“The best virtual experience in cybersecurity” is fast approaching. On October 14-15, the Institute for Critical Infrastructure (ICIT) – the only think tank dedicated exclusively to cybersecurity – hosts its 2020 fall virtual briefing. Co-chaired by DLT, this year’s theme is: “A Secure Roadmap for the Future.” 

DLT Solutions recently sat down for an interview with Joyce Hunter, executive director for strategy and process at the Institute for Critical Infrastructure and Technology (ICIT), the nation’s leading cybersecurity think tank. On the table for discussion was how ICIT is cultivating a “cybersecurity renaissance” – including promoting the role of women in cybersecurity. We also talked to Hunter about how government agencies can compete more effectively for cybersecurity talent and nurture the next generation of cyber warriors. 

There are 76 days until the 2020 presidential election, and it has already been upended by an unfortunate pandemic that has required states to go back to the drawing board to re-evaluate how voting will take place on November 3rd. However, government officials, particularly at the local level, not only have to contend with a pandemic but also an increase in digital threats such as ransomware attacks. These attacks are being used to create chaos in political campaigns and steal voting data before election day.

Article by James Hofsiss, CISSP, DLT and Asad Zaman, Sales Engineer III, DLT

Federal agencies are developing and releasing software and apps at a rapid speed. This haste comes at a price. Verizon reports that nearly 70% of the data breaches it investigated in 2019 were due to attackers targeting vulnerabilities in public-facing web applications. It also introduces compliance risk.

With the general election approximately 113 days away, there are mounting concerns about what will occur on Nov 3rd, 2020! Election officials face an extensive array of new cybersecurity threats arising from voting remotely to election officials working from home on unsecured systems leaving delicate data exposed to hackers. Before this health crisis, Congress approved $380 million in grant funds through the Help America Vote Act (HAVA).

The old saying goes, there are only two kinds of organizations: those that have been breached and those that will be soon. Clearly, the “moat-and-castle” approach to security has not worked. Simply being “inside” a network – behind a firewall, DMZ and other traditional defenses – does not confer trustworthiness, whether it’s a device, a user, network traffic, or an application.

Election security is a big topic, but it resembles a many-legged centipede. Federal contractors face the reality that elections are the purview of state, county and municipal officials. The technical and managerial abilities of these entities vary from what you might expect in a tiny hamlet to what you might encounter in a million-person suburban county.

DHS recently published version 3.0 of the Trusted Internet Connection (TIC) architecture. A response to changing IT conditions, Executive Orders, and OMB mandates, the new architecture seeks to support IT modernization through cloud adoption while keeping security as a top priority. The comprehensive set of documents includes an overview, a catalog of security capabilities, a reference architecture, guidance for pilot programs, advice for service providers, and a very helpful set of use cases relevant to agency needs.

The Threat

Risk is a function of likelihood times impact.  When it comes to zero-day exploits, particularly those that use return-oriented programming (ROP) or one of its many cousins the likelihood is high, and the impact is higher.  How do these attacks work, and what is the industry doing to stop them?  More importantly, what can you do to stop them?  Is it possible to stop a zero-day without patching or updating systems?  Let’s explore these questions.

How ROP Works