Network Attached Storage (NAS) device—and prevent guests from messing with the playlist on your WiFi-enabled speakers.
Some routers can isolate guests from each other. This prevents something malicious on one guest’s device from seeing or infecting your other guests.
You can also isolate kids’ or Internet of Things (IoT) devices for additional security and safety.

Security is good. Security that actually makes people’s life easier is great.

Cool Job of the Week

GE Digital — Director - Cyber Security (Location: San Ramon, CA)

Veteran-Preferred Job of the Week

IBM CISO — Cyber Security Forensic Analyst (Location: Dallas, TX)

This is the last issue of the CyberWeekly Newsletter for 2018. It’s been a great start. I’d like to thank CyberWeekly’s readers and early adopters. I look forward to continuing to grow engagement with the cyber security community in 2019. I would love to hear your thoughts about the newsletter and what you’d like to see more of next year.

The CyberFuture

Discussion about this post