Kevin Gholston

FBI concerns about TikTok’s use of U.S. citizens’ user data were conveyed to the House Committee on Homeland Security by Director Christopher Wray.  The Chinese owned social media app currently has over one billion monthly users.  Among the FBI’s concerns is that the Chinese government could conduct influence operations with the app or use it to gain control of millions of user devices.

The Chinese government allows officials to obtain access to data from companies.  Currently Chinese sponsored cyber attacks have stolen more U.S. personal and business data than all other nations combined.  Wray stated that the bureau has seen an increase in cybersecurity cases.  It is estimated that ransomware alone cost U.S. businesses $1.2 billion dollars in 2021.

Chinese Government Ties Not a New Concern

Former President Donald Trump attempted to ban TikTok in the United States in 2020 due to concerns for national security.  This executive order was revoked in 2021 by President Joe Biden. The Biden administration then asked the Treasury Department to investigate the app.  Consequently, the Committee on Foreign Investment in the United States (CFIUS) has been examining the risks and implications of TikTok’s continued activity in  the U.S. market. 

In 2020, the Department of Defense recommended that employees not install or uninstall TikTok  on their personal devices.  This was incorporated into Army, Navy, and Marine policies.  These policies ban the app from all government phones because the app is considered a cyber threat.

Many private organizations are also banning the app on business owned devices and taking cybersecurity preventative measures such as blocking specific internet categories or domains.

Chief Concerns About TikTok

TikTok’s parent company ByteDance is a Chinese company.  The Chinese National Intelligence Law requires all organizations and citizens to cooperate with state intelligence activities.  The company collects sensitive information from millions of devices without the user’s knowledge or permission.  This data can include browsing history, geolocation, and file names. 

ByteDance also collects Personally Identifiable Information (PII) such as image, age, gender, and relationship status.  Additionally it is alleged that the app collects various types of biometric data such as fingerprints, iris scans, and facial geometry. On the whole TikTok’s data collection activities are seen by industry experts as being far more intrusive than comparable apps.

Of even greater concern, TikTok has regularly been in violation of the Children’s Online Privacy Protection Rule (COPPA) which prohibits the collection of PII of children under the age of 13 without parental consent.  App content has also been a recurring concern raise about the app.  A national group of state attorneys have stated concerns that app content may pose a threat to the mental health of children. 

Aside from distribution of content that is not appropriate for children, the app also is used as a propaganda device for the Chinese government by both putting forth influencing content and banning information critical of the policies and actions of the nation.

CVG Strategy Cybersecurity Solutions

FBI Concerns about TikTok illustrate scope of the problem businesses are facing with cybersecurity.  IT solutions alone are not sufficient to combat these forces.  Viable solutions include all stakeholders in an enterprise.  They include people, policies, procedures, risk analysis, incident responses, and an internal auditing process that yields constant improvement.

CVG Strategy provides cybersecurity consulting and training for large and small organizations.  Our experts can tailor a program using risk management process to identify information assets and interested parties.   We can create the documentation and provide the essential training to establish your ISMS and guide you through certification audits.

CVG Strategy also provides consulting services for NIST 800-171 and CMMC Certification for those businesses and institutions providing services to the Department of Defense and other government agencies.

The Truth About Iranian Cybersecurity Threats

Given recent headlines, one might conclude that Iranian Cybersecurity threats were a new development.  In fact, Iran has been a player in the international cyber game since 2002 with the formation of the Ashiyane hacking forum to repress dissidents.  By 2007, government backed organizations had begun to develop sophisticated tools and engage in active campaigns. 

As reported by the Carnegie Endowment for International Peace, Iran’s first major international act was to attack Twitter in December of 2009 to disturb the efforts of the Iranian Green Movement that was working against the reelection of Mahmoud Ahmadinejad.  Two years later Iranian efforts resulted in one of the largest data breaches in internet history when a hack on DigiNotar gave the Iranian government access to Gmail users in Iran.

Cybersecurity Threats to Businesses

As Iran’s skills in cyber attacks developed, their focus has expanded to international businesses.  In 2012 an alleged virus was launched against Saudi Arabia’s Aramco oil conglomerate.  It also conducted denial-of-service attacks against U.S. banks. This trend in Iranian cybersecurity threats is continuing to grow.

The Iranian hacker group OilRig has focused primarily on private industry targets and managed to breach Las Vegas Sands in 2014.  Another group, Iranian Dark Coders Team, has focused on cyber-vandalism by defacing industry sites with pro-Iranian propaganda.

Recent Iranian Cyberattacks Against Albania

Albania has accused the Iranian government for multiple cyberattacks that have disrupted Albanian government.  These attacks included targeting the Total Information Management System that is used to track data of parties leaving and entering the nation.  According to prime minister Edi Rama these same Iranian actors have been responsible for previous hacks against Albania.

The FBI and The Cybersecurity & Infrastructure Security Agency (CISA), in a joint cybersecurity advisory, confirmed these attacks against the government of Albania.   These attacks were executed between July and September of 2022 by Iranian state sponsored cyber actors identified as HomeLand Justice.  These attacks included the use of ransomware-style file encryption and disk wiping malware.  Initial access was accomplished by exploiting an Internet-facing SharePoint.

The U.S. Department of Treasury has imposed economic sanctions against HomeLand Justice and Esmail Khatib who is linked to the Iranian Ministry of Intelligence and Security.  These sanctions have been enacted in reaction to cyberattacks and various anti humanitarian crimes against the nation’s citizenry.  Aside from the imposed sanctions, these actions place any possible nuclear deal with Iran in jeopardy.  

Other Iranian Hacking Activities

Here in the United States, federal authorities have indicted three Iranian individuals for cyberattacks.  These attacks used ransomware to target critical infrastructure targets including power companies. The campaigns were coordinated efforts of the Iranian Government and the Islamic Revolutionary Guard Corps.

Internationally Iran has been actively targeting both individuals and entities in both the public and private sectors.  Such activities have been reported in Canada, Australia, and the United Kingdom.  According to additional reports from Israel,  the Israel Defense Forces (IDF) claim that cyberattacks against Israel have more than doubled in 2022.

Iranian cybersecurity threats are changing in that more state run organizations are being utilized.  In the past Iran had largely depended on outsourced hackers.  Now, as the country develops it talent resources more groups like HomeLand justice and APT42 are being identified as having directly under the Islamic Revolutionary Guard Corps.

International Threats

In truth, there are few innocent nation states in the cyber attack world.  There has been an invisible and silent international state of war in the cyber world for decades. Those that pose the greatest threat to businesses in the United States include The Peoples Republic of China, Russia, and North Korea.  These players actively seek on an ongoing basis to disrupt businesses and steal vital and sensitive information.

Cyberattacks initiated by nation states normally fall under four categories; disinformation and propaganda, espionage, terrorism, and sabotage.  While these activities are often discovered and attributed to countries, as of now, little public retribution is to be expected.  We are in a world of war in the shadows where nefarious exploits can render very real and harmful effects.

The Larger Cybercrime Situation

International trends in cybercrime show an increasing sophistication by both organized crime and hostile nation states. These cybercriminals are continuing their efforts against high-value targets that include the industrial, IT, and infrastructure sectors. This activity is occurring at a time when many organizations are struggling to develop integrated cybersecurity solutions.

Many industrial sectors have been reluctant to adopt systematic approaches to cyber hygiene.  Effective cybersecurity for organizations must include an Information Security Management System (ISMS).  An  ISMS is a collection of policies, procedures, controls, and incident responses that systematically address information security in an organization.  It is a framework based on risk assessment and risk management.

This has been the case with numerous businesses in the United States contracting with the Department of Defense (DoD).  In 2020, the interim ruling, DFARS 252.204-7012, placed cybersecurity requirements on Department of Defense (DoD) supply chain contractors vendors to complete security compliance with NIST SP 800-171 DoD assessment methodology.  

Cybercriminals control a vast underground economy worth trillions of dollars a year. Hacking enterprises offer their services for hire and sell their stolen private and proprietary data online. These players specialize in specific methods to meet their clients needs.  Beyond the hackers, dealers of stolen data create wealth to fund other activities including human trafficking.

CVG Strategy ISMS Solutions

Businesses worldwide are under attack from players that are well funded and very focused on compromising proprietary data.  CVG Strategy can help you attain an ISO 27001 certification.  This can help you demonstrate a commitment to data security through an internationally recognized process. IT solutions alone are not sufficient to combat these forces. 

Viable solutions include all stakeholders in an enterprise.  They include people, policies, procedures, risk analysis, incident responses, and an internal auditing process that yields constant improvement.

CVG Strategy provides cybersecurity consulting and training for large and small organizations.  Our experts can tailor a program using risk management process to identify information assets and interested parties.   We can create the documentation and provide the essential training to establish your ISMS and guide you through certification audits.

CVG Strategy also provides consulting services for NIST 800-171 and CMMC Certification for those businesses and institutions providing services to the Department of Defense and other government agencies.

The National Institute of Standards and Technology (NIST) announced that they had selected four Quantum-Resistant Cryptographic Algorithms to address concerns of quantum computer cyber attacks against current encryption technologies.  The selection was made from respondents to a post-quantum cryptography standardization project.

The Emerging World of Quantum Computing

Quantum computers utilize certain phenomena of quantum mechanics to perform computational problems.  Although current quantum computers are unable to out perform standard computers, this technology will eventually dramatically outperform today’s technology.  This is especially the case in operations such as integer factorization which is central to encryption technologies. 

Current public key encryption systems utilize integer factorization.  These systems generate keys by using the products of large prime numbers.  As cryptography is a central tool for protecting the confidentiality and integrity of digital information, it is critical to create and adopt quantum resistant cryptography standards.  One of the criticisms leveled at current cryptography is that algorithms are not validated or internationally standardized.

Application Specific Cryptographic Solutions

Cryptographic systems are used in a variety of applications in cybersecurity.  NIST has selected the four algorithms to address specific applications.  One algorithm, CRYSTAL-Kyber is intended for general encryption.  General encryption is used to secure websites.  Its advantages for this application are its speed of operation and the ease in which parties can exchange encryption keys.

NIST selected three other algorithms to address requirements for digital signatures.  Digital signatures applications are used to verify the identity of parties.  They are often used for digital transactions or remote document signatures.  Those selected are CRYSTALS-Dilithium, FALCON, and SPHINC+.  Of the three, CRYSTALS-Dilithium and FALCON were rated as the most highly efficient in operation.

Two separate technologies are used in these algorithms.  They utilize different families of math problems to generate and decode encryption.  SPHINC+ uses hash functions cryptography.  While this approach is a larger and slower application, it is seen as valuable in that it uses a different approach.  The other solutions implement mathematical problems based on structured lattices.

NIST is Looking Towards the Future

New challenges emerge with every step in the evolution of technology.  Computer science is no different than any other technology in this regard.  As classical computers are replaced with large scale quantum computers, encryption algorithms will need to evolve.  Current public key cryptography has served the digital world well but will need constant improvement to ensure security.

As with other technologies, standardization and accepted means of validation are required to provide acceptable performance criteria.  To address this need, NIST is creating a post-quantum cryptographic standard.  The four selected technologies will be central to that standard.  These new Quantum-Resistant Cryptographic Algorithms technologies are still rapidly developing and there will certainly be new solutions in the future. 

NIST is currently on schedule to finalize the standard in two years.  This should provide the cyber community with better tools for securing vital and sensitive information.  In the mean time NIST is encouraging information security experts to experiment with the new algorithms.  It is also suggesting that consideration be given to how these applications could be implemented.

As these solutions are still in development they are not, as yet, ready for integration into live cybersecurity programs but cybersecurity practitioners would be well advised to familiarize them selves with the new technologies.  They can also act as messengers to inform their associates and users of the upcoming changes in public-key cryptography.  This will allow organizations to plan for the necessary allocation of resources to integrate Quantum-Resistant Cryptographic Algorithms into their systems.

CVG Strategy Cybersecurity Solutions

Businesses worldwide are under attack from players that are well funded and very focused on compromising proprietary data.  IT solutions alone are not sufficient to combat these forces.  Viable solutions include all stakeholders in an enterprise.  They include people, policies, procedures, risk analysis, incident responses, and an internal auditing process that yields constant improvement.

Amendments were signed into law to the Florida State Cybersecurity Act on July 1, 2022.  These revisions illustrate the gap between desired levels of information security and attained levels in both the public and private sectors.

The Act, also known as the Cybersecurity Act applies to the Florida Digital Service (FLDS) and the heads of state and local agencies in the state of Florida.  While the revisions are well intended, many will  be difficult if not impossible to meet.  Therefore further revisions will probably be required to adjust the legislation to accommodate the reality of government entities’ operations.

A major requirement is that fines and penalties are now established for parties that engage in ransomware attacks against government agencies.  Another development is that those agencies are prohibited to make payments or comply with ransom demands.  Additionally, and perhaps most importantly, the revision requires local governments to adopt cybersecurity standards in accordance with NIST and train technology employees with access to highly sensitive information annually.

Reporting Requirements Under the Revised Act

The revised act now requires state agencies and local governments to provide after-action reports of ransomware incidents no later than 12 hours after discovery.  Reports are to be placed with the state’s Cybersecurity Operations Center (“CSOC”), the Cybercrime Office of the Department of Law Enforcement and local sheriff.  The CSOC must then provide the Legislature and the Cybersecurity Advisory Council (CAC) with a consolidated incident report on a quarterly basis.

Information required to be reported to the CSOS by agencies includes:

• a summary of the incident
• date of most recent data backup
• integrity of backed up data, and physical location of data
• the types of data compromised
• any estimated fiscal impact
• ransom demand details

Other Florida State Cybersecurity Act Requirements

The revised legislation now requires that incidents be classified in severity based on the Department of Homeland Security’s National Cyber Incident Response Plan (NCIRP).  The NCIRP rates incidents (which are defined as a violation or imminent threat of violation) on a 1-5 scale, with 1 being a low-level incident, and 5 being and emergency-level incident.  The rating reflects the inherent impacts on public safety, governmental security, economic security, civil liberties, and public confidence. 

Unintended Consequences of the Revision

Though well intentioned, these amendments could create significant issues, especially for smaller local governments.  Adoption of an effective cybersecurity program is a challenging task that requires significant effort and resources.  Example of this situation can be seen at the federal level where adoption of the CMMC by the Department of Defense is causing distress for smaller defense contractors.

Another potential issue is the number of agencies involved in an incident.  This could well hamper a swift and efficient response and resolution to incidents that pose high threat levels to a community.  

Overall many items remain vague or undefined which can lead to confusion and ineffective actions taken.  As an example the term “highly sensitive information” is not defined in the documentation.  Levels and types of information assets need to be specifically defined in NIST cybersecurity protocols.

CVG Strategy Cybersecurity 

CVG Strategy consultants provide training to make your entire team aware of cyberattacks and how to employ processes to prevent these threats.  We can assist with reviews of policies, risk assessment approaches, and best practices to build management systems capable of handling complex cybersecurity requirements.

Our ISMS consulting services help organizations plan, create, upgrade, and certify a robust and effective Information Security Management System (ISMS).  Our team of experts bring extensive experience and deep information security process control expertise (including certifications as Exemplar Global Lead Auditor ISO/IEC 27001:2013 Lead Auditor) to ensure that you achieve ISO 27001 certification—on time and on budget.

CVG Strategy is also committed to the goals of CMMC in securing our defense manufacturing supply chain’s information secure.  As industry leaders in cybersecurity, ITAR, and risk based management systems.  We have experience with companies of all sizes and understand the importance of innovating flexible approaches to meeting the requirements CMMC, establishing effective programs, and achieving certification.

Integrating NIST cybersecurity for business applications into existing management system processes requires specialized implementation.  This is of special concern for organizations involved in contracting with the Department of Defense (DoD) that are adopting NIST SP 800-171 to meet Cybersecurity Maturity Model Certification (CMMC) requirements.  

A major issue in this integration, is that the NIST cybersecurity framework was originally designed for U.S. Government federal agencies.  These agencies do not share the organizational challenges in managing information security that businesses face.  Businesses must balance a wide array of risks including quality and regulatory into a cohesive management system.  To address these concerns, NIST has released a series of reports that address cybersecurity risk management methodologies applicable to Enterprise Risk Management (ERM) systems.

NISTIR 8286 Reports

NIST Interagency or Internal Report 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) is a series of three documents that provide guidance in establishing and maintaining a systematic approach to risk guidance, identification, and analysis applicable to business management systems.  Central to these reports is the differentiation of roles of Enterprise Level Management and the Cybersecurity Risk Management.  It emphasizes the need for cooperation and collaboration of all parties in the establishment and operation of a Cybersecurity Risk Management System (CSRM). 

It describes a system whereby senior management provides a framework complete with scope, internal and external context, and essential requirements from stakeholders.  The CSRM is then tasked with controlling these risks and monitoring them in a Monitor, Evaluate and Adjust (MEA) cycle.

NISTIR 8286 goes further by describing an ongoing systematic approach to reporting findings back to the Enterprise Risk Management.  This allows for notification of stakeholders as to the status the program and evaluation of information security risks.  During this evaluation process adjustments are made of the organization’s approach to risk management to better address the dynamic requirements of the organization.

NISTIR 8286A

NISTIR 8286A provides guidance for risk context, scenario identification, and determination of the impact and likelihood of occurrence for those risks.  It utilizes Cybersecurity Risk Registers (CSRR) and Risk Detail Records (RDR) to aid in identifying and managing these risks.

NISTIR 8286A describes the necessity of senior management to establish the scope, context, and criteria of the program.  It further describes the establishment of organizational structures, processes, and business systems relevant to accomplishing these mission objectives.

NISTIR 8286B

NISTIR 8286B provides guidance for organization and system level management to assign risk ownership, define a specific risk descriptions, determine a response cost, and provide a priority for those risks.  Topics covered in this report include risk avoidance, risk transfer, risk mitigation, risk response, risk strategy, and implicit acceptance of risk.

NISTIR 8286C

Upon release of this post, NISTIR 8286C is published as a draft, although the public comment period has been closed.  This report describes methods for integrating information from the CSRM such that it can inform senior management and be implementable in the overall risk management process of the organization.  It emphasizes a continuous process for adjusting risk strategy and management activities.

ISO 27001:2013 Information Security Management System

ISO IEC 27001:2013 is an international standard and widely accepted Information Security Management System (ISMS).  The role of an ISMS is to preserve confidentiality, integrity and availability of information.  It accomplishes this task by applying risk management processes.  An effectively tailored program can meet this challenge because it is part of the organization’s processes and management structure. 

This standard provides the mechanisms and processes laid out in NISTIR 8286 and allows for an appropriate implementation of NIST cybersecurity for businesses.  It can when properly implemented provide processes for continual improvement.  

Implementation of an effective ISMS requires an assessment of the organization’s objectives, security requirements, and organizational processes.  These assessments include a consideration of the size and structure of the organization so that the ISMS is scaled to meet the needs of the organization.

Once these influencing factors have been defined a risk assessment can be conducted.  This process should:

• identify the information security risks
• identify the risk owners
• assess the potential consequences of an undesired occurrence
• assess the realistic likelihood of the occurrence
• determine the levels of risk
• establish priorities for treatment of the risk (e.g. implementation of information security controls)

CVG Strategy Information Security Management System Consultants

To assist businesses meet the challenges in adopting CMMC programs, CVG Strategy has developed an approach that combines the compliance requirements of CMMC 2.0 compliance with the ISO 27001 information security management system.  This provides a coherent methodology for implementing and maintaining essential cybersecurity for businesses of any size.

We can help you meet your information security management system goals.  CVG Strategy QMS experts are Exemplar Global Certified Lead Auditors.  We can provide the training required to understand and engage in a ISMS and make it meet desired objectives. This process includes defining the context of your organization, creation of internal auditing processes and much more.