Russia weighs the risks of launching cyberattacks against the West! #17

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it. And, uh, good afternoon. I am Robert Siciliano and this is Peter Warmka. We are the Security Guy and the CIA Spy. This is our live broadcast. Peter, say hello to everybody.

Hi everybody, this is fantastic. Robert, how are you doing?

Doing very good, thank you. So this is our, um, first, uh, LinkedIn Live in YouTube and Twitter and Facebook, and, um, y'all have the opportunity to comment and say nice things and ask good questions. And so we are here to facilitate Your digital literacy, cybersecurity, and personal protection. Peter is a retired CIA agent. He spends a lot of his time in Langley. So if you watch Homeland, you'd know what Langley is. And I provide security awareness training, and our team also provides virtual Chief Information Security Officer Vulnerability Scanning and Testing. And our podcast is in our— I think this is our 17th episode, Peter.

That is correct. Yes.

Yeah. Yeah. And so, yeah, today we are going to be discussing lots revolving around Russia and Ukraine and cybersecurity and all of the warnings that CISA and other federal and state agencies have been warning us of. So let's get right into it. Peter, you know, it is a bit scary what's going on out there, right? You know, it is 2022 and Russia has invaded the Ukraine and they are essentially terrorizing innocents and murdering them. There's really no other way to look at it. All right. So right here, Russia weighs risks of launching cyberattacks against the West. Uh, this is via The Hill, uh, Russia weighs risks. Russia isn't weighing risks. Russia knows what they should and shouldn't do, what they want to do and what they can't do, and what they probably are doing and what they will eventually do. I mean, that's kind of summing it all up, right? Uh, Russia is already launching cyber attacks against us. They've been doing it forever, and they're going to continue to do it. This same way that we are doing it to them. Uh, this is, uh, just, uh, last week or so. Although the United States is bracing for retaliatory Russian cyber attacks, experts in the field say the Kremlin is likely still weighing whether a destructive action in cyberspace is worth the blowback. And that's really what it boils down to. Uh, can or will Russia actually cripple us on purpose, or will they just kind of kick back? I don't think that they will, at least not yet. Things haven't escalated, or we have not involved ourselves in such a way where they see that as a necessity. Peter, what are your thoughts on that?

This is a very interesting topic, and I think for a lot of the viewers to appreciate the magnitude, you need to understand that over the last several years, I mean, we've heard a lot about attacks from Russia. A lot of those have been undertaken by criminal organizations, uh, some with direct ties to the Russian intelligence apparatus and some that are operating pretty autonomous. In the past, they have dealt with penetrating organizations predominantly for financial extortion, ransomware, business email compromise, etc. But what we're looking at now is the actual cyber warfare capabilities that you mentioned, that they have built this up. There are war plans on the shelf. Every country that's— that looks at different contingency when it comes to undertaking warfare, whether it's the offensive or defensive, and they study targets, they analyze them, they continuously update it and have it ready. The fact that they haven't launched some specific ones does not mean that they don't have the capabilities. They're going to predominantly be looking at targeting our critical infrastructure.

Right.

You don't have to worry about land forces arriving at the border and trying to get into the country. Now, with cyber, they can get into the interior and attack that critical infrastructure anytime they want. So as you mentioned, probably not going to go into this too quickly, but they would be ready to depending on how this escalates.

So Peter, I actually had a question for you. Um, have you, as an intelligence officer, right, a former intelligence officer, have you ever actually been to Russia?

I have not. I mean, I've been to over 50 countries, but I never actually— never had the pleasure of traveling to Russia, uh, for business or for, uh, for pleasure. And now really I can't go. I can't go even though I'm retired. I wouldn't risk going even though I've never, you know, undertaken any operations involving Russia. But the fact of being who I am, being out in the open, I would be a target. I would be a target of opportunity to the Russians if I were to travel there because they could easily say, hey, this guy was conducting some kind of espionage operations. People look into my past. Yeah, this guy was a CIA officer. And so, you know, I— and this has happened to other people too, you know. We've known of other individuals who have been picked up and locked, uh, locked up by the Russian scene and charging them with espionage, whether or not they were actually involved in espionage or not. They will hold you, you know, they can hold you there. And, and, um, I'm too concerned that that could happen to me.

Yeah, yeah, definitely. Especially if you're traveling with your wife and the both of you get, uh, sent to the gulag, right? So, um, yeah, so, uh, The Hill says, while there are no specific or credible threats, uh, to the U.S. homeland— this is via CISA— Russia's unprovoked attack on Ukraine, which has involved cyber attacks on Ukrainian government and critical infrastructure organizations, may impact organizations both within and beyond the region, particularly in the wake of sanctions imposed by the U.S. and our allies, says CISA. Every organization, large and small, must be prepared to respond to disruptive cyber activity it added. And then they have a link there for Shields Up via CISA, and that is at cisa.gov/shields-up. And by the way, all of these links will be in the show notes that we will provide anyone via our website at protectnowllc.com in our newsletter. So Shields Up talks about while there are no specific credible threats, which we talked about and discussed, Down here, this is guidance for all organizations. They say they recommend, regardless of size, adopt a heightened posture when it comes to cybersecurity and protecting their most critical assets. Recognize that many organizations find it challenging to identify resources for urgent security improvements, which, you know, you should have systems in place anyways. They said they've compiled a catalog free of services— of free services from government partners and industry to assist They recommend the following to reduce likelihood of damage: validate that all remote access to the organization's network and privilege or administrative access requires multi-factor authentication, MFA, which you should have anyways, but too many don't. Further, ensure that the software— your— all of your software is up to date. This is like 101. Prioritizing updates that address known exploited vulnerabilities. Identified by CISA, which you could also be on a mailing list for CISA, and you should be, so you get acknowledgement of those or notification of those various vulnerabilities. I do, and so does Peter. Confirm that the organization's IT personnel have disabled all ports and protocols that are not essential for business purposes. Again, this is something your CIO, CTO, CISO, and so forth would engage in, or your VCISO or your MSSP P would do. If the organization is using cloud services like, um, Microsoft 365 or Google Workspace, ensure that IT personnel have reviewed and implemented strong controls outlined in CISA's guidance and sign up for CISA's free cyber hygiene services, including vulnerability scanning, to help reduce exposure or threats. Uh, all of this, you know, again, 101 for your, uh, company officers, your IT people. But for your smaller to medium businesses, you may not be engaging in such practices, which might necessitate either a VCISO or a fractional CISO, which, you know, either Peter and I could refer you to, and/or, you know, engaging in an MSSP, which can be really expensive. MSSP being managed security service provider. Again, usually for larger businesses, because, you know, you're looking at $20,000, $30,000 a month.

Robert, I think we need to emphasize here because a lot of people, you know, typically even prior to discussions of cyber warfare, they're thinking, well, my firm is too small, no one's going to care about my firm. They're looking at the larger firms. And we many times say, hey, listen, they're attacking, they have attacked, penetrated small and medium-sized firms. And even today with cyber war, it's not looking at specifically attacking U.S. government facilities. We're looking at critical infrastructure. What percentage of that is owned and operated by the private sector? The vast majority of it. So, and within the private sector, there's a lot of interworking, interconnections between these companies. So cannot overlook the possibility that your firm, even though you think you're not involved in, directly involved in something large like critical infrastructure, that you might not be a target when it comes to undertaking these type of attacks.

Yeah, and then your, say, your local utilities, right? Regional, local utilities owned by cities and towns, water, electricity. The local water supply might be managed by a couple of guys that are former plumbers, in-house city plumbers that eventually started working for the city water supply. For the municipality, and they may not have, you know, they may have, you know, all necessary, you know, skills regarding making sure that everything's running properly, but they might not have the IT background in order to keep the pumps, you know, from getting hacked, right? And that's a big deal. The same thing with the local grid. It could be run by a bunch of, you know, local electricians. But they may not have the skills in order to protect their devices, their network. So here Yahoo Finance talks about Russia may be primed to attack America's infrastructure. And they've been snooping and sniffing for decades in that regard. I wanted to pull out a couple of key points here. Russia has launched devastating cyberattacks against the Ukraine in the past, including striking portions of its power grid in both 2015 and '16 and in 2017. It launched NotPetya, a cyber weapon so powerful it not only destroyed computer systems across the Ukraine but also parts of the world. Further, Russia has previously demonstrated its capability to wage cyber, cyber war in the US as well, whether through malware or disinformation campaigns during the lead-up to the 2016 and 2020 elections and throughout the COVID-19 pandemic. So yeah, I mean, we are definitely under attack. It's going to get worse before it gets any better. And here the New York Post talks about data wiping software found on hundreds of Ukraine computers, right? And, and we've seen the same tech, uh, malicious software, malware, deployed everywhere in the U.S. Uh, here they go on to say that a newly discovered piece of destructive software found circulating in the Ukraine has hit hundreds of computers according to researchers at the cybersecurity firm ESET, part of what Ukrainian officials said was an intensifying wave of hacks aimed at the country. Further, the company said on Twitter that the data wiping program had been installed on hundreds of machines in the country, an attack it said likely had been in the works for the past couple of months. Further, Vikram Thakur of cybersecurity firm Symantec, who we know, uh, which is also looking into the incident, told Reuters that infections had spread outside Ukraine. So once an attack like this happens, you know, in the Ukraine, it's easy for that virus to spread elsewhere like a virus does. You know, looking at COVID, it started in, say, Wuhan, and it spread worldwide pretty quickly. Computer viruses can do much the same. Peter, what are your thoughts on this?

No, I agree, and I think the fact that so much of the infrastructure that has, uh, the Ukraine has right now has been actually developed or supported by the Russians. So they really have excellent access into Ukraine in regards to these type of attacks. So it's very easy for them to undertake these attacks, which they are doing. And I think, as you mentioned earlier, the fact that there hasn't been necessarily any big attacks here in the United States yet, there have been these probes., uh, of the water systems, of the dams, not only by the Russians but of other services as well. The Iranians are really active in this. And so, oh yeah, I think our, our, um, our infrastructure really needs to be updated when it comes to, um, you know, IT protection. I think, I think it's very outdated, unfortunately.

So, uh, there is an article put out by CNBC, here's how to protect yourself against cyber attack as Russia-Ukraine crisis Escalates. Now, I will be the first one to admit that the article itself and the information in it is pretty rudimentary. It's really coming from a personal finance point of view, and it's not necessarily going to help those that are safeguarding our critical infrastructures. However, you know, it's stuff that every mom-and-pop, small, medium, large business employee, CEO, company officer needs to be be aware of. All good information regardless. Just give me one second here. Right. So cybercriminals, as we know, capitalize on uncertainty. And that's what's going on with the Russia invasion of the Ukraine is just the type of upheaval that may put individuals at risk. And part of what Peter and I do, obviously, is help to secure the enterprise. But of course, B2C, securing the consumer, people like you and I are— we are just as vulnerable. The problem is kinetic warfare is almost always accompanied by cyber warfare, says Vahid Behzadin, an assistant professor of cybersecurity at University of New Haven. It's unlikely Russia would target critical infrastructure here in the U.S. However, there is a long history of Russian hackers engaging in patriotic attacks against entities not well aligned with the Russian government. We've already seen attempts that happening around the world. He said, all right, so number one, plain and simple, as you should always, uh, really be on high alert. You know, um, it goes on to say that the types of scams we anticipate range from politically oriented robocalls and texts, which I haven't gotten yet, to fake donation pages, you know, for the Ukraine in general, trying to get people involved in cryptocurrency to pay via Bitcoin And then never open an email attachment from someone you don't know and be wary of forwarded attachments from people who you do know. That's like Common Sense 101 email security, but a good reminder.

Robert, remember all these scams that were coming up in the beginning of COVID because everybody was searching for information? The same thing is happening now. People are like, want updated information regarding what's happening in Ukraine. And so there's that temptation if all of a sudden they receive an email with a link with a news story or an attachment with information that they click that on without verifying that this is coming from a valid source. So a lot of these same techniques are being utilized now because this is what's grabbing people's attention.

Right, of course. You know, whenever there's any inclement weather, you know, whether it's hurricane, disaster, world disaster, local disaster, any type of a breach, significant breach, you know, any type of world issue. There's always a— criminals have their own editorial calendar, and they build it around stuff that gets our attention, you know. And so choose a strong password. Again, 101: password should be 12 to 15 characters, characters long with strategically placed special characters and symbols. You know, I don't actually create my own passwords at this point. I use a password manager. I know only like 1 out of 10 people use a password manager, and I think that's kind of crazy because if you're going to have a different passcode across every single account, if it's going to be a strong passcode, the only way to do that really effectively is, is with a password manager. I don't even know most of my passwords, but my password manager does. Peter, what are your thoughts on that?

No, I agree. I, I haven't used a password manager. I have friends that think they're being very, uh clever or safe, let's say, by having a journal and writing all their passwords down in a journal, or even having a file on, you know, on their computer that has, you know, like a spreadsheet with all their passwords. Once again, it's not that hard for a malicious actor to gain access to all of those passwords. A password manager is much safer. There is probably a good 15 to 20 options out there from password managers. I would recommend that people take a look at them. Some are free, some are for a fee or a small fee. It's definitely worth the investment.

Yeah, I, um, recommend starting out with the free version just so you can see if you like it, and then you're going to quickly realize that in order to maintain it, because of the, uh, amount of passwords you're going to have, you're going to need to pay for it. And usually a password manager can be anywhere from 20 to 60 bucks a year for a license. They can— and it can work across a number of different devices. And then keep your antivirus software updated, which that makes the most sense. Keep all of your software updated, including your operating system, and update your critical security patches. And you really should be paying for antivirus. Free antivirus, you generally get what you pay for. And with the paid version, you get multiple layers, which include antivirus, anti-spyware, anti-phishing, and a firewall. Use only trusted Wi-Fi resources. So free Wi-Fi, as you know, is unprotected, like at the airport, hotel, resort, out and about. So you want to use either a local password-protected encrypted Wi-Fi and/or use a VPN, also known as a virtual private network, that'll lock down your unprotected unencrypted free Wi-Fi, using a VPN, it's like going through an encrypted tunnel. Okay. And of course, don't give out personal information. But that recommendation has limitations. So it says be particularly aware of any request to provide information such as your birthdate, Social Security number, or bank account. The same goes for information on social media. I give out my Social Security number at least a couple of times a year for one reason or the other. You know, when, when it's— when you're told don't give out your social, that's not necessarily, you know, reasonable, uh, because if you want to get a loan, if you want to apply for various insurances, if there's certain things that you're going to have to give out your social for, and while you may be hesitant to do so, you're really going to have to do that. At different certain points in time. I think that that advice is for like the masses who are unaware and just will just give out the information anyways.

You're right, Robert, but I would, uh, there are those cases where you do have to provide it, especially when it comes to like getting a credit, right, a financial transaction. But there's so many other times when it's on the form, you know. We think about every time you go to a doctor to update your, your medical forms at a doctor or hospital, They're asking for your social, and I'm saying, why? I usually don't even provide it. And they never come back to me saying, sir, you need to provide this. It's just there, and people automatically think it's a blank that I need to fill in. So I think it's having some prudence in regard to, do they really need it? In some cases, they might, as you mentioned. But a lot of times, it's not necessarily absolutely necessary for them to have it.

I would agree with you 1,000%. Yeah, so there is a time and a place. I do ignore that little, you know, fill this out, uh, line for the social most of the time, but I know when it's necessary, and I'm gonna give it out when it's necessary. And I have what's called the credit freeze, which locks down my identity and protects me from new account fraud. You get a credit freeze through the local credit bureau, for the 3 major credit bureaus, and it's free. So as long as you have that, it generally makes the Social Security number useless to a thief.

All right, so important. I, I also highly recommend the credit freezes. I mean, a lot of people have heard of them, but so few people have really taken advantage of it, and that can really, really protect you.

Yeah. And then, um, finally it says check your credit. You know, you should be checking your credit at least annually. You can do it for free in the U.S. at annualcreditreport.com. When you do that, you're not going to be getting your credit scores, you'll only be getting your credit report. That shows all the revolving lines of credit under your name, both closed, you know, from the past and current. And if you see anything open, new, that you didn't authorize, a new line of credit that you had no idea existed, that's a likely sign that your identity was compromised. So that's a good reason to check your credit. Other than that, if you have a credit freeze, it'd be very difficult for anyone to open up new lines of credit under your name. Peter, you know, what do you do?

Well, for protecting my, uh, for protecting my, my financial information.

Yeah, but you like your identity from like from credit, you get a credit freeze. Do you have identity theft protection services?

Be honest with you, I have not, I've not, uh, procured those. I've been thinking about it, but I do exercise, uh, protection, self-protection in regard to the credit freeze across all three bureaus. I'm very careful with the, uh, yeah. The financial organizations that I work with, who I have accounts with, all of them use multi-factor protection, at least dual-factor protection. I think almost all the financial institutions do today. And, and those that are not, I mean, they're, they're behind. So critical. Yeah.

And you know, Credit Freeze fundamentally is what you need to protect yourself from new account fraud. Having identity theft protection services is an additional expense. It's basically just credit monitoring. And they usually provide an additional layer with, you know, dark web monitoring, which is, you know, you can take it or leave it. It's a good thing to have. And then they have restoration experts or agents that would work on your behalf should your identity get compromised. And that really is the main benefit of having identity theft protection is those additional experts that will work on your behalf to fix a stolen identity, often, you know, working with you to fix a stolen identity that goes— where there's vulnerabilities that go beyond what their service might protect from. For example, they may not protect you from tax-related identity theft or medical-related identity theft or even account takeover for that matter. But their restoration agents will work with you in that regard to fix those issues that you might come across. So yeah, it's good to have. It's an extra layer of protection and security. We're all about layers and more layers. That you have, the more secure you're going to be. It's simple as that. So Peter, um, what do you have going on these days? Where are you at? What do you have to plug?

Actually, uh, I'm gearing up for some travel. I'm getting actually getting a few, uh, emails and phone calls for individuals, organizations requesting the training and or presentations, especially I think that's on the heels of what's going on now with, with Ukraine and Russia and a concern of the upbeat of potential cyber attacks. That's funneling into some good business prospects for me, so that's a good thing for me. And I think probably you're experiencing some of the same things right now, the uptick of interest in our topic.

Yeah, war will do that, and all the discussion and mention of cyber warfare is definitely getting more interest in our fractional VCISO, Virtual Chief Information Security Officer, fractional CISO services where our team goes in either on-site or remotely to do vulnerability testing, penetration testing, and then protect your network in response. Also our e-learning, we've created 6 hours of pre-recorded e-learning and our CSI protection certification designation program is getting a lot of interest from the real estate, manufacturing, and construction industries as well. You could see, uh, me and my team online at protectnowllc.com. And Peter, where can they see you?

Yeah, just scrolling on the bottom of the screen, counterintelligence-institute.com. Recently updated, so those who have visited in the past, please visit it again. There's some new videos on there and more information about our products and and services. Before we close, I do want to, I do want to put a plug in for— I think it's a very opportune time to be very careful. We have to discern even more today what we are reading, what we are listening to, and what we are taking in as what's going on in this, in this greater conflict, because there's a lot— there is a lot of misinformation out there, and especially information that's putting out by the by the Russians. I mean, we talked about this in the past. They've had a program since the 1920s, uh, the Soviets, called active measures. And now we're seeing a lot of specific examples of how disinformation can really get, you know, serve to create even greater panic within our, you know, country, greater divisions between individuals. And I think we just got to be really, really careful about what we're taking in and trying to verify where is this information coming from.

Yeah, we should do a whole podcast on disinformation. It was actually the Russians or Joseph Stalin, his team, his— they had coined the term disinformation. And I think it was disinformation, disinformation, something to that degree that— and they, and they use that more against their own people than anywhere else in the world. Peter, last words.

Well, stay safe out there, and let's really, you know, think about our poor fellow human beings out in Europe, you know, especially the Ukrainians, that they're fleeing their country. Women are with their children. They don't know what their future is going to entail. Their husbands, fathers are back home fighting, and we got to really think hardly about them and keep them in our prayers and our thoughts. Any other thing that we can do to help, you know, help support them.

Yes. And here in the US, just be nice to each other. Just please be patient with each other and be nice to each other. Thank you, Peter Siciliano.

Thank you, Robert Siciliano. Till next time.

Till next time.