Cloud Hosting

As the race to recruit female talent in STEM continues moving ahead with steady progress, stunning statistics still wrack the cybersecurity sector: Women working in cybersecurity currently account forless than one quarter of the overall workforce.

Megan Rapinoe. Sister Rosetta Tharpe. Shirley Chisholm. Donning jeans and a Ukrainian flag t-shirt, the director of the nation's lead cybersecurity agency ticked through PowerPoint slides of women "who took a sledgehammer to the glass ceiling."

"I need your help," said Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, on Friday to an audience of 1,700 female cybersecurity professionals assembled for a three-day technical conference in Cleveland. "We need to get to 50% of cybersecurity by the year 2030. Think we can do it?" Someone whistled. ACDC pulsed through the speakers. "Come on!" Easterly rallied.

After exiting the stage, Easterly told CBS News she has become accustomed to setting "unreasonable" goals. "That's been sort of my [modus operandi] my entire life," she quipped. "And I honestly believe if you set a super ambitious goal, and you as a leader inspire and empower people, and look at that goal as something that may be challenging, highly ambitious, but is in fact achievable, you can get there."

Pressed on how close America's cyber defense agency is to "getting there," Easterly responded down to the decimal. "Right now, we're at 36.4% women at CISA's workforce, but I think we can get to 50% before 2030." She paused before adding, "Actually, I'm hoping we can get there before 2025."

Easterly says she hopes colleagues across the federal workforce including FBI, NSA, U.S. Secret Service make similar pledges. The Army veteran-turned-corporate leader came close to "getting there" in her previous stint as head of Firm Resilience at Morgan Stanley, where she oversaw a team that was roughly 48% women.

Currently, there's just one woman serving as chief information security officer, or "CISO," among the top 10 largest companies nationwide: Chandra McMahon, CISO of CVS Health. The former executive at Verizon and Lockheed Martin can remember what it was like to be the only woman in the room.

"Cybersecurity is not well understood as a career or as an opportunity," McMahon said during an interview with CBS News on Friday. "What most people don't realize is that there's a spectrum of roles and careers that you can have." McMahon rattled them off: "Penetration testers, ethical hackers, the cyber security engineers and architects."

But the gender gap marks just one of the cybersecurity workforce's persistent challenges. Hispanic, African American, Asian and American Indian/Native Alaskan workers made up just 4%, 9%, 8% and 1% respectively of the cyber security workforce, according to the Aspen Institute.

An estimated 3.7 million cybersecurity jobs are available but unfilled, according to the latest (ISC) Cybersecurity Workforce Study, with 377,000 of those vacancies located in the United States. By that measure, the global cybersecurity workforce will need to grow 65% in 2022 to effectively defend organizations' critical assets.

Last week, Microsoft called recruitment of women "mission-critical" to filling the worldwide cyber vacancies. A survey commissioned by Microsoft Security found that only 44% of female respondents felt sufficiently represented in their industry.

Not all "black hoodies" and "dungeons"

Part of the federal government's cyber strategy is just showing up. Easterly, who ditched plans to appear via video at Friday's Women in Cybersecurity Conference only to instead dance onto stage to the tune of ACDC, recounted the thrill of manning CISA's booth at the conference.

"At the end of the day, if people can see me as the director of America's Cyber Defense Agency, then there are women out there who can say I can be her," she told CBS News.

A decade ago, that lack of visibility in a security field known for operating behind the scenes served as the inspiration for the group behind Friday's conference, Women in Cybersecurity, or "WiCyS."

"I think people have to understand that even though cybersecurity works best when it's invisible, there are so many people behind it," said WiCyS founder Dr. Ambareen Siraj.

"There's this stereotypical notion about cybersecurity that it's all about fighting. And we're all working in some sort of dungeon in black hoodies. But it is really not the case," Siraj said.

Unclogging the cyber talent pipeline will require more than just breaking a stereotype though, with experts advocating for more outreach to non-traditional candidates.

"Some of the best talent we have in cyber did not come from a background in cybersecurity," McMahon said.

Just 38% of women came from an IT background, compared to half of men in today's cybersecurity workforce. According to the (ISC) report, women also have higher rates of entry from self-learning (20%) compared to male counterparts (14%).

"We're now seeing an opening in the market for cyber skills. It's not so siloed in that you must have a cybersecurity degree," McMahon added.

Mind the gap: reshaping the federal workforce

Just 25.2% of the full-time federal cyber workforce is female, compared to 43.6% of government workers nationwide, according to the non-profit Partnership for Public Service, which assesses data from the U.S. Office of Personnel Management and U.S. Census Bureau.

The federal cybersecurity workforce is also decades older than the U.S. labor force. The percent of full-time cyber employees under the age of 30 steadily increased from 4.1% to 6.3% between September 2014 and September 2021. But it still lags behind the almost 20% of the employed U.S. labor force in 2021 that is under age 30. In the federal IT workforce, there are 15 times more employees over the age of 50 than under age 30.

"I think the most fundamental problem in the federal workforce is the lack of generational diversity," said Max Stier, head of the Partnership for Public Service. "There are very, very few young people in the federal technology and cyber workforce. And it becomes this self-fulfilling prophecy: the absence of young talent makes it harder for new young talent to want to come in or stay."

Data on the federal government's cybersecurity workforce vacancies remains scarce, but Stier estimates a "minimum of tens of thousands of jobs" is needed to bolster U.S. cyber defenses.

A 47-page audit by the Senate Homeland Security Committee last year found federal agencies responsible for safeguarding the security and personal data of millions of Americans earned a C- report card in talent recruiting.

Since 2014, the Department of Homeland Security has received a whopping $76 million to create a new cyber talent recruiting system, which launched with 150 job postings, last November. DHS received 650 applications in its first 48 hours of operation but has not released further progress reports on hiring. There are currently five positions posted on the Cyber Talent Management System's dashboard.

Easterly says CISA, an agency of approximately 5,000 full and part time employees, plans to hire between 500-1000 more in the next few years.

In an effort to reach young talent, the agency has also formed partnership programs with the Girl Scouts, Cyber Corps, and Historically Black Colleges and Universities.

But among career leaders in the government's Senior Executive Service (SES), just 28% of STEM leaders are female, and only 19% are people of color.

"It's not just women, but it's all types of diversity. Whether that's neuro diversity, diversity of gender identity, of sexual orientation of race, of national origin," Easterly said.

Leaders from across the federal government and private sector have likened diversity initiatives to a national security imperative.

"What we would like to see is a strong, adequate cybersecurity workforce that has people of all kinds, different racial backgrounds, ethnicity, gender," said Siraj. "When we have diverse people working in cyber, which is an extremely complex place, then it is more likely that we are going to bring the different perspectives and skills necessary to solve complex problems."

No room for "vigilance fatigue" amid Ukraine-Russia crisis

As information warfare plays out in the shadows of the Ukraine-Russia crisis, Easterly worries about "vigilance fatigue."

"It is hard to maintain a very high tempo of extreme preparedness," she conceded. "But we are not even a month into this unjust illegal, unprovoked invasion of a democracy and we need to continue to keep our shields up," Easterly told CBS News.

CISA and the FBI have released two alerts this week alone, including a joint bulletin to satellite communication (SATCOM) networks just days after the hack of telecommunications firm Viasat by unidentified actors disrupted broadband satellite internet access at the start of the Russian invasion.

That fatigue is further punctuated by a cybersecurity workforce shortage that sees more than just the federal government working overtime to monitor potential threats.

CISA and FBI "have not identified cyber activity in the US Homeland attributable to Russian state actors since the invasion commenced," an NYPD intelligence bulletin obtained by CBS News and published last week indicated.

But since November, the Department of Homeland Security has overseen more than 80 briefings, table exercises and informational sessions with the private sector designed to bolster U.S. cyber defenses in the event of Russian malicious cyber activity.

Through its Joint Cyber Defense Collaborative, CISA administers a Slack channel dedicated to information sharing with tech and cybersecurity giants, including Cloudflare, CrowdStrike, Mandiant, Microsoft, Verizon, Google, and Amazon Web Services, along with the NSA, the FBI, and US Cyber Command.

Still, cybersecurity advocates worry that a lack of investment in cybersecurity extends to the larger workforce, with compromises a few clicks away from unwitting employees scanning through email inboxes. "You actually need the broader workforce familiar and capable of addressing these cyber challenges in the context of their normal, daily jobs," Stier said. "Consider the classic phishing incident."

"We are putting out more and more information so that the public understands the nature of the threat environment," Easterly said, Friday. "We have said consistently, that every business large and small remains at risk and is vulnerable to Russian malicious cyber activity. That's why we need to continue to keep our shields up to be prepared to be vigilant, to keep our thresholds low for sharing information about anomalous activity, and to ensure that we are working together for the collective cyber defense of the nation."

Catherine Herridge contributed to this report.

Trending News

CBS News reporter covering homeland security and justice.

See more here:
Women make up just 24% of the cyber workforce. CISA wants to fix that. - CBS News

Read More..

Though a flood of claims by hacking groups followed Russia's invasion of Ukraine, one study shows most made by Anonymous check out.

Nurphoto | Nurphoto | Getty Images

More than three weeks ago, a popular Twitter account named "Anonymous" declared that the shadowy activist group was waging a "cyber war" against Russia.

Since then, the account which has more than 7.9 million followers, with some 500,000 gained since Russia's invasion of Ukraine has claimed responsibility for disabling prominent Russian government, news and corporate websites and leaking data from entities such as Roskomnadzor, the federal agency responsible for censoring Russian media.

But is any of that true?

It appears it is, says Jeremiah Fowler, a co-founder of the cybersecurity company Security Discovery, who worked with researchers at the web company Website Planet to attempt to verify the group's claims.

"Anonymous has proven to be a very capable group that has penetrated some high value targets, records and databases in the Russian Federation," he wrote in a report summarizing the findings.

Of 100 Russian databases that were analyzed, 92 had been compromised, said Fowler.

They belonged to retailers, Russian internet providers and intergovernmental websites, including the Commonwealth of Independent States, or CIS, an organization made up of Russia and other former Soviet nations that was created in 1991 following the fall of the Soviet Union.

Many CIS files were erased, hundreds of folders were renamed to "putin_stop_this_war" and email addresses and administrative credentials were exposed, said Fowler, who likened it to 2020's malicious "MeowBot" attacks, which "had no purpose except for a malicious script that wiped out data and renamed all the files."

Another hacked database contained more than 270,000 names and email addresses.

"We know for a fact that hackers found and probably accessed these systems," said Fowler. "We do not know if data was downloaded or what the hackers plan to do with this information."

Other databases contained security information, internal passwords and a "very large number" of secret keys, which unlock encrypted data, said Fowler.

As to whether this was the work of Anonymous, Fowler said he followed Anonymous' claims "and the timeline matches perfect," he said.

The Twitter account, named @YourAnonNews, has also claimed to have hacked into Russian state TV stations.

"I would mark that as true if I were a factchecker," said Fowler. "My partner at Security Discovery, Bob Diachenko, actually captured a state news live feed from a website and filmed the screen, so we were able to validate that they had hacked at least one live feed [with] a pro-Ukrainian message in Russian."

The English-language Russian news website RT "is for a western audience, and so what what's being shown on RT is not what's being told in Russia," said Security Discovery's Jeremiah Fowler.

Lionel Bonaventure | AFP | Getty Images

The account has also claimed to have disrupted websites of major Russian organizations and media agencies, such as the energy company Gazprom and state-sponsored news agency RT.

"Many of these agencies have admitted that they were attacked," said Fowler.

He called denial of service attacks which aim to disable websites by flooding them with traffic "super easy." Those websites, and many others, have been shuttered at various points in recent weeks, but they are also reportedly being targeted by other groups as well, including some 310,000 digital volunteers who have signed up for the "IT Army of Ukraine" Telegram account.

Fowler said he didn't find any instances where Anonymous had overstated its claims.

But that is happening with other hacktivist groups, said Lotem Finkelstein, head of threat intelligence and research at the cybersecurity company Check Point Software Technologies.

In recent weeks, a pro-Ukrainian group claimed it breached a Russian nuclear reactor, and a pro-Russian group said it shut down Anonymous' website. Check Point concluded both claims were false.

"As there is no real official Anonymous website, this attack appears to be more of a morale booster for the pro-Russian side, and a publicity event," CPR said, a fact which did not go unnoticed by Anonymous affiliates, who mocked the claim on social media.

Groups are making fake claims by posting old or publicly available information to gain popularity or glory, said Finkelstein.

Fowler said he feels Anonymous is, however, dedicated more to the "cause" than to notoriety.

"In what I saw in these databases, it was more about the messaging than saying 'hey, you know, Anonymous troop No. 21, group five, did this,'" he said. "It was more about the end result."

Hacktivists who conduct offensive cyber warfare-like activities without government authority are engaging in criminal acts, said Paul de Souza, the founder of the non-profit Cyber Security Forum Initiative.

Despite this, many social media users are cheering Anonymous' efforts on, with many posts receiving thousands of likes and messages of support.

"They're almost like a cyber Robin Hood, when it comes to causes that people really care about, that no one else can really do anything about," said Fowler. "You want action now, you want justice now, and I think groups like Anonymous and hacktivists give people that immediate satisfaction."

Many hacktivist groups have strong values, said Marianne Bailey, a cybersecurity partner at the consulting firm Guidehouse and former cybersecurity executive with the U.S. National Security Agency. Cyber activism is a low-cost way for them to influence governmental and corporate actions, she said.

"It is protesting in the 21st century," said Bailey.

Yet cheering them on can be dangerous in the "fog of war," she said.

"A cyberattack has the potential for such an immediate impact, in most cases well before any accurate attribution can be determined," she said. "A cyber strike back or even kinetic strike back could be directed to the wrong place.And what if that misattribution is intentional? What if someone makes the attack appear from a specific country when that's not true?"

She said cyber warfare can be cheaper, easier, more effective and easier to deny than traditional military warfare, and that it will only increase with time.

"With more devices connected to this global digital ecosystem the opportunity for impact continues to expand," she said. "It will undoubtedly be used more often in future conflicts."

Go here to see the original:
Anonymous declared a 'cyber war' against Russia. Here are the results - CNBC

Read More..

Colleges and universities have a great deal of valuable and private data in their systems. Personnel, academic, financial and administrative systems hold everything from research data to student medical records. It all adds up to a lot of sensitive information that requires protection.

This is where cyber insurance comes in: an insurance product that shields the school from the financial disaster that comes with data breach lawsuits, liability findings, regulatory failure fines, and huge legal costs associated with a failure to protect that information and keep it private. Read on for some facts and fallacies about cyber insurance.

DISCOVER: What one university learned after a ransomware attack.

Cyber insurance isnt designed to handle the case of someone losing a laptop or having it stolen. Cyber insurance covers the case in which the laptop loss turns into a data breach and then the university must pay for fraud monitoring for 3,000 students who had their personal financial information exposed as part of the breach.

Of course, cyber insurance isnt all the same, and every institution will have a policy customized for its own requirements. The point of cyber insurance is to cover the cases that are handled poorly by other types of insurance, such as paying for legal costs and fines related to a regulatory action that came out of a cyber incident: device loss, system break-in, the wrong email going to the wrong person, and so on. Cyber insurance policies can cover liability costs, costs to replace lost data, even loss of income.

One of the most popular coverages in cyber insurance is for ransomware attacks. This insurance is designed to reduce financial risk related to cyber extortion.

Click the banner belowfor exclusive insights about cybersecurity in higher ed.

Cyber insurance isnt like fire or theft insurance you dont just pick a dollar amount and send in a check. Because the cyber risk landscape is constantly changing and because cyber security is such a complicated area for IT teams, cyber insurance doesnt come with a one-size-fits-all rate sheet.

To make a fair price, the insurance company needs to be able to estimate the risk: the likelihood of loss and the amount of money at stake. That means the process of buying cyber insurance is going to require a lot of in-depth disclosure from your institution, along with very clear lines delineating what kind of coverage is needed and what is excluded.

FIND OUT: How to support mental health for university cybersecurity professionals.

In fact, the exact opposite is true. When you buy cyber insurance, the underwriter becomes very interested in your security profile and the attack surface you present to the world. Insurance companies may perform regular vulnerability scans permitted as part of the policy on all your internet-connected systems. If they find something they dont like, youll hear about it, first from an automated system and, if you dont do anything about it, from a human who wants to know when youre going to solve the problem thats been identified.

Your security team will be partially beholden to the standards set by the insurance company as well. What your team may have considered reasonable configurations or optimizations for usability, such as allowing old encryption algorithms, may suddenly show up on the insurance companys radar as a problem that you must solve, lest you see higher premiums or even lose insurance entirely. Cyber insurance underwriters will also want to look at your incident response plan and may insist on changes, especially in areas such as reporting and timelines.

The percentage of education IT decision-makers who falsely believe cybersecurity insurance protects them from ransomware (insurance helps cover the cost of an attack but does not stop the attack itself)

Source: Sophos, The State of Ransomware in Education 2021, July 2021

Theres a good side to all this too: Cyber insurance underwriters are interested in reducing risk, so youll gain a new partner when it comes to implementing these new security controls. Consulting services, training and automated assessments may all be part of the benefits that come with cyber insurance.

When its time to measure risk and make decisions about security investments, insurance companies have in-house experts that you can call on to help understand what types of investments have the best cybersecurity cost-benefit ratios.

EXPLORE: How to avoid security breaches within the IT department.

Insurance is all about risk transfer: A breach may or may not happen, but if it does, it will be expensive, so youll pay an insurance company to take that risk off your shoulders. This means that its the CFO who is responsible for buying insurance of all types. Insurance doesnt solve any problem other than a financial one, so the CFO is the person most interested in reducing the risk to the institution.

However, CIOs and their teams are the ones with the expertise and knowledge in this area. The CIO and CISO will be able to read policies and understand the specific terms of art used in a way that the CFO cant. The security team will be able to understand what is and isnt excluded and put it into context for the CFO. Thats a critical step, because if the important risks are not covered properly, then the insurance isnt meeting the goals of the institution or the CFO.

alexsl/Getty Images

Go here to see the original:
What Higher Education Institutions Need to Know About Cyber Insurance - EdTech Magazine: Focus on K-12

Read More..