Under Siege: Cybersecurity Failures Sound the Alarm

The public has been aware of cyber incidents for a long time, but recent high-profile cybersecurity breaches have ignited fresh concerns and garnered elevated attention. These incidents underscore the persistent threats that exist to businesses across industries, hospitals, and even the cryptocurrency market. What valuable lessons can we extract or re-emphasize from these events as we close out Cybersecurity Awareness Month?

Money Alone Can’t Buy You Security: MGM Resorts

The most conspicuous incident in recent memory was the substantial cyberattack on MGM Resorts, a global leader in hospitality and entertainment. MGM boasts generous IT and security budgets, essential for maintaining their seamless gambling operation around the clock. However, despite substantial investments in IT resources and attention to cybersecurity, this attack forced the company to take the drastic step of shutting down its highly sophisticated IT systems completely. While the precise nature of the attack’s origins will become clearer over time, the immediate impact was disruption of the company’s operations — and the raising of critical questions about customer data security. Financial implications of the attack are beginning to appear, as well.

The MGM incident highlights the paramount importance of cybersecurity in the hospitality industry, where customer trust and data protection are non-negotiable. An attack can ripple across multiple operational facets, including financial operations, physical security, planning and client services. It serves as a stark reminder that no organization, regardless of its size or reputation, is immune to cyber threats. To safeguard their operations and customer data, companies must make continuous investments in cybersecurity measures and build robust incident response plans.

Target on Crypto Funds: North Korean Hackers

In a daring cyber heist, North Korean hackers reportedly siphoned off $41 million in cryptocurrency to finance their ongoing cyber activities. Their target was a cryptocurrency exchange, where they exploited vulnerabilities in the security infrastructure to pilfer the digital assets. While criminal activity has long plagued crypto operations, financial threats have also become a persistent concern.

This incident involving North Korea underscores the audacious and relentless nature of cybercriminals. Cryptocurrency exchanges are particularly attractive targets due to the potential for substantial financial gains. To shield against such attacks, exchanges must prioritize security, conduct regular audits, and educate users about best practices for securing and accessing their digital assets.

Healthcare Sector Vulnerabilities: Prospect Medical Cyberattack

This year has witnessed a surge in healthcare cyberattacks, an unsettling reality confirmed by emerging reports. These attacks are especially dangerous, as they can jeopardize sensitive patient data and essential medical services. In a recent attack, Prospect Medical, a healthcare management company in California and Pennsylvania, fell victim to a cyberattack that disrupted its operations. Beyond these operational hindrances, Prospect Medical encountered billing issues with Medicaid and is grappling with an extensive recovery process. Reports also suggest the financial toll and implications of the breach could affect a planned sale of various hospitals, extending the impact to future business operations.

This incident underscores the life-threatening consequences of cyberattacks targeted toward healthcare organizations. They can disrupt patient care, compromise sensitive medical records and even impact the organization’s future business plans. The lesson here is clear: robust cybersecurity measures, regular staff training and investments in technology that guard against threats are imperative.

Key Takeaways

These recent cyber incidents offer several vital takeaways that can be applied more broadly:

  • No Entity is Immune: Cyber threats can impact any organization, from global corporations to local hospitals. Acknowledging this reality is the first step in developing a proactive cybersecurity strategy.
  • Invest in Cybersecurity: Investing in cybersecurity infrastructure, regular updates and employee training is not an option; it’s a necessity in today’s digital landscape.
  • Rethink and Reset on Cyber: Major incidents provide an opportunity to reevaluate cybersecurity programs and strategies from top to bottom, and to extract insight from tough lessons learned.
  • Comprehensive Security is a Must: Whether through outsourcing, partnerships or in-house measures, comprehensive security, 24/7 monitoring, early detection, incident response and actionable insights are non-negotiable.
  • Ransomware Preparedness: Robust backup and recovery solutions are essential to minimize disruption and data loss in the face of ongoing ransomware attacks.
  • Investing Wisely in Cybersecurity: While financial resources are essential, effective cybersecurity goes beyond budget size; it requires a holistic approach to protection and readiness.

Cybersecurity: A Continuous Imperative for Safeguarding the Digital Future

The recent cyberattacks on MGM Resorts, cryptocurrency exchanges and healthcare organizations serve as stark reminders that the cybersecurity landscape is continually evolving with high stakes. In the spirit of Cybersecurity Awareness Month, let’s remember that readiness is not a choice. Organizations must take proactive measures to protect their digital assets and customer data. Safeguarding the digital future is a collective responsibility that demands continuous improvement, collective action and the latest tactics and technologies to address evolving risks.

This article was originally published in Forbes, please follow me on LinkedIn.

Reflecting On The Biggest Crypto Hack Ever

Crypto has been a hot topic in recent news. It is relatively new, and security protocols unfortunately are not a high priority. Read this piece from Ntirety CEO, Emil Sayegh originally published in Forbes for more insight. 

 

Reflecting On The Biggest Crypto Hack Ever 

The gaming and crypto worlds have reacted strongly to the news of a major attack that cost one crypto-gaming network upwards of $625 million in assets. The Ronin hack is among the largest crypto heists in history and when the dust settles, the incident may wear that crown alone. The story of this crypto-gaming company holds valid lessons for any organization that is watching. 

Big Pity for Crypto 

Crypto is known to the masses as an investment vehicle and to some it is known as a payment source for scams and hacks. Since the beginning, crypto has provided a fascinating ride, but bad actors have inevitably been there all along. Along the way, they ruined some parties. 

As it stands, the yearly damage for crypto theft and fraud activity worldwide is estimated at over $10 billion per year (and growing). These statistics have created doubt over secured capabilities in the cryptocurrency industry. The Ronin hack holds clues to that uncertain crypto future. 

Breaking Down the Heist 

Parties behind the Ronin network reported that validator nodes were subverted using hacked private keys, later leveraged to forge crypto withdrawals. These nodes bridged into a popular game known as “Axie Infinity” – notable for its thorough NFT and crypto monetization. The attackers were able to exploit a back door within a node that was part of the network’s validation protections. With unfettered access, the attackers were able to withdraw 173,600 ether and 25.5 million in USDC. Now, the network must hope that government law enforcement agencies can assist in recovering the stolen assets. 

Shortcuts and Bad Decisions 

Sky Mavis, the company behind the Axie Infinity game shared that the attack was possible in part because “immense user load” drove the company to take a self-described “shortcut”. Let’s be clear. This looks like a bad decision that lost sight of the risks. Fixing this specific flaw might be a minor technical affair, but the company must now release a substantial plan that addresses how they technically and philosophically plan to prevent this sort of issue from happening again. In this matter again and again, assets became liabilities, and they were blind to recognizing when that transition occurred. 

Crypto Liabilities? 

If risks continue to be treated this way, by anyone, flawed decisions will continue to be a costly problem. The currency at risk can consist of data, crypto, passwords, cash transactions, or anything you would seemingly want to protect and provide. Let us run down specifics on why this is a growing problem for organizations that rely on crypto assets. 

1. Cyber liability insurance – It will not cover all your losses. As a matter of fact, the entire cyber insurance industry is being reborn with skyrocketing premiums as it evolves to adapt to heightened threats, ransom amounts, and costs. 

  1. Activity surge – Billions of crypto assets are stolen each year. Reports indicate that the figure is in the tens of billions and growing. Many parties are engaged in these activities, including North Korea which boasted of its $1.7 B of stolen crypto in 2021.
  2. Crypto nature – Crypto happens to be the medium of choice for online crime in part because it is difficult to trace, has no central controlling authority, yet is accessible throughout the world. It is also difficult for law enforcement to recover.
  3. The Private Key is GOLD – The possessor of a cryptocurrency account private key wields total and exclusive control. Stealing a private key is like theft of any other traditional piece of info. Scammers will use any means at their disposal to gain access, including Social Engineering, email scams, phishing, and more.

Safe Crypto for Us 

On a personal level, it makes sense to protect your assets using multi-factor authentication (MFA) for sensitive accounts and integrating your notifications correctly. Any major activities surrounding your account should be tracked, and they should alert you. You should also: 

  1. Protect your secret keys well – this means using strong passwords, combined with MFA. Never share your keys.
  2. Avoid public networks and Wi-Fi – Keep your transactions on secured and trusted networks only.
  3. Strong, unique passwords – Do not use MFA alone, or combined with weak passwords. Never share it.
  4. Keep your crypto secure – Use crypto hardware wallets and never store it on virtual storage.
  5. Make sure your apps and exchanges are secure – If you’re using mobile, review and validate every app and crypto exchange you use for security features and reputation.

Safe Crypto for Business 

When protected by constant security measures, cryptocurrency in the enterprise can be a safe and viable business feature that can be implemented in exchanges, consumer and business transactions, in application features, building a marketplace and more. 

This should not be a surprise, but it turns out that cryptocurrency security is no different than IT security, making it very secure when implemented correctly. At its core, cryptocurrency relies on the blockchain – by design, it features changes and updates that are immutable, publicly distributed, made in multiple copies, and continually validated by means of encrypted key transactions along every step. 

Blockchain alone is great – but when it comes to business, you need reassurances, and you need awareness. These are fundamental components of comprehensive security, which is the way to go in protecting crypto in the enterprise. 

Protecting crypto systems in the enterprise depends on ensuring the base platform is fully safe and secure with a comprehensive security approach. After all, not all platforms are equal. You then must make sure that the security state stays that way, assuring that the internals of your crypto foundation are continuously known. If anything goes wrong or changes, you should know immediately, leading you to another critical lynchpin in comprehensive security – monitoring systems. 

We all expect these sorts of protections to financial transactions. It makes sense for crypto as well, even in a game. 

 

Check out this piece, originally published in Forbes, here and follow me on LinkedIn.