Page 40 - FCW, June/July 2021

GameChanger network at a reasonable, not anomalous,
Besides hygiene, cyber basics include continuously patching internet-exposed assets and backing them up. Agencies often overlook these fundamental steps on the hunt for more sophisticated defenses, but that’s like planning Super Bowl plays when you can’t walk to the refrigerator without huffing and puffing, according to one cybersecurity expert.
without seeing how they relate in the big picture. Synergy can increase effectiveness at little or no additional cost.
time. Additionally, it includes access management to ensure that someone working remotely cannot see data outside their authorization. Another crucial cyber defense tool is basic cyber hygiene, which has become more important than ever with the increase in ransomware attacks. Between July and December 2020, Fortinet’s FortiGuard Labs documented
Second, use a security platform that enables all of the assets in an IT and security ecosystem to leverage AI and Machine Learning to communicate, cooperate and exchange data efficiently and cost-effectively. Without that, agencies risk upgrading parts of their infrastructure and looking at problems in isolation
The third element is zero trust - a strategy that recognizes that no agency’s defenses will be perfect. Rather than giving free rein within the network, recognizing that any device or user account can be compromised, therefore operating by assigning each action the minimum privileges, limiting access to that needed to accomplish the task at hand, and verifying each and every action. Any network can be breached, but governments can take actions to minimize the effects of compromise.
a sevenfold increase in ransomware activity. Instead of targeting holes in enterprise networks, they simply targeted home office networks that have holes everywhere. Bad actors penetrate those machines and used them as a hop point into the enterprise.
Ransomware is rampant, especially among state and local governments, simply because it works. The emergence of cryptocurrencies facilitated payment methods for agencies that need to get their data back or to keep it from being leaked. Also contributing to the proliferation
Blended Workplace
Challenges to cyber investments
The pandemic took an economic toll on state and local agencies. The Center on Budget and Policy Priorities reported that revenues were 7.8% below pre-COVID projects in January, when it said that states, localities, tribal nations, and U.S. territories face shortfalls
of about $300 billion through fiscal 2022. “If states fully spend the roughly $75 billion in reserves they held heading into the pandemic, that estimate drops to $225 billion,” CBPP added.
Federal efforts to help states in the form of the Technology Modernization Fund and the Coronavirus Aid, Relief, and Economic Security (CARES) Act are helping agencies make up some of the difference. The trick is that chief information and chief information security officers need to know how to prioritize their investments.
“Software-defined networking is a great place to spend money because it gives you the ability to have this kind of flexibility about where you work, how you work,” said James Richberg a Fortinet field CISO. It lets IT managers tune the settings for things users care about while showing senior leaders that they can have a workforce that works from anywhere and is still protected.
is how easy it to deploy ransomware. Dubbed ransomware-as-a-service, bad actors don’t have to write the code, just rent it from those who can, and share the profits.
Additionally, hackers are starting to use multiple attack modes simultaneously. For instance, they’ll execute a big denial-of- service attack while also unleashing a spear phishing campaign in hopes that the defending agency is too distracted by the former to notice the latter.
Modular code is also gaining traction with attackers. Built from ‘best of breed’ functions in existing malware, it allows, for example, for combining code that efficiently gains access to a target, with another piece of malware’s ability to rapidly spread laterally. Some malware code can also do different things, for example, take over a computer to use its processor to mine for cryptocurrency or rent it out as part of a botnet.
There are three main ways to fight back - implementing the basics, recognizing the power of an integrated ecosystem and zero trust.
aws.amazon.com/marketplace/featured-seller/Fortinet