Tag Archive for: Everyone’s

Building cyber resilience in HE needs everyone’s commitment

/in


UNITED KINGDOM

When it comes to cyber threats in 2023, no sector is safe. While the financial, insurance and consumer industries have traditionally been some of the worst hit by breaches, higher education has fast become a new favourite target for attackers in recent years.

According to the United Kingdom government’s 2022 Cyber Security Breaches Survey, of the educational institutions surveyed, higher education employees were the most likely to identify breaches or attacks, with 92% reporting an incident within the last 12 months.

The consequences have been extreme. A ransomware attack impacting the University of York in 2021 resulted in sensitive data being encrypted and held captive by hackers for weeks without resolution. At other universities, sophisticated attacks such as phishing emails and distributed denial of service (DDoS) have run havoc – intercepting confidential logins, tampering with student data and forcing downtime during valuable learning hours.

A vulnerable sector

It’s unsurprising, then, that higher education institutions face a variety of challenges that render them at higher risk for such attacks.

For starters, the ongoing digital skills shortage has meant a lack of experienced candidates capable of safeguarding universities from today’s cyber threats.

In the private sector, 51% of businesses have reported a shortage of “basic technical cybersecurity skills”. In the public sector, additional budget constraints heightened by the global economic downturn have made matters even worse.

‘Head of Cybersecurity’ salaries are currently being advertised at a fraction of what they would be in a private firm, which makes cyber recruitment an uphill battle for many public sector organisations, including universities.

There has also been a surge in the number of devices being used by both students and staff on a daily basis. Laptops and mobile phones became staples of remote learning during the pandemic due to lockdowns and social distancing protocols. Internet of Things (IoT) devices – including assistive technology and ID scanners – have also become commonplace across university campuses.

While these devices boost efficiency and support learning, they…

Source…

Another Report Highlights How Wireless SS7 Flaw Is Putting Everyone’s Privacy At Risk

/in

Last year, hackers and security researchers highlighted long-standing vulnerabilities in Signaling System 7 (SS7, or Common Channel Signalling System 7 in the US), a series of protocols first built in 1975 to help connect phone carriers around the world. While the problem isn’t new, a 2016 60 minutes report brought wider attention to the fact that the flaw can allow a hacker to track user location, dodge encryption, and even record private conversations. All while the intrusion looks like like ordinary carrier to carrier chatter among a sea of other, “privileged peering relationships.”

Telecom lobbyists have routinely tried to downplay the flaw after carriers have failed to do enough to stop hackers from exploiting it. In Canada for example, the CBC recently noted how Bell and Rogers weren’t even willing to talk about the flaw after the news outlet published an investigation showing how, using only the number of his mobile phone, it was possible to intercept the calls and movements of Quebec NDP MP Matthew Dubé.

Again the flaw isn’t new; a group of German hackers revealed the vulnerability in 2008 and again in 2014. It’s believed that the intelligence community has known about the vulnerability even earlier, and the hackers note that only modest headway has been made since German hacker Karsten Nohl first demonstrated it. But the flaw has gained renewed attention in recent weeks after Senator Ron Wyden sent a letter to the FCC (pdf) complaining that the agency isn’t doing enough (read: anything) to address it:

“One year ago I urged you to address serious cybersecurity vulnerabilities in U.S. telephone networks. To date, your Federal Communications Commission has done nothing but sit on its hands, leaving every American with a mobile phone at risk.”

Apparently, shoring up national security wasn’t as big of a priority as gutting net neutrality or eliminating consumer privacy protections at Comcast and AT&T’s behest. Wireless carriers have been downplaying the flaw, in part because of the cost of fixing it. But they also worry it will be used to justify more meaningful privacy protections here in the States. When the DHS published a 125 page report (pdf) detailing the scope of the problem, lobbyists for the industry called the problem “theoretical,” and the report “unhelpful,” calling the report’s advocacy for regulatory and legislative solutions “alarming.”

And while carriers have implemented some security standards to address the SS7 probem, at its core SS7 lacks a mechanism to ensure that carriers sending data requests are who they claim to be. And while some of the firewall solutions carriers have adopted can protect some of their own consumers, these fixes don’t extend to users who may be roaming on their networks. By and large, a large chunk of the problem is that these companies don’t want to spend the necessary time and money to engineer a real solution, especially if their intelligence partners are benefiting from it.

In a follow up report over at the Washington Post, the paper notes how the flaw at this point is far from theoretical, and is routinely exploited en masse by numerous intelligence agencies (including the United States):

“Wyden said the risks posed by SS7 surveillance go beyond privacy to affect national security. American, Chinese, Israeli and Russian intelligence agencies are the most active users of SS7 surveillance, experts say, and private-sector vendors have put systems within the reach of dozens of other governments worldwide. Sophisticated criminals and private providers of business intelligence also use the surveillance technology.

Other experts said SS7 surveillance techniques are widely used worldwide, especially in less developed regions where cellular networks are less sophisticated and may not have any protection against tracking and interception. But the experts agreed that Americans are significant targets, especially of rival governments eager to collect intelligence in the United States and other nations where Americans use their cellphones.

And again, that’s a particular problem for a country whose President thinks basic phone security is too much of a hassle. For a country that’s currently spending an ocean of calories trying to blacklist Chinese network vendors under breathless claims of national security, you’d think a massive problem with global privacy and security implications would get a little more attention.

Permalink | Comments | Email This Story

Techdirt.

Hey Mark Zuckerberg: Don’t Lock Down Everyone’s Data, Open It Up To Services That Give Your Users More Control Over Their Data

/in

As we’ve been discussing all week, a lot of people are reacting to the wrong thing in the whole Facebook / Cambridge Analytica mess. The problem was not that Facebook had an open API — but that its users were unaware of what was happening with their own data. Unfortunately, many, many people (including the press and politicians) are running with the narrative that Facebook failed to “protect” data. And, just as we warned, the coming “solutions” won’t help matters, but will actually make them worse.

Case in point: when Mark Zuckerberg finally made his big press tour on Wednesday evening, he repeatedly told people that, the public has spoken and Facebook will lock down your data now.

I do think early on on the platform we had this very idealistic vision around how data portability would allow all these different new experiences, and I think the feedback that we’ve gotten from our community and from the world is that privacy and having the data locked down is more important to people than maybe making it easier to bring more data and have different kinds of experiences.

This is the wrong solution for two reasons: (1) It makes Facebook that much more central and dominant to online activities, making it that much more difficult for upstarts and competitors to compete and (2) it takes away power from the end users to do more with their own data. For all the people whining about Facebook having too much of your data, this is not the solution you want. This is effectively giving Facebook even more power over your data, not less.

If people were to take the time to actually understand the issue, then they wouldn’t be pressuring Facebook to react this way. And there are better solutions: give people more access to their own data. That means, as Cory Doctorow suggested, the better way out is for Facebook to open itself up in a different way: to open itself up to third party app developers not to suck up data for marketing databases, but to give end users more control over their own data and how it is used.

People are so focused on Facebook sucking up their data, that they’re responding by demanding Facebook be a better steward of their data… rather than demanding that they get to manage their own data.

Nearly a decade ago, EFF suggested a social media bill of rights that it hoped sites like Facebook would adopt. It included giving users transparency into who wants their data and who gets it, giving users full control over their data, and finally enabling them to export their data in a useable format to bring to other sites on their own terms. If we lived in such a world, then we wouldn’t have to worry about the Cambridge Analytica situation, because users would know that some creepy personality test app was requesting their info, and they could deny it (or they could set filters that would automatically block it).

So, if Mark Zuckerberg really wants to respond to this crisis in a way that’s helpful, he should be opening up his platform… to a different set of app developers. It shouldn’t go to the developers who are siphoning up everyone’s data, but to those who can provide tools for end users to have full transparency and control over their data.

Unfortunately, the political and media reality is that if Zuckerberg actually went down this path, he’d probably be slammed for “opening up” user data, rather than locking it down.

Permalink | Comments | Email This Story

Techdirt.