On April 17, 2020, it was reported that researchers at Finland’s Arctic Security found “the number of networks experiencing malicious activity was more than double in March in the United States and many European countries compared with January, soon after the virus was first reported in China. ”
Lari Huttunen at Arctic Security astutely pointed out why previously safe networks were now exposed: “In many cases, corporate firewalls and security policies had protected machines that had been infected by viruses or targeted malware . . . . Outside of the office, that protection can fall off sharply, allowing the infected machines to communicate again with the original hackers. “
Tom Kellerman – a cybersecurity thought leader, distills it this way: “There is a digitally historic event occurring in the background of this pandemic, and that is there is a cybercrime pandemic that is occurring.”
During our Cyber Pandemic, companies recognizing and properly addressing the potential damage caused by threat actors will not only survive minor short-term hits to their bottom line caused by paying outside resources, they will likely be the ones coming on top after both Pandemics subside. There is definitely a light at the end of the tunnel for those willing to take the ride – just continue using trusted vehicles to get you there.
When implementing COVID-19 business continuity plans, companies should take into consideration security threats from cybercriminals looking to exploit fear, uncertainty and doubt – better known as FUD. Fear can drive a thirst for the latest information and may lead employees to seek online information in a careless fashion – leaving best practices by the wayside.
According to Reinsurance News, there has already been “a surge of coronavirus-related cyber attacks”. Many phishing attacks “have either claimed to have an attached list of people with the virus or have even asked the victim to make a bitcoin payment for it.” Not all employees are accustomed to the risks from a corporate-wide work from home (WFH) policy given the previous lack of intersection between work and personal computers.
One cyber security firm released information outlining these WFH risks. And, another security provider offers a common-sense refresher: “If you get an email that looks like it is from the WHO (World Health Organization) and you don’t normally get emails from the WHO, you should be cautious.” In addition to recommendations made by security consultants, there are privacy-forward recommendations that will necessarily mitigate against phishing exploits. For example, WFH employees should be steered towards privacy browsers such as Brave and Firefox to avoid fingerprinting and search engines such as Duckduckgo for private searches. A comprehensive listing of privacy-forward online tools is found at PrivacyTools.IO.
Criminals have already exploited the current FUD by creating very convincing COVID-19-related links. As reported by Brian Krebs, several Russian language cybercrime forums now sell a “digital Coronavirus infection kit” that uses the Hopkins interactive map of real-time infections as part of a Java-based malware deployment scheme. The kit only costs $200 if the buyer has a Java code signing certificate and $700 if the buyer uses the seller’s certificate.
At a very basic level, WFH employees should be reminded not to click on sources of information other than clean URLs such as CDC.Gov or open unsolicited attachments even if they appear coming from a known associate. Now that banks, hotels, and health providers are sending emails alerting their clients of newly-implemented COVID-19 procedures, it is especially easy to succumb to spear phishing exploits – which is the hallmark of state-sponsored groups. As recently reported, government-backed hacking groups from China, North Korea, and Russia have begun using COVID-19-based phishing lures to infect victims with malware and gain infrastructure access. These recent attacks primarily targeted users in countries outside the US but there should be little doubt more groups will focus on the US in the coming weeks. Until ramped up testing demonstrates that the COVID-19 risk has passed, companies are well advised to focus some of their security diligence on these targeted attacks.
Even though we are now on the whole facing a much lesser evil than the Swine Flu we remain exponentially more alarmed and have been withdrawing en mass from social interactions. This is obviously not a good thing but our current pandemic panic should pass by mid-April. Until then, we can continue downing the hottest drink in town just to be on the safe side.
UPDATE: April 23, 2020
The CDC reports in its latest published statistics there were 802,583 reported cases of COVID-19 and 44,575 associated deaths. Without a doubt, this pandemic is certainly much worse that the Swine Flu pandemic as previously reported by the CDC. Moreover, the current “panic pandemic” certainly shows no indications of subsiding.
On April 30, 2020, it was reported Tonya Ugoretz, deputy Assistant Director of the FBI Cyber Division, stated the FBI’s Internet Crime Complaint Center (IC3) is currently receiving between 3,000 and 4,000 cybersecurity complaints daily – IC3 normally averages 1,000 daily complaints.
UPDATE: May 6, 2020
On May 5, 2020, a joint alert from the United States Department of Homeland Security Cybersecurity and Infrastructure Security Agency and the United Kingdom’s National Cyber Security Centre warned of APTs targeting healthcare and essential services.
The alert warned of “ongoing activity by APT groups against organizations involved in both national and international COVID-19 responses.” This May 5, 2020 alert follows an April 8, 2020 Alert that warned in broader terms of malicious cyber actors exploiting COVID-19.
APTs are conducted by nation-state actors given the level of resources and money needed to launch such an attack. Moreover, they generally take between eight and nine months to plan and coordinate before launching. It is particularly disheartening that these recent attacks include those launched by state-backed Chinese hackers known as APT 41. As one cybersecurity firm points out in a recently-released white paper: “APT41’s involvement is impossible to deny.”
Distilled to its essence, the uncovered APT41 attacks mean that before COVID-19 was even on US shores, Chinese state-actors were planning attacks targeting the healthcare and pharmaceutical sectors. One can only hope the cyberattacks were not coordinated alongside the spread of the virus – a virus that only became public months after a coordinated attack would have been first planned.
Despite the recent public trend of paying these extortion demands, the FBI has long advocated not paying a ransom in response to a ransomware attack. Specifically, the FBI has said: “Paying a ransom doesn’t guarantee an organization that it will get its data back—we’ve seen cases where organizations never got a decryption key after having paid the ransom. Paying a ransom not only emboldens current cyber criminals to target more organizations, it also offers an incentive for other criminals to get involved in this type of illegal activity. And finally, by paying a ransom, an organization might inadvertently be funding other illicit activity associated with criminals.”
In fact, some have argued that by having insurance for this exposure the industry itself is actually at the root of increased ransomware activity. Those in the security industry correctly point out that what drives these actors turns more on quick conversion rates rather than whether an insurer stands behind a victim. To suggest the insurance industry is the cause of this problem gives threat actors way too much credit while completely ignoring the benefits derived from the cyber insurance underwriting process.
In the same way it is never too late to go back to school, it is never too late to begin importing a more robust security and privacy profile into an organization – which is the only real way to diminish the risk of a ransomware attack. As suggested in 2016: “Given the serious threat of ransomware, businesses large and small are reminded to at least do the basics – train staff regarding email and social media policies, implement minimum IT security protocols, regularly backup data, plan for disaster, and regularly test your plans.”
In a decision that might have significant ramifications in future discrimination and whistle-blower lawsuits, the New Jersey Supreme Court ruled in Quinlan v. Curtiss-Wright Corp., No. A-51-09 (N.J. Sup. Ct. Dec. 2, 2010) that an employee who copied 1,800 of pages of documents that she came upon during the normal course of her work — many with confidential information — could share them with the attorney representing her in a lawsuit against the employer. The Supreme Court allowed the usage of these documents even though the plaintiff signed her employer’s standard confidentiality agreement that bars employees from using confidential information for private use.
According to the dissent:
From this point forward, no business can safely discharge an employee who is stealing highly sensitive personnel documents even as she is suing her employer and disregarding the lawful means for securing discovery. Moreover, lawyers may think that, even after they have initiated a lawsuit, they can accept pilfered documents and benefit by using them to surprise an adversary in a deposition rather than abide by the rules of discovery.
Although the decision did reaffirm the ability of an employer to fire an employee for the theft of confidential documents, it provides for a potential safe harbor to the extent such documents are used in a subsequent suit for discrimination. Newspapers as well as law firms have written on the decision, including Lowenstein Sandler, Proskauer Rose, Jackson Lewis, and Fox Rothschild.
Commentators have suggested that employers implement comprehensive confidentiality policies that are communicated firm-wide and uniformly enforced. Although that is certainly sound counsel, it is also suggested that adequate security measures be implemented that allow employers to prevent or at least track the copying and removal of over one thousand documents. Moreover, although not discussed in either the ruling or subsequent commentaries, there is only a minor leap to be made to extend this holding to whistle-blower suits. Although choice of law issues remain untested, the new Dodd-Frank’s whistle-blower provisions — which allow employees to obtain significant rewards for providing information to law enforcement authorities about violations of the federal securities laws, the Foreign Corrupt Practices Act, the Investment Advisers Act and the Investment Company Act — may even be in play. Bottom line: New Jersey employers need to review their data security and confidentiality policies to address this new decision.
Although the New York metro area traditionally is known for being dominant in the financial sector, this report demonstrates something those in the tech/telecom industry have known for years. Whether born out of Bell Labs in Murray Hill, New Jersey or IBM in Armonk, the New York metro area has laid claim to some of the major technology innovations of our time. Couple those breakthroughs in core technologies with the new media leaps taken in Silicon Alley during the early days of the Internet and New York’s recipe for tech growth is quickly realized — it is all about innovation. Those who innovate usually lead.
First introduced by Sen. John Thune, The Red Flag Program Clarification Act of 2010, S. 3987, would define a creditor as someone who uses credit reports, furnishes information to credit reporting agencies or “advances funds…based on an obligation of the person to repay the funds or repayable from specific property pledges by or on behalf of the person.” Sen. Thune’s web site statement regarding the regulations states that action was necessary given the FTC was threatening small businesses with its regulations.
As written, the existing law applies to “creditors,” a term the FTC interpreted broadly to include professionals who regularly deferred payment on services. The FTC had delayed enforcement of these regulations numerous times due to pressure by the ABA and AMA given that the sweeping nature of the regulations would take into account professionals who would incur significant costs to address a perceived slight exposure. As recognized on the House floor by Rep. John Adler (D-N.J.),“When I think of the word ‘creditor,’ dentists, accounting firms and law firms do not come to mind.”
Lost on many is the fact these regulations will remain in force and will still impact business owners throughout the country, including financial institutions, car dealers, contractors, utilities, phone providers, retailers (if financing is provided), mortgage brokers, etc. Moreover, even if a business may no longer be “technically” within the rubric of the regulations, it may be a good best practice to still comply. For example, an ID theft victim may look to the FTC Red Flags regulations to help determine a baseline reasonableness standard. Although estimates of compliance costs range from $1,000 to $1,500 for small business owners, this amount may pale when compared to the expenses incurred in defending a data breach claim.
The Ponemon Institute’s latest report, “The Billion Dollar Laptop Study,” shows that 329 organizations surveyed lost more than 86,000 laptops over the course of a year. Based on these findings and an earlier survey that put the average cost of lost laptop data at $49,246, the total cost amounts to more than $2.1 billion or $6.4 million per organization.
Some other key findings of the report: (1) while 46 percent of the lost systems contained confidential data, only 30 percent of those systems were encrypted; (2) only 10 percent had any other anti-theft technologies; and (3) 71 percent of laptops lost were not backed up so all work in progress was lost.
At the release media event reported on by InformationWeek, Larry Ponemon explained that most of the cost “is linked to the value of intellectual property on these laptops and the fees associated with data breaches and statutory notification requirements.” During this same press conference, Ponemon recounted interviewing one woman at a company who had lost 11 laptops in two years: “She claimed she wasn’t really that careful with laptops because the only way she could get a better one was to lose it.”
It is this disconnect — the value of the information lost vs. the relative interest in the user in protecting such information — that becomes the ultimate challenge faced by most firms. Employee training remains the front line in addressing this challenge but having employees pay for their lost corporate laptops may actually yield more desirable results. It would be interesting to have the next Ponemon lost laptop study include the ratio of lost business laptops compared to lost personal laptops, i.e., those actually purchased by an employee.
According to a recent ABA Journal article, the global digital infrastructure is under siege and law firms are to some extent on the front lines given the vast amounts of sensitive data they process and maintain. Bradford A. Bleier, unit chief to the Cyber National Security Section in the FBI’s Cyber Division, is quoted in the article: “Law firms have tremendous concentrations of really critical private information” and breaking into a firm’s computer system “is a really optimal way to obtain economic and personal security information.” Philip Reitinger, the director of the National Cybersecurity Center in the Department of Homeland Security, believes this threat is increasing for two different reasons. First, he said, “the skill level of attackers is growing across the board.” And, secondly, the nation’s networks of computer systems are becoming more connected and complex all the time, “and complexity is the enemy of security.” Marc Zwillinger, a founding partner of Zwillinger Genetski, recognized another obvious problem for law firms: “Lawyers haven’t been as diligent with security as some of the institutions that gave them information.”
After sufficiently spreading the FUD (fear, uncertainty, and doubt) throughout, what does the ABA author suggest as a solution. Well, not much of note. It is suggested that firms change their culture to be more in tune to security – which will likely need to be done from the top down given most managing partners, according to the author, have little time with sophisticated passwords and things that might otherwise slow them down. It is also suggested that data be segregated and that encryption be deployed.
The most relevant bit of information from the article actually was added in the sidebar and builds on Marc Zwillinger’s suggestion that a client’s security is usually more evolved than that of its law firm. The author’s sidebar comment points out that clients may soon be auditing their law firm’s security. Given that lawyers have been helping clients with technology due diligence for years now and have also been advising on the use of audits, it is not much of a stretch to expect one law firm to recommend auditing another firm. Those law firms in front of this issue will not only keep existing clients – they will also be in great shape to potentially win new ones. Afterall, what law firm would suggest such an audit if it did not already deploy a sophisticated security infrastructure of its own?
In a recent article, author Gina Passarella argues that the law firm industry “is moving away from a monolithic provider of legal services – the law firm – to a fragmented service platform where the competition isn’t just a broadening array of law firms, but legal process outsourcers [LPOs] and other non-law firm legal service providers as well.”
In essence, Ms. Passarella argues that the industry is “unbundling” into various constituent parts — from the client (who is keeping more and more work in-house) to the legal LPO vendor (who is doing more and more specialized work ). And, according to experts quoted in the article, the trend is towards global firms that can do everything and boutique firms that can do certain things very well — with little room in between for other types of firms. These legal consultants argue that law firms can no longer be “bet the farm” firms and commodity firms at the same time.
What the article posits as future fact may actually be the a short-term trend towards cost-cutting. For example, a good portion of LPO competition may actually be driven now by those lawyers who could not otherwise get a job with a traditional firm. Once the market picks up again, those lawyers may find a more traditional home. As recognized by K&L Gates chairman Peter Kalis, who is quoted in the article, LPOs do not provide the same attorney-client privilege guarantees as law firms; and therefore, can never really be a threat to most of the business his firm does. As he puts it, “they are a gnat in an elephant’s ear when it comes to K&L Gates.”
Not sure if LPOs are ultimately law firm gnats or very large bed bugs. What is clear, however, is that a law firm needs to continually reassess its business model – with a constant eye towards improving efficiencies – before it can ever hope to improve its bottom line. A good starting point is to hone in on core competencies. There are good reasons boutiques have taken a chunk out of BigLaw books over the past decade or so — all of which boils down to self-awareness on core competencies tied to a focused business plan that is well executed.
It’s been six months since passage of the administration’s healthcare reform act — the Patient Protection and Affordability Care Act (PPACA). As reported in newspapers around the country, that means that for those health plans that begin today:
Parents will be able to keep their young adult children on their group health plan up to age 26, regardless of whether the adult child lives with the parent, is a full-time student, disabled or married.
Insurance companies will be banned from dropping coverage when an enrollee gets sick.
All new plans must offer free preventive services, such as mammograms, colonoscopies and certain child preventive health-care services, meaning plans can’t charge deductibles, co-pays or co-insurance.
All employer plans and new plans in the individual market will be prohibited from denying coverage to children under age 19 with pre-existing conditions.
Parents will be able to select a pediatrician as the primary care provider for their children.
Female enrollees will be able to obtain obstetrical/gynecological specialist services without a referral from another primary care provider.
Group plans will be banned from imposing lifetime benefit limits and will start gradually eliminating annual benefit limits.
New plans must provide consumers access to an internal and external claims appeals process.
For plans operating on the calendar year, these new PPACA requirements will take effect on January 1, 2011.