CyberNews journalists sat down with dozens of cybersecurity experts in 2021 to help you make sense of the digital world around us.
The constant flood of unsettling news about cyberattacks, breaches, and ransomware-induced deaths might make you want to quit the internet altogether. Therefore, we constantly talk to prominent cybersecurity experts to paint the bigger picture of what’s happening and what’s ahead of us.
After all, technology is opening many opportunities we’ve only dreamt about not that long ago, and it would be a shame to go all medieval to avoid all the dangers and monsters of the digital realm. Knowledge beats fear, and that’s why we strive to provide all kinds of information - from simple yet essential security tips to a more in-depth analysis of current events and the cybersecurity landscape.
Here are some of our favorite interviews of 2021 - from what it’s like to be a woman in a male-dominated field of cybersecurity and darknet researchers being under constant threat to something more entertaining like Hollywood movies about hackers.
1. Darknet researcher: they said, they’ll come and kill me - interview
Hardly traceable and hidden from the public view, the darknet is a perfect place to build shady connections. An ample supply of criminal forums guarantees steady access to willing accomplices, new extortion techniques, and fellow crooks. Little do they know, however, there are imposters among them. The good kind, who gather intelligence about the schemes on the dark side of the digital world.
The task is neither easy, nor safe. Even the slightest whiff of suspicion may raise alarms. Losing access to a valuable forum is just the tip of the iceberg of problems a revealed identity can cause to a darknet researcher. For that very reason, we agreed not to disclose the personal information of a researcher from DarkOwl, a darknet data provider and intelligence company, who talked with us.
"I was trying to figure out where they were operating, who they were involved with, what groups they were involved in, and I became a target. They turned on me and said, we will find whoever wrote this and come kill them," the researcher told CyberNews.
2. Why do cyber gangs win? Because 'bad guys' talk to each other - interview
According to veteran security expert Bob Scalise, Partner Risk and Cyber Strategy at Tata Consultancy Services (TCS), one of the reasons why it's exceedingly challenging to combat cyber gangs is that while threat actors share information between themselves, companies hesitate to cooperate with competitors.
"The attackers are very good at sharing information about their targets, about their victims. On the good guy side, we're much less willing and, and much, much less sophisticated at sharing information about what we're seeing in the threat landscape," Bob Scalise said.
3. The satellite-hacker’s guide to the space industry: don’t panic (yet)
Modern satellites are becoming a collection of mass-produced computers floating in space. By the end of the decade, thousands more will be out there. But with the increasing reliance on orbital technology comes a growing appetite for hacking it.
Data relayed via satellites is not immune to hacking. James Pavur, an Oxford PhD focusing on satellite systems security, has proven the above statement to be disturbingly evident. With his team, he used $300 worth of satellite TV equipment to intercept vast amounts of information distributed along the larger part of the Northern hemisphere.
“When you’re eavesdropping on satellite internet signals, you’re effectively seeing what someone’s ISP would see. You see every website that a customer browses to, or every email that they receive for every account that they own,” Pavur told CyberNews.
4. To ransom-proof healthcare, we need to go on the offensive – interview
The US might have had its first ransomware-related death recently. A lawsuit in Alabama claims that a newborn baby ended up with severe brain injury because an expecting mother did not receive necessary care due to an ongoing attack against the hospital she was in. The baby died nine months after birth.
Hospitals, like so many other organizations, are ill-prepared to double or triple extortion attacks. Even though there are few novel remedies to combat the threat to hospitals, simply updating attack-reporting routines might not cut it when human lives are at stake.
According to Chris Bowen, Co-Founder and security expert at ClearDATA, a healthcare cloud hosting and security company, law enforcement and businesses need to join forces to combat threat actors more efficiently.
5. Attackers target the cloud. We just don't care to notice - interview
As much as 79% of companies have experienced cloud data breaches in the last 18 months, with 43% suffering from ten cloud-based intrusion attempts. With over 90% of organizations housing at least part of their digital assets in the cloud, that's a big problem.
Even grands like Azure can succumb to critical vulnerabilities. Recently, researchers at Palo Alto found that the Azure containers used code that had not been updated to patch a known vulnerability, allowing the researchers to get complete control of other users' data.
It doesn't help that the rapid transition to the cloud left many security holes open for exploitation. According to Menachem Shafran, a cybersecurity expert and VP Product at XM Cyber, a cloud and physical network security company, attackers often may target the cloud. Still, the focus is often on how the attackers gained initial access.
6. Cybersecurity professionals are tilting at windmills - interview
Even though the recent (ISC)2 Cybersecurity Workforce Study showed that cybersecurity professionals are a highly engaged and satisfied workforce, the prevailing narratives in the media tell a different story - employees feel stressed, unappreciated, and face overwhelming pressure.
Employees often complain about monotonous tasks. According to the Invicti survey, 96% of respondents say false positives are problematic, and 78% say they always or frequently perform manual verification of flagged vulnerabilities, with each taking over an hour to investigate.
I virtually sat down with Mark Ralls, president & COO of Invicti, to talk about talent shortages, professional burnout, and how companies should address this problem.
7. Sophos principal research scientist: some criminals might not know how dumb they are
Infosec researchers know about cybercriminals more than they reveal to the public. “We do not want to tip the criminals off to something dumb that they regularly do,” Chester Wisniewski, a principal research scientist at the cybersecurity company Sophos, told CyberNews.
Instead, researchers share this knowledge with law enforcement to help catch criminals by hand.
Wisniewski, having more than 20 years of professional experience, analyzes the massive amounts of attack data gathered by SophosLabs to distill and share relevant information in an effort to improve the industry’s understanding of evolving threats, attacker behaviors, and effective security defenses.
“2021 has just been a rollercoaster,” he told me during the interview. After ransomware was banned on the hacker forums, cybercriminals moved to private discussions, making it harder for law enforcement and security researchers to trace them. The rebranding of major ransomware gangs also makes them lag behind the masterminds of the criminal world.
8. Why Hollywood movies about hackers make this cybersecurity veteran cringe
Greg Scott is a published author, and he calls his first novel Bullseye Breach, an educational book disguised as fiction. Cybersecurity books are good medicine for insomnia, he laughs after recently publishing his second novel, Virus Bomb, and promises he will not stop writing fiction just yet.
Scott believes fiction helps us understand the world around us - it keeps us engaged while also helping us learn something. He hopes some talented Hollywood scriptwriter will notice Scott’s fiction one day. Because for now, the way they picture hackers and any IT-related issue just makes this cybersecurity veteran cringe.
But don’t worry - if (when) Hollywood starts picturing the cyber world more accurately, the drama will still be there, as there’s plenty of tension and emotions in real-life cyberattacks, too.
9. She walked into a NATO Committee as a security expert, everyone thought she was a waitress
At the age of 21, Agnese Morici saw her dream to be a diplomat shatter to pieces. Six years and many broken stereotypes later, she proudly calls herself a cybersecurity expert.
A shy and simple girl, as Agnese described herself to CyberNews, now blossomed into a self-confident cybersecurity consultant. Not only did she break into the field despite her closest friends and family nagging her about not having what it takes (basically, not being a man), but Agnese also strives to make the field more welcoming to other women.
A couple of years ago, Agnese had the opportunity to work on a NATO project designed to outreach to the countries that are members of the Mediterranean Dialogue and Istanbul Cooperation Initiative and partners from the broader region of the Middle East. She was assigned to advise a NATO Committee, whose members were military men. Agnese was very happy on her first day, introducing herself and making connections during the Committee meeting.
“Every military representative present in the Committee thought that I was not the advisor of the Committee, but a waitress for the Committee,” Agnese recalled. A woman of 25 cannot advise men twice her age, can she? She must be a waitress.
10. Head of Europol’s European Cybercrime Centre: there are no systems that cannot be breached
The distribution of child pornography, financial crimes, and ransomware remain a major headache for Europol’s European Cybercrime Centre (EC3). In 2020, there was a rise in cybercrime. Yet nothing caused disruption or damage beyond repair, head of EC3 Edvardas Šileris told CyberNews.
Cyberattacks against FireEye or the Solar Winds hack don’t come as a surprise to Mr. Šileris. Not a single system is built in a way that can’t be hacked, and it would be very naive to think otherwise.
“Sometimes, the media covers breaches as if a disaster has happened. The truth is, in some cases, leaked data is not critical. It’s not something that could cause irreparable damage to the state. It happens rarely,” he told CyberNews.
Your email address will not be published. Required fields are markedmarked