Part networking event, part industry update and part educational seminar, the Howard County Chamber of Commerce’s (HCCC) eighthth annual Cybersecurity Conference provided a full day of programming targeting industry professionals throughout the region in June.
Held at Howard Community College and presented by HCCC’s GovConnects program, this year’s Cyber 8 event attracted hundreds of participants ranging from small- and mid-sized business owners and employees to investors, as well as state and local government personnel and office holders.
Conference topics included the role of government and academia in innovation, health data security, the insider threat and questions surrounding funding growth, mergers and acquisitions.
Cyber encompasses a wide spectrum of fields and operations that’s hard to define, and threats that are increasingly more difficult to contain. Leidos Deputy Operations Manager Jack Terry briefed attendees on the most prevalent trends that defenders are following.
“We’re seeing a significant change in the sophistication of ransomware,” he said. “It’s open season on the Internet of Things (IoT), often affected by ransomware attacks. Mobile security threats are everywhere and connected to your corporate networks.”
Political hacking has gone mainstream, he said, with a wide-open profile that can include everybody from disgruntled employees to politically motivated “hack-tivists” who disseminate classified and proprietary data to promote causes or advance an agenda, á là the recent Reality Winner.
“In the travels I make within the cyber community, insider threat is, without question, one of the top two or three topics on everybody’s mind,” said Cyber Conference Chair Mike Cameron, director of cybersolutions for Noblis-NSP, in Annapolis Junction.
As the business and government worlds continue to automate, planners need to consider strategies to transform the workforce and prepare for an inevitable time within the next decade when the skills in use today are no longer in vogue.
“We have to think about what we do with unemployment in that regard,” said Curtis Dukes, executive vice president of the CIS Security Best Practices Automation Group. “[We’re] talking about potentially up to 47% to 53% of current jobs that will no longer be needed. That’s what happens with innovation.”
Disruptive technology is becoming more prevalent, he said, evidenced by the transformation of the car hire service by companies like Lyft and Uber, and information technology (IT) trajectories that are tied to smaller, ever more powerful devices and the, at times, perplexing desire of innovators to network even simple household appliances to the Internet.
“With IoT, everything is an agent,” Dukes said. “Everything is collecting telemetry and looking for a way to feed that telemetry out.”
As for predictions and consequences, “Big data is only going to get bigger, and digital transformation accelerates,” he said. “Mobility will continue to dominate, and crypto-currencies will increase [in acceptance] as a form of currency. I believe crypto-currency is going to transform the world and the marketplace.”
They payoff, Dukes suggested, will come in the form of knowledge and increased liberation from the office environment.
“Space exploration will become increasingly affordable, finance will be more automated, the need for small brick-and-mortar bank [branches] will go away and a highly-skilled workforce can work from anywhere,” Dukes said. “The need for going into an office? Those days are past. I’m actually more productive today.”
Hackers come in all shapes, sizes and flavors, but in the eyes of Jason Taule, chief security officer for Columbia-based FEi Systems, all cyberthreats are ultimately insider threats.
“I’ve been doing this for 30 years, and I’ve never seen some random account that didn’t belong to anybody in my company that an outsider had created,” Taule said. “They are compromising insider accounts. It’s both someone on the inside misusing their privilege, or someone on the outside compromising that insider’s privileges to do something inappropriate.”
Limiting access to certain types of data exclusively to those who need and use it is one way to keep a tighter rein on security, said Ananta Hejeebu, managing partner of Howard Tech Advisors. He observed that some companies also disable USB ports and go so far as to block personal webmail on their networks, as well as all websites extraneous to those absolutely necessary for work being done.
Even so, it’s not just employees that a company may have to worry about.
“It’s also temps, contractors and support staff from your vendors when you give them remote access to your systems,” said Kaizen Approach CTO Melissa McCoy.
Ounce of Prevention
Despite a mandate from the Defense Security Service for all government contractors with Facility Security Clearance to establish insider threat monitoring and mitigation programs by Nov. 30, many have yet to comply.
Part of the difficulty, according to Leidos Cybersecurity Program Manager Robert Smith, is that companies with a global presence must take the privacy concerns and foreign laws of their host countries into consideration.
“There is currently an expansion underway as to what constitutes protected information in the U.K.,” said Innoplex IT Manager Jennifer Scanlon.
As Smith pointed out, the system implemented by Leidos can identify employees who access information they’re not supposed to see, and can flag high-risk individuals based on behavioral traits, personnel profiles and financial record checks.
“Before we implemented our program, security was its own silo,” said Scanlon, who stressed the importance of a group effort to identify potential problems that could stem from crippling medical bills, mental health or behavioral issues before they become reportable situations.
Helping someone negotiate a second mortgage would be preferable to having an employee who feels his or her only way out is to sell secrets, said National Security Consultant Mary Griggs.
Losing an employee “is a huge deal for a small company,” said Scanlon. “In the end, they may not be able to restaff.”
Considering the overall implications of the insider threat and the evolving cybersecurity threat from outside agents, Dukes said he believes there’s room for improvement in policy approach.
“I think in this country there’s an imbalance in what we spend on offensive weapons as opposed to what we spend on defensive weapons,” he said. “We shouldn’t think about innovation if we don’t also think about it from a security context. We’re going to make the same mistakes that we made 10 years ago right now with IoT, not thinking about baking in security at the very beginning.”
The technology revolution “has really transformed us as individuals,” Dukes said. “We’re so much more efficient, our lives are so much more pleasing, but I don’t think we’ve factored in the security aspect.”