Robert Siciliano discusses cyberattacks on U.S. critical infrastructure like power grids and water systems. He covers the Epsilon phishing campaign and warns against clicking email links. He recommends antivirus software and identity protection as basic defenses.
Chapters
Forget these high gas prices, worry about high-tech attacks because that's what really could unplug this economy. You heard about this? It is scary stuff. All right, forget gas prices soaring and food prices spiking, the deficit exploding, because of a new threat to the economy that's now emerging. There's a new report that shows hackers now attacking vital American industries at a growing clip. They're doing this with, like, reckless abandon. Now, that includes cyberattacks on oil and gas facilities, power plants, or water supply. And worse yet, companies still not doing enough to protect themselves because they don't know what the heck is going on. They, they get in the morning and say, gee, look at this. My next guest says this is just the beginning, and he should know. He's a cybersecurity expert. His name is Robert Siciliano. Robert, I've been hearing a lot about this, a lot more about this. Scary incidents. I mean, really scary incidents, but being perpetrated against companies you would think are on top of this and they're not. Why can't they stop it?
Well, the issue here is that they may not consider themselves targets and/or they're just simply not allocating the necessary resources.
Yeah, but if you're a water authority, come on, if you're a water authority, you gotta think you're a target, right?
At some level you would think so, but most don't want to believe it's happening to them. And— but then when it does, then they, you know, begin to make those investments, but sometimes it's too late.
So what's happening here? What's driving this?
So, you know, 20 years ago, in order to penetrate one of these, you know, facilities, someone that would have to jump a fence. Today, all you need is a connection to the internet. One of the employees on the inside receives an email from what looks like his boss He clicks on a link in the email, and it launches a virus onto the network that begins to shut down their defenses, allows the bad guy into the back door, and all of a sudden he's able to penetrate the entire network and hold it hostage. Now, from there, the bad guy will request ransom in order to give the system back, and/or that exact same process allows the bad guy, maybe a foreign nation, to copy trade secrets, to be able to remotely control the entire system.
Um, what about these cases, Robert, where— remember, it happened not too long ago, a few weeks ago, I think. Affected everyone from Disney to some big Fortune 500 companies, where outsiders were able to hack emails. Now, we were told they just got their email addresses, and in and of itself, that wasn't a big deal. But I thought to myself, well, an email address, you could make some significant progress off of that, couldn't you?
That hack was via a company called Epsilon, which is a marketing company. They send over 40 1 million email communications out a year for marketing, you know, for major corporations like Marriott and Hilton and others. And they received a phishing-type email, clicked the link, infected the system. And now all those emails that they have, which is, you know, for a lot of the Americans in the country, all these emails can be used to send out what looks like legitimate communications and ultimately infect people's PCs. And then, you know, the same thing happens all over again.
So they have all those addresses. I just want to understand how this works. They have all those addresses. Then it's only effective if you respond to what appears like a legitimate email. Let's say your bank, it seems legit, is asking for information, then they got you, right?
Exactly. And you know, not all, not everybody in the country knows what a phishing type email is. And when you receive communications regularly from your bank or from a hotel you might do business with, from a retailer you might do business with, you know, regular communications, and all of a sudden you're getting another one that looks like a regular communication and it has a new offer in it or, you know, anything, update your account, and you click on it because again, you just got one yesterday, not that big of a deal.
Right, right.
You click on it, right. And too many people click these emails and right now phishing is one of the top biggest issues.
So what do you do? A simple step to avoid it, how do you know what to avoid?
I don't click links in emails. Plain and simple. And that's what I tell everybody else. If you want to visit a website, manually type it into the address bar, go to your bookmarks, Just don't click links in emails because they're dangerous today. You also have to have, you know, the latest, greatest antivirus, identity theft protection, all that stuff. Make sure that you're locked down and you're secure. The bad guy's working 24/7, 365 to get to you, to get to major corporations, to get to our critical infrastructures. And without the necessary defenses, without the education, we're all just sitting ducks because they are full force, organized. They know what they're doing.
Apparently they do. All right, Robert Siciliano, thank you. Good advice all.
