Zoom Security in 7 Steps (Video + Graphic)

https://www.youtube.com/watch?v=CTDjDCiI9Hc’ format=’16-9′ width=’16’ height=’9′ custom_class=” av_uid=’av-mo9up3

Since this video was recorded, Zoom has issued several security updates. Learn more at the Zoom Security web page and don’t forget to update to the latest version!

Zoom Security Transcript:

Hey, everybody. It’s good to see you back again. Today we’re going to talk about seven steps you can take to lock down your Zoom Security. At this point I have heard from clients everything from seeing naked people showing up in their webinars, incredibly embarrassing, bad for the brand. I’ve seen hacked Zoom accounts. I have seen whiteboards and presentations that have been shared with racial epithets, with everything terrible under the sun.

So, I thought I’d give you some ways to lock your Zoom video conference down. Here we go. I’m just going to show you right on the screen so that you can set these up either as we go or right afterwards. First of all, you’ll notice on the zoom interfaces, which I’m showing you here, that there is now a security tab. It allows you to lock your meeting, so that once you have everybody in that you want and you don’t want a Zoom bomber, somebody who comes in not wearing clothes or shares their screen, you can lock the meeting, so that nobody else can get in. Super important that you use that right there, so I’m going to lock my meeting. Nobody else at this point can get in.

Secondly, you can have a waiting room so that nobody can talk to each other until you come in. This is great for teachers or if you don’t want people discussing anything before the meeting starts before you as the controller of the meeting beginning it. This one’s super important and I’m going to show you how to set these up as your defaults in the second part here, but sharing your screen, this allows the participants to share their screen. We don’t want that on unless you really want them to share because this is how they share everything from the whiteboard where they write … What I’ve seen is is nasty racial epithets on it, or they share their PowerPoint presentation with stuff that you don’t want to see.

So, we do not want them to share the screen by default. Again, we’ll set that up in a minute, but you can turn it on and off here. You can turn chat on and off and renaming themselves. This means that if you kick somebody out, they can rename themselves and come back. So we’re going to take a look at how to change all of those things in your default settings. That’s what’s so important here. So let’s go to the default settings.

The easiest way to set up your defaults for Zoom security is when you start scheduling the meeting, you do it in that interface. So let’s say that we were going to schedule a new meeting here in our software. You bring the software up, the first thing you need to know is you want to generate a meeting ID automatically. You don’t to use your personal meeting ID because once that ID is out, once people know it, it’s on social media or whatever, anybody can join that personal meeting ID. I rarely use this feature unless it’s just for a quick meeting. You’ll also want to start requiring a password on every one of these. This is what keeps your video conference encrypted, it’s what keeps unwanted people out because they don’t have the password. So, we would go ahead and schedule that. I’m not going to do it at this point because I’m on a meeting right now.

And you’ll notice up here in the corner that there is a settings button. That’s where we want to go to set our defaults. When you do that, it brings up a bunch of choices. I’m not going to go through settings that don’t have to do with security or privacy. I’m going to just talk about the ones that have to do with privacy. So down here in the profile section, if you click on view advanced features, that will bring you up. I’m going to close that out now, that will bring you into the settings portion of your online account. And this is where we change all of the default settings. Now understand, Zoom is doing a lot of work to increase security, to have better encryption, which right now is weak and to lock down security. But until then you’re going to have to really pay attention to these default settings.

I turned my host video off from the start because I want to make sure that I know when I’m on that screen and being recorded. I turn it on when I am ready. Okay. Down here, use personal meeting ID when scheduling a meeting. Again, I turn this off by default. I do it for an instant meeting as well. I don’t like to use that generic address. Once it’s out there, anybody can Zoom bomb, they can join, just knowing that address. This is a really important one. Only authenticated users can join the meetings. There’s different ways that you can define down here what an authenticated user is. It could be somebody who has the right email address, it could be somebody based on the fact that they have a Zoom account or not. So this is an important one for security. And the same goes for joining from a web client, you want to make sure that they are an authenticated user, that they have a legitimate Zoom account, not just joining from the outside.

Right here, require a password when scheduling new meetings or instant meetings. That should be turned on by default. You will be using a password. That makes it more encrypted and that keeps unwanted users out. I also require passwords when joining by phone because it’s the same thing. You don’t want somebody calling in on a generic number and being able to disrupt your meeting. This one here, requiring cryption for third party endpoints. This is good unless you’re using YouTube to do live broadcasting. If you try and turn that on and you’re broadcasting to YouTube in a live stream, it will not work because YouTube does not work with that form of of encryption. So, if you’re not live broadcasting to Facebook or YouTube or other, you can turn that on, which improves your Zoom security.

Okay, file transfer. I turn that off unless I’m in a meeting where I’m definitely going to transfer documents because if somebody gets on that is not meant to be there, a cyber criminal or a hacker, they can transfer malware using that file transfer capability. So in general, I keep that turned off and I turn it on when I need to transfer a file. This one’s really important. Screen-sharing, who can share? I turn it on because I want to share my screen, but I also note that I’m the only one that can share the screen, not all of the participants. And then in the individual meeting or webinar, I can say, Hey, this particular user can share their screen.” I control that access. This is where Zoom bombing happens, people when screen-sharing is left open, they share photos, videos, presentations that you definitely do not want to be seeing.

So you want to control that. So you turn on screen sharing, but you turn it on for the host only. You can also disable desktop and screen sharing for users. One more tool that lets you totally lock it down. I, of course, do allow some sharing of that so I don’t completely disable it. You don’t probably want to share annotation or whiteboard or remote control of the system. You can do that again on an individual basis when you need it, but setting that as the default allows anybody that’s in your meeting or your conference to share the whiteboard or the annotating services.

This is good here, identify guest participants in the meeting. So, if you didn’t invite somebody but they’re on, they will appear in a separate participant list, so that you know that you’ve got people that you weren’t expecting there. You can either leave them on or you can cut them off.

Let’s go back up to the top real quickly and I want to show you here in the recording section as opposed to the meeting section a couple of best practices. You can give participants the permission to record locally. This is a good privacy setting. You don’t necessarily want everybody to be able to record locally, so I give that out on a very limited basis and understand anytime you record something it will be shared. So, if you’ve got a private board of directors meeting, if you’re discussing intellectual property, if you’re having a conversation or video of any time, you probably do not want that to be recorded. One other thing is I like to record on the local computer, not in the cloud. This takes away some of the ability for Zoom to be able to scan and share or advertise based on the content of your meetings.

Believe it or not, when you sign their data use policy, you are giving them the right to scan what you leave in the cloud. So, I always use a modern enough computer that I can save it right to my hard drive. And finally, the recording disclaimer, this asks participants for their consent when recording. This is a best practice. People need to know that they’re being recorded.

One last thing that I want to go through is what happens if somebody is Zoom bombing, somebody comes into your conference unwanted. I recommend always having a cohost. If you’re doing a webinar or an important meeting, somebody who can watch over, for example, the participant list. So that if somebody came up here that you didn’t want, you could simply click on them. Because I’m the cohost, you can’t do this, but you could click on more, you could have that person forced out of the meeting, to leave the meeting.

It’s a great way if somebody’s causing trouble, but it’s hard to do when you’re actually the one giving the webinar like I am right now to both monitor that, monitor the chat. That’s why I always recommend that you have a cohost along.

All right. Summary. You need to lock your meeting. You need to have passwords. Don’t use that personal meeting ID. Have it be customized for every single one and go in and change those defaults. Read through them. If you don’t understand something, Zoom walks through it on their site, they have videos on it makes it much easier to go through and customize those settings. Start by locking everything down, practice with it, and then back into your preferred settings. I just don’t want you getting out there and having a meeting on something that’s confidential in private that then gets out to to the public.

All right, thank you so much. I hope this helped out. Let me know what you want to see next time. Please like us. Pass us on. Share us. That’s how we let people know what we’re doing. Take care.

zoom security 10 tips

Cybersecurity for Your Home or Virtual Office

Cybersecurity Virtual Office Key Links from the Webinar:

ZOOM Sileo Security Video
Password Managers Review
Data Backup Physical/Cloud Backup 
ZOOM Security & Privacy Page

There is something great to be learned about cybersecurity from this pandemic. Preparing for a crisis before it happens is far less expensive than recovering after it happens. The U.S. saved several billions of dollars cutting corners on pandemic preparation, and it’s now estimated that coronavirus will cost the world more than $300 Trillion when the economy is factored in – not to mention the death toll.

Smart preparation beats recovery every time. The same is true for cybersecurity where optimism grows out of preparation. Proper cyber hygiene, just like washing your hands for a full 20 seconds, is both mildly inconvenient and wildly effective. And we need it more than ever, because cybercriminals are taking advantage of the chaos. Going remote increases the exposure of company data exponentially, especially because we had so little time to prepare.

This outline focuses primarily on solopreneurs and small businesses as I have held out some of the more technically detailed information on how larger enterprises can further protect their remote workforce. In this time when so much is outside of our control there’s actually a great deal within our control when it comes to cyber security.

7 Cybersecurity Threats in Your Remote Workplace

I’ve put together the 7 threats that I feel, from having observed thousands of organizations with remote workers, are the FIRST you should address. This is not an exhaustive list, but a great place to start.

Threat #1 – Zoom Videoconferencing – Rapid adoption has meant little security

  1. I received a call from a client who told me two things had happened 1) They discovered that a competitor was lurking on a video BOD meeting and 2) When they discovered it, the user screen-shared porn, called “Zoom bombing”. Had this been a call between business and client, it would have been devastating.
  2. It is imperative that you consider the privacy and security implications of Zoom before you use it for sensitive or critical meetings: https://zoom.us/docs/doc/Zoom-Security-White-Paper.pdf
  3. This article from the NY Attorney General about Zoom privacy practices has good information https://www.nytimes.com/2020/03/30/technology/new-york-attorney-general-zoom-privacy.html
  4. To learn to use Zoom, please visit Mike Domitrz’s recorded webinar on the topic: https://www.youtube.com/watch?v=aVKbnQJrrjg&feature=youtu.be

Threat #2 – You and Your Kids – People, not technology, introduce the greatest risk into your systems

  1. Coronavirus scams started the day the epidemic was announced, let’s focus on…
  2. Phishing emails are a hackers best friend. Consent to download crimeware or upload logins
  3. These scams follow the headlines, especially a crisis (can be by text, phone or SM adv)
  4. Solutions:
    • Recognize the coronavirus scams
    • Click Hygiene – pause for 20 seconds before you click – Too good to be true, too bad to be real, too dramatic to be worth your time, then ignore it
    • The Hover Technique – expectations vs. reality
    • 3rd-Party Spam Filters (corporate tip – block it at the Gateway)
    • Train your kids, as anyone on your network can download malware and spread it elsewhere

Threat #3 – Cyber Blackmail – Cheapest tool hacker has is to lockup data & demand a ransom

  1. Ransomware – byproduct of phishing
  2. Worms its way to other devices – Home offices, kids click habits are biggest culprit
  3. 3-2-1 Backup Plan – iDrive https://www.pcmag.com/reviews/idrive

Threat #4 – Game of Knowns – 95% of vulnerabilities are known

  1. Outdated & Unpatched Operating Systems and software (Windows 7 Question – Bruce)
  2. No centralized firewall to protect whole network (not just yours) DSL Router
  3. Unprotected WiFi – Change Default PW, WPA2+, SSID Masking, MAC-specific addresng
  4. Unencrypted computers, laptops and mobile devices (BitLocker & File Vault) LIABILITY
  5. Wide open Remote Access Protocol
  6. Unprotected, wide-open WiFi
  7. SOLUTION: have an IT professional configure all of the above for you – working @ home, spend the money to prevent it up front. You can learn all of this, but devil in details.

Threat #5 – Cloud Hacking – We’ve pivoted to cloud computing and ignored the storm of cybercrime

  1. Setup 2-Step Logins (2 Factor Authentication)
  2. Enable a VPN
  3. Use a Password Manager Like Keeper, Dashlane or LastPass (https://www.pcmag.com/picks/the-best-password-managers)
  4. Dropbox is NOT a secure enough platform for PII or sensitive data
  5. Bad Communication – We email, transfer & store sensitive docs in plain sight
  6. Don’t email documents with sensitive info unless they are encrypted. PDF/Winzip/TrueCrypt (Use the portal with your financial provider)
  7. Messaging: Signal; Apple Messages (Not What’sApp, Facebook Messenger or Droid)

Threat #6 – Stupid Smartphones – The supercomputers in our pockets are a security afterthought

  1. Walk through EVERY Privacy and Security Setting on your smartphone. Period. If you don’t understand the setting, Google it.

Threat #7 – The “Squirrel” After this Class – Action distraction is the primary cause of breach

  1. Even when people have a checklist of what to do, the often don’t take action until after the breach, after the pandemic.

This is a broad outline of a starter course in protecting your virtual office. To customize a virtual webinar like this one to your organization, contact John directly on the number below.

About Cybersecurity Keynote Speaker John Sileo

John Sileo is the founder and CEO of The Sileo Group, a cybersecurity think tank and an award-winning author, keynote speaker, and expert on technology, cybersecurity and tech/life balance. John specializes in making security engaging so that it sticks. Contact him directly on 303.777.3221. 

 

 

Coronavirus Cyberscam Alert: Protect Your Digital Health and Safety During a Pandemic.

Hey, this is a bit of a solemn and serious post today. First of all, my heart goes out to all of those communities, families, people that are battling with Coronavirus. Just like our physical health, we have to also pay attention to our digital, or cyber health, and how we watch out for all of the disinformation that is out there. Listen, cybercriminals will always exploit the headlines. They will always take advantage of our fears and our ignorance, whether it’s for product sales, whether it’s just to make us panic or whatever the motivation. My daughter, the reason that prompted this, was a feeling of, as a dad, my daughter texted me and said, “Hey, there’s a student, I have just seen that a student is being pulled out of class, out of their dorm by people in hazmat suits.”

Well, of course, that was a social media post. It made its way all the way around the campus and was absolutely false. So I want to just let you know some of the schemes and scams that we have seen, make you aware of them so that you’re listening and that you act differently. First of all, there is just massive disinformation out there right now. There are hoaxes, there are rumors, and you need to be extra skeptical at the moment. One example, there are government advisories out there that aren’t actually being issued by governments. They are false, they are fake, they have nothing to do, for whatever reason, people are putting those out there. There are bogus home remedies of how you can solve the Coronavirus, which there’s no vaccine yet and probably won’t be for 12 to 18 months. Of course, there are home remedies like washing your hands that are legitimate.

There are products meant to defraud you, pills that you can buy, masks that don’t actually work. You have to be really careful that what you’re buying is actually legitimate. And on top of that, there’s price gouging. So masks that are going for hundreds of dollars on Amazon that you don’t probably actually need, hand sanitizer that has run out at your local store. Think before you spend all of the money on this because there are many other answers. There are a ton of fraudulent emails that scam you into clicking on Covid-19 type alerts, an alert in your hometown from your school system, a remote work policy from your work. It may not actually be your work. False test results we have seen. Covid test results. Of course, you probably haven’t been tested, but you’re tempted to click on those links. We’ve seen a bunch of videos, social media, blog posts, fake articles that spread disinformation, a lot of it about voting and the voting that we’re going through right now and polling places, politics, and so forth.

So watch all of that. This is essentially the weaponization of information. It happens all the time. It happens in the corporate world, it happens in the government, and now it’s happening around the health system because it’s in the news. So just like good hygiene, physical hygiene, washing your hands, there are cyber hygiene tips that will help you protect yourself. Number one, if you don’t recognize an email or a text, if you weren’t expecting it, don’t click on it. Don’t respond to it. It’s probably not legitimate. If you can’t verify that it’s from your work, from your kid’s school, from the government, do not believe it until you verify it. Same advice for social media. Articles, videos. Don’t believe it until you verify with a source that you trust, that you go to over and over again. Do that before you take the action that they’re talking about because most of these right now is not legitimate.

So sources like the CDC, the World Health Organization, your local news if you trust it, or the paper that you trust. Finally, if you have questions, ask an expert. Don’t count on what you see in the media necessarily, what you see on the internet, especially on the internet, as being totally legitimate until you verify. The point is, just like with cybercrime, those who think before they react with this Covid and vice versa, those who think about their digital settings and what they’re doing online and email and text and on those devices, those are the ones who prepare in advance for that, that avoid the worst outcomes. Listen, thanks so much. Sorry, it’s such a serious topic, but it’s really important that you protect both your physical health and your digital health. Thanks so much and stay safe.

Are Hackers Targeting Your Association? Here’s How to Stop Them.

 

Are hackers targeting your association?

The recent revelation that Chinese hackers penetrated the internal computer network of the National Association of Manufacturers (NAM) last summer should be a clarion call to all associations: They are coming for you. 

The suspected Chinese hackers ramped up their efforts to steal information in the days surrounding a meeting between NAM President Jay Timmons and President Trump this past summer. While we don’t know what data was stolen, the incident took place during intense trade negotiations, as US and Chinese government officials began to hash out details of a potential deal.

The primary motivating factor behind the hacking of trade associations is simple: INFLUENCE. The fact that NAM is an influential group that’s helped shape Trump’s trade policy made them an attractive target for the Chinese, who undoubtedly leveraged inside information to gain an upper hand in the talks. 

While the NAM hack is notable for its ties to the executive branch and high-stakes negotiations, the fact is that associations of all sizes and political influence are potential targets of hackers such as nation-states, foreign businesses or individual cybercriminals. In other words, you don’t need to have political or lobbying connections to be an attractive hacking target. Your member list, industry-specific intellectual property, employee data, digital connections to influencers, and banking and financial information are all just as attractive to cybercriminals and cyberextortionists as your political relationships. 

Over the past decade, numerous associations have been hacked: In May, the National Association of Realtors reported on a number of hacks of state associations and advised their members to beef up cybersecurity. Earlier hacks include (ironically) the Intelligence and National Security Alliance, the Fraternal Order of Police and the US Chamber of Commerce.

It’s not a matter of if your association will be hacked, but when

The World Economic Forum’s 2019 Global Risks Report ranked cyberattacks as the number one risk in North America. And with good reason. Data breaches alone are predicted to cost $5 trillion globally by 2024; in just the first nine months of this year, 7.9 billion records were exposed in North America. Associations haven’t traditionally been a large part of those statistics, which is exactly what makes them ripe for future picking. Lack of direct threats tends to breed complacency and lack of proactive protections.

Protecting your association from hackers and cybercriminals

As an industry association, in addition to advocating for your members, you have two vital responsibilities:

  1. Protecting your member data, financial details and intellectual property from cybercrime 
  2. Educating your members about protecting their organizations against those same evil forces

Here are the first steps you can take to fulfill both responsibilities:

  • Commission an External Cyber Penetration Test to expose your specific and known vulnerabilities
  • Educate your internal employees to detect and deter social engineering tactics like phishing, ransomware and deepfake videos
  • Prepare a data breach response plan in case you are successfully attacked. This should include a list of executive responsibilities, a public relations strategy, legal response and methods of communicating with the breach response team (remember, your email and texts and mobile devices can be compromised in a breach)
  • Educate your association members about cybersecurity best practices at your next annual event

Your reputation as an association depends on many factors. One of the most overlooked of those is the reputational damage done by a cyber breach incident, especially if member data is compromised. Take steps to manage your risk and defend your data — before it’s too late. 

About Cybersecurity Keynote Speaker John Sileo

John Sileo is the founder and CEO of The Sileo Group, a privacy and cybersecurity think tank, in Lakewood, Colorado, and an award-winning author, keynote speaker, and expert on technology, cybersecurity and tech/life balance. John specializes in making security engaging for association and corporate audiences. Contact him directly on 303.777.3221. 

 

 

Small Business Cybersecurity: 5 Steps to Stop Cybercrime 

Small Business Cybersecurity Gone Terribly Wrong 

On August 12, 2003, as I was just sitting down to a tea party with my daughters and their stuffed animals, the doorbell rang. Standing there when I opened the door was a special agent from the economic crimes unit at the district attorney’s office—ready to charge me for electronically embezzling (hacking) $298,000 from my small business customers. The DA’s office had enough digital DNA to put me in jail for a decade. 

I was the victim of cybercrime, and I should have known better. You see, earlier that year my personal identity was stolen by cybercriminals out of my trash and sold to a woman in Florida. This woman purchased a home, committed a number of crimes, drained my bank accounts and filed for bankruptcy—all in my name. I learned all of this one day at the bank, right before I was escorted out by security guards.

The experience of losing my money, time and dignity motivated me to protect my personal information assets with a vengeance. Unfortunately, I didn’t apply my newfound cyber vigilance to my small business, which is how I ended up losing it. 

Like a lot of small business owners, it never occurred to me that my $2 million company would be targeted by cyber criminals. I figured we weren’t worth the effort, especially compared to large multinational companies like Target, Marriott, Google and Facebook. My naivete cost me my family’s business and two years fighting to stay out of jail. 

The fact is, cyber criminals are increasingly going after small and midsize businesses (SMBs) precisely because they are easier targets than larger organizations. According to the Ponemon Institute’s most recent Global State of Cybersecurity in Small and Medium-Sized Businesses report, 76 percent of  small and midsize businesses experienced a cyber attack in the past 12 months. The same report found that only 28 percent of companies characterize their ability to mitigate threats, vulnerabilities and attacks as “highly effective.” 

Not all hacking results in criminal charges being filed against the victim, as in my case, but that doesn’t mean there aren’t significant costs involved. According to last year’s Ponemon Institute study, companies spent an average of $1.43 million due to damage or theft of IT assets. On top of that, the disruption to their normal operations cost companies $1.56 million on average. 

In other words, your organization’s chances are greater than 50/50 that it will suffer a serious cyber attack in the next year or so and that the attack will have a significant negative impact on profitability. The good news is that you can eliminate much of the risk with a reasonable budget and some good leadership.

5 Small Business Cybersecurity Strategies

In my experience, good entrepreneurs begin with the following steps:

Identify All data is not created equal. Bring together the key players in your business and identify the specific pieces of data, if lost or stolen, that would make a significant impact on your operation, reputation and profitability. This could be everything from customer credit card, bank account or Social Security numbers to valuable intellectual property.

Evaluate Understand your business’ current cyber security readiness. During this step, I recommend bringing in an external security firm to conduct a systems penetration test. A good Pen Test will give you a heatmap of your greatest weaknesses as well as a prioritized attack plan. Have a separate IT provider implement the remediation plan, if possible, to provide an objective check on the security firm’s work. 

Assign Engage stakeholders from across your organization, not just those within IT. Assign a detail-oriented, tech-savvy leader other than yourself (if feasible) to oversee the analysis and implementation of your cyber strategy. Other players essential to this conversation are your lawyer and your accountant/auditor, who can help you build a breach response plan for when data is compromised. In today’s digital economy, theft and loss are part of business as usual and they should be planned for—like any other risk to your organization.

Measure Just as with any other business function, cyber security needs to be measured. Your security or IT provider should be able to suggest simple metrics—number of blocked hacking attempts (in your firewall), failed phishing attacks, days without a breach, etcetera—with which to keep a pulse on your data defense. 

Repeat Each one of these steps should be re-evaluated and updated on a regular basis. I recommend taking a look at your security during your slowest season annually. Strong cyber security thrives in the details, and the details in this realm change every year. 

The bottom line is that SMBs can no longer ignore the very real threat of cyber crime, including crime perpetrated by an insider (in 2018, 34 percent of data breaches involved internal actors and 2 percent involved partners). I learned both of these lessons the hard way. It takes an average of 73 days for organizations to contain an insider-related incident; my case dragged on for two years, during which I spent every day fighting to keep myself out of jail. 

In the end, I found out the cyber criminal was my business partner. A man I loved and trusted like a brother stole and used my banking login credentials to embezzle from our clients; he used my identity to commit his cyber crimes. He exploited my trust and then he cut the rope and let me take the fall. 

And I should have known better. So if you think your company is too small to be targeted or you’re too smart to be victimized, think again. 

About Cyber security Keynote Speaker John Sileo

John Sileo is the founder and CEO of The Sileo Group, a cybersecurity think tank, in Lakewood, Colorado, and an award-winning author and Hall of Fame Speaker who specializes in providing security-awareness training to small businesses as well as large organizations. He has shared his experiences on “60 Minutes,” “Anderson Cooper” — and even while cooking meatballs with Rachael Ray. John earned a BS with honors in political science from Harvard University. 

 

Data Integrity Attacks: How Cybercriminals Manipulate Rather Than Steal Your Info

You’re rushed to the hospital after a serious car accident. Doing her job, the admitting physician verifies your blood type prior to giving you a life-saving transfusion. But no one knows the hospital’s medical records have been hacked — but not stolen. In this case, your records have been changed, reflecting a blood type that if transfused, would likely kill or seriously harm you. Welcome to the age of data manipulation.

Manipulating data is the latest trend in cybercrime, and it’s on the rise. The most recent study by Ponemon Institute and Accenture warned that attacking data integrity is the “next frontier.” To understand how we got to this point, we need to take a look at the evolution of cybercrime over the past two decades and how hackers seek a variety of hacking outcomes.

An approximate cybercrime timeline

Early on, cybercriminals were mostly looking to restrict access to your data availability, using malware to launch Denial of Service attacks, where legitimate users are kept from accessing a network, information or devices. Their motivation was twofold: to test their hacking tools for larger campaigns and to disrupt business operations of predetermined targets. 

Next, hackers expanded their exploits to steal data out of large databases — such as the Equifax breach that compromised the personal information of 143 million Americans — and sell it for a profit on the dark web. The cybercriminals’ primary motivation was good old fashioned greed. 

Simultaneously, cybercrime expanded into espionage, using malware and other methods to obtain secret files from U.S. defense contractors, including plans for the F-35 jet from Lockheed Martin. 

Then came cyberextortion, like when Sony Pictures was hacked just before it released the anti–Kim Jong-un movie, “The Interview.” At the time, the FBI said North Korea was responsible for the attack, but five years later questions about the perpetrators and motives remain, which just goes to show how hard it is to identify cybercriminals. 

On the heels of cyberextortion came disinformation and influence campaigns, like those used with Brexit and the 2016 U.S. presidential election. 

The point of this brief history lesson is to demonstrate how quickly sinister actors migrate time-tested tools of crime (fraud, extortion, disinformation, etc.) into cyberspace.

Data manipulation is mostly unique to cyberspace

The old fashioned alteration of checks, IDs and airplane tickets aside, data manipulation is a crime that grew exponentially in cyberspace. Former U.S. Cyber Command and NSA head admiral Michael Rogers said his worst-case attack scenario would involve data manipulation “on a massive scale.” 

Despite Rogers’ warning, the U.S. government continues to drag its feet on combating cybercrime, including data manipulation, which is now being discovered only after the fact by security teams. And I’m expecting that data alteration attacks will quickly become one of the most pernicious and undetectable threats for nation-states and corporations around the world. 

To expand on my previous example, it’s no longer just your blood type at risk. It’s the blood type, address and information on the family members of every soldier, spy and diplomat serving the United States. The potential to inflict great harm is enormous.  

Cybercrime is like a virus altering your DNA

Data manipulation is unique among cybercrimes because it’s not about taking the information — it’s about altering the data. The information generally never leaves the owner’s servers, so the criminal raises no red flags that something is amiss. This makes it much harder to catch, and it can be much more destructive. Think maliciously altering flight plans with air traffic controllers, altering bank account balances, or appending your criminal record with fictitious arrests. 

Think of data manipulation as a virus that invades the body and alters its fundamental DNA. The damage is done quietly, and you may never know it happened.

The integrity of our data is at stake

In 2017, a Michigan man hacked the IT system of the Washtenaw County Jail and altered the release date of a friend who was serving a sentence there. The hacker used a social engineering campaign to trick workers at the jail into downloading malware on their computers and was then able to access and change the data. Luckily, staff noticed something was amiss and used paper records to verify the sentence But the scheme cost Washtenaw more than $230,000, and the criminal got access to the personal information of over 1,600 people.

Getting a friend out of jail is one creative use of data manipulation, but there are far more nefarious uses, such as altering operating procedures on nuclear facility instruction manuals, modifying software code in driverless vehicles, and changing the temperature threshold on refrigeration equipment or power turbines. And of course, as we’ve already experienced, altering votes or voter eligibility.

The stock market is another place that’s ripe for data manipulation. As the Wall Street Journal reported last year, 85% of stock market trades happen “on autopilot — controlled by machines, models, or passive investing formulas.” Consequently, if the underlying data that feeds the algorithms is altered by hackers, it could create widespread chaos in the markets and ultimately destabilize the global economy.

The biggest threat may be to the healthcare industry, which has become a prime target in ransomware attacks, and where the effects of data manipulation can be deadly. To underscore this point, researchers in Israel created malware that can add realistic but fake malignant growths to CT or MRI scans before they’re reviewed by doctors or radiologists. Likewise, the malware can remove cancerous nodules or lesions from patients’ scans. 

In April, The Washington Post reported on the malware and revealed that a blind study conducted by researchers at Ben-Gurion University Cyber Security Research Center had devastating results. “In the case of scans with fabricated cancerous nodules, the radiologists diagnosed cancer 99 percent of the time. In cases where the malware removed real cancerous nodules from scans, the radiologists said those patients were healthy 94 percent of the time.”

When it comes to cybercrime, the best defense is a good offense

Because the defense of data integrity is in its early stages, there is very little that organizations can do to defend against manipulation once the cybercriminals have cracked into critical databases. Few organizations possess the tools to accurately detect and eliminate data manipulation, and those tools are more than a year away. 

In the meantime, your solution is to keep criminals out of your data in the first place, using the tools that I talk about in every one of my presentations. When it comes to data integrity, prevention beats recovery every time.

John Sileo is the founder and CEO of The Sileo Group, a cybersecurity think tank, in Lakewood, Colorado, and an award-winning author, keynote speaker and expert on data integrity, cybersecurity and tech/life balance.

The Unlikely Weapon in Cybersecurity: Going Analog

 

Rule #1: Technology is highly unpredictable when it’s new & untested. And even worse when it’s insecure.

All of us have learned not to count on Technology Version 1.0 in mission critical situations. But it seems that Iowa and Pennsylvania didn’t get the memo, which rendered their election results as untrustworthy. Iowa attempted to use a caucus tally app that had very few cybersecurity protections and hadn’t been adequately tested prior to caucus night. Combined with an earlier voting fiasco in Pennsylvania, it’s logical to conclude that the only way to ensure the integrity of our elections is to use paper ballots.

As if Iowa didn’t make it clear enough, a recent voting fiasco in Pennsylvania was a stark reminder that the only way to ensure the integrity of our elections is to use paper ballots, either as a primary means or in a backup role. In Northampton County, a glitch in the computer voting system resulted in some straight-line Democrat votes being recorded as straight-line Republican, and gave a statistically impossible victory to a Republican judicial candidate. Thanks to paper backups of the electronic ballots, election officials were able to do a manual recount and restore the actual election results (the Republican judicial candidate lost by a small margin). 

As The Washington Post reported, voters got lucky. The margin of victory for the Republican candidate was so massive that there was obviously something wrong, but what if the margin has been in the probable range? It’s likely the error would never have been uncovered. 

The Northampton County voting machines were recently purchased in response to last February’s state-wide mandate to adopt voting systems with paper back-ups before the 2020 elections. In making the move, Pennsylvania joined other states in upgrading or replacing voting systems following Russian interference in the 2016 election and warnings from “ethical hackers” that voting machines in the U.S. are vulnerable.

Recently, Colorado became the first state to ban barcodes for counting votes, opting instead for receipts that show darkened ovals identical to the ballot itself. Colorado is also one of a handful of states to aggressively emphasize mail-in ballots, both for convenience and security’s sake. These moves come amid growing concerns over election security following Russian interference in the 2016 election and warnings from “ethical hackers” that voting machines in the U.S. are vulnerable. 

Reintroducing selective physical and human elements into the technological supply chain is the best weapon we have to protect our elections from interference. But this strategy—going analog—shouldn’t be limited to voting machines; it needs to be implemented across the board in public and private enterprise.

In our zeal to embrace the digital revolution and the convenience of smart devices, we’ve sacrificed some security, not to mention privacy. It’s hard to name a product or service that isn’t networked, but connecting every known device to the internet doesn’t necessarily make us “smart.” It makes us vulnerable. From Siri and Alexa to our televisions, insulin pumps and even refrigerators, our lives are increasingly dominated by digital tech—which is not only sharing our data but can also be hacked and manipulated. 

In July, the Department of Homeland Security issued a security alert, warning that flight systems of small aircraft can be easily and quickly hacked by someone with physical access to the plane. And last month, hackers successfully sabotaged vital systems of an F-15 fighter jet during an Air Force-sanctioned experiment at Def Con. 

The Def Con operation represents an increasing willingness of government agencies to open their doors to ethical hackers in an effort to thwart rising cybercrime. In August, 22 Texas towns were hit by a coordinated attack, in which computer systems were taken over and held for ransom. And that was hardly an isolated incident; Baltimore, Riviera Beach and a host of cities were similarly hit. According to CBS, 50 of 70 U.S. ransomware attacks in the first half of the year targeted cities. 

Even more troubling, an April report by the Ponemon Institute, found that 90% of all critical infrastructure providers say their Information Technology (IT) and Operational Technology (OT) environments have been damaged by a cyberattack in the last two years, and 62% experienced two or more attacks. Operational technology is what runs the physical systems behind our planes, trains, ships, traffic systems and power grid—so the stakes have skyrocketed from lost data to lost lives.

As cybercriminals ramp up attacks on Critical National Infrastructure (CNI), it’s vital that we innovate beyond increasingly ineffective cybersecurity measures. Thanks to mobile devices, the Internet of Things and cloud computing, “securing the perimeter” is no longer achievable.

The fact is, once information or operational systems are digitized, they are vulnerable to attack by remote forces—including hostile nation states, organized crime and malicious competitors. In other words, when the only method of controlling a system is digital, hackers have a way to assume 100% control. Going analog—introducing human and physical “backstops”—provides our best defense against network-based remote control. 

For example, commercial and private aircraft should be equipped with an “override” analog system that allows the pilot to disconnect the plane in the event of an attack and control it manually. The same is true for gas and electric utilities, traffic systems, hospitals and maybe even corporate computer networks. 

The U.S. Navy was an early adopter of the human solution, bringing back celestial navigation training in 2015. The move to train recruits and officers in the ancient art of navigating by the stars was prompted in part by fears that the Global Positioning System (GPS) satellites could be shot down, or the system simply hacked or jammed. It was a prudent decision, given that cheap GPS jammers can easily be found online.

Meanwhile, that same year, the Ukranian power grid was digitally attacked by Russia—leaving 225,000 customers in the dark. Grid operators on the ground were able to physically override digital systems to get the power back on in a reasonable time. 

These two examples illustrate a key point: Just because systems or techniques were used in the “old days” or aren’t connected to the internet, doesn’t mean we should exclude them as part of the security equation. We haven’t given up seatbelts just because smart cars automatically brake to prevent a collision. We should apply that same “both/and” logic to cybersecurity: The solutions can and should be both technological and human, digital and physical, internet-connected and old school. 

That’s the thinking behind the Securing Energy Infrastructure Act (SEIA), introduced in the Senate in 2016 (following the Ukranian attack). 

The press release announcing the Senate’s passage of the SEIA earlier this summer stated that the act aims to remove vulnerabilities that could allow hackers digital access to the energy grid, and “replace automated systems with low-tech redundancies, like manual procedures controlled by human operators.” SEIA is currently being considered in the House as part of the National Defense Authorization Act for Fiscal Year 2020. If it passes, a two-year pilot program will be set up to identify vulnerabilities and test analog solutions. 

While the SEIA winds its way through Congress, the private sector is already implementing analog solutions. In my work with defense contractors, I’ve seen entire computer systems taken permanently offline to keep them out of reach of remote foreign actors (to avoid situations such as China’s theft of Lockheed Martin’s plans for the F-35 fighter jet). This technique, known as air-gapping is not perfect, but it does make digital espionage more difficult. Similarly, classified communications often take place face-to-face—even when it requires travel to meet in person—and I’ve been in highly confidential meetings where the chosen “recording” devices were a whiteboard, dry-erase markers and the human brain. 

Many corporations are limiting what data they digitize in the first place, selectively opting to archive paper documents and records with physical locks rather than risk a remote hack. I’ve worked with several food-industry clients that have taken their recipe for the “secret sauce” completely offline, choosing to protect their intellectual property using nondigital means. It’s exponentially harder to gain access into a confidential physical location—especially when access is limited to a small group of trusted users. 

Even small businesses can benefit by taking key systems offline overnight, when a majority of successful hack attempts take place. Imagine the lawyer, dentist or doctor that eliminates more than 50% of all hacking attempts simply by shutting down their internet connection before they leave the office. This doesn’t work if employees are working remotely or data backups take place overnight, but many smaller businesses go offline at closing time. 

I’m not saying that all data should be handled this way or that (God forbid) we return to rotary phones—in fact, I’m a believer in the positive power of big data and the smart use of technology to drive progress and innovation. However, in the absence of a 100% foolproof method of protecting the digital systems that we rely on—including those responsible for our safety and security—we need to add analog protection on a selective, well-planned basis.

True innovation isn’t just adopting the latest technology. It’s also knowing how to beat it.

About Cybersecurity Keynote Speaker John Sileo

John Sileo is the founder and CEO of The Sileo Group, a privacy and cybersecurity think tank, in Lakewood, Colorado, and an award-winning author, keynote speaker, and expert on technology, cybersecurity and tech/life balance.

Top Cybersecurity Trends 2020 & the Perils of Prediction

 

(i.e., Cybercriminals read the same articles as cybersecurity experts)

Oh how we love to predict the future. Who will win the next Super Bowl, Presidential Election, or Best in Show Pooch-a-thon following the Macy’s Day Parade? I’m frequently asked as a cybersecurity expert to peer into my somewhat cloudy crystal ball and give opinions on what cybersecurity trends the criminals have in store for us. It’s so common at this time of year that I’m thinking of setting up a Fantasy Hacker League to take advantage of our love of betting on things that haven’t yet happened. 

Ironically, cybercriminals read the same predictive articles that we do, but they take notes. And then, innovative as they are, run in the complete opposite direction. Here’s a peek into the cheeto-soaked (that’s a false stereotype by the way – these criminals have PHDs) and highly brilliant minds of organized cybercriminals: “If a CEO is reading this same predictive article on how bad Ransomware is going to be in 2020, and that advice serves as the basis for her decision to over-fund anti-ransomware countermeasures, I, smart hacker that I am, will trade my pick on Ransomware in 2020 and browse the “Insider Theft” section of the cybercrime-gamblers catalog.” 

Unlike football (or dog shows), where the outcome is not influenced by predictions, cyberthreats often become trends because no one has predicted them yet. And by the time they do, the smart criminals have moved onto something new. 

But this isn’t always true, and we still do need to prepare for what is coming, which is why, in the spirit of the season, I can predict with almost perfect accuracy, the Top Cybersecurity Trends for 2020 that will affect the average organization. 

Top Cybersecurity Trends 2020 – The average organization will CONTINUE to…

  • Treat cyber risk as an overwhelming tech puzzle rather than a solvable business issue
  • Fail to budget appropriate funds to train the humans that misuse the technology
  • Give hackers easy access to the crown jewels by allowing pet names as passwords (see graphic)
  • Shut down for weeks or pay the ransom due to system backups that “just won’t restore”
  • Spend inordinate amounts of cash to protect “all the data” instead of “the right data”
  • Lose more data to incompetence, human error and malicious insiders than to hackers
  • Live in a Fantasy League where “something like this” can’t happen to “someone like them”

Why can I predict these and other trends so accurately? Because they have been trending for the past ten years and show no signs of stopping. The good news is that everything in this list is eminently solvable if you dedicate the appropriate time, budget and leadership focus. While you are taking action on the above items, don’t forget to consider the Top 2020 Cybersecurity Trends, Part II.

Top Cybersecurity Trends 2020 (What You Were Actually Looking For)

The Internet of Things and Ransomware Will Get Married. Instead of just freezing an organizations’ computers, ransomware will burrow it’s way into WiFi-connected refrigerators, industrial control systems, operational sensors and monitors, pace-makers, emergency room equipment, traffic lights and anything connected to the internet. It will then freeze the operation of the device and ultimately will demand that you pay a sizeable ransom to (maybe) get your nuclear power plant back online. 

Leading Organizations Will Discover a Centuries-Old Cybersecurity Tool: Going Analog Once information or operational systems are digitized, they are vulnerable to attack by remote forces—including hostile nation states, organized crime and malicious competitors. In other words, when the only method of controlling a system is digital, hackers have a way to assume 100% control. Going analog—introducing human and physical “backstops” into your security supply chain—provides the best defense against network-based remote control takeover. We will see traditional analog systems (paper ballots) increase security in the 2020 Presidential Election, better protect the electric grid (manual on/off switches) and decrease the chance of hacked naval navigation (sextants). 

Data Manipulation Will Challenge Financial Gain For Top Cybercrime Honors 

Data manipulation is unique among cybercrimes because it’s not about taking the information — it’s about altering the data. The information generally never leaves the owner’s servers, so the criminal raises no red flags that something is amiss. This makes it much harder to catch, and it can be much more destructive. Think maliciously altering flight plans with air traffic controllers, altering bank account balances, or appending your criminal record with fictitious arrests. Every one of us takes data integrity for granted, except for cybercriminals, who will use that bias against us. Think of data manipulation as a virus that invades the body and alters its fundamental DNA. The damage is done quietly, and you may never know it happened.

A.I. Won’t Take Over the World, But it Will Follow Malicious Instructions Like a Robot

Right now, artificial intelligence is more human than we think. From my experience peering under the hood of AI-enabled technology like smart TVs, digital assistants and end-point cybersecurity products, I’m constantly amazed by how much human input and monitoring is necessary to make them “smart.” But that is changing as machine learning progresses. We tend to focus on AI taking over the world (thanks to the movies), but it’s not that we need to fear. It’s AI in the hands of would-be dictators and cybercriminals. Fathom, for a moment, Darth Vader, Hitler or a cyberterrorist in charge of an army of robots that always obey their leader’s command. As always, there is the positive side of the technology, and AI will be used to detect malicious attacks and defend the data on which our economy runs. 

To help you get ahead of these topics, I will be writing at length and speaking on all of the above trends (and more) in 2020. Please check back here often, or connect with me to get our latest news on Facebook, Twitter or YouTube. In the meantime, resist the trend to let fear paralyze you in taking action on cybersecurity.  

 

About Cybersecurity Keynote Speaker John Sileo

John Sileo is the founder and CEO of The Sileo Group, a cybersecurity think tank, in Lakewood, Colorado, and an award-winning author, keynote speaker and expert on intentional technology, cybersecurity and data privacy.

How to Turbocharge your Cybersecurity Awareness Training

Security awareness training can’t be a boring afterthought if it’s going to work. 

Own it. Secure it. Protect it. 

Those are the key themes for this year’s National Cybersecurity Awareness Month, coming up in October, and it’s good advice. Unfortunately, it’s the same message your trainees have been hearing for years and, at this point, they’ve largely tuned it out.

The challenge isn’t creating a pithy slogan. It’s turning advice into action and an enduring “culture of security.” At this point, cybersecurity is on the radar for most companies, and the smart ones make it a priority. To achieve their cybersecurity goals, many organizations implement security awareness training sessions, which seek to educate the rank and file on threats and how to thwart them. When done well, these initiatives can be a way to focus the entire organization — and can greatly reduce the risk of data breach, cyberextortion or damaging disinformation campaigns.

When not done well, you’ll be lucky if your team remembers the words cybersecurity awareness as they shuffle out the door — no doubt refreshed after scrolling through Facebook or watching the latest Taylor Swift video.

The problem is that many security programs are actually less than the sum of their parts for the simple reason that they don’t have an overarching end goal. Sure, the objective is to educate your team on emerging threats so your company is more secure, but that’s a nebulous goal. And because it’s a nebulous goal lacking tangible motivation, your team doesn’t buy in. 

That’s not to say they don’t care about the company’s security. Of course they do — but it’s not personal. 

Unfortunately, when it comes to cybersecurity in the corporate sector, the human element is usually overlooked. This is a mistake. I often hear companies refer to humans as the “weakest link” in cybersecurity, which of course becomes a self-fulfilling prophecy. Enlightened organizations understand that security is a highly effective competitive differentiator (think Apple) and that humans, when properly trained, are the strongest defense against cyberthreats. Consequently, an effective program must start by getting people — from the top down — invested in the goal and the process. 

I’ve been the opening keynote speaker for hundreds of security awareness programs around the world, many of them outside the bounds of National Cybersecurity Awareness Month, and most of them leave me hungering for more: More engagement, more interaction and more actionable information. In short, more substance. 

Here are a few tips for designing a cybersecurity awareness program that will engage your team and get results.

Ownership

Don’t focus on the CISO, CRO, CIO or CTO. That would just be preaching to the choir. The missing but crucial link in cybersecurity awareness programs tends to be a security “believer” from the executive team or board of directors. Successful programs are clearly led, repeatedly broadcast and constantly emphasized from the very top of the organization — with an attitude of authenticity and immediacy. Whether it’s your CEO at an annual gathering or a board member kicking off National Cybersecurity Awareness Month, your security champion must not only become an evangelist but also have the authority and budget to implement change.

Strategy

Approach your program strategically, and devise a plan to protect your intellectual property, critical data and return on information assets. You’re competing for resources, so build a compelling business case that demonstrates the organization’s ROI in business terms, not buried in technobabble. 

  • What did it cost your competitor when ransomware froze its operation for a week? (e.g., FedEx: $300 million)
  • How much would the training have cost to avoid the CEO whaling scheme that lost a similar-sized company millions of dollars? 
  • What do the directors of compliance, HR and IT have to add to the defense equation? 

The most successful cybersecurity awareness programs have a budget, a staff (however small) and cross-departmental support. Involve the business team and other stakeholders up front to leverage their expertise before rollout.

Methodology

Here’s a litmus test for the potential effectiveness of your security awareness program: Does it begin by focusing on the critical information assets and devices inside of your organization? If so, it’s probably doomed. Why? Because your employees are human beings, and they want to know how this affects them personally before they invest time to protect the organization’s coffers. 

Excellent security awareness kicks off by making data protection personal — building ownership before education. From there, the training must be engaging (dare I say fun?) and interactive (live social engineering) so your audience members pay attention and apply what they learn. Death-by-PowerPoint will put behavioral change to sleep permanently. Highly effective programs build a foundational security reflex (proactive skepticism) and are interesting enough to compete against cute puppy videos and our undying desire for a conference-room snooze.

Sustenance

Best practice security awareness training, like a five-course meal, doesn’t end with the appetizer. Yes, kickoff is best achieved with a high-energy, personally relevant, in-person presentation that communicates the emotional and financial consequences of data loss — but that’s only the beginning. 

From there, your team needs consistent, entertaining follow-up education to keep the fire alive. For example, we’ve found short, funny, casual video tips on the latest cyberthreats to be highly effective (once your team takes ownership for their own data, and yours). Then, add lunch workshops on protecting personal devices, incentive programs for safe behavior, and so on. Culture matures by feeding it consistently.

Measurement

If you don’t measure your progress (and actually demonstrate some), no one will fund next year’s training budget. Here are a few questions I ask when facilitating board retreats on cybersecurity: 

  • What are your cybersecurity awareness training KPIs, your key metrics? 
  • How did successful phishing or social engineering attacks decline as a byproduct of your program? 
  • Has user awareness of threats, policy and solutions increased? 
  • How many employees showed up for the Cybersecurity Awareness Month keynote and fair? 
  • Do your events help employees protect their own data as well?
  • How department-specific are your training modules? 

When you can show quantitative progress, you’ll have the backing to continue building your qualitative culture of security.

Over the long term, a culture of security that reinvents itself as cyberthreats evolve will be far less costly than a disastrous cybercrime that lands your company on the front page. National Cybersecurity Awareness Month is a great catalyst to get your organization thinking about its cybersecurity strategy. Now it’s time to take action.

About Cybersecurity Author & Expert John Sileo

John Sileo is an award-winning author and Hall of Fame Speaker who specializes in providing security awareness training that’s as entertaining as it is educational. John energizes conferences, corporate trainings and main-stage events by interacting with the audience throughout his presentations. His clients include the Pentagon, Schwab and organizations of all sizes. John got started in cybersecurity when he lost everything, including his $2 million business, to cybercrime. Since then, he has shared his experiences on 60 Minutes, Anderson Cooper, and even while cooking meatballs with Rachel Ray. Contact John directly to see how he can customize his presentations to your audience.

Deepfakes: When Seeing May Not Be Believing

 

How deepfake videos can undermine our elections, the stock markets and our belief in truth itself

Last weekend, attendees at a conference in Las Vegas got quite a surprise. They were waiting for a presentation by Democratic National Committee Chairman Tom Perez and, instead saw his image on a big screen via Skype. During his brief video appearance, the chairman apologized that he was unable to be there in person. In fact, the voice coming out of Perez’s mouth was DNC’s chief security officer Bob Lord and the audience had just been treated to a deepfake video — video that’s been manipulated to make it look like people say or do things they actually didn’t.

The video was shown in the AI Village at DEFCON — one of the world’s largest hacker conventions — to demonstrate the threat deepfakes pose to the 2020 election and beyond. It was made with the cooperation of the DNC; Artificial Intelligence (AI) experts altered Perez’s face to make it look as if he were apologizing, and Lord supplied his voice. 

Watch carefully as Bill Hader turns into Seth Rogan & Tom Cruise!

https://www.youtube.com/watch?v=VWrhRBb-1Ig’ format=’16-9′ width=’16’ height=’9′ custom_class=” av_uid=’av-mobzww’

[For a CNN video primer on deepfakes, click here.]

Remember when Forrest Gump shook hands and spoke with Presidents Kennedy and Nixon? That was an early example of a deepfake video. More recently, and less innocuous, was a video of House Speaker Nancy Pelosi, altered to make it appear that she was drunk and slurring her words. The video went viral and was viewed more than 3 million times. For some viewers, it confirmed their disdain for Nancy Pelosi; for others, it simply confirmed that they can’t trust the other side of the political spectrum. It’s troubling that neither of these reactions is based in fact.

In the 25 years since Forrest Gump introduced manipulated video, sophisticated AI has been developed to create nearly undetectable deepfakes. Not only has the technology improved, but the nefarious uses have proliferated. Take deepfake porn, where a victim’s face is superimposed on the body of a porn actor. It’s often used as a weapon against women.  Actress Scarlett Johansson, whose face was grafted onto dozens of pornographic scenes using free online AI software, is one famous example, but it happens to ordinary women, too. Just for a second, imagine your daughter or son, husband or wife being targeted by deepfake porn to destroy their reputation or settle an old score. As the technology becomes less expensive and more available, that is what we face.

Until recently, the warnings about deepfakes in the U.S. have focused on political ramifications, most notably their expected use in the 2020 election. Imagine a doctored video of a candidate saying they’re changing their position on gun control, for example. In June, during a House Intelligence Committee hearing on the issue, experts warned that there are multiple risks, including to national security: What if our enemies post a video of President Trump saying he’s just launched nuclear weapons at Russia or North Korea? 

The business community and financial markets may also be targeted. A video of Jeff Bezos warning of low quarterly Amazon results could cause a sell-off of Amazon stock, for instance. Bezos has the platform to quickly respond, but by the time he’s corrected the record, real damage could be done. Similarly, CEOs of lesser-known companies could be targeted, say the night before an IPO or new product launch. 

There’s currently a kind of arms race occurring between those developing deepfake technology and those developing ways to detect the altered videos — and the good guys are losing. 

In an interview with The Washington Post in June, Hany Farid, a computer science professor and digital forensics expert at the University of California at Berkeley said, “We are outgunned. The number of people working on the video-synthesis side, as opposed to the detector side, is 100 to 1.”

Soon, we may all be awash in deepfake video, unable to detect truth from fiction, and this is perhaps the most worrying aspect. We already live in an age where more than half the U.S. population distrusts the media, the government and their neighbors, and belief in conspiracy theories is on the rise. A staggering one in 10 Americans don’t believe we landed on the moon — 18% of the nonbelievers are between the ages of 18 and 34 — and a 2018 poll found that one-third of Americans don’t believe that 6 million Jews were murdered in the Holocaust. That’s to say nothing of the people worldwide who deny the Holocaust ever happened. 

Historically, the best way to refute conspiracy theorists has been video proof. The countless hours of footage of the Allies liberating concentration camps, the 9/11 attacks and that grainy film of Neil Armstrong planting the American flag on the moon couldn’t be denied. Until now. 

In a statement, the House Intelligence Committee said, “Deep fakes raise profound questions about national security and democratic governance, with individuals and voters no longer able to trust their own eyes or ears when assessing the authenticity of what they see on their screens.”

In other words, we’re entering an age when seeing is no longer believing. 

This is all part of a larger movement where technology is used to erode trust, and in the hands of foreign enemies like Russia, it can and will be used to undermine our belief in the free press, in our leadership and in democracy. It is essentially the use of the First Amendment to undermine the First Amendment, and unethical corporations and cyber criminals will hop on board as soon as the AI technology is affordable to the mass market.

So where is the hope in all of this? Unlike our weak regulatory response to the malicious tools that have come before — from viruses to spyware, botnets to ransomware — we must combine comprehensive legislative oversight and control with the ethical use of technology to proactively minimize the problem before it becomes mainstream. Our senators and representatives must take the lead in setting standards for how AI technology, including technology to produce deepfakes, is released, utilized and policed. 

Bruce Schneier’s book, “Click Here to Kill Everybody,” includes an excellent primer on the regulatory framework that would start us down the path. We, as voters, must directly express our concern to congressional leadership and urge them to act before a proliferation of deepfake videos destroys reputations — along with our ability to believe our own eyes.

About Cybersecurity Keynote Speaker John Sileo

John Sileo is an award-winning author and keynote speaker on cybersecurity, identity theft and tech/life balance. He energizes conferences, corporate trainings and main-stage events by making security fun and engaging. His clients include the Pentagon, Schwab and organizations of all sizes. John got started in cybersecurity when he lost everything, including his $2 million business, to cybercrime. Since then, he has shared his experiences on 60 Minutes, Anderson Cooper, and even while cooking meatballs with Rachel Ray. Contact John directly to see how he can customize his presentations to your audience.

[elfsight_social_share_buttons id=”1″]