Click to register for Larry’s webinar about supply chain security on Wednesday, Feb. 9, 2022 at 2 p.m. ET.

The Kaseya supply chain compromise has demonstrated the threats to supply chains that ransomware groups pose. The supply chain compromise of SolarWinds Orion network management due to the SUNBURST malware has also underscored how vulnerable supply chains are to attacks. According to participants in this research, these compromises and the increase in supply chain and IoT attacks require organizations to rethink supply chain and product security processes.

Sponsored by Finite State, Ponemon Institute surveyed 632 IT and IT security practitioners in the U.S. who are familiar with their organizations’ approach to securing embedded and connected devices and have complete or partial responsibility for setting and/or implementing their supply chain security strategies. The research targets device and connected device manufacturers in highly regulated industries.

Larry Ponemon will present findings from the study at a webinar on Wednesday, February 9, 2022, at 2 p.m. ET. Also presenting: Rich Nass,Executive Vice-President, Brand Director, Embedded Franchise, OpenSystems Media. Register for the webinar at this link

Seventy-three percent of respondents say their organizations are very committed (40 percent) or committed (33 percent) to achieving a secure supply chain. Twenty-seven percent of respondents say their organizations are only somewhat committed.

While respondents are aware and very concerned about the threats to their organizations’ supply chain based on recent compromises, only 39 percent of respondents say there is a direct risk assessment of the security of the supplied hardware and/or software, such as penetration testing, vulnerability scanning, requests for Software Bills of Materials and requests for security reports. Further, only 43 percent of respondents say their organizations conduct a risk assessment of the security development lifecycle for third-party vendors.

The following findings reveal why organizations are not making supply chain security as important as it should be.

• Product security is not a priority. Only 41 percent of respondents say their organizations make it a priority despite the finding that 76 percent of respondents say the security of an IoT device is very important

• Executives and boards of directors are not involved as they should be in their organizations’ product security practices. Only 27 percent of respondents say the leadership requires assurances that product security is being assessed, managed and monitored appropriately.

• Product security processes and programs are not reviewed frequently. Only 24 percent of respondents say such a review occurs frequently to address evolving supply chain risks. 

• Lack of resources and in-house expertise are obstacles to achieving a strong security posture. When asked what is preventing the development of secure IoT/embedded products, 62 percent of respondents say it is a lack of resources and 60 percent of respondents say it is a lack of in-house expertise. 

• Organizations need more resources to improve product security. Fifty percent of respondents say their organizations are not increasing investments for product security. As mentioned above, the number one obstacle to improved product security is the lack of resources.

• Organizations find it difficult to manage supply chain risks. Sixty percent of respondents say their organizations find it difficult to rapidly respond to new vulnerability disclosures that may affect their devices.

To read the full report, The Importance of Securing Connected and Embedded Devices In the Supply Chain, visit Finite State’s website.

Bob Sullivan

I’ve been thinking a lot about distraction lately.  We are all living lives of grand distractions these days, with one eye over our shoulder keeping track of Covid and its consequences.  The constant drumbeat of cases and science and conspiracy and bickering never ends.  If you are lucky enough that so far Covid has been just a distraction — and not something worse for you or your family — perhaps you managed to keep it together through nearly two years of remote everything. But right now, as our gas tank for pandemic tolerance is nearing empty, Omicron has arisen, seemingly to finish us off.  Sure, try to focus on that big work project, or the book you are reading, or on getting healthy, or getting your finances in order, or even the conversation you are having with a loved one, with everything else going on.

This is not a new problem.

I’ve been interested in distraction for a long time — since at least the 1990s, when a computer science researcher at Xerox Parc named Mark Weiser turned me onto the issue. I do believe it is the crisis of our time. Attention is our most precious commodity and it is under relentless attack right now. I tried to write a book about the problem about 10 years ago, but I couldn’t get publishers to focus on it. (Really!)  I did write an op-ed for The New York Times called “Brain, Interrupted,” which is still among the most popular piece I’ve written.

The digital age is the age of interruptions. Gadgets surround us, constantly beeping and blinking and popping up to get in our way, bringing whatever we might be doing to a screeching halt. Billions of dollars in research have been spent hacking your brain, and mine, to learn just how to steal your attention — and ultimately sell it to someone for a price. Think about it: if we live in the attention economy, then grabbing someone’s focus without their consent is theft.  The phrase is “pay attention,” after all. A new book called Stolen Focus: Why You Can’t Pay Attention by Johann Hari makes this argument, too, and cites some of my earlier research.

The cost is very real. About 10 years ago, when writing our book The Plateau Effect, I helped plan a distraction study at Carnegie Mellon University. You can read the details in my op-ed, but basically, students who received text messages during tests performed about 20% worse.  Other studies show that people who are interrupted for even just a few moments at work can languish for 20 or 30 minutes before regaining focus on whatever it was they were doing.

Constant task-switching robs our brains and hearts of the satisfying feeling that “stick-to-it-ive-ness” brings, the dopamine hit we get for setting a goal and completing a task. It robs us of intimacy, too. Try talking to someone who glances at their smartphone every 15 seconds, and you understand how every dancer in history has felt when they catch their partner looking around the club for someone more attractive.

Today I want to mention another cost of distraction, however. Crime.

If you grew up anywhere near New York City in the 1970s and 80s, you know who Crazy Eddie is (His prices are INNNNNSAAAAAANE!). The ubiquitous electronics store with the never-ending TV ads succeeded for one reason: Crazy Eddie was a cheater.  He eventually was convicted of tax fraud and went to jail. His brother, Sam Antar, former company chief financial officer and also convicted of fraud, later became a forensic accountant. He also gives a mighty fine speech about how white-collar criminals commit crimes. They create diversions.  “The distraction is more important than the lie,” he says over and over. He’s right.

You’ve seen it on TV, if you haven’t seen it yourself in person — pickpockets often bump into their victims to cause a distraction, then use that moment to steal a wallet or purse.  That’s the simple version.  Antar, speaking on the Bloomberg Odd Lots podcast a couple of years ago, explains how such distractions can work at scale. I won’t steal his material, it’s well worth the 10-minute watch on YouTube.  But Eddie’s real talent wasn’t lying about sales taxes. It was distracting the auditors when they came every year.

Distractions have been a key tool for ripoff artists throughout history. Car dealers sneak fees into loans while chatting about cupholders.  Real estate agents gloss over the cost of flood insurance while they describe how great the big garage will be for loading and unloading the kids’ car seats. Websites nudge you into trial subscriptions with a single click, then require a 30-minute call to cancel. (The FTC is finally taking on that one!) It’s up to consumers to refocus, constantly, on the bottom line, and on what matters. That’s a fair fight, I guess, or at least it can be. It’s a fight made much harder by endless fine print, dark patterns on websites, automated payments, and other gadget-driven intrusions.

But now, digital distractions are only half the problem. Covid has made so much of our lives a daily battle.  Did I forget my mask? Are we out of toilet paper? Should I book that vacation? That dental appointment?  Why is that person ignoring the guidelines / taking the guidelines too seriously?

We are all living lives of constant distraction. And that makes us all vulnerable. Charlatans smell this kind of distraction and go in for the kill. Early in the pandemic, we saw criminals steal billions of dollars from unemployment benefits programs.  TV characters and politicians are using this moment to incite hatred and distrust, to consolidate power, and most of all, to make money.  Whatever TV channel you watch, I challenge you to spend an hour or two paying more attention to the advertisements than the “content” and ask yourself how you feel supporting those products.

I wish I had a silver bullet or even some good-enough words of advice for this dark time. All I know is this: attention is indeed the most valuable commodity in the world. That’s what I learned from Mark Weiser at Xerox Parc when I wrote about it decades ago. Attention is like time; we just can’t make any more of it. We have what we have, and we decide how to use it.  At this time of crippling distractions, try to take things a little more slowly. Find some extra time to make big financial decisions if you can. Be gentle with yourself and with others as they try to find their focus.  And from my perch as a consumer reporter, beware people and things that interrupt you from doing what’s really important.

Enterprises continue to feel threatened in the pandemic with many feeling targeted, and this along with remote work and associated loss of productivity from password problems is driving increased adoption of passwordless technologies. Going forward organizations are extremely bullish on adopting passwordless authentication.

The purpose of this research is to understand the state of workforce passwordless authentication, the motivations and results when organizations transition to the use of passwordless authentication. Based on the experiences of organizations represented in this research, passwordless authentication can help remediate many concerns around cybersecurity posture caused by password and traditional MFA authentication approaches, sustained cyber threats and pandemic shifts to greater remote work.

Organizations that have adopted passwordless authentication say the main motivation was to improve the end-user experience and operational efficiency. The growing remote workforce also influenced these organizations’ decision to adopt passwordless authentication.

A key takeaway regarding economic efficiencies is that the use of passwordless authentication can reduce the financial consequences of attacks involving employees’ passwords and help desk costs due to password problems or resets by an average of $1,871,780 over a two-year period.

With sponsorship from Secret Double Octopus, Ponemon Institute surveyed 663 IT and IT security professionals in the United States. All respondents are familiar with their organizations’ approach to employee authentication and have some level of involvement in managing and making decisions about their organizations’ IT security strategy.

The following findings reveal the state of workforce passwordless authentication, its drivers and benefits: 

• Phishing attacks are pervasive. Phishing is the number one password-based attack according to 63 percent of respondents. An average of only 44 percent of all phishing emails are detected. 

• The shift to a remote workforce during the pandemic is driving the adoption of passwordless authentication. Fifty-five percent of respondents say their organizations use passwordless authentication for at least some use cases. Of these 55 percent of respondents, 79 percent say a growing remote workforce influenced passwordless adoption. 

• Remote working negatively affects employees’ and help desk productivity. Another reason to adopt passwordless authentication is that 75 percent of respondents say password authentication issues because of remote working has increased employee downtime. Seventy-four percent of respondents say it has decreased the productivity and increased the stress of the help desk team. 

• Organizations stand to save significant costs in both breach-related financial expenses and productivity with passwordless authentication. 

• Adoption of passwordless authentication is gaining traction. Forty-five percent of respondents say their organizations exclusively use conventional passwords. However, of these respondents, 66 percent of respondents expect to adopt passwordless authentication in the next six months (33 percent), within the next year (21 percent) and within the next two years (12 percent).

Part 2. Key Findings

 In this section, we provide a deeper analysis of the research findings. The complete audited findings are presented in the Appendix of this report. The findings are organized according to the following topics.

• Concern and vulnerability run high with respect to password-related cyber threats
• Remote work shifts are driving passwordless authentication adoption amidst security and productivity challenges
• Passwordless authentication cost savings totaled an average of $1.9M over 2 years per organization
• Opportunity and optimism remain high around passwordless authentication

Concern and Vulnerability Run High with Respect to Password-related Cyber Threats

The most prevalent password-based attacks are phishing. Some 63 percent of respondents say their organizations had attempted or successful phishing attacks in the past two years.  However, according to the research, cybersecurity teams can detect an average of only 44 percent of phishing emails. Seventy-one percent of respondents say phishing emails and employees’ misuse of passwords is increasing the risk of a targeted and successful attack.

 Organizations also experienced ransomware (57 percent of respondents) and credential stuffing or dictionary attacks (57 percent of respondents).

Remote Work Shifts Are Driving Passwordless Authentication Adoption Amidst Security and Productivity Challenges

 The remote workforce is decreasing organizations’ security posture.  According to 60 percent of respondents, a remote workforce reduces the security of the cloud infrastructure, makes connections to the domain less secure (56 percent) and increases the attack surface (49 percent).

The help desk is not immune from password authentication problems created by remote working. Some 74 percent of respondents say productivity has decreased and increased stress significantly (40 percent) or decreased productivity and increased stress (34 percent) of help desk workers.

 Passwordless Authentication cost savings totaled an Average of $1.9M Over Two Years

 Passwordless authentication significantly reduces the economic loss due to attacks involving employees’ passwords. Organizations with conventional authentication methods averaged $5.6 million in total economic loss from attacks involving employees’ passwords over the past two years vs. $4.2 million in organizations with passwordless authentication. Respondents were asked to include IT costs, downtime, lost business, damaged reputation, fines and legal fees, stolen proprietary data and ransoms paid in the total cost.

Opportunity and Optimism Remain High around Passwordless Authentication

In this section, only organizations that have adopted passwordless authentication are represented. In the context of this research, authentication is defined as the process of verifying the user’s identity by asking for a secret (e.g., password) possession of an item (e.g., USB dongle) or inherent attribute (biometrics). Passwordless authentication is any authentication method that does not require users to know their password.

Most organizations are still dependent upon traditional passwords at some level. However, 55 percent of respondents say their organizations use passwordless authentication for most or all use cases (11 percent), some use cases (19 percent) or only for specific use cases (25 percent).

Almost half of respondents rate the user experience and security of passwordless authentication far higher than conventional passwords. Respondents were asked to rate the quality of the user experience using passwordless authentication and conventional passwords on a scale from 1 = low quality to 10 = high quality. They also rated the security from 1 = low security to 10 = high security. Figure 15 shows the 7+ responses on the 10-point scale.

We found that 47 percent of respondents rate the quality of the user’s experience with passwordless authentication as high. However, only 26 percent of respondents rate the quality of conventional passwords as high.

To read the rest of this study and view the accompanying charts, visit DoubleOctopus.com

Bob Sullivan

When we talk about Facebook’s bad behavior, it’s easy to get bogged down in the details. Don’t. We should focus more on the outright fraud enabled by its platforms.

There’s been near constant talk about Facebook’s misbehavior lately, reaching a new crescendo after whistleblower Frances Haugen told Congress the firm knowingly makes software that hurts kids.  But as Haugen herself pointed out this week, regulators risk talking themselves into circles as they get bogged down in the details about how to react to Facebook’s various transgressions.  Debate on Section 230 could easily last into the next century, I think. And Facebook’s role in the 2016 election? Well, that’s destined to fill up talk radio show hours with never-ending prattle.

That’s why I wish there were much more focus on the outright fraud that Facebook enables. The case there is much more clear, as a the pillowcase-couch above suggests.

Facebook’s advertising platform got some of the attention it deserves this week after a story by Donie O’Sullivan at CNN showed the social media giant has taken payment for anti-vaxx ads, including a set that compared the U.S. vaccine program to the Holocaust. Facebook has publicly taken the stance that it has not contributed to anti-vaccine sentiment in the U.S., but anti-vaxxers have contributed to Facebook’s bottom line, the report found. Unsavory? Sure. Illegal? Probably not.

Look deeper into Facebook ads, and you’ll find far more dubious activity.  Earlier this year, I reported on a lawsuit filed in California that alleges Facebook has earned billions of dollars from advertisements it knows, or should know, are fraudulent. The social media giant makes it easy for criminals to target consumers who are not only likely to click on certain kinds of ads, but also likely to follow through with purchases, the case claims.  The firm is “actively soliciting, encouraging, and assisting scammers,” the suit claims.

Many of these highly-targeted ads on Facebook and Instagram promise consumers great deals on novelty products that seem specifically-tailored for them. Instead, credit card payments go to firms — many based in China — that never send the item or send something worth only pennies.  Criminals are using Facebook’s algorithms to micro-target victims, or as I like to say, to hack people. And steal their money.

The lawsuit seeks class-action status, and contains only allegations. But a Better Business Bureau report published this week by Steve Baker ads to the evidence that Facebook’s empire is built with the help of fraud, much of it originating in China.

BBB solicits complaints from Internet users through its Scam Tracker, and said on Thursday that the largest target of these complaints — 40% of the total – involve victims of online ads found on Instagram and Facebook.  While deceptive ads theoretically violate Facebook’s terms of service, the firm doesn’t seem to care much.

“Consumers tell BBB that Facebook and Instagram are often not helpful in addressing violations
of their own policies when consumers receive nothing at all, counterfeit goods, or items that were inferior to what was advertised and purchased,” BBB wrote. “These encounters often take place after seeing enticing social media ads placed by operations in China.”

Many of the crimes are blatant and obnoxious. A Canadian anti-fraud official told the BBB that he
has seen “accounts of people buying a cordless drill online but only receiving a screwdriver from China.”

The accusations in the lawsuit, and the BBB report, are not new. Buzzfeed News reported one year ago that internal Facebook research found 30% of ads placed in China violate the site’s terms of service.  The story also quotes a Facebook employee saying the company intentionally looks the other way, fearful that a crackdown might slow the flow of dollars from China.

Facebook told Buzzfeed for that story that it invests heavily in keeping deceptive and low quality ads off its site — given the scale of its ad business, that is no doubt true. But it also seems obvious the firm still isn’t investing nearly enough to fight fraud.  Last month I wrote about a disturbing example of criminals forcing victims to make “hostage-style” videos endorsing scams in a desperate attempt to regain control of their social media accounts. If Facebook hired enough people to assist consumers who were in trouble, there’d be no such desperation.

Another key piece of the puzzle revealed by the BBB study: Facebook and Instagram play a key role in connecting scammers to victims who weren’t even shopping online. BBB found that victims
who were not actively looking for a product, but lost money in the transaction, began with Facebook or
Instagram 70% of the time.

And all this fraud causes collateral damage, too. Many small businesses see their photos and product descriptions copied by criminals and used for deceptive ads.  Often, consumers blame the small businesses when they discover the crime. One art dealer in Dallas says he’s spent hours per week fighting this kind of copyright theft, and Facebook was quite unhelpful.

“Facebook will not take down these obviously related ads, but instead forces him to challenge the
ads one at a time,” the report says.

And victim consumers who report fraud in an effort to prevent future crimes told BBB they often don’t get results. One purchased a table based on a clever video that popped up on his Facebook feed. When he received nothing, said he contacted Facebook dozens of times about this fraud, and “they responded that the video did not violate their policies. The ad remained running for several months,” the BBB report says.

Fraud trend stories like this are always tricky: For years, credit card processors would respond to every story about online fraud by saying the actual fraud rate at e-commerce sites was very small, far less than one percent. That was cold comfort to victims, and it was also hard for external observers and policy-makers to evaluate. How much fraud is too much? At what rate should additional safeguards — safeguards that would add friction and probably impact revenue — be required?   Has fraud on Facebook reached that point? I cannot say. I can say the  Department of Homeland Security has warned that “e-commerce business models have a variety of new actors that aid, abet, or assist the transactions, including payment processors, social media websites, and online marketplaces.”

And I can say that Facebook simply doesn’t answer the phone when there’s an ongoing crime on its platform. Their online process for dealing with a serious consumer problem, such as an account takeover or a fraudulent ad, is severely lacking. Users should be able to get immediate help with issues like that. You’ll often hear defenders of the firm say that kind of support doesn’t scale. To that, I’d say that means their business doesn’t scale. If they can’t operate without enabling fraud, and can’t quickly help victims, their business model is fatally flawed.

The BBB tells me that Facebook did not take the opportunity to respond to its report. Facebook did not respond to my request for comment, either.  It did respond to the California lawsuit, however. With this straightforward defense: We are immune!

“The Court should dismiss all of Plaintiffs’ claims with prejudice because the Communications Decency Act, 47 U.S.C. § 230 (“Section 230”), shields interactive computer service providers such as Facebook from liability arising from content created by third parties,” the motion for dismissal says. “Plaintiffs have not—and could not—allege any facts that take their claims outside a plain and straightforward application of that statutory immunity.”

Section 230 reform is a multi-tentacled beast and my own opinions on what to do about it are still evolving. But I interviewed a law professor recently who told me that blanket immunity always causes problems, and this example makes it pretty clear.  Facebook is saying it’s not responsible for fraud it enables by matching criminals with victims because it has been granted immunity by Congress. That kind of license for bad behavior sounds chilling to me.  And the next time a Facebook spokesperson says the firm cares about fraud, remember that this defense.

A primary challenge to improving the security of organizations’ Industrial Control System (ICS) and Operational Technology (OT) environments, as revealed in this research, is the need to overcome the cultural and technical differences between OT and IT teams. Ideally, organizations should work toward establishing a unified IT and OT approach to addressing the threats and closing the gaps in security that leave organizations vulnerable to cyber attackers. Sponsored by Dragos, Ponemon Institute surveyed 603 IT, IT security and OT security practitioners at the C-level, managerial and director level in the United States. All are familiar with cybersecurity initiatives and ICS and OT security practices within their organizations.

In the context of this research, OT represents the programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). Examples include industrial control systems (ICS), building management systems, safety control systems, and physical access control mechanisms.

ICS encompasses several types of control systems, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other control system components such as programmable logic controllers (PLC) often found in the industrial sectors and critical infrastructures. An ICS consists of combinations of control components that act together to achieve an industrial objective.

The cultural divide between IT and OT teams affects the ability to secure both the IT and the ICS/OT environment. Because of the lack of alignment between an organization’s cybersecurity policies and procedures with OT and ICS security objectives, only 35 percent of respondents say their IT and OT teams have a unified security strategy that secures both the IT and OT environments, despite the need for different controls and priorities. Only 39 percent of respondents say IT and OT teams work cohesively to achieve a mature security posture in both the IT and OT environments.

The risks created by the cultural divide between the IT & OT Teams 

• Fifty percent of respondents are optimistic about the future of their ICS/OT cybersecurity program. However, only 21 percent of respondents say their ICS/OT program activities have achieved full maturity and emerging threats drive priority actions. A fully mature program also means C-level executives and the board of directors are regularly informed about the efficiency, effectiveness, and security of the program. Twenty-nine percent of respondents say their organizations are in the late-middle stage which means C-level support, adequate budget, risk assessment and a cross-functional team of IT and OT SMEs work together cohesively. 

• As the frequency and severity of attacks increase, organizations are struggling to keep ahead of these threats. Sixty-three percent of respondents say their organizations had an ICS/OT cybersecurity incident in the past two years. 

• For the first time, this research calculates the cost of one cybersecurity incident in the ICS/OT environment. The average cost per cybersecurity incident research is $2,989,550 (the calculation is shown in Table 1 of this report). An average of 316 days is spent to detect, investigate and remediate the cybersecurity incident. Based on the use of a threat hunting and incident response team that averages six IT and IT security personnel, it costs an average of $963,168 to detect, investigate and remediate the incident. The fixed costs including the replacement of equipment, downtime, legal and regulatory fines total $2,026,382. This equals the average total cost of $2,989,550. 

• The majority of respondents say senior management lacks an understanding about the cyber risks in the ICS/OT environments. As a result, not enough resources are allocated to defend the ICS/OT environments. Paradoxically, according to 56 percent of respondents, the primary blocker for investing in ICS/OT cybersecurity is that ICS/OT cybersecurity is managed by the engineering department, which does not have security expertise followed by 53 percent of respondents who say ICS/OT security is managed by an IT department without engineering expertise. 

• The Director/Manager of IT and the VP of Engineering are the functions most respondents in this study report to. However, by far the VP of Engineering is most accountable for the security of the ICS/OT program. Only 12 percent of respondents say the CISO is most accountable for the security of ICS/OT program. Further, only 35 percent of respondents say someone responsible for ICS and OT cybersecurity reports IT and cybersecurity initiatives to the board of directors. Of these respondents, 41 percent say such reporting takes place only when a security incident occur.

• Only 38 percent of respondents say the security safeguards in place to protect the ICS and OT environments are covered during board meetings and only 36 percent of respondents say the effectiveness and efficiency of security programs and measures are presented.

• Cultural and technical differences must be overcome to have OT and IT teams work cohesively. The challenges often are not caused by a competition for budget dollars and new security projects (only 32 percent of respondents). Rather, it is the cultural and technical differences between traditional IT-specific best practices and what is possible in OT environments, such as patch management and unique requirements of industrial automation equipment vendors that cause conflicts between these two functions (50 percent and 44 percent of respondents, respectively).

• Only 46 percent of respondents say their organizations are effective in gathering intelligence about threats to the ICS/OT environment and 45 percent of respondents say their organizations are effective in discovering and maintaining an inventory of all devices attached anywhere on the OT network throughout the asset lifecycle.

To read the full report, visit, Dragos.com. 

Bob Sullivan

A California woman who thought she was helping an old friend pay for a kidney transplant has been caught up in an Instagram hacking scheme with a nightmarish twist —  criminals drained her bank account via Zelle and then forced her to make a hostage-style video endorsing a get-rich-quick scheme in an attempt to get some of it back.

I found her “hostage” video online, which was posted by an Instagram account containing hundreds of similar videos endorsing a scheme promising 1,000 percent% on investments; many seem to be coerced.

Makaylah Lervold wrote to me on Friday desperately seeking help getting a refund after her bank account was hacked and criminals sent themselves about $3,000 of her money. The hack followed a chain of events that began with an old friend reaching out over Instagram messages saying he’d finally found a kidney donor match after a four-year search.  Lervold had met the sick friend several years ago at work, but hadn’t stayed in touch, though she was aware that he was indeed seeking a transplant.  His search was public; I’ve been able to confirm it through local news coverage.  Lervold said she messaged with the writer, whom she now knows was an imposter, and agreed to take a phone call from a hospital representative who would provide instructions on how to contribute.

She sent $1,000 to the caller’s account via Zelle, thinking it was a donation. Instead, the money was sent to a criminal’s account. The caller gleaned enough information — she asked for Lervold’s authentication codes — that the criminal or someone else was able to transfer nearly $3,000 more out of Lervold’s account through a series of additional Zelle transactions.  Lervold provided a screenshot of those transactions to me. Then, using stolen credentials, someone hacked into Lervold’s Instagram account and locked her out. The criminal subsequently threatened Lervold with more financial crimes unless she produced a video endorsing an investment scheme.

“Hi everyone. It’s Makaylah,” she says in the video. “I’m just here. I want to let you know about a huge opportunity. I just invested $1,500 with [name removed] and she turned my $1,500 investment into $15,000. Don’t miss out on this opportunity. I’m so grateful. Thank you [name removed]. Hit her up. She will invest your money. And turn it into a huge profit. You won’t regret it.”

Other videos on the “investment” Instagram account page contain similar messages. The account has more than 1,500 followers and has made 1,700 posts, dating back well into last year.

Posing as an old acquaintance, I contacted the hijacked account that originally belonged to Lervold’s sick friend, offering congratulations for finding a kidney match. The response came quickly: “Thank you so much sweetheart and I was about to ask you if you’d be interested in making some extra money.” Then later in our exchange, the imposter wrote, “Can you help me out $300 until tomorrow morning. I was short on a bill…I’m actually at the hospital.”

That victim declined to respond to a request for an interview.

Joseph Cox at Motherboard reported last week on a victim who was also forced to make a hostage-style video after being coerced into a bogus bitcoin investment. It’s unclear if these incidents are related, but my concern is the compelling tactic of forced video endorsement.

Lervold said the experience was terrifying.

“I’m so distraught…it was really scary,” she said. They drained all the money that I had saved for my wedding in June. It’s devastating. …  They forced me to make a video just like the last video they posted on my friend’s hacked account. …  They said if I didn’t do it they would completely drain my account. It was the scariest situation I have ever been in.”

Worse yet, when she contacted me, the criminals were using Lervold’s hijacked account in an attempt to scam her friends, she said.

“Now they are trying to scam my friends and inviting people from my Instagram to our wedding and are asking for money,” Lervold said.

She provided me with screen grabs of a dialog between a friend and the hacker in which the criminal offers to invite the friend to the wedding…then tries to convince the friend to send in money for the investment scheme.

“Did you see my ad? I actually made $15k from the investment. I posted it,” the message from the criminal, posting as Lervold, says. “Was wondering if you’d like to tap in.”

Last week, I reported that there was a large increase in consumers reporting that their Instagram accounts had been attacked by hackers. This complex scheme…involving trusted friend relationships, and hopping from one hijacked account to another, armed with intimate knowledge of each hacked victim…shows why hacked Instagram attacks can fetch nearly $50 on the digital black market.

Lervold said she reported that her Instagram account had been hacked to Facebook late last week; she has not yet heard back from the company. On Facebook, she can be seen pleading for friends to unfollow her Instagram account and asking them to report it as fraudulent so they would not be deceived by her video.

Monday afternoon I reported her account to Facebook’s media relations deparment, along with the account hosting the hostage videos.  Facebook has not yet returned my request for comment, but by Tuesday morning, Lervold’s account and the account hosting the hostage videos were both taken offline.

“Apparently each scam is different,” Lervold said. “They were messaging me already knowing I was (the kidney patient’s) friend. Which is why they knew I would donate. Other people they have used this investment scam saying they can turn a certain amount of money and turn it into a huge profit. Like the videos. You can turn $1,000 into $10,000. They took over my account and are asking people for money to help with my wedding. They must have read personal messages and are using that to get to my Instagram friends…the read back years in my messages.”

Eva Velasquez, CEO of the Identity Theft Resource Center, said her agency has been tracking the large increase in Instagram scams.  She said she was very concerned about the hostage video trend.

“It’s a new twist on ransoms,” she said. “Instead of asking for money, they are asking for videos.”

Her message to the public: Don’t make coerced videos. Paying the “ransom” doesn’t work.

“Do not make these videos endorsing something to get your money back or your account back because it’s not going to happen, you’re not getting it back,” she warned.  “Just walk away from the account.”  Work through the social media companies to get account access restored she said, admittedly an “arduous process.”

She warned that victims would suffer even deeper emotional consequences than those who send money to criminals — because their accounts and their words can be used to scam friends.

“When you add a layer that you were an instrument of victimization involving people you know and love, who are part of your personal network. that just adds another layer of emotional grief,” she said.

Velasquez also reminded users never to share authentication credentials — including two-factor text message codes  — with anyone.

I’ve decided that those SMS codes should no longer be used; it’s time that users switch to an authentication app for two-factor needs.  There are too many stories about criminals accessing text messages through hacking or coercion.

Larry Ponemon

The purpose of this research is to understand how COVID-19 has impacted how healthcare delivery organizations protect patient care and patient information from increasing virulent cyberattacks, especially ransomware. Prior to COVID-19, 55 percent of respondents say they were not confident they could mitigate the risks of ransomware. In the age of COVID-19, 61 percent of respondents are not confident or have no confidence.

Sponsored by Censinet, Ponemon Institute surveyed 597 IT and IT security professionals in HDOs. In the context of this research, HDOs are entities that deliver clinical care and rely upon the security of third parties with whom they contract services and products. These include integrated delivery networks, regional health systems, community hospitals, physician groups, and payers.  Click here to visit Censinet and download the full report.

Our findings correlated increasing cyberattacks, especially ransomware, with negative effects on patient care, exacerbated by the impact of COVID on healthcare providers. We also analyzed steps that HDOs are taking to protect patient safety, data, and care operations to determine what is working since so many respondents have been victims of more than one ransomware attack.

Ransomware attacks on healthcare organizations can be a life-or-death situation.

The onset of COVID-19 introduced new risk factors to HDOs, including remote work, new systems to support it, staffing challenges, and elevated patient care requirements. There’s been a great deal of media coverage on the rise of cyberattacks such as ransomware both within the healthcare industry and beyond. This research focuses on the healthcare industry to understand the extent to which HDOs are being targeted and ascertain the impact of those attacks. Both are covered in-depth in the key findings section of the report.

Over the last two years, 43 percent of respondents say their HDOs experienced a ransomware attack. Of these respondents, 67 percent of respondents say their HDO had one and 33 percent of respondents say they experienced two or more.

These attacks risk patient safety, data, and overall care availability. Respondents report that ransomware attacks had a significant impact on patient care, reporting longer length of stay (71 percent of respondents), delays in procedures and tests (70 percent of respondents), increase in patient transfers or facility diversions (65 percent of respondents) and an increase in complications from medical procedures (36%) and mortality rates (22%).

HDOs forecast that the number of contracted third parties will increase by 30 percent over the next 12 months

Driven by cost containment, regulatory directives and the demand for accessible, higher-quality patient care, HDOs have shifted to the digitization and distribution of health information. Moreover, medical devices, whether in patient rooms or labs, rely on network connectivity for operations and maintenance.

Nearly all of the technology components described are not developed by the HDO. These include software, services, and hardware development from organizations known as third parties. This study revealed that the average number of third parties that organizations contract with is 1,950, and this will increase to an average of 2,541 in the next 12 months.

Third-party products and services are a necessary and critical part of the HDO IT blueprint, but each brings another set of risk factors to the table. Some risks are inherent to the third party such as secure operating systems and other software in medical devices. Other risks involve how the HDOs deploy and use third parties, including storing protected health information (PHI) on cloud-based systems that weren’t meant to support it. In either case, the risk created by the third party or the HDO use of the third party needs to be managed. The burden is on the HDO to perform assessments throughout their relationship with the third party (e.g., procurement, implementation, usage, updates, termination, etc.).

Third-Party Risk Management is Hard, and COVID-19 Made it Worse

This research also looks at the capabilities and maturity of HDOs to manage third-party risk, both before and during COVID-19. According to only 44 percent of respondents, controls critical to assessing third-party risks are only partially accomplished in HDOs. Only 40 percent of respondents say their organization always completes a risk assessment of its third parties prior to contracting with them. However, 38 percent of respondents state the assessment findings are ignored by leaders.

Re-assessments are another critical part of third-party risk management and are not conducted as often as required. More than half (53 percent) of respondents say re-assessments are conducted only on-demand or on no regular schedule.

Recommendations for Mitigating Ransomware and Third-Party Risks

According to the findings, healthcare organizations are less prepared to deal with third-party risks. Following are recommended steps for HDOs to take to protect patient safety, data, and care operations.

• Invest in workflow automation, resources, and processes to establish a digital inventory of all third parties and PHI records. An HDO must know the number and location of PHI records that are accessed, transmitted or stored by third-party products or services.
• Increase overall risk coverage of third parties by leveraging automation to conduct more assessments. The average number of third parties that organizations contract with is expected to increase from 1,950 to 2,541 over the next 12 months. However, only 40 percent of respondents say their organizations always complete a risk assessment prior to engaging with a third party. If their organizations conduct an assessment, only 38 percent of respondents say their leaders always accept their recommendation not to contract with them.

• Allocate resources and funding to re-assess high-risk third parties. Currently, only an average of 32 percent of critical and high-risk third parties are assessed annually, and only an average of 27 percent of these third parties are re-assessed annually.

• Increase efforts to secure medical devices. Only 36 percent of respondents say their organizations know where all medical devices are. Only 35 percent of respondents say they know when a medical device vendor’s operating device is end-of-life or out-of-date. Only 29 percent of respondents say they know the non-planned expense of medical device operating system patches.

• Ensure critical steps for identifying and mitigating third-party risks are in place. Sixty percent of organizations represented in this research had a data breach in the past two years, resulting in an average of 28,505 records containing sensitive and confidential information compromised. According to the research, organizations can only partially evaluate the various threats targeting their assets and IT vulnerabilities. They also lack the capability to continuously monitor vendor risks.

• Assign risk accountability and ownership to one role. The ability to execute an enterprise-wide risk management strategy is affected by not assigning accountability and ownership to one role.

Click here to visit Censinet and download the full report.

Bob Sullivan

It’s the news feed, stupid. The algorithm.

You’re probably going to read 1,000 things about the recent Facebook whistleblower hearing, so I won’t belabor the discussion. I have just one point I’d like to drive home. But first– I will say I’m sad that, after all this time, journalists from all over give prominent placement to the disinformation published by Facebook about Facebook — The New York Times felt the need to put the firm’s misdirection statement about the hearings in the fourth paragraph of its story about the hearings, showing journalists have learned little about the way both-sides-ism is abused in the information age.   I won’t repeat it here, but suffice to say the company just attacked the message without disputing any of the messages.

I’d like people to focus on something simple and often overlooked when it comes to the harm Facebook’s apps cause in the world: Control of the news feed.   Witness Fraunces Haugen talked quite a bit about Instagram and Facebook’s use of “engagement-based ranking” for items that appear before users.  You can’t pick what appears on these apps, not really. Facebook picks. And it picks the most extreme, most manipulative, most addictive content it can place in front of you. All the time.

Facebook has spent billions of dollars hacking you. Researching you. Picking you apart. Finding your weakness. And then feeding it. Like candy bars with too much sugar, or better yet, opioids that ease the pain just enough. Well, nearly enough, but not quite. So, you must come back for more, and more, and more.   To one man, it’s angry Trump content. To a young woman, it’s workout videos. Still another gets climate change outrage, or posts about the Latin Mass.  Facebook doesn’t care.  Like an evil creature from a science-fiction movie, it finds your weakness and exploits it. To feed the ever-hungrier beast inside.

This is “engagement-based ranking,” as Haugen called it.  And when we like or share these addictive things, we “give little hits of dopamine” to our friends.  Like a nightmare digital drug gang — *shiver*

Users have forever asked for a simpler way.  They want control of the news feed, or the way Instram picks images to display.  Consumers have forever wanted a simple page full of close friends’ posts.  Babies, weddings, the occasional professional announcement.  This request has been denied over and over by Facebook.  In fact, the company has stopped outside firms from creating plugins that would enable just that simple feature.  Why?    Haugen explained: Engagement would fall. Clicks would drop. Revenue would fall.

Facebook claims the reason is something else: User-directed feeds would be full of spam and other annoying content. That reasoning — Facebook-i-an NewsSpeak — is so bogus I hesitate to repeat it.  We all deal with spam, every day. We could handle it on Facebook and Instagram in exchange for ending the tool’s ever-increasing, artificial intelligence-fueled addictive algorithm.

So as Congress and other law enforcement ponder what should happen now, here’s my wish list of one: Require Facebook to let users opt out of the algorithm.  Or, as  Haugen suggested, end Section 230 protections for algorithm-programmed content farms.  If they pick the things we see, they should be responsible for them. I’m not saying this would fix every problem. But it sure would fix a lot. And it could happen….immediately.

It’s not that hard to fix. We’ve just failed…so far.  Tim Sparapani, another former Facebook employee, told me that last year in my “Original Sin of the Internet” podcast. It’s more true than ever now.

Ponemon Institute is pleased to present the findings of the 2021 Global Encryption Trends Study, sponsored by Entrust. We surveyed 6,610 individuals across multiple industry sectors in 17 countries – Arabian Cluster (which is a combination of respondents located in Saudi Arabia and the United Arab Emirates), Australia, Brazil, France, Germany, Hong Kong, Japan, Mexico, Netherlands, the Russian Federation, Spain, Southeast Asia, South Korea, Sweden, Taiwan, the United Kingdom, and the United States.

The purpose of this research is to examine how the use of encryption has evolved over the past 16 years and the impact of this technology on the security posture of organizations. The first encryption trends study was conducted in 2005 for a US sample of respondents.  Since then we have expanded the scope of the research to include respondents in all regions of the world.

Since 2015 the deployment of encryption has steadily increased. This year, 50 percent of respondents say their organizations have an overall encryption plan that is applied consistently across the entire enterprise and 37 percent of respondents say they have a limited encryption plan or strategy that is applied to certain applications and data types, a slight decrease from last year. Following are the findings from this year’s research:

Strategy and adoption of encryption

Enterprise-wide encryption strategies increase. Since conducting this study 16 years ago, there has been a steady increase in organizations with an encryption strategy applied consistently across the entire enterprise. In turn, there has been a steady decline in organizations not having an encryption plan or strategy. The results have essentially reversed over the years of the study.

Certain countries have more mature encryption strategies. The prevalence of an enterprise encryption strategy varies among the countries represented in this research. The highest prevalence of an enterprise encryption strategy is reported in Germany, the United States, Japan and the Netherlands. Respondents in the Russian Federation and Brazil report the lowest adoption of an enterprise encryption strategy. The global average of adoption is 50 percent.

The IT operations function is the most influential in framing the organization’s encryption strategy over the past 14 years. However, in the United States the lines of business are more influential (305percent of respondents). IT operations are most influential in Sweden, Korea and France.

Trends in adoption of encryption

 The use of encryption increases in all industries Results suggest a steady increase in all industry sectors, with the exception of communications and service organizations. The most significant increases in extensive encryption usage occur in manufacturing, hospitality and consumer products.

 The extensive use of encryption technologies increases. Since we began tracking the enterprise-wide use of encryption in 2005, there has been a steady increase in the encryption solutions extensively used by organizations.

Threats, main drivers and priorities

Employee mistakes continue to be the most significant threats to sensitive data. The most significant threats to the exposure of sensitive or confidential data are employee mistakes.

In contrast, the least significant threats to the exposure of sensitive or confidential data include government eavesdropping and lawful data requests. Concerns over inadvertent exposure (employee mistakes and system malfunction) significantly outweigh concerns over actual attacks by temporary or contract workers and malicious insiders.

The main driver for encryption is the protection of customer’s personal information. Organizations are using encryption to protect customers’ personal information (54 percent of respondents), to protect information against specific, identified threats (50 percent of respondents), and the protection of enterprise intellectual property (49 percent of respondents).

A barrier to a successful encryption strategy is the ability to discover where sensitive data resides in the organization. Sixty-five percent of respondents say discovering where sensitive data resides in the organization is the number one challenge. Forty-three percent of all respondents cite initially deploying encryption technology as a significant challenge. Thirty-four percent cite classifying which data to encrypt as difficult.

Deployment choices

No single encryption technology dominates in organizations. Organizations have very diverse needs. Internet communications, databases and internal networks are the most likely to be deployed and correspond to mature use cases. For the fourth year, the study tracked the deployment of encryption of IoT devices and platforms. Sixty-one percent of respondents say encryption of IoT platforms devices and 61 percent of respondents say encryption of IoT platforms have been at least partially deployed.

Encryption features considered most important

Certain encryption features are considered more critical than others. According to the consolidated findings, system performance and latency, management of keys and enforcement of policy are the three most important encryption features.

Which data types are most often encrypted? Payment related data and financial records are most likely to be encrypted as a result of high-profile data breaches in financial services. The least likely data type to be encrypted is health-related information and non-financial information, which is a surprising result given the sensitivity of health information.

Attitudes about key management

How painful is key management? Fifty-six percent of respondents rate key management as very painful, which suggests respondents view managing keys as a very challenging activity. The highest percentage pain threshold of 69 percent occurs in Spain. At 37 percent, the lowest pain level occurs in France. No clear ownership and lack of skilled personnel are the primary reasons why key management is painful.

Importance of hardware security modules (HSMs)

The United States, Germany and Japan organizations are more likely to deploy HSMs. T United States, Germany and Japan are more likely to deploy HSMs than other countries. The overall average deployment rate for HSMs is 49 percent.

How HSMs in conjunction with public cloud-based applications are primarily deployed today and in the next 12 months. Forty-one percent of respondents say their organizations own and operate HSMs on-premise, accessed real-time by cloud-hosted applications and 39 percent of respondents rent/use HSMs from a public cloud provider for the same purpose. The use of HSMs with Cloud Access Security Brokers and the ownership and operation of HSMs on premise are expected to increase significantly.

The overall average importance rating for HSMs, as part of an encryption and key management strategy in the current year is 66percent. The pattern of responses suggests the United States, Arabia (Middle East) and the Netherlands are most likely to assign importance to HSMs as part of their organization’s encryption or key management activities.

What best describes an organization’s use of HSMs? Sixty-one percent of respondents say their organization has a centralized team that provides cryptography as a service (including HSMs) to multiple applications/teams within their organization (i.e. private cloud model). Thirty-nine percent say each individual application owner/team is responsible for their own cryptographic services (including HSMs), indicative of the more traditional siloed application-specific data center deployment approach.

What are the primary purposes or uses for HSMs? The three top uses are application-level encryption, SSL/TLS, followed by container encryption/signing services. There is a significant increase in the use of database encryption 12 months from now.

Cloud encryption

 Sixty percent of respondents say their organizations transfer sensitive or confidential data to the cloud whether or not it is encrypted or made unreadable via some other mechanism such as tokenization or data masking. Another 24 percent of respondents expect to do so in the next one to two years. These findings indicate the benefits of cloud computing outweigh the risks associated with transferring sensitive or confidential data to the cloud.

How do organizations protect data at rest in the cloud? Thirty-eight percent of respondents say encryption is performed on-premise prior to sending data to the cloud using keys their organization generates and manages. However, 36 percent of respondents perform encryption in the cloud, with cloud provider generated/managed keys. Twenty-one percent of respondents are using some form of Bring Your Own Key (BYOK) approach.

What are the top three encryption features specifically for the cloud? The top three features are support for the KMIP standard for key management (59 percent of respondents), SIEM integration, visualization and analysis of logs (59 percent of respondents) and granular access controls (50 percent of respondents).

 Read the full Global Encryption Trends story at Entrust’s website.

Bob Sullivan

Facebook profits from advertisements it knows, or should know, are fraudulent, a federal lawsuit filed in  California alleges. The social media giant makes it easy for criminals to target consumers who are not only likely to click on certain kinds of ads, but also likely to follow through with purchases, the case claims.  The firm is “actively soliciting, encouraging, and assisting scammers,” the suit claims.

Alleged frauds include ads for products that never ship, or are substantially different from what is advertised. Fraud rates for some types of ads are as high as 30%, the suit claims.

Not only does Facebook look the other way when such ads are placed, but it has actively recruited suspicious sellers through conferences and other means, the case claims. Lawyers for the plaintiffs seek class-action status for the case, and claim there are potentially millions of victims and Facebook has earned billions of dollars.

Facebook did not immediately respond to a request for comment about the lawsuit (I’ll update the story if needed).

Tech companies have faced allegations they profit off fraud enabled by their platforms for a long time. Journalists have been writing about fake Google Maps businesses for at least seven years.  Instagram fraud had its day in the sun back in 2018. The firms make money off disinformation, too. Recently, I searched for “Can I get the vaccine from my doctor” on Google and was presented with a long list of anti-vaxx links and products for sale.

There have long been questions about how hard these services work to correct these problems. “More than a third (34%) of people that reported a scam ad to Google said it was not taken down while just over a quarter (26%) said the same had happened with Facebook, according to a study published by British consumer group Which?” BusinessInsider has reported.

The recent Facebook case, filed in August, alleges negligence, breach of contract, and breach of covenant of good faith and fair dealing. It builds on the work of several journalists who have written about Facebook ad fraud in recent years — most notably Zeke Faux’s story in 2018, which includes details from a Facebook ad conference that Bloomberg attended; and a Buzzfeed story from last year, titled Facebook Gets Rich Off Of Ads That Rip Off Its Users. 

The California lawsuit claims that “Facebook’s sales teams have also been aggressively soliciting ad sales in China and providing extensive training services and materials to China-based advertisers, despite an internal study showing that nearly thirty percent (30%) of the ads placed by China-based advertisers — estimated to account for $2.6 billion in 2020 ad sales alone — violated at least one of Facebook’s own ad policies.”

It also cites increased social media advertising fraud complaints, driven most recently by stay-at-home orders during the pandemic. “In October 2020, the Federal Trade Commission (“FTC”) reported that about 94% of the complaints it collected concerning online shopping fraud on social media identified Facebook (or its Instagram site) as the source,” the case notes.

Facebook denied to Buzzfeed that it profits off fraud. It told the news site: “Bad ads cost Facebook money and create experiences people don’t want. Some of the things raised in this piece are either misconstrued or missing important context. We have every incentive — financial and otherwise — to prevent abuse and make the ads experience on Facebook a positive one. To suggest otherwise fundamentally misunderstands our business model and mission.”

But it’s hard to deny the incentives large tech companies have to look the other way when companies are paying them millions of dollars to get finely-tuned ads in front of users.

In the lawsuit, plaintiff Christopher Calise says he spent about $50 to buy a car engine assembly kit and never received it. He reported the ad as fraud to Facebook, and the social media company took it down, but the alleged scam firm was able to re-place the ad using a slightly different name soon after.   Plaintiff Anastasia Groschen says she responded to an ad for a child’s activity board. When a simple puzzle arrived instead, she complained to the company, only to be instructed that she’d have to pay to ship the puzzle back to China.

The lawsuit seeks monetary damages for all impacted members of the class, and wants the court to force Facebook to make immediate changes to the way it patrols ads.