1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar

Internet of Things (IoT) Security Takes Center Stage At FBI, DHS, NIST and Congress

On October 21, 2016, a domain name service host and internet management company experienced at least two waves of a distributed denial of service (DDoS) attack that impacted at least 80 websites, including those belonging to Netflix, Twitter and CNN.  The attack was launched by infecting millions of American’s Internet of Things (IoT) connected devices with a variation of the Mirai malware.  The Mirai malware primarily targets IoT devices such as routers, digital video records and webcams / security cameras by exploiting their use of default usernames and passwords and coordinating them into a botnet used to conduct DDoS attacks.  The U.S. Federal Bureau of Investigation (FBI) does not have confirmation of a group or individual responsible for the attack.  In September 2016, two of the largest IoT DDoS attacks using the same malware disrupted the operations of a gaming server and computer security blogger website.

In light of these attacks, there has been an increased focus on IoT security at the FBI, the U.S. Department of Homeland and Security (DHS), the National Institute of Standards and Technology (NIST) and Capitol Hill.

FBI Guidance

Five days after the October 21, 2016 attack, the FBI issued a Private Industry Notification, providing a list of precautionary measures stakeholders should take to mitigate “a range of potential DDoS threats and IoT compromise,” including but not limited to:

  • Having a DDoS mitigation strategy ready ahead of time and keeping logs of any potential attacks;
  • Implementing an incident response plan that includes DDoS mitigation.  The plan may involve external organizations such as law enforcement;
  • Implementing a data back-up and recovery plan to maintain copies of sensitive or proprietary data in a separate and secure location;
  • Reviewing reliance on easily identified internet connections for critical operations, particularly those shared with public facing web servers;
  • Ensuring upstream firewalls are in place to block incoming UDP packets;
  • Changing default credentials on all IoT devices; and
  • Ensuring that software or firmware updates are applied as soon as the device manufacturer releases them.

A copy of the FBI Notification can be found here.

DHS Guidance

On November 15, 2016, the DHS issued its own non-binding guidance for prioritizing IoT security, aimed at IoT developers, IoT manufacturers, service providers, industrial and business-level consumers.  According to the DHS, there are six non-binding principles that, if followed, will help account for security as stakeholders develop, manufacture, implement or use network-connected devices.

Principle #1 – Incorporate Security at the Design Phase

The DHS notes that security should be evaluated as an integral component of any network-connected device.  Building security “in at the design phase reduces potential disruptions and avoids the much more difficult and expensive endeavor of attempting to add security to products after they have been developed and deployed.”  To that end, the DHS suggests the following practices:

  • Enable security by default through unique, hard to crack default user names and passwords.
  • Build the device using the most recent operating system that is technically viable and economically feasible.
  • Use hardware that incorporates security features to strengthen the protection and integrity of the device.
  • Design with system and operational disruption in mind.

Principle #2 – Advance Security Updates and Vulnerability Management

Even when security is included at the design stage, vulnerabilities may be discovered in products after they have been sent to market.  The DHS notes these flaws can be mitigated through patching, security updates, and vulnerability management strategies.  Suggested practices include:

  • Consider ways to secure the device over network connections or through automated means.
  • Consider coordinating software updates among third-party vendors to address vulnerabilities and security improvements to ensure consumer devices have the complete set of current protections.
  • Develop automated mechanisms for addressing vulnerabilities.
  • Develop a policy regarding the coordinated disclosure of vulnerabilities, including associated security practices to address identified vulnerabilities.
  • Develop an end-of-life strategy for IoT products.

Principle #3 – Build on Proven Security Practices

According to the DHS, many tested practices used in traditional IT and network security can be applied to IoT, and can help identify vulnerabilities, detect irregularities, respond to potential incidents and recover from damage or disruption to IoT devices.  The DHS recommends NIST’s framework for cybersecurity risk management, which has widely been adopted by private industry and integrated across sectors.  Other suggested practices include:

  • Start with basic software security and cyber security practices, and apply them to the IoT ecosystem in flexible, adaptive and innovative ways.
  • Refer to relevant Sector-Specific Guidance, where it exists, as a starting point from which to consider security practices (e.g., the National Highway Traffic Safety Administration recently released guidance on Cybersecurity Best Practices for Modern Vehicles and the Food and Drug Administration released draft guidance on Postmarket Management of Cybersecurity in Medical Devices).
  • Practice defense in depth.
  • Participate in information sharing platforms to report vulnerabilities and receive timely and critical information about current cyber threats and vulnerabilities from public  and private partners.

Principle #4 – Prioritize Security Measures According to Potential Impact

The DHS recognizes that risk models differ substantially across the IoT ecosystem, and the consequences of a security failure will vary significantly.  The DHS therefore recommends:

  • Knowing a device’s intended use and environment, where possible;
  • Performing a “red-teaming” exercise where developers actively try to bypass the security measures needed at the application, network, data or physical layers; and
  • Identifying and authenticating the devices connected to the network, especially for industrial consumers and business networks.

Principle #5 – Promote Transparency Across IoT

Where possible, the DHS recommends that developers and manufacturers know their supply chain, and whether there are any associated vulnerabilities with the software and hardware components provided by vendors outside their organization.  This increased awareness could help manufacturers and industrial consumers identify where and how to apply security measures or build in redundancies.  Recommended practices include:

  • Conduct end-to-end risk assessments that account for both internal and third party vendor risks, where possible.
  • Consider the creation of a publicly disclosed mechanism for using vulnerability reports.
  • Consider developing and employing a software bill of materials that can be used as a means of building shared trust among vendors and manufacturers.

Principle #6 – Connect Carefully and Deliberately

The DHS notes that consumers, particularly in the industrial context, should “deliberately consider whether continuous connectivity is needed given the use of the IoT device and the risks associated with its disruption.”  To that end, suggested practices include:

  • Advise IoT consumers on the intended purpose of any network connections
  • Making intentional connections.
  • Build in controls to allow manufacturers, service providers, and consumers to disable network connections or specific ports when needed or desired to enable selective connectivity.

A copy of the DHS guidance can be found here.

NIST Guidelines

On November 15, 2016, NIST released its own guidance advising IoT manufacturers and developers to implement security safeguards and to monitor those systems on a regular basis.  NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems.  The new NIST Special Publication 800-160 is the product of four years of research and development, and focuses largely on engineering actions that are required to ensure connected devices are able to prevent and recover from cyber attacks, and lays out dozens of technical standards and security principles for developers to consider.

A complete copy of the NIST guidance can be found here.

Congressional Hearing

One day after the DHS and NIST guidance was released, on November 16, 2016, the House Committee on Energy and Commerce’s Subcommittee on Commerce, Manufacturing, and Trade and the Subcommittee on Communications and Technology held a hearing on “Understanding the Role of Connected Devices in Recent Cyber Attacks.”  The witnesses were Dale Drew of Level 3 Communications, Kevin Fu of Virta Labs and the University of Michigan, and Bruce Schneier from the Berkman Klein Center at Harvard University.

The witnesses uniformly recommended that while the DDos attack in October was just on popular websites, and not critical infrastructure, attacks toward critical infrastructure, including public safety and hospital systems, are likely.  Each witness stressed the importance of addressing the vulnerabilities at the onset of developing technology, and urged greater oversight by lawmakers.

A video of this hearing can be found here.

Internet of Things (IoT) Security Takes Center Stage At FBI, DHS, NIST and Congress

US Officially Blames Russia For DNC Hack

The United States (US) Department of Homeland Security (DHS) and Office of the Director of National Intelligence (ODNI) issued a joint statement on Friday, October 7, 2016, publicly stating for the first time that the US Intelligence Community is “confident” that the “Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations.”

DNC Attack Background

Last April, after the DNC discovered malware on its computer systems, it hired third party cybersecurity firm CrowdStrike to investigate the breach.  After completing its investigation, CrowdStrike issued a report in June 2016 linking the attacks to two groups associated with Russia:

  • “Cozy Bear,” a group suspected of previously attacking networks at the White House, State Department and Joint Chiefs of Staff; and
  • “Fancy Bear,” a group suspected to have targeted public and private entities for decades.

CrowdStrike linked the attacks of Cozy Bear and Fancy Bear to Russia because their programming code sometimes matched the code used in earlier hacks by Russia, and their behavior matched that of Russia’s in its historic efforts to increase Russian sphere of influence in Eastern Europe.  Thousands of stolen e-mails from the DNC were subsequently published on a source called DC Leaks, which ThreatConnect, a separate cybersecurity firm, has linked to Fancy Bear.

A day after the report, someone calling themselves Guccifer 2.0 claimed responsibility for the hack in a blog post.

Joint Statement Blames Russia For DNC Hack

In Friday’s joint statement, the DHS and ODNI stated for the first time that the “recent disclosures of alleged hacked e-mails on sites like DCLeaks.com and WikiLeaks and by the Guiccer 2.0 online persona are consistent with the methods and motivations of Russia-directed efforts.”  The agencies found that the “thefts and disclosures are intended to interfere with the US election process[,]” which is activity that is not “new to Moscow – the Russians have used similar tactics and techniques across Europe and Eurasia, for example, to influence public opinion there.”  Based on the “scope and sensitivity” of such efforts, the agencies concluded that only “Russia’s senior-most officials could have authorized these activities.”

No Conclusion On Voting Machine Hacks

The joint statement stopped short of attributing the recent state election data system breaches to Russia.  These breaches, which have seen at least Illinois and Arizona experience scanning and probing of their election systems, have been tied back to servers operated by a Russian company.  The FBI is currently investigating this claim, but the DHS and ODNI said the US Intelligence Community is not “now in a position to attribute this activity to the Russian Government.”

The joint statement came on the same day as a ceasefire in Syria fell apart and the US accused Russia of war crimes in Aleppo.   A copy of the joint report can be found here.

US Officially Blames Russia For DNC Hack

White House Issues Presidential Directive Coordinating Government Response To “Cyber Incidents”

On July 26, 2016, President Obama issued a new Presidential Directive setting forth the framework for how the United States (US) federal government will respond to “cyber incidents,” whether involving government or private sector entities.  The new directive (PPD-41):

  • Outlines guiding principles governing the federal government’s response to “cyber incidents”;
  • Sets forth the concurrent lines of effort federal agencies shall undertake in responding to any “cyber incident,” whether private or public;
  • Identifies the ways the federal government will coordinate its activities in responding to “significant cyber incidents,” including the establishment of lead US federal agencies; and
  • Requires the US Departments of Justice (DOJ) and Homeland Security (DHS) to maintain updated contact information for public use to assist entities impacted by “cyber incidents” in reporting those incidents to the proper authorities.

Definitions

  • Cyber Incident: PPD-41 defines “cyber incident” as an event “occurring on or conducted through a computer network that actually or imminently jeopardizes the integrity, confidentiality or availability of computers, information or communications systems or networks, physical or virtual infrastructure controlled by computers or information systems, or information resident thereon.”
  • Significant Cyber Incident: PPD-41 defines a “significant cyber incident” as one that is “likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people.”

Guiding Principles

In carrying out its incident response activities, the federal government is to be guided by the following principles:

  • Shared Responsibility: Individuals, the private sector, and government agencies have a “shared vital interest and complementary roles and responsibilities” in protecting the US from malicious cyber activity and managing cyber incidents and their consequences.
  • Risk-Based Response: The federal government will determine its response actions on an “assessment of the risks posed to an entity, our national security, foreign relations, the broader economy, public confidence, civil liberties, or the public health and safety of the American people.”
  • Respecting Affected Entities:  Federal government responders will “safeguard details of the incident,” to the extent permitted under law, as well as “privacy and civil liberties, and sensitive private sector information[.]”  In the event a “significant” federal government interest is served by a public statement concerning the incident, federal responders are to coordinate their approach with the affected entity.
  • Unity of Governmental Effort:  The efforts of the various governmental entities must be coordinated to “achieve optimal results.”  Therefore, whichever federal agency “first becomes aware of a cyber incident will rapidly notify other relevant” federal agencies in order to facilitate a unified response, and will coordinate with relevant state, local, tribal and territorial governments to coordinate the same.
  • Enabling Restoration and Recovery: Federal response activities are to be conducted “in a manner to facilitate restoration and recovery of an entity that has experienced a cyber incident[.]”

Concurrent Lines of Effort

In responding to a cyber incident, federal agencies are required to take three “concurrent lines of effort:”

  1. Threat response;
  2. Asset response; and
  3. Intelligence support and related activities.

Where a federal agency is the affected entity, it shall undertake a fourth concurrent line of effort “to manage the effects of the cyber incident on its operations, customers and workforce.”

Threat Response

Threat response activities include:

  • Conducting appropriate law enforcement and national security investigative activity at the affected entity’s site;
  • Collecting evidence and gathering intelligence;
  • Providing attribution;
  • Linking related incidents;
  • Identifying threat pursuit and disruption opportunities;
  • Developing and executing courses of action to mitigate the immediate threat; and
  • Facilitating information sharing and operational coordination.

Asset Response

Asset response activities include:

  • Furnishing technical assistance to affected entities to protect their assets;
  • Mitigating vulnerabilities;
  • Identifying other entities that may be at risk;
  • Assessing potential risks to sector; and
  • Facilitating information sharing and operational coordination.

Intelligence Support and Related Activities

Intelligence support and related activities will facilitate:

  • The building of “situational threat awareness and sharing of related intelligence;”
  • The integrated analysis of threat trends and events;
  • The identification of knowledge gaps; and
  • The ability to degrade or mitigate adversary threat capabilities.

Impacted Government Agency

An affected federal agency will engage in a fourth concurrent line of effort to manage the impact of a cyber incident, which may include:

  • Maintaining business or operational continuity;
  • Addressing adverse financial impacts;
  • Protecting privacy;
  • Managing liability risks;
  • Ensuring legal compliance;
  • Communicating with affected individuals; and
  • Dealing with external affairs.

Architecture of Federal Government Response Coordination For Significant Cyber Incidents

PPD-41 directs the federal government to coordinate its activities in response to a “significant cyber incident” in three ways: (1) National Policy Coordination; (2) National Operational Coordination; and (3) Field-Level Coordination.

National Policy Coordination

The National Security Staff’s Cyber Response Group (NSC CRG) will “coordinate the development and implementation” of the US “policy and strategy with respect to significant cyber incidents affecting the” US or “its interests abroad.

The NSC CRG is a White House led Assistant Secretary level interagency policy coordination group that coordinates policy related issues for the National Security Council and the Homeland Security Council review as outlined in Presidential Policy Directive-1.

National Operational Coordination

  • Agency Enhanced Coordination Procedures: Each federal agency that regularly participates in the CRG shall “establish and follow enhanced coordination procedures as defined in the annex” to PPD-41 “in situations in which the demands of responding to a significant cyber incident exceed its standing capacity.”
  • Cyber Unified Coordination Group:  A Cyber Unified Coordination Group (UCG) will serve as the “primary method for coordinating between and among” federal agencies “in response to a significant cyber incident as well as for integrating private sector partners into incident response efforts.”  The Cyber UCG will be formed at the direction of the National Security Council when two or more federal agencies request its formation.  A Cyber UCG will also be formed when a “significant cyber incident affects critical infrastructure owners and operators” identified by the DHS.
  • Federal Lead Agencies:  In order to ensure the Cyber UCG “achieves maximum effectiveness in coordinating responses to significant cyber incidents,” the following agencies will serve as federal lead agencies:
    • Threat Response: The DOJ, acting through the FBI and National Cyber Investigative Task Force, will lead the government’s “threat response” activities.
    • Asset Response: The DHS, acting through the National Cybersecurity and Communications Integration Center, will lead the government’s “asset response” activities.
    • Intelligence Support: The Office of the Director of National Intelligence, through the Cyber Threat Intelligence Integration Center, will lead the government’s “intelligence support” activities.

Field-Level Coordination

Field-level representatives of the federal asset or threat response lead agencies “shall ensure that they effectively coordinate their activities within their respective lines of effort with each other and the affected entity.”

Unified Public Communications

PPD-41 requires the DHS and DOJ to “maintain and update as necessary a fact sheet outlining how private individuals and organizations can contact relevant” federal agencies about a cyber incident.

To read the full text of PPD-41, click here

White House Issues Presidential Directive Coordinating Government Response To “Cyber Incidents”

Impact of the European General Data Protection Regulation (GDPR) on Adequacy and 5 Tips to Weather the Changes

Recent media coverage has brought to light the internal deliberations of the Government of Canada regarding the possible impact of the entry into force in 2018 of the GDPR on Canada’s adequacy status to receive personal data from the European Union (EU).  Ten other countries, and the businesses in those countries, should examine the same question:  Andorra, Argentina, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland and Uruguay. The EU-US Privacy Shield, to which U.S. companies may self-certify, has received adequacy status.

Two issues arise: i) since the provisions of the new GDPR are stricter than the current  European regime with which these eleven States have been deemed  adequate,  will adequacy survive the coming into force of the new GDPR? And,  ii) now that adequacy may be repealed, how should governments or business prepare in that regard?

The following seeks to summarize what to watch for and how to weather this significant,  yet still ill-defined legal development.

  1. Why is adequacy status important?

European privacy law prohibits the transfer of personal data outside of the EU, except to states that have been recognized as providing adequate privacy protection (GDPR, Chapter V). “Non-adequate” states may only receive EU data under onerous conditions, namely:

  • Individual consent, and even then this is not valid for employee information as the employer-employee relationship is one of authority which defeats the assurance of “free” consent; or,
  • Standard model clauses, adopted by the European Commission, that bind the parties to the same level as European data protection law and submits the party receiving the data to audits by the party transferring the data; or,
  • Binding Corporate Rules, which apply within “a group of enterprises engaged in a joint economic activity” (Article 43.1) and bind the companies within the group to the European standards of privacy law.

Non-EU states that have been recognized as providing adequate protection for privacy may receive transfers of personal data from Europe without “any specific authorization.” (Article 41.1)

With a European market of 500 million, this is a critical economic advantage.

  1. How is a State considered adequate?

Article 41.2 of the GDPR summarizes the conditions for adequacy:

  • Respect for “the rule of law, human rights and fundamental freedoms, relevant legislation both general and sectoral, data protection rules and  security measures, including rules for onward transfer of personal data to another third country or international organization, as well as the existence of effective and enforceable data subject rights and effective administrative and judicial redress for the concerned data subjects;
  • Existence of an effective data protection authority;
  • International commitment of the State to uphold protection of personal data.
  1. What is the difference between State adequacy and the EU-US Privacy Shield?

Because the U.S. does not have adequacy status for not meeting the criteria above, U.S. companies  require a specific legal instrument to receive EU personal data. That is the EU-US Privacy Shield under which U.S. companies self-certify and commit to:

  • European data protection standards;
  • The new scrutiny of the Ombudsperson to be created in the US as well as of the Department of Commerce and Federal Trade Commission;
  • Stronger requirements on consent ;
  • New Europeans’ access to remedies in the U.S.

It is noteworthy that the EU-US Privacy Shield process is still more burdensome than for companies in States that have adequacy status.

  1. What next for adequacy?

The coming into the force of the GDPR introduces the possibility for an adequacy decision to be “amended, replaced or repealed” (Article 41.3a) by a Commission decision. Moreover, the Commission will “monitor the functioning of decisions”  already adopted in view of adequacy remaining in force, being amended or repealed.

So nothing can be taken for granted.  The maintenance of adequacy will be earned with conformity to European standards on privacy law.

  1. Honing privacy compliance strategies in the context of adequacy

Here are the best practices from our clients transferring or receiving European personal data:

  • Identify legal obligations under the coming GDPR;
  • Perform a gap analysis to address possible compliance issues in advance of the GDPR coming into force;
  • Negotiate with sub-contractors contract clauses compliant with GDPR;
  • Include monitoring provisions in the contract clauses such as the right to audit the sub-contractor to ensure compliance.
  • Establish data centres or hire cloud services in States having adequacy or companies being self- certified under the EU-US Privacy Shield.

Adequacy status is a shared objective by governments and companies.

Impact of the European General Data Protection Regulation (GDPR) on Adequacy and 5 Tips to Weather the Changes

Global Privacy Sweep Finds Privacy Issues in Children’s Apps

Last week, the Global Privacy Enforcement Network (GPEN) released the results from their third annual Privacy Sweep. Twenty-nine privacy enforcement authorities spread across 21 countries reviewed 1,494 websites and mobile applications (apps) either targeted to or popular among children – the theme of this year’s sweep.

Canadian regulators participating in the international sweep included the Office of the Privacy Commissioner of Canada (OPC), the Office of the Information and Privacy Commissioner of Alberta and the Office of the Information and Privacy Commissioner of British Columbia, who focussed their review on websites and apps based in Canada.

Among the overall findings by GPEN, 67% of the websites and apps examined collected personal information from children, such as names, photos, videos, audio, addresses and phone numbers.

“Too many developers are collecting particularly sensitive personal information such as photos, videos and the location of children, and often allowing it to be posted publicly, when there are clearly ways to avoid it,” said Privacy Commissioner Daniel Therrien in a statement. The OPC has repeatedly recommended in its publications and report of investigations that the best practice is to never collect personal information from children.

The OPC noted that many companies are developing innovative, creative and dynamic technological tools that balance the purpose of the website or app while respecting privacy protection.

The Privacy Sweep also found that 51% of websites and apps reviewed indicated they may disclose the children’s personal information to third parties. The Privacy Sweep found that 58% of websites and apps reviewed, while purporting not to collect personal information, redirected children to sites and apps that did collect personal information. The redirection was via an advertisement or a contest that sometimes appeared to be part of the website or app.

In considering parental or some form of adult supervision or control, only 31% of websites and apps reviewed had any protective control in place that would limit the collection of personal information; even less (24%) had some form of parental involvement.

The focus of privacy protection of vulnerable groups, such as youth and children, is one of Commissioner Therrien’s current privacy priorities.

The OPC also provided recommendations for companies to consider when collecting, using or disclosing personal information that may involve children, including:

  1. Avoid collecting any personal information from children.
  2. Instead of requiring children to disclose their name or photo or other personal information – for example to register with a website or app – companies should use protective controls such as preprogrammed avatars and usernames that children can select instead.

The goals of the GPEN Privacy Sweep include creating awareness and encouraging compliance with privacy legislation; however, GPEN and the OPC note that the results of the Privacy Sweep could lead to follow-up action being taken, including outreach and investigations.

 

Global Privacy Sweep Finds Privacy Issues in Children’s Apps