Category: Blog

Energy Industry Incident Response

Energy is vital to our everyday life. Companies face a competing demand to preserve data and at the same time continue to function. Experts Lee Neubecker and Geary Sikich give advice on how to overcome these challenges.

The Energy Sector provides the global economy with oil, gasoline, electricity, wind and natural gas. An Energy Industry incident could be a physical attack on a power grid or a cyber attack that stops a company from functioning. The properly planned and orchestrated energy sector incident response will minimize or reduce recovery time and loss. Potentially saving lives! Enigma Forensics CEO & President, Lee Neubecker and Geary Sikich, Principal at Logical Management Systems, Corp. strongly urge all companies to create an incident response plan.

This is the final segment in the four-part series on Energy Sector Cyber Insecurity.

Part 4 of our Global Energy Sector – Incident Response

Energy Sector Incident Response video transcript follows

Lee Neubecker: Hi I’m here again with Geary Sikich, and we’re continuing with our final fourth part segment in this discussion about global cyber insecurity as it relates to the energy sector. And in this segment, we’ll be telling you a little bit more about some of the things that need to happen, related to the incident response of a data breach, for the energy sector. Geary, thanks for coming back.

Geary Sikich: Thanks Lee for having me. I think this is, probably one of those areas that are challenging to talk about.

LN: Yeah, certainly, and at the forefront, when things first go wrong, there’s a need to immediately take action to help preserve the data, and collect data so that it can be analyzed. But at the same time, there’s a competing demand for wanting the organization to function. And sometimes those two needs, create conflicts.

GS: Yeah, they sort of butt heads if you will. Yeah, I think the issue for a number of organizations, and I’ve experienced being in the kind of command center if you will, of organizations where their website had gone down. And it was, one of these where a lot of stuff was processed through the portals that they had there. Suddenly there was this pressure to get things back up, and then to look at, what is this costing us? Because now our customers cannot execute their orders and whatnot. And that becomes a challenge because it’s the urgency issue. The other aspect is that when we look at incident response, and this is a little bit different from the typical natural disaster incident response. If I’ve been breached in a cyber incident, how long is it before I actually realize that I’ve been breached? It may not happen very quickly, it could be very subtle. And things could be manipulated, and suddenly I’m in a situation like some of the big companies that had data hack, where all the sudden personal accounts of cardholders are exposed. Now, what do I do? So there’s a lot of not the only rapid response that’s needed, but a lot of consequence analysis that’s really needed.

LN: Is it?

GS: How do you do that and yet maintain, as you were saying, and begin to look at that.

LN: Yeah.

GS: From, not really a legal standpoint, but, from a defensive standpoint.

LN: Yeah, well there’s a lot that needs to happen in a short period of time, you have the collection and preservation. Which, forensic professionals are often called in, such as myself. To collect the data. Firewalls, servers, logs. Then you also have the analysis of that data to determine, what are the motivations of the attacker? Was it an attacker? Was it negligence? You know, oftentimes things go down, people assume it’s a cyber attack, external. It could be an internal attack, it could just be something as innocent as, I’ve seen a new system coming online that’s supposed to help back up and provide redundancy, actually reformat a storage NAS array, that it was supposed to help protect. So, these things can happen. And quickly understanding, making sure that data doesn’t disappear that could be used to rebuild is important And that’s where bringing in the outsider’s important because someone new coming in doesn’t have skin in the game. And, you really need that objective party, to help you figure out what’s happening.

GS: But I think that in that respect when you bring in someone from outside, they also have a vested interest in making sure that, from not only a reputation standpoint but also from the standpoint of the viability of their services, making sure that they’re helping to alleviate the issue. And to bring back some, equilibrium if you will. So there’s this issue of consequence management that comes to bear on those–

LN: And you have some conflicts that happen with having the people that were, kind of in charge of watching over the equipment, do the investigation. And that can cause some, serious problems to the organization. And it may be very well that, the attack wasn’t the fault of the people responsible for managing it. But, if for instance there was, an action that took place that might show some carelessness or mishandling of events by the people in charge of IT, there’s a real risk there that, that person might take actions that could result in further data destruction. In an effort to cover up, what had happened.

GS: So now in that respect, we need to protect, we need to begin to look at how we manage the data collection post-incident, or during an incident, if you will. There obviously some legal ramifications.

LN: Yeah well whoever does this might have to testify. And that’s another reason why having a third party come in to do this work is important. Because you may want, legal may want to know, “well before we put an expert up to testify in this, “just tell us what happened and how do we respond? “How do we get ahead of this?” If it was a problem with a vendor, you want to know that. Because the clocks ticking. You know from the time a data breach is confirmed, it is a real data breach and known, to the time it has to be reported, oftentimes its thirty days. So there’s not a lot of time, to wait around If your data breached before you get in your expert, your forensic expert to inspect.

GS: Okay, so we’ve got a legal consideration, that has to be looked at. Insurance today has changed in a lot of respects. So, business interruption insurance. Obviously, that’s a critical area because if you want to file a claim–

LN: Yeah you have to report it to the carrier, or even if you have cyber coverage, it might not be covered if you failed to notify the insurance company of the incident.

GS: So, when I look at that aspect and say, “I’ve got a business interruption policy,” you mention cyber. And now I know that there are other writers to those policies. Like for terrorism and things like that today. If I don’t have a cyber writer, which is a contingent business interruption issue, my business interruption insurance may not cover me, on something like that. So it really becomes more incumbent to have one, the knowledge, two, to be able to look at the legal considerations, three, to begin to understand insurance laws, what do I have from a coverage standpoint? Which is where the traditional risk management group comes into play. But IT’s got to coordinate with them, to ensure all that.

LN: Exactly, and I had Todd Rowe on my show, who’s an insurance cyber attorney, that deals with these coverage issues. So, that’s an excellent video to watch that delves into that more. The other things though with incident response, you know you have the potential PR issues that relate to being data breached. So really, you need to assemble your team, your in-house legal, your HR, your media advisor. Preferably you have a PR firm that has dealt with data breaches before. And then, you’ve got to put together a plan. And all this stuff needs to be going on in parallel. So while that’s happening, your internal people are probably trying to work on, getting their disaster recovery systems restored. You might even have an outside IT provider come in and help bring those systems back up online. The workload that happens when a data breach has occurred, is such that it really isn’t pragmatic or practical to try to have internal IT do all the work. And it also isn’t covered by insurance typically. The outside providers will usually be covered, but not the internal people.

GS: So, if from a structural standpoint, and I’ll draw this to the areas that I worked in many years back after some of the events in the energy industry. Oil spills and things like that. Where industries adopted what they called an incident command system. The United States now has the National Incident Management System. So with cyber though, the composition, in terms of that team, is not necessarily the same that we would see in a typical, incident command system as is generally presented. So from a functional standpoint, I think that there are some things that I would look at. One, somebody’s got to be in charge. Two, somebody’s got to look at planning. What’s going on, and future planning, what do we do? Three, operationally, what’s effected what’s not affected? How do we keep it from cascading? Four, a communications perspective. Internal and external. An administrative function, which looks at the financial aspects. An infrastructure function, which again, internal-external infrastructure. And then, the aspect of, you know, bringing this all together as a team. Your HR people, all these other things. So, yeah.

LN: That was an excellent wrap-up Geary. I really appreciate you being on the show. If you liked this video, please share it. And check out the other segments we did as well. Thanks again Geary for being on the show.

GS: Thank you, Lee. Very challenging to present on this topic. So much.

LN: Be safe.

Watch the other segments in our Cyber Insecurity in the Energy Sector Series.

Energy Sector Detection

Energy Sector: Intrusion Detection

Energy Sector Protection

Energy Sector Protection

Energy Sector Global Cyber Insecurity

Energy Sector: Global Cyber Insecurity

Enigma Forensics related video blogs

Data Breach Impact Analysis
Hospital Data Breached
Cyber Insurance Coverage
Top Ways to Protect Your Home from Cyber Attacks

Energy Sector Protection

The Energy Sector must protect the electric power grid system, oil, and natural gas infrastructures from the ever changing cybersecurity environment. Enigma Forensics CEO & President, Lee Neubecker and Geary Sikich, Principal at Logical Management Systems, Corp. cover the many steps necessary in detection and protection against any and all threats.

As global unrest heats up, the Energy Sector has to maintain its cool. What is the energy sector? The oil, electric power grid, natural gas refineries, and pipelines are all part of the intricate web of the energy sector. To avoid a disaster they must wrestle with the ever-changing cyber security environment, protect themselves from internal and external threats in all of the energy sector infrastructures all while keeping up with energy demands. That’s a mammoth task! Both experts agree Energy Sector protection can be achieved if approached with precision. Enigma Forensics CEO & President, Lee Neubecker and Geary Sikich, Principal at Logical Management Systems, Corp. cover the many steps necessary in detection and protection against any and all threats.

Part 3 in the four-part series on Energy Sector Cyber Insecurity.

Part 3 in our Global Energy Sector Insecurity

Lee Neubecker: I’m back again with Geary Sikich and we’re continuing our series discussing cyber global insecurity, as it relates to the energy sector. And in this segment, we’re going to talk more about things that can be done to help protect against these cyber threats.

Geary Sikich: So Lee, when we look at protection, I think there’s a three-level process and I think you can describe some of the things that have to go on in these three levels. Strategically, I put together a business plan for an organization and that organization sets goals and objectives, one would be to have cybersecurity. Now, how do I execute that, what are the things that, at the operational and tactical level, the things that really are going to prevent, what are those things, what are those things that are going to help me?

LN: Well, much like we were talking before about detecting compromises, having a solid inventory on what your digital assets are, what computer devices, what cell phones, if you know what your devices are and you have that information available, you’ll be able to spot when something goes wrong. So, part of protecting is doing the bean-counting work of inventorying your digital assets.

GS: So, it’s not just an audit process, it’s a much more of a detailed look at what those assets consist of?

LN: Yeah and once you know what your assets are, you can figure out, who are they assigned to? If someone leaves your organization, you should have accountability steps in place to retrieve those assets. You should also be inventorying the state of those assets, are they fully patched and up-to-date? If you’re not patching your devices, you’re at great risk of cyber compromise.

GS: So is identity, not only do I have to worry about being compromised from an external source but I also have the internal threat of a disgruntled employee, of someone leaving the company, not with any mal, you know, intent, no malicious intent, if you will but just not following up on what I should have done as they out-process.

LN: Exactly, password rotations, people have weak passwords, people become compromised, people reuse their passwords. As someone reused their password for one of your important infrastructure systems on a popular social media site and that site becomes compromised, guess what, those passwords get loaded up into software for hacking and they do what’s known as “credential-stuffing attack”, they loop through and they fire at every device they can using the username and password, the known username and password and that’s how a lot of people fall prey to attacks.

GS: So, in that context, should you store passwords via one of them, like Google Chrome or some of the other, Internet Explorer, those types of things, should you store passwords that way?

LN: I recommend against storing it in your browser. If you’re going to store them somewhere, I think a password management tool like LastPass, that has two-factor capabilities, two-factor authentication essentially means that you have to know your, it’s something you know, plus something you have or something you are and in the case of LastPass, you’re typically using either your cell phone with an app that has an authenticator, that’s something you have, plus your master password and that helps protect against someone intercepting your password and being able to log on.

GS: So, in essence, protection is not a simplified process, protection is something that we have to, sort of, dedicate ourselves to conscientiously and make sure that we continue to maintain an up-to-date awareness, in order to be able to fully protect ourselves.

LN: Exactly and that brings in your staff, you need to know that your staff are being educated about popular ways that companies become compromised like if a bunch of USB devices are dropped in the parking lot, they might say things like “payroll” or something on it, would your employees plug that into your computer, you know, are you testing for that? You know, there are things you can do, there are services out there where you can have your own organization spearfished by a white-hat hacker, that’s going to tell you who clicked and then you know who you need to educate.

GS: So, we’ve made two points thus far on protection. One is that it needs to be part of the business plan, it has to be audited. In terms of auditing, knowing what you have devices-wise. Second is that you have to have educated employees. Now, both of those aspects present somewhat of a business conundrum, if you will. Education doesn’t necessarily equate to dollars coming in but from a protection standpoint, I think the sales point would be that it prevents dollars going out and the better educated, the more aware so that we can look at the other aspects that we discussed, detecting and protecting being two.

LN: Unfortunately, if you run an organization today, you have a new job, which is to make sure that you’re cyber secure and it’s a serious threat that corporate boards are making their CEOs accountable for so you know and it’s multi-faceted, you got to train your employees, you got to nail what you have, you got to make sure what you have is up-to-date and patched and then you also need to make sure that you have some mechanism to monitor and record events so that you can tell if you become compromised so the protection really requires much more today than it used to, it’s, the number of ways that an organization can become compromised, can be via an employee’s cell phone that becomes compromised and then it launches an attack on your internal systems.

GS: So, in the, it’s kind of like the mindset, if you will, has to be changed, in terms of looking at management and their commitment to cybersecurity protection. In the days past, we looked at protection. “What can I do, put up a wall, what can I do, “I can physically protect my facilities and my operation.” Now, today, that becomes more of a challenge because we’re dependent more on things that are not necessarily in the realm of physical protection per se so we really have to be getting to rethink how we look at protection and then ensure that the process is continuous, not a one-time situation.

LN: Exactly and certainly, you know, a DR, known as disaster-recovery planning and contingency planning can go a long way, you know, a simple act of making an offline backup on a periodic basis and you know, maybe that’s only once a month for some organizations but at least, if you have something offline, if you get hit by a Cryptolocker attack, the risk comes down to “well, what does it cost “for us to rebuild the last month?” Or maybe it’s the last week or maybe it’s last night so thinking through, I think going through the disaster-recovery planning exercise is a really good way to help protect your organization.

GS: Okay, I agree with you on the planning aspect. The caution I would say with that is that all too often, organizations develop disaster-recovery, business continuity, other types of plans to deal with emergencies, the response. The challenge is that those plans need to be kept, as you did say, with the cyber up-to-date and consistently reviewed, we have to have it in the mental work.

LN: And that’s where having someone like you and myself come into audit the business risk and actually inspect to see is the plan being followed, is the C-suite having a false sense of security because there’s this plan that was produced years ago, that no one’s really looked into, you know, it doesn’t take but you know, I think, you and I onsite for one day, we could help poke holes and give a report of, is an organization following their plan or does it look like everything’s far off but you’re not going to get that reporting from your own people internally.

GS: Yeah, I think it’s a challenge for people internally because there’s a vested interest, number one. Number two, they think that, in a lot of respects, they’ve done what needs to get done. The other aspect and I think this is important from what you pointed out, is that when you begin to look at today’s plans, you have to realize, they’re kind of reactive, in many respects, they’re not very proactive so they react to an event happening. That’s good because that helps companies become more resilient but it doesn’t keep them from protecting themselves as they need to.

LN: Exactly but there’s also a financial component to these plans, you know, it’s not uncommon that IT, they’ll go through this exercise and then afterwards, they’ll say “well, I need this subscription, this software, “I need this vendor” and none of that funding comes through but it’s much better and that sometimes gets lost in the minutiae from planning to execution and if that, in fact, is happening, you’ll want to know about it before you need the DR and it’s not there.

LN: So, I think that wraps up our section on protection. In our next segment, we’ll be talking a little bit more about responding to the crisis of a cyber breach, as it relates to the energy sector.

Watch the other segments on Cyber Insecurity in the Energy Sector

Part 1 – Global Energy Sector: Insecurity

Energy Sector: Global Cyber Insecurity
Part 1 Global Energy Sector Insecurity

Part 2 – Energy Sector: Intrusion Detection

Energy Sector: Intrusion Detection
Part 2 Energy Sector: Intrusion Detection

Watch other related video segments

Cyber Readiness: Power Grid Outages
Energy Sector and Cyber Readiness
Info Security Risk Assessments

To learn more read this government report about Cybersecurity for the Energy Sector delivery system

https://crsreports.congress.gov/product/pdf/R/R44939

Energy Sector: Intrusion Detection

After the most recent Iranian attacks most people don’t think about the danger to our Energy Sector that lurks in the global underworld. Cyber Security Experts Lee Neubecker and Geary Sikich are on the job! They say we can tighten our security and detect cyber attacks before they happen.

Energy Sector Intrusion Detection is complicated and delicate and necessary to maintain our power grid. The Energy Sector provides energy for the world and must be secured and protected. Many detection tools and resources of expert precision are used to ensure the security of these precious resources. Think about it? What do you do on a daily basis that doesn’t involve energy or some type of energy? Enigma Forensics CEO & President, Lee Neubecker and Geary Sikich, Principal at Logical Management Systems, Corp. put your mind at ease and dissect cyber security and intrusion detection systems that are utilized by the Energy Sector.

This is Part 2 in the four-part series on Energy Sector Cyber Insecurity.

Lee Neubecker (LN): Hi, I’m back on the show again with Geary Sikich, thanks for coming back on the show.

Geary Sikich (GS): Thanks for having me back Lee.

LN: So we’re continuing our series discussing about global cyber insecurity as it relates to energy sector. In the second part of the series we’re talking more about detection of compromise. Um Geary, what’re your thoughts in this area?

GS: I believe that there’s a lot to be looked at in terms of the detection aspect, and this is one of the areas where you from a forensic standpoint, provide sort of a critical juncture, what’re you seeing that the general person, and even the general employee of the utility, might not be seeing? And might not be aware of?

LN: Well we know from reports by Dragos Cyber Security firm, that there’s a number of groups, I think around 11 groups are specifically targeting the energy sector. This report just came out this month, so there is a heightened attack readiness requirement to defend against these attacks. And the key thing that organizations need to be doing is they need to know that they have their firewall actively logging, and they need to be looking at those logs.

GS: Those are all state sponsored groups, right?

LN: Well, we don’t know exactly who they are, there could be terrorist cells, the Dragos report doesn’t give attribution as to the entities behind them. They describe the types of attacks, and the character of the attack methods, but there is a number of them that you can check out, there’s a link that will take you to their report if you’re interested in reading it. But you know, often times organizations fall compromised, and they don’t know it, and these things go on for a long time. There was a credit reporting agency attacked recently, for instance.

GS: So from a detection standpoint, the challenge that industries are faced with, cause our focus is going to be on the energy industry, so we’ll get energy industry. In general, the challenge that they face then, is that it’s not just what we perceive could be state sponsored hacking of their systems, it could be individuals, it could be terrorist cells, it could be pretty much anyone with a desire to infiltrate a system whether it’s to do harm, or whether it’s just to see if they can do it

LN: Exactly. The barrier to entry to launching one of these attacks is much lower. It requires knowledge, but the knowledge could be in the head of a teenager, that got rejected at school and wants to take the power out in his town. So that’s a legitimate problem. Now related to detection, I mentioned the firewall logs, there’s a great product out there called, Canary. Have you heard of it?

GS: No, it’s new to me.

LN: Essentially, it’s a company they tell these little devices, you deploy in your network, and they can pretend to be a payroll mass, health care information system storage database, or you can make it be whatever you want. But it’s essentially trying to lure an attacker. So if someone’s in your network, there going to scan your network to look for resources and it will detect people trying to brute force that item. So these items are a great way to have another way of knowing are you compromised. If organizations that had recently been publicly compromised, that didn’t know it for many years had some of these devices in place, they would probably know pretty quickly, like within a day or so, of someone getting through their firewall.

GS: So the challenge then I guess, from a detection standpoint, and the way we’ve seen it, and in discussions with organizations that I’ve worked with. Is that it’s not a single point of penetration that we have to worry about, it’s become multiple points of penetration, and multiple points that are not necessarily hard wired into the operating system. So utilities in a lot of respects have gone out to do with their status systems, monitoring your water usage, or electric usage, all remotely, and you periodically might see a utility vehicle drive by, and they may have a cellular type phone system, that goes by and scans your homes to see what your energy usage is. So those all become a factor. We get into detection in terms of things, we’ve mentioned today shipping is a big issue, and we mentioned with the current situation with Iran, the concern over the Strait of Hormuz, but shipping in general, navigation systems, have been targeted, not only by state actors, but by other groups. So you have navigation systems which is not just water born shipping. Think of where navigation systems are today. Look into your pocket and see your cell phone.

LN: Well we had the recent issue with the Boeing Max airplane, it turned out the sensors were damaged. Well these sensors they’re called MEMS sensors, they’re a combination of electro-mechanical sensors, and if the chip is hit at the frequency that matches the natural frequency of the component board, it can actually cause the chip to malfunction and report erroneous readings temporarily. Or if the frequency matches and it’s of a great enough amplitude it can actually damage the chip. And there hasn’t been much discussions about whether these chips were cyber-attacked but it’s very possible, if you look up University of Michigan, they have research on MEMS chip sensors and interestingly enough, the patent for these sensors was a Boeing patent. So there’s not a lot of talk about that and I think more likely if the chips were damaged, it’s more likely they were damaged while they were on the ground interestingly enough, the two crashes that occurred were in countries that had a lot of terrorist activity.

GS: I think the other aspect with detection is that when you begin to bring out a point like that, people have a tendency to assume durability of systems when systems can be very sensitive to, if you will, shocks, minor shocks to the system. So it’s not necessarily the physical attack, you could take the example recently Puerto Rico has had an earthquake. What damages were incurred by the, on their systems as a result? That are undetected yet. The sensitivity of systems I think has become really critical in a lot of these aspects.

LN: But like with these chips we’re blending mechanical with computer embedded processors. So like these chips think of an opera singer, that sings the natural frequency of a wine glass. If he sings it loud enough, that glass will shatter. It’s the same concept with this chip. You can fire sound at it, if you’re close enough, or if you have a strong enough amplifier, you could fry it. Now that could happen, a drone could potentially launch a sonic attack, someone onboard, a passenger could do it, cleaning crew coming through could do it. So these are some questions that it’s kind of a new paradigm but we even had issues with military aircraft having this uptick in crashes, and these same types of systems are in the newer military helicopters and planes and whatnot. So I think it was good that the military grounded some of these devices that were having these problems, And you know the investigation, I’m sure, continues and the public may not fully be briefed on this, but it is a threat that needs to be detected before people die.

GS: So the real issue with the situation that we’re in, with this kind of global insecurity if you will, is our ability to detect has been I’ll put it in these terms, if our ability to detect has been compromised by virtue of the disruptive technologies that exist that are making detections more and more of a challenge, because they’re becoming more and more subtle in how they entered in the system. So I can have a system that looks like it’s working perfectly, and yet at a point be compromised like the mechanical system that’s supposed to open a valve, and it’s been doing it for a long time, and then suddenly it either leaves it open, or completely shuts it.

LN: This is where it’s important that these entities have an accurate inventory of what their equipment is, and they also have an accurate inventory of the embedded systems and what that software code should look like. And they should have procedures in place to periodically verify that the embedded firmware chips that do these functions haven’t been altered. Otherwise they won’t even know, and something could happen at a very critical time. So that wraps up our section on detection. In our next segment will be talking about helping to protect against these types of attacks.

GS: Great.

Watch the other segments on Cyber Insecurity in the Energy Sector

Energy Sector: Global Cyber Insecurity
Part one of our four-part series on Energy Sector Cyber Insecurity

Learn more about cyber security and data breach from Enigma Forensics.

Cyber Security Summit in Chicago
Computer Forensics & Cyber Investigations
Data Breach Impact Analysis
Info Security Risk Assessments
Cell Phone Forensics
Photo Forensics
Cell Phone Privacy

Check out the government’s directives on cybersecurity as it relates to energy infrastructure.

https://www.energy.gov/ceser/activities/cybersecurity-critical-energy-infrastructure

Check out what ComEd is doing.

https://www.comed.com/SiteCollectionDocuments/SmartEnergy/SmartGridAndDataSecurity.pdf

Energy Sector: Global Cyber Insecurity

Global Energy Sector Cyber Insecurity can lead to complete chaos that will be felt throughout the world. Neubecker and Geary Sikich who are experts in cyber security and incident response share their solutions.

Energy Sector: Global Cyber Insecurity can lead to global calamity. If a major attack happens there would be a cascading effect with catastrophic results. In lieu of the most recent Iranian conflicts, the Energy Sector, as well as Corporate America, has been warned by our government to be aware of imminent security threats. Enigma Forensics CEO & President, Lee Neubecker and Geary Sikich, Principal at Logical Management Systems, Corp. take apart the many threats that will affect the Global Energy Sector. Starting with SCADA, which is a computer system for gathering and analyzing real-time data. Cyber Insecurity means if hacked the SCADA systems would have a rippling effect.

In this four-part series, Lee and Geary will discuss cyber threat detection, protection and global incident response in the Global Energy Sector.

The video transcript for Energy Sector: Global Cyber Insecurity follows.

Lee Neubecker (LN): Hi, I’m here again with Geary Sikich on my show. Geary is the president of Logical Management Systems, a business consulting and risk advisory firm. Geary, thanks for being on the show again.

Geary Sikich (GS): Thanks for having me back, Lee.

LN: So today we’re going to talk about the current state of global cyber insecurity. News events have been published detailing Iran’s potential cyber response. The energy sector has been put on notice to be looking out for attacks, as well as corporate America. So Geary, what is the current state of cyber risk as you see it?

GS: I think it’s kind of appropriate to begin to look at it as you introduce it, global insecurity. One has to begin to look at how secure are you? And in the context of how secure are you, how secure is our infrastructure. All the things we depend on for our day to day lives. And how we live, literally. So everything from your food on the table to the heat, to clean water, to your heat in your home, et cetera, all become potentially

LN: Transportation, travel, and fulfillment.

GS: Road systems, everything that’s out there.

LN: So we’re going to be talking about the highest areas of concern where a rogue terrorist organization might want to strike or a nation state that we’re at odds with. And unfortunately, we have quite a few. Later on in the second, third, and fourth segment we’ll be talking about detecting threats. In the third segment, we’ll be talking about protection against that, things that can be done proactively. And then finally, in the fourth and last segment we’ll be talking about responding to compromises, incident response, and how to recover and get back up online. So Geary, can you give everyone an understanding of what encompasses SCADA devices and what SCADA means?

GS: SCADA systems were developed for the use to control operations and utilities and other areas. It’s called the Supervisory Control and Data Acquisition.

LN: So what kind of devices make up SCADA devices?

GS: Everything from the control of pipelines, utility, electricity functions, all the way onto healthcare, pacemakers and other types of systems.

LN: CPAPs. So these are critical systems. These are systems that if someone wanted to cyber attack and really hurt us, they’re natural targets. And they’re classified as such because they have to be regulated and handled in a way to help keep them safe.

GS: Yeah. And the problem we face is not that these are systems that are so vulnerable, the problem we face is that because of the technology that we’ve embraced over the years since 1999, so that’s what, almost 20 years now. Or it is 20 years now. That those systems have become so embedded that we have gotten rid of the manual systems that they replaced. So things like switching for railroads. You would be hard pressed to find manual switches available to the industry. Because they got rid of ’em, and they were scrapped, and they’re gone. No once produces them, or should I say, they’re produced in limited quantities. And they’re hard to get. The things we depend on in a lot of respects for the smooth running of our infrastructure become very critical to us because there are no alternatives for those systems. And as a result, we become more and more vulnerable to a infiltration of the systems for disruption.

LN: And then we also have what’s known as FPGA’s, Field Programmable Gateway Arrays. They’re microprocessor controllers that can be programmed that can actually be altered by an attacker to change how these systems function, the logic that works. We can only think of, what would happen, Geary, if a nation state that we’re in a conflict with, what would happen if the water filtration system sensors were altered to put water out that appears safe but isn’t?

GS: I think you see a lot of that today simply because the threat levels are such that we have to make sure these systems are so well protected. And unfortunately, the ability to protect the systems is not necessarily as good as it should be, let me put it that way. It’s not that they’re bad, it’s not that they’re behind the times, it’s just that they’re trying to keep up with things that are changing so rapidly. Technology disruptions, and disruptive technologies today have made a lot of systems sort of antiquated before their time. And the problem is that, to keep up with replacement, to keep up with the viability systems becomes another burden to the system. Another critical issue in this global insecurity aspect is look at the talent pool that’s out there in the workforces, and you start to begin to realize that there are very few people that are talented in the areas where we need them. I think in our last segment that we did I mentioned that in the energy industry, nuclear engineers, petrochemical engineers, desperately needed areas because their workforce is transitioning and the skill levels are not there. So that becomes a real challenge.

LN: Just the past, in this month alone, cybersecurity firm Dragos issued a report showing that there is a number, I think around 11 groups that are actively targeting the energy sector and trying to take out various providers of energy. Oil, gas, you know, nuclear. There’s other threats there. You know, locally here in Chicago, you’re in Indiana, we’re in Illinois, what part of the energy sector to you think is at greatest risk?

GS: Well, I think the interesting point with that is that the bigger players, Commonwealth Edison, NIPSCO, Northern Indiana Public Service, are doing their part to ensure that their infrastructure is well maintained and protected. The problem we run into is that they’re not the only utility providers. If you look at across the United States, there are so many smaller utility providers, co ops, small utility companies, that don’t necessarily have the resources

LN: They don’t have the scale.

GS: Yeah, the skills. And the problem that they encounter and we encounter as a result is that they are critical links in the grid system. So everything from water, gas, electric, telecommunications, et cetera, all dependent on a lot of these small players. And getting one to go could potentially offer cascade effects to all the others. And as it cascades, things can get even more disruptive.

LN: So you could actually take down the big electrical utility by getting enough of the small, vulnerable electrical co ops and launching a cyber attack on the electrical co ops to then take out the big giant. Because when these happens, you have power imbalance. And Kirchhoff’s Law dictates the flow of electricity, and it will flow where it’s weak, and the current flows, well that can cause line tripping and power outages.

GS: Yeah. And I think the thing that people have to realize is that the apparently most vulnerable things are not necessarily the ones that are the most visible. And I say that in this respect, we look at power plants, we look at nuclear plants, and there’s a fear of someone attacking the plant. In reality, it’s the part of the system that are not related, or that are related, linked to the power plant, but not directly.

LN: It’s an interconnected system.

GS: It’s the transformers

LN: Everything from endpoint demand to supply. And in our prior video we talked about manipulation of endpoint demand that could cause a cyber attack.

GS: And it’s the step up and step down systems. When you generate it, electricity’s stepped up, it goes over transmission lines, it goes to a point, it’s stepped down and then it goes in the user groups, the residential, your cities, your smaller industries. So you start seeing these as being potentially vulnerable in a respect. In terms of vulnerability is that we have to begin to look at the users and begin to differentiate which ones are what we call interruptible and which ones aren’t.

LN: So in our next segment, we’ll be talking about detection of these threats, and then finally after that, the third segment we’ll talk about protecting and what organizations should do such as electrical co ops, things they can do to get ahead of this. And then when things invariably do go wrong, finally we’ll talk about incident response. So tune in next time, and please, we appreciate your shares, likes. Sign up for my YouTube channel if you liked this and you’ll get alerted when we publish the next one. Thank you.

Learn more about Global Cyber Security from Enigma Forensics

Cyber Readiness: Power Grid Outages
Keys to a Secure Supply Chain
Data Breach Response
Data Breach Impact Analysis
NIST 800-53: Security & Privacy Controls
When to Select A Computer Forensic Expert
Naval Air Station Attack: Cell Phone Privacy

More on Global Security …

Here is the bulletin issued by the Department of Homeland Security on Global Security

https://www.dhs.gov/national-terrorism-advisory-system

Check out this article warning about Iranian Cyberattacks

https://fortune.com/2020/01/16/iran-cyberattack-false-flag-russia/

Naval Air Station Attack: Cell Phone Privacy

The recent Pensacola Naval Air Station shooting left the FBI with the assailant’s locked iPhone. Apple has refused efforts to assist with bypassing the security features. Should legislation require Apple provide a back door to law enforcement? Hear more about the cell phone privacy debate between two noted cyber and privacy experts.

On Friday, December 6, an aviation student from Saudi Arabia opened fire in a classroom at the Pensacola Naval Air Station (NAS) killing three people in the attack and injuring eight others. Another Saudi student recorded the shooting events as it unfolded. The shooter was identified as Mohammed Saeed Alshamrani, an aviation student from Saudi Arabia. The assailant’s name doesn’t really matter because the question in these national security threats remains the same.

How does law enforcement obtain personal information off smart devices in a timely fashion?

What role does cell phone privacy play when it comes to terror attacks such as the most recent Naval Air Station attack?

Leading computer forensic expert Lee Neubecker, CEO & President of Enigma Forensics discusses with the Data Diva, Debbie Reynolds of Debbie Reynolds Consulting about the many technical tools in their arsenal that’ll offer solutions in these cases.

Lee Neubecker and Debbie Reynolds discuss cell phone privacy as it relates to national terrorist acts

Cell Phone Privacy: Naval Air Station Attack – Final Video of 4-part series

The transcript for Cell Phone Privacy – Naval Air Station Attack follows:

Lee Neubecker: Hi, I’m back again with Debbie Reynolds, the data diva. Thanks for being on the show again.

Debbie Reynolds: Thank you, Lee.

LN: So, we’re finishing up our multi-part series relating to cell phone forensics, as it relates to the FBI’s desire to get Apple and other information from the cell phone makers so that they can unlock their phones.

DR: Right, so there was a recent shooting, unfortunately, in Pensacola, at the Naval Air Station and because there were people who were recording the attack, they’re interested in being able to get information from those cell phones and this is renewed calls, as was the case with the San Bernardino attack in California in 2015, to have Apple help law enforcement unlock particular cell phones of folks.

LN: Yeah, as Debbie was saying, with the Pensacola Naval Air Station, what had been reported in the associated press was that a Saudi national student who was getting training out of the navy facility, which, our government trains foreign nationals and other militaries and has been doing that for a long time but some of the Saudi students had been watching, earlier that evening, they had been watching videos of mass shootings before the shooting took place. And during the shooting that she said, one of the students had been recording the events as they unfolded and likely has data on cell phones and other information.

DR: Right, I think the issue is, you know, is law enforcement able to get this information without accessing the cell phone and the chances are, possibly yes. But there are many different ways to get it.

LN: Yeah but this week they asked Apple for help to get in and they said they haven’t been able to get in the phone but like what happened with San Bernardino, it’s not entirely clear if they had fully used their capabilities, like their mobile access unit, had that unit exhausted their capabilities, had they reached out to third party vendors and computer forensic consultants and firms, like myself or others.

DR: That does this every day, yes.

LN: Or even the Israeli firm, called Cellebrite, which makes the equipment used by many forensic people, like myself, that was ultimately successful in unlocking the San Bernardino terrorist’s phone.

DR: Well, the one thing I will say is, in 2015, the phones have gotten a bit more advanced, the encryption is better but if, for example, people are taping things on cell phones, typically, they’re sharing it with other people so you may be able to get the information from another person’s phone, if the phone is backed up, you may be able to get the data from a backup, you may be able to get phone records about who they were calling or who they were texting, even though you may not get the actual footage, there are a lot of different ways to triangulate this information.

LN: And if they plugged their cell phone into their computer, a lot of times, it will automatically create a backup file but, in this case, I think the, you know, the FBI has a legitimate interest in wanting to know who were they texting right beforehand, were other people involved so I support that but I think that there are different means of how to accomplish their goal.

DR: Absolutely, absolutely. So, I think, the way that the story was told in the media, it makes it seem as though the only way the information can be gotten to is to have Apple or other cell phone makers create a vulnerability that anyone can use on any phone and I don’t think that that’s exactly true.

LN: No.

DR: Because we’ve not seen that in the field and many of us work with cell phones every day.

LN: Well, there was, recently disclosed, a vulnerability in every iPhone up to, not including, the very latest model but every iPhone relating to the Bootrom, where the phone can be, you know, basically, bootlegged and taken over until it’s rebooted, then it resets so I’m sure that there’s already bypass means on 95% of the iPhones out there, since most people aren’t running the latest model but again, the concern here is that it almost seems like there’s an effort to try to change the policy, you know, Director Comey, from the FBI, Former Director Comey had repeatedly stated that we need to be able to defeat encryption but by its nature, it’s like saying everyone should have weak locks on all their doors and companies shouldn’t lock their stuff up so that’s going to lead to problems in, you know, as I said, in the prior segment, a multi-key solution that has unlocked but specific to an individual user’s cell phone, with approval by the court, I think that is a much better solution than having a master key that can open up any phone.

DR: I think so and, I mean, we’ve seen in other cases, even though it’s not about terrorism, obviously, with the Jussie Smollett issue in Chicago, they were able to get a ton of information so they went to Uber, they had surveillance cameras, they had phones, I mean, the–

LN: They get GPS records on phones.

DR: Oh, all kinds of stuff.

LN: You can get cell phone tower records and then you have all these third-party apps like, you know, the secure Signal and WhatsApp, well, is it very secure if you get one of the two phones?

DR: Right.

LN: Not exactly because you can see all the messages.

DR: Oh, absolutely and I think Paul Manafort, unfortunately, found this out the hard way when he was using WhatsApp to chat with people about illegal dealings and the forensic folks were able to get the exact chat and all the texts because he had backed it up to his iPhone or his iCloud, I believe, so.

LN: It’s interesting now, you discover, these days, when things get involved with what was intent on a business deal gone wrong or was there fraud or misrepresentation, you know, getting, finding out what the text messages are and who was texting with which party and what did they say, that can be very important and litigation, still, it seems that text messages are just starting to come upon the attorney’s radar, for asking for that information.

DR: Well, it’s coming up on their radar ’cause people use many different means so someone may start with an email and then go to maybe Snapchat or go to texts, so.

LN: Or Slack.

DR: Or Slack so there are many different, yeah, right.

LN: You’ve got these other platforms that are just, that should be part of the discovery, that are getting ignored, unless you have an attorney or advisors, like us.

DR: Yes.

LN: Helping to make sure that you get that information.

DR: Exactly, exactly, it’s not easy because it’s not as linear as you think it would be but if you know that you have this information, that it’s out there, it’s possible to find ways to get it. Obviously, the cell phone would probably be the easiest way to at least be able to help you point to where things are but there are different ways to be able to get the information, not necessarily, so you do need the cell phone for the actual texts, the text message but.

LN: But sometimes people have that hooked up to their computer too.

DR: Yes, that’s true, right, that’s true.

LN: So their computer might have, you know, people who have an Apple laptop and running that, you might be able to get the messages off the laptop, which is yet another means of getting the data and then, you know, there are entities that do log the messages in between so you have the servers that they cascade through so there’s a lot of places that the information can be found and, you know, before a mass policy change is made to just by giving an open key, you know, people need to think this through because, you know, we had keys, master keys that open in the past, those keys have gotten leaked and it’s created a lot of problems.

DR: No, absolutely, I think that’s the villain in almost any little movie you could think of, someone who has a master bit of information that can rule the world so this is definitely something that needs to be thought through and we already know that there are, you know, other things that can be done that don’t require, currently, a master key.

LN: Yeah, well, one of the ways that all of you can show your appreciation if you like our videos, is click like, share the videos out and sign up for our blogs and check ’em out, thanks a bunch for being on the show again.

DR: Thank you, Lee, this was fantastic.

LN: Have a good day, everyone.

DR: Goodbye.

More about Cell Phone Privacy

Cell Phone Privacy
Cell Phone Privacy: San Bernardino
Technical Solutions: Cell Phone Privacy
Mobile Phone Forensics
Cell Phone Forensics

Enigma Forensics can help gain access to locked personal devices. Choose an expert!

When to Select A Computer Forensic Expert

More on Naval Air Station: Cell Phone Privacy.

FBI says…Deceased Assailant’s Locked Phones a Hurdle for Investigators.

https://www.fbi.gov/news/stories/naval-air-station-pensacola-shooting-called-act-of-terrorism-011320

Rep. Gaetz: 12 Saudi cadets sent back home were stationed at NAS Pensacola

https://weartv.com/news/local/rep-gaetz-12-saudi-cadets-sent-back-home-were-stationed-at-nas-pensacola

Technical Solutions: Cell Phone Privacy

Is it necessary to have Apple provide a back door so that law enforcement can access a person’s cell phone? Computer Forensic Experts Lee Neubecker and Debbie Reynolds say there are technical solutions to use instead.

A law-abiding citizen or a criminal’s cell phone can be the largest piece of evidence in a criminal investigation. Once confiscated, cell phones are powerful tracking devices that can be used to infringe on an individual’s cell phone privacy. In this video, Data Diva, Debbie Reynolds of Debbie Reynolds Consulting’s and renowned Computer Forensics Expert Lee Neubecker, CEO & President of Enigma Forensics share their cell phone cracking technical solutions. Is the government’s desire to have a backdoor into all smartphones really necessary? No matter what security measures are placed on smart phone devices, there are many technical solutions available from the computer forensics experts to utilize when attempting to unlock a mobile smart cell phone. Check out this video to learn what technical solutions available that don’t require going back to the manufacturer and asking them to create a backdoor.

Experts discuss unique technical solutions available to retrieve cell phone information

Cell Phone Privacy: Part 3 of 4

Lee Neubecker: Hi, thanks for watching the show again, we’re now talking again about cell phone forensics as it relates to privacy issues and our government’s request to get information on specific cell phone users. I have Debbie Reynolds the data diva back on the show. Joining me again, and to help me elucidate some of the unique issues that relate to the current situation.

Debbie Reynolds: Right, so there are privacy issues obviously with being able to track, or be able to crack someone’s cell phone. In a law enforcement situation, time’s of the essence. They want to be able to get the information on the cell phone the best way that they can. The issue is, and especially with the Louden news reports, they aren’t exactly accurate about how this happened. So in order to do this cracking of certain cell phones, there are things that forensic folks, like Lee can do to actually do this that don’t require you going back to the manufacturer, asking them to create a backdoor. My opinion, and I think this is something that was echoed by Apple in their objection to this. Is that, you know, the iPhone or the cell phone is their invention. And the way that they do privacy for phones is kind of their unique, you know, secret sauce or special sauce so. Being able to, Having to try to do that is sort of the antithesis of what they’re doing, of their invention. And I’m not seeing any court cases where ever. Where someone had to literally create, invent something to sort of negate their own invention.

LN: And even then government, like, our US government has resources to have a lab where they can use equipment to actually replicate all the chips and storage devices. And then make a virtual machine where they can brute-force crack the device without worrying about the three false passwords that slow it down. Because if you virtualize, if you duplicate the embedded memory off the D-Ram, the various chips and storage, you can then set up a mass server farm of virtual machines to just pound away, trying combinations. And with quantum computing, it wouldn’t take much time, but that isn’t even necessary today. There are easier tools to get into the phones, but the real issue becomes if, it would much be like if the government said we want everyone to have one particular key-type for their home.

DR: Right.

LN: So that we have a key that we can take and we can get into any door without having to break down the door.

DR: Yeah.

LN: And the problem with that is, what happens when someone gets fired from the FBI and they copy that key? You know, then we got to lock change every house in America? And every business.

DR: Yeah, who’s to say, I mean not every person who has a phone is a criminal. So if you think let’s say you know 1% of everyone who has cell phones is doing a criminal activity, so should 99% of everyone else have these vulnerabilities that, you know, hackers love to have. They would love to be able to crack into your phone and do different things.

LN: That could actually you know lead to HIPAA violations, you know there are physicians and people that have some medical data as they connect to their work machines. and if there’s this weak backdoor key, that creates a problem. Now, I want to talk a little bit about how I think they could do it and it hasn’t been done yet.

DR: Okay.

LN: But if Apple were to issue, I mean if you have a multi-key solution where anyone key alone doesn’t work. But the FBI could make a request to the justice department, to the judiciary, a judge of some sort. The judge could issue a key unique to the cell phone IMEI identifier, and then that information could be a key that then goes to Apple or to Microsoft or whatever provider, who then generates a key that can unlock the phone. So you can have a multi-key solution, but it’s specific to the phone and that would preclude a situation where any one person’s key gets leaked and all phones are compromised. And, you know, if for instance the FBI’s key that they use to generate request keys, if that got compromised they would rotate that and going forward new keys would be used and they’d invalidate all the others. But you’d have a technical means to still get into the phone without necessarily meaning that every phone is totally open to one key.

DR: I think so, but I think, that’s actually a smart solution. But I also think companies like Apple, and I’m, we’re just picking on Apple ’cause the phone was an Apple phone that we’re talking about. But, you know, companies are in business to make money, and not to be law enforcement. So there’s probably not a lot of money in law enforcement stuff for them, so they may not be compelled, or feel like this is something they really want to invest a lot of time or energy in. Especially because there are smart people that do this for a living and can actually do this work.

LN: I support the idea that if there’s a terrorist out there, that we should have a system that does allow to get into that phone, but there’s got to be a check and balance, it can’t just be one person acting alone or else it inherently makes everything insecure.

DR: I agree, I agree. Yeah, it’s a tough issue, I feel like people get really, sort of, wound up about it. especially ’cause they’re thinking about sort of, patriotism and freedom and stuff like that. But you know there’s a way to solve this problem without creating problems for the whole world basically.

LN: Thanks for watching this segment, in our next segment we’ll talk about the more recent story regarding the Pensacola Naval Air Station terrorist attack, as they’re calling it. And the FBI’s renewed request of Apple to get into the cell phone.

DR: Thank you.

LN: Thanks

Watch the Next Segment on Cell Phone Privacy: Part 3 of 4 continued

Cell Phone Privacy: San Bernardino
Part One on our Series of Cell Phone Privacy as it relates to the user
FBI Warning: Smart TV’s may be spying on you.
Cell Phone Privacy

National Institute of Standards and Technology for company cyber security

NIST 800-53: Security & Privacy Controls
Mobile Phone Forensics
Computer Fraud & Abuse Act Charges Filed

Here’s Apple’s stance on government requests for personal cell phones.

https://www.apple.com/privacy/government-information-requests/

What does the ACLU have to say about personal cell phone privacy?

https://www.aclu.org/issues/privacy-technology/location-tracking/cell-phone-privacy

Cell Phone Privacy: San Bernardino

Computer Forensic Experts Lee Neubecker and Debbie Reynolds discuss the problem that involves government versus cell phone privacy.

Cell phone privacy played an important role in the San Bernardino attacks. On December 2, 2015, Syed Rizwan Farook and his wife, Tashfeen Malik, open fired on San Bernardino County workers at a holiday party killing 14 and injuring 22 others. The FBI wanted Apple to give them access to the perpetrator’s phone.

Apple states, “We built strong security into the iPhone because people carry so much personal information on our phones today, and there are new data breaches every week affecting individuals, companies, and governments.” Apple continued…”We feel strongly that if we were to do what the government has asked of us — to create a backdoor to our products — not only is it unlawful, but it puts the vast majority of good and law-abiding citizens, who rely on iPhone to protect their most personal and important data, at risk.”

Leading computer forensics expert Lee Neubecker, CEO & President of Enigma Forensics discusses the issues relating to cell phone privacy and the government’s desire to have a back door into your smartphone with the Data Diva, Debbie Reynolds of Debbie Reynolds Consulting. These experts have an interesting perspective.

Cell Phone Privacy: Part 2 of 4

The Video Transcript follows.

Lee Neubecker (LN): Hi, I’m back again with Debbie Reynolds. Thanks again for being on the show.

Debbie Reynolds: Thank you, Lee.

LN: So, we’re continuing with this multi-part series talking about cell phone forensics.

DR: Right.

LN: It’s specifically, this section we’re going to talk about the San Bernardino 2015 December attacker that unleashed terror, Syed Farook, and at the time when that happened, the FBI went to Apple and claimed that they needed assistance with unlocking the phone.

DR: Right, so I remember this very well. This was maddening to me, because a lot of the news reports, I don’t think any of them correctly stated how cell phones actually work, and they sort of bungled the information about the cell phone. So, a lot of the articles were trying to say that the only way they could unlock the cell phone is with Apple’s help,

LN: That wasn’t true. We knew that wasn’t true.

DR: No, you know that wasn’t true.

LN: You know, I thought when they were doing that, that they might have said that to put out misinformation so that other people who were communicating with the terrorists might have thought that they were safe. I was wondering if they might have done that on purpose so that people would keep their phones so that they could track and follow other people.

DR: I don’t know, my feeling was that you know, the FBI or whoever was making this request was trying to create a precedent to be able to have people like Apple give them, create vulnerabilities in phones so they don’t have to do this one-on-one unlock feature, but why would Apple or any other company who’s in the business to make money create a vulnerability that possibly could be the antithesis of their invention. I wouldn’t use a cell phone if I thought it was unsafe, right, or insecure.

LN: Well, I just assume they’re all insecure.

DR: Well, as secure as it can be

LN: As secure as it can be, but you know, Microsoft, Apple, they issue patches and updates for security flaws every month, so there are still bugs out there that can be exploited, but when that happened right away, I was wondering why they didn’t call Cellebrite, and ultimately, Cellebrite, Israeli firm, they’re likely the ones who actually got the contract to unlock that phone.

DR: Yeah, right, exactly.

LN: But the whole notion of having a common key that law enforcement can quickly unlock any device without any judicial intervention, it’s a little concerning.

DR: It’s very much concerning. It’s like you’re trying to boil the ocean to solve one problem.

LN: Well, then if you have one key, someone in the FBI leaves, and they take that key with them, then they go and they link it on the Dark Web, and this is the type of thing that’s happened with contractors to various cyber agencies and the government, and these keys get out there, or weapons get out there, and everyone’s getting exploited, and it takes the government a long time to report it to Microsoft, to Apple, and everyone’s getting hacked in the meantime.

DR: Well, and there are a lot of other ways to get stuff off of a phone, so I think of a phone as a gateway to other things. You know, if even you do banking on your phone, if you lose your phone, that doesn’t mean that the information’s lost. You can go to the bank, companies can serve affidavits on different entities that have other information. If a person was communicating with someone else, you may be able to crack their phone, so there are a lot of different ways to solve this problem that don’t require creating a back door for a complete product.

LN: Yeah, and you know to your point about the issue when then-director Comey, James Comey, had testified seeing that they needed help, apparently the FBI’s own remote phone specialization group hadn’t been tasked with trying to get into the phones, so they hadn’t fully explored their own capabilities before they went to ask for Apple, because like you said, they wanted to establish precedent, and they wanted to change how it worked, and I think we’ve consistently seen and heard that the FBI wants full access anytime so that they can protect people, and there are some issues with that because if it’s simply full access, it’s going to make everyone less secure.

DR: Absolutely, absolutely, so I think all of us, there was quite a bit of eye-rolling when these reports were coming out about them not being able to do the cell phone, and it was like a lower version, too, so it wasn’t like the super– With every cell phone they get more secure, the OS–

LN: You know, it’s like give me the cell phone, DR: Exactly! LN: I’ll get into it. DR: Exactly!

DR: You know, even when they were interviewing people in the press, they weren’t really interviewing the forensic people who do this for a living, so I’m like who are they talking to?

LN: All the computer forensic people I know, we talked about this. The best plausible explanation I could think of, again, that they were trying to create a false narrative so that they could break up other people who were collaborating, but in fact, the Inspector General’s report from the FBI revealed that they just hadn’t fully done everything, and it sounds like it was two-part, it was part they wanted the power and the access, but second the operational component. What happens, you know, there’s a more recent case that we’ll talk about in a later series, and the question becomes then, again, have they used that most, their own internal resources fully before they’re going to Apple?

DR: Or even have they leveraged people like Lee, who do this for a living. It was funny, because when they were, when this case was going on, I had another case at the same time, had the same cell phone, and literally I sent it out and got it cracked like within a day. I couldn’t understand what the issue was, exactly.

LN: Hey, what can I say, I’m good.

DR: Exactly!

LN: Well, tune in for our next segment, where we’ll be talking more about some privacy issues related to having a back door, and some better solutions that if, you know, if Congress and Senate if they want to pass legislation, there are some ways that we can still allow the FBI to get in without having a common back door key that doesn’t undermine security.

DR: Exactly.

LN: Thanks for watching. DR: Thank you.

To review the first video in this series please read below.

Cell Phone Forensics
Cell Phone Privacy
FBI Warning: Smart TV’s may be spying on you.
Mobile Phone Forensics
NIST 800-53: Security & Privacy Controls

Click here to view Apple’s comments.

https://www.apple.com/customer-letter/answers/

Cell Phone Privacy

One can’t overstate how much of our personal lives we reveal to our smartphones and that includes criminals too. Watch this three-part series to learn more.

Introduction of our four-part series on Mobile Phone Privacy and Security.

Cell phone privacy is a real concern for both individual users and law enforcement. Literally, everything you do on your smartphone or any other device is vulnerable and completely defenseless against criminals and sometimes the government. Think about what you have on your phone and how it’s used on a daily basis. All of your personal contacts, photos, videos, text messages, emails, online bank or other accounts, GPS locations data, basically, your history of who, what, where, when and how about yourself all exist on your smartphone. We can’t overstate how much of our personal lives are revealed and how much our cell phones are vulnerable if disclosed to unauthorized parties.

Guess what? Criminals have cell phones too, and their information can lead to not only solving a crime but saving lives. Law enforcement agencies continue to call for access to encrypted communications and devices, while tech companies warn that doing this would weaken the protection and allow potential criminals to take advantage of that same access. Leading computer forensics expert Lee Neubecker, CEO & President of Enigma Forensics discusses the issues relating to cell phone privacy and the government’s desire to have a back door into your smartphone with the Data Diva, Debbie Reynolds of Debbie Reynolds Consulting.

Cell Phone Privacy: Part 1 of 4

The video discussion transcript follows.

Lee Neubecker: Hi, it’s Lee Neubecker again, and I have “the Data Diva”, Debbie Reynolds back on my show again.

Debbie Reynolds: Hi!

LN: Thanks for being on.

DR: Thank you, Lee, for having me. I’m happy to be here.

LN: So we’re going to try something new. Instead of doing a big long eight to ten-minute video clip, we’re going to do a multi-part series, and this one’s going to be on the topic of…

DR: Cell phone forensics and recent incidents in the news having to do with the government asking private companies to unlock or create back doors to cell phones.

LN: Yeah, so cell phone privacy is an issue that many people are concerned about There’s a legitimate national interest in being able to investigate when terrorists use cell phones to conduct attacks. But there are also some concerns that every business should be concerned about if there’s a single back door key because we know the government can’t keep their keys in place. At least that’s what happened to the FBI, the NSA, then other agencies that were breached following the OPM breach.

DR: That’s right.

LN: So in the first segment of our four-video series, were going to be talking about what was reported by the Inspector General’s report from the FBI involving the San Bernardino terrorists when they wanted to get into the cell phone.

DR: Right. And next, we are going to talk about the privacy issues related to the FBI or possibly companies creating back doors, the court issues, the key solutions, and also the imperatives of organizations or companies not wanting to create these types of vulnerabilities in their inventions.

LN: Then you’ll get to hear us banter a little bit about what we think should happen

DR: That’s right.

LN: And then finally, in our last segment, the Pensacola Navy Yard station shooting that happened just this week. The FBI again approached Apple wanting help to get into the phone because they haven’t been able to get into the phone, and they’re wanting to know who else was involved, who they were texting with and whatnot so that they can help prevent other such attacks. So, that will be the wrap-up, and we welcome your comments on the website, your likes, and feel free to check out our video and share it.

DR: Thank you.

LN: Thanks a bunch.

Watch the Next Segment on Cell Phone Privacy: Part 2 of 4 continued

More to read about Cell Phone Vulnerabilities

Cell Phone Forensics
FBI Warning: Smart TV’s may be spying on you.
When to Select A Computer Forensic Expert
Trade Secret Theft Litigation
Robocall Legislative Update
Trade Secret Theft

Understanding EMR Audit Trails

Understanding EMR Audit Trails is important to any company dealing with (PHI). They must have all the necessary security measures in place and follow them to ensure HIPAA Compliance.

Understanding EMR Audit Trails is essential to a patient’s medical history In medical malpractice litigation. The Health Insurance Portability and Accountability Act (HIPAA) requires that the Electronic Medical Records (EMR) maintain an audit trail including all of the metadata. This EMR audit trail is a piece of highly relevant evidence as to who accessed what in the record, what entries were made and/or changed, by whom and when. Computer Forensic experts are key to effective electronic discovery during medical malpractice litigation.

How do hospitals record, protect, and store data? HIPAA sets the guidelines for the most highly sought after information by the world’s best technology hackers. Medical records are worth 4 times more than credit card information. Managing Personal Healthcare Information (PHI) places Healthcare facilities at risk of cyber attack 24/7, 365 days a year.

Check out this video with Enigma Forensics, President & CEO, Lee Neubecker, and John Blair, a noted Healthcare Industry Cyber Security Expert where they discuss the importance of protecting Personally Identifiable Information (PII).

Lee Neubecker and John Blair

Understanding EMR Audit Trails video transcript follows:

This is the third of the last video in the three-part series on Health Care Industry Cyber Threats:
Watch Part 1, Watch Part 2

Lee Neubecker: Hi, I have John Blair, a cyber security expert in the field of healthcare, and John is also involved with understanding patient medical, electronic medical record (EMR) audit trails, so I asked him to come on the show and talk a little bit about that with me. John, thanks for coming back on the show.

John Blair: Thanks, Lee. Glad to be back.

LN: So John, can you tell everyone a little bit about what HIPAA requires of healthcare organizations as it relates to tracking data of caregiving and the patients?

JB: Sure. Most of this is obviously directed at hospitals, but HIPAA also has things called business associates, and any interaction from any entity with, or any user with, PHI is going to be subject to these audit logging. Hospitals use systems called EMRs, so generally those, the audit trails are built into the EMRs by default, but obviously entities can turn those off if they so choose or configure them differently. HIPAA requires that you pretty much log any interaction, whether it’s read-only, view-only, edit, whatever that interaction might be. Identify the user, identify the time, what was done to the record, and that has to be maintained for several years. So it doesn’t matter what a user does with the record. Even if they just view it, that counts as a valid interaction and has to be logged and maintained.

LN: In fact, all of these hospital software systems out there have to be HIPAA compliant, or else the hospitals wouldn’t be able to use the software packages. Isn’t that true?

JB: Right, right. There’s a lot of federal regulations regarding that, that the standards that these systems have to meet in order to get refunds or rebates from the government.

LN: So Medicare funding, reimbursement, obviously is important.

JB: All of that stuff. And audit logs of user activity and interactions, or any interaction with PHI, is a critical component of that.

LN: You know, what I’ve seen is sometimes despite the software packages being EMR, audit trail compliant, that there’s the ability for the software that’s deployed to be altered so that the audit trails aren’t retained as long as required by law.

JB: Yeah, sometimes the storage of the audit logs, it can be overwhelming. So oftentimes they are archived offsite or inappropriate access is given to the audit log itself. And then it possibly can be changed, which ruins the integrity of the log, obviously, and that would be a very bad thing should something come up down the road and you needed that log.

LN: Yeah, and certainly, someone who has the master database administrator password to that back-end system, they could do whatever they wanted.

JB: Yup. But there’s supposed to be logs of that activity, as well, and reviews of those logs, but you’re absolutely right. If you’re an administrator, you can do a lot of damage.

LN: Yeah, I’ve assisted clients before involved in litigation, medical malpractice litigation, with just seeking the truth of what’s there in the records. Most of the time, they think many hospitals are compliant and do have those audit trail records.

JB: Absolutely.

LN: But, they don’t necessarily want to make that data readily available.

JB: No, they don’t. And it depends, it’s a case-by-case scenario, under the advice of counsel and things like that, but it’s very, very sensitive information, and obviously, it’s a public relations nightmare to have a breach of patient data, so they take those things very, very seriously.

LN: Absolutely. So can you tell everyone what PHI stands for?

JB: It’s Protected Health Information, as defined by HHS, there are 18 very specific fields that comprise PHI. PHI is a subset of PII, which is Personally Identifiable Information, but with respect to healthcare, it’s primarily PHI that we’re worried about and those 18 identifiable fields.

LN: Why would hackers want to target health care records?

JB: It’s far more valuable now than several years ago, it was credit card information, basically for year after year. Now, the credit card companies and technology with respect to how quickly a card can be replaced and deactivated. And so, just more money in it to steal medical information. And there’s more flexibility, as well. You can go get drugs, you can do a variety of things, whereas, with the credit card, it’s just money.

LN: If people wanted to launch a targeted scam on individuals, certainly having records that would enable them to filter patients that have Alzheimer’s, might give them an unfair advantage at duping people out of their savings.

JB: Absolutely. Because generally if you get someone’s entire record, you’re getting everything about them: their Soc number, their address, phone numbers, relatives, I mean, all this information is now at your disposal. And loans can be taken out in their names, it’s just a disaster waiting to happen.

LN: So Electronic Medical Records, known as EMR, represent an important target that hackers seek, because of the value of that information, and the uniqueness.

JB: Yup. The price of those records, per record, now varies, but I believe it’s in the $150, $200 range per record if it’s a breach now, and laptops can hold hundreds of thousands of records. So it can be very, very expensive.

LN: But it seems that this is a problem, too, that it isn’t just localized to any one area, it’s universal.

JB: Yeah, it’s across the board. Anyone dealing with PHI has this problem.

LN: How does the cost of a patient medical record compare to a credit card record, compare to the black market?

JB: Yeah, for the last several years, medical records have gained in value every year, while financial records, credit card information have devalued. And it’s to the point now where medical information’s worth four times as much as financial information. And that’s only increasing.

LN: So does that mean that people that work in the healthcare sector in IT and security are going to get paid four times as much as the people of the financial sector?

JB: I wish.

LN: Well, thanks again for being on the show, this was a lot of good stuff. I appreciate this.

JB: Thanks, Lee, appreciate it.

Other related stories about EMR Audit Trails

Patient Medical Records: Metadata as Evidence in Litigation
EMR Audit Trails
Computer Forensics in Medical Malpractice
Hospital Data Breached

Other resources to learn more about EMR Audit Trails.

https://www.cdc.gov/phlp/publications/topic/hipaa.html

Keys to a Secure Supply Chain

The world is data-driven. Companies face an overwhelming barrage of big data. Neubecker and Blair discuss the certifications necessary to ensure constant data security.

Cyber Security is Crucial to Supply Chain

Companies face an overwhelming barrage of endless data that contains sensitive information and involves a variety of supply chain vendors. The world is data-driven and securing your supply chain will help minimize your risk of cyberattacks. Here are some keys ways to help you understand more about securing your data beginning with supply chain vendors.

Check out this video with Enigma Forensics, Lee Neubecker, President & CEO, and John Blair, noted Healthcare Industry Cyber Security Expert dissect big data and the certifications needed to understand how to secure your supply chain to help monitor the risks.

2nd video in a three-part series

This is the second video transcript of a three-part series.

Lee Neubecker: Hi, thank you for doing this show, John.

John Blair: No problem.

LN: I appreciate you coming back on.

JB: Thanks Lee, glad to have you here.

LN: So, we’re going to talk today a little bit about what organizations should be doing to monitor the risk associated with their supply chain.

JB: Okay.

LN: And John, if you can, give me an understanding of what are things that you look for when selecting a vendor or city that might be hosting your data.

JB: Right.

LN: Or running parts of your operation.

JB: Well, the world is data-driven, and so your evaluation of vendors is critical and should be focused on their interaction with your data, what their subcontractors are going to do, are you going to allow them to have subcontractors? Where are those subcontractors located? And by all means, get some sort of attestation, that their environment that you’re now relying on, has been audited, you know, the SOC 2’s, those types of things, go a very long way in giving you some level of comfort that they’re operating their controls effectively and that you can rely on ’em.

LN: Great, can you explain to our viewers what essentially a SOC 2 certification is, and why you care about that with a vendor?

JB: That one, the SOC 2, there are multiples ones, but a SOC 2 Type 2 is the standard. There are five Trust Principles associated with it. The biggest one used probably, 75 percent of the time is security. And that’s where you, the vendor would offer, whatever service you’re interested in, the SOC report would be scoped for that service, and then the auditors evaluate that service according to the security principle that’s defined by SOC.

LN: So, typically they’re looking at physical security measures, as well,

JB: Yep.

LN: that extend just beyond data,

JB: Right.

LN: but physical security measures that help to protect your data.

JB: Right, SOC defines objectives, and then the organization defines controls within those objectives, so the objectives are the boundaries, and then the organization defines the controls, but generally speaking, they are the IT basics, chain management, software development, life cycle, physical security, logical security, network security, data storage and security, transmission security, those types of things are almost always covered under the security principle.

LN: Isn’t it true that someone could have all the certs out there and still get compromised?

JB: Oh, absolutely. The certs are not a guarantee, by any stretch. They are just, you know, as we’ve said, they’re meant to give you a level of comfort in the control environment of the people you are now, basically trusting with your data.

LN: And so, as you go out, and you select vendors if you do this diligence and you find vendors that have a certain level of attestation, and various certs that you care about, that might help you if data breach happened, to show that you actually practiced good faith and due diligence, in selecting your vendors.

JB: No, absolutely, and HIPPA requires it, so if you did some sort of due diligence at least, at least you have a story to tell. If you don’t have a story to tell, then that’s where things start going off the rails almost immediately, because you didn’t do anything, and that’s never a good thing.

LN: Well, thanks for being on the show again.

JB: My pleasure, thank you.

More about cybersecurity

NIST 800-53: Security & Privacy Controls
WGN Cyber Security Chicago Conference 2018
Data Breach Response

Information on HIPPA website for security professionals

https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html