The Electoral Commission has admitted it failed a cybersecurity test in the same year hackers successfully attacked the organisation.

The UK’s elections watchdog said it did not pass a Cyber Essentials test, a voluntary government-backed scheme that assesses an organisation’s readiness against cyber-attacks.

The commission said it failed the test in 2021, when it was breached by an unknown assailant.

The organisation revealed last month that it had been the subject of a “complex cyber-attack” that resulted in hackers accessing reference copies of the electoral registers, equating to the names and addresses of 40 million people. It said the attack started in August 2021 but was not detected until October 2022.

The commission said it did not pass the test due to two issues unrelated to the hack: an earlier version of Windows software on some laptops and a dated version of staff mobiles. It said those problems were not linked to the attack, which affected the organisation’s email servers.

“We are always working to improve our cybersecurity and systems. We draw on the expertise of the National Cyber Security Centre – as many public bodies do – to continue to develop and progress protections against cyber-threats. We regularly seek guidance and feedback on our systems to deal with the continued risk of cyber-threats as they evolve and take different forms. We welcome these learnings and act on them,” said an Electoral Commission spokesperson.

Sign up to First Edition

Our morning email breaks down the key stories of the day, telling you what’s happening and why it matters

after newsletter promotion

The Cyber Essentials website states that the scheme is important because vulnerability to basic attacks marks organisations out as targets for “more in-depth unwanted attention from cyber criminals and others”.

In March 2022, the Securities and Exchange Commission (SEC) proposed a rule on cybersecurity disclosure, governance, and risk management for public companies, known as the Proposed Rule for Public Companies (PRPC). This rule would require companies to report “material” cybersecurity incidents within four days. It would also require that boards of directors have cybersecurity expertise.

Unsurprisingly, it’s being met with all sorts of pushback. In its current form, the proposed rule leaves a lot of room for interpretation, and it’s impractical in some areas.

For one, the tight disclosure window will put massive amounts of pressure on chief information security officers (CISOs) to disclose material incidents before they have all the details. Incidents can take weeks and sometimes months to understand and fully remediate. It is impossible to know the impact of a new vulnerability until ample resources are dedicated to remediation. CISOs may also end up having to disclose vulnerabilities that, with more time, end up being less of an issue and therefore not material. That, could in turn affect the short-term price of a company.

Incidents Are a Living Thing — Not a One-and-Done Deal

Four-day disclosure requirements might sound fine at face value. But they are not realistic and will ultimately distract CISOs from putting out fires.

I’ll use the European Union’s General Data Protection Regulation (GDPR) as a comparison. Under the regulation, companies must report incidents of non-compliance within 72 hours. However, In the case of GDPR, the need to report is well-defined. While 72 hours is often too soon to know the specifics of an incident’s overall impact, organizations at the very least will know if personal information has been compromised.

Compare this with the PRPC’s proposed disclosure requirements. Organizations will have an extra 24 hours, but — based on what’s been publicized thus far — they must qualify internally if the breach is material. Under GDPR, a company can do that based on the sensitivity of the data, its volume, and where it went. Under PRPC, “materiality” is defined by the SEC as anything that a “reasonable shareholder would consider important.” This could be virtually anything shareholders consider material to their business. It’s rather broad and not clearly defined.

Other Weak Definitions

Another issue is the proposal’s requirement to disclose circumstances in which a security incident was not material on its own but has become so “in aggregate.” How does this work in practice? Is an unpatched vulnerability from six months ago now in scope for disclosure (given that the company didn’t patch it) if it’s used to extend the scope of a subsequent incident? We already conflate threats, vulnerabilities, and business impact. A vulnerability that isn’t exploited isn’t material because it doesn’t create a business impact. What will you need to disclose when aggregate incidents need to be reported, and does the aggregation clause make this even harder to discern?

To make this more complicated, the proposed rule will require organizations to disclose any policy changes that resulted from previous incidents. How rigorously will this be measured and, honestly, why do it? Policies are supposed to be statements of intent — they’re not supposed to be low-level, forensic configuration guides. Updating a lower-level document (a standard) to mandate a specific encryption algorithm for sensitive data makes sense, but there are few higher-level docs that would be updated due to an incident. Examples might be requiring multifactor authentication or changing the patching service-level agreement (SLA) for in-scope critical vulnerabilities.

Lastly, the proposal says quarterly earnings reports will be the forum for disclosures. Personally, quarterly earnings calls don’t seem like the right forum to go deep on policy updates and security incidents. Who will give the updates? The CFO or CEO, who typically provides earnings reports, might not be sufficiently informed to give those critical reports. So, does the CISO now join the calls? And, if so, will they also respond to questions from financial analysts? It all seems impractical, but we’ll have to wait and see.

Questions About Board Experience

The first iteration of PRPC required disclosures about board oversight of cybersecurity risk management policies. This included disclosures about the individual board members and their respective cyber expertise. The SEC says it purposefully kept the definition broad, given the range in skill and experience particular to each board.

Luckily, after much scrutiny, they decided to remove this requirement. PRPC does still call for companies to describe the board’s process for overseeing cybersecurity risks, and management’s role in handling those risks.

This will require some adjustments in communication and general awareness. Recently, Dr. Keri Pearlson, executive director of cybersecurity at MIT Sloan, and Lucia Milică, CISO at Stanley Black & Decker, surveyed 600 board members about activities surrounding cybersecurity. They found that “fewer than half (47%) of members serve on boards that interact with their CISOs regularly, and almost a third of them only see their CISOs at board presentations.” This clearly points to a communications gap.

The good news is most boards already have an audit and risk committee, which can serve as a subset of the board for this purpose. That said, it’s not uncommon for CISOs and CSOs to present matters involving cybersecurity that the rest of the board doesn’t fully understand. To close this gap, there needs to be greater alignment between the board and security executives.

Uncertainty Prevails

As with any new regulation, there are questions and uncertainties with PRPC. We’ll just have to wait and see how it all evolves and whether companies can meet the proposed requirements.

August 28, 2023- WASHINGTON – The National Cybersecurity Alliance (NCA) today announced it has received a significant boost in funding from Craig Newmark Philanthropies. The $200,000 grant will support ongoing initiatives within NCA’s Historically Black Colleges and Universities (HBCU) Cybersecurity Career, Mentoring, and Scholarship Program, as students return to school.

Launched in 2022, the ‘See Yourself In Cyber’ HBCU Career Program equips students with the necessary skills to navigate the search process for positions in security and builds a pipeline to black cybersecurity talent. The program provides HBCU students access to ongoing mentorship opportunities, on-campus career events featuring keynotes, panels and workshops, and a recently launched scholarship program to ensure equitable access and advancements within the cybersecurity and tech careers. 

“We extend our heartfelt appreciation to Craig Newmark Philanthropies for their generous support,” stated Lisa Plaggemier, Executive Director of the National Cybersecurity Alliance. “This funding will enable us to expand the ‘See Yourself in Cyber’ Program, empowering students from underrepresented backgrounds to break into and excel in the rapidly evolving cybersecurity sector.”

NCA will use the grant to bolster its 2023-2024 program with strategic investments in guest lecturers and curriculum development; student training, certification, and job placement; and developing real-world experiences via internship opportunities. In addition, a portion of the grant will be committed to producing virtual events, amplifying the programs’ overall reach and impact. 

“I am proud to support the National Cybersecurity Alliance in their mission to empower underrepresented students with the tools and opportunities to succeed in the cybersecurity field,” said Craig Newmark, founder of Craig Newmark Philanthropies and craigslist. “This program exemplifies the positive impact that education and mentorship can have on building a diverse and skilled workforce.”

In the last year, ‘See Yourself in Cyber’ has made remarkable strides toward fostering education, engagement, and mentorship for HBCU students. Through generous donations from organizations like Craig Newmark Philanthropies, the program will continue to expand its role in addressing the critical shortage of cybersecurity professionals while championing diversity and inclusivity.

To stay updated on the ‘See Yourself in Cyber’ HBCU Cybersecurity Career, Mentoring, and Scholarship Program and learn more about the National Cybersecurity Alliance, please visit NCA’s official website.

To learn more about our valued partners and how to become a sponsor, please visit NCA’s HBCU Cybersecurity Career Program webpage.

About National Cybersecurity Alliance

The National Cybersecurity Alliance is a non-profit organization on a mission to create a more secure,interconnected world. We advocate for the safe use of all technology and educate everyone on how best to protect ourselves, our families, and our organizations from cybercrime. We create strong partnerships between governments and corporations to amplify our message and to foster a greater “digital” good. National Cybersecurity Alliance’s core efforts include Cybersecurity Awareness Month (October); Data Privacy Day (Jan. 28); and CyberSecure My Business™, which offers webinars, web resources and workshops to help businesses be resistant to and resilient from cyberattacks. For more information, please visit https://staysafeonline.org.

About Craig Newmark Philanthropies

Craig Newmark is a Web pioneer, philanthropist, and leading advocate. Most commonly known for founding the online classified ads service craigslist, Newmark works to support and connect people and drive broad civic engagement. In 2016, he founded Craig Newmark Philanthropies to help and protect the people who protect our country. At its core, all of Newmark’s philanthropic work helps to strengthen American democracy by supporting the values that the country aspires to – fairness, opportunity, and respect. For more information, please visit: CraigNewmarkPhilanthropies.org. Craig can be found sharing his personal perspective on the issues of the day at @craignewmark.

Hackers have developed a sneaky new tactic to push malware onto your phone and snoop on your conversations. Researchers at the cybersecurity firm ESET found fake apps in the Google and Samsung app stores that posed as extensions or premium versions of the popular messaging platforms Signal and Telegram designed to steal user data. 

The malicious apps, called Signal Plus Messenger and FlyGram, could pull sensitive information from legitimate Signal and Telegram accounts, including call logs, SMS messages, locations and more, when users took certain actions.

Here’s how it works: Signal and Telegram enable users to link the mobile app to their other devices, such as their desktop or one of the best tablets. These malicious apps leverage this feature to automatically connect a compromised device to the attacker’s Signal, allowing them to spy on their communications while the user is none the wiser. 

Google and Samsung have removed both apps from their respective app stores, but not before they racked up thousands of downloads. Signal Plus Messenger went live on the Play Store in July 2022 and was downloaded roughly 100 times before Google took it down in April in response to a tip from ESET, according to a report from The Hacker News. An app called FlyGram received 5,000 downloads after launching on the Play Store in June 2020 before its removal the next year. 

How to protect your Android phone

That the discovery of this stealthy “auto-linking” capability has largely gone unnoticed until now is particularly concerning. If you have either Signal Plus Messenger and FlyGram downloaded on your Android phone, you should uninstall them immediately. To keep your phone safe moving forward, it’s important to download only the legitimate versions of Signal and Telegram, as well as periodically check Settings > Linked Devices to make sure no unrecognized devices pop up.

This campaign marks an unprecedented attempt to snoop on some of the most popular messaging apps in the world. Both malicious apps were built on open-source code available from Signal and Telegram. Within that code, hackers stealthily wove in the espionage tool tracked as BadBazaar, a Trojan used in previous attacks targeting Uyghurs and other Turkic ethnic minorities. ESET told the outlet it suspects the China-aligned hacking group known as GREF is behind the campaign.

“BadBazaar’s main purpose is to exfiltrate device information, the contact list, call logs, and the list of installed apps, and to conduct espionage on Signal messages by secretly linking the victim’s Signal Plus Messenger app to the attacker’s device,” security researcher Lukáš Štefanko said in an interview with The Hacker News.

In a statement to Forbes this week, Signal president Meredith Whittaker said the company was “deeply concerned for anyone who trusted and downloaded this app.” She praised Google for removing “this pernicious malware masquerading as Signal off their platform,” and urged Samsung to follow suit, which it has since.

DALLAS, Aug. 29, 2023 /PRNewswire-PRWeb/ — Everest Group is calling on enterprises to make the critical shift in focus from cybersecurity to cyber resilience. While cybersecurity focuses on safeguarding against threats, cyber resilience emphasizes the ability to withstand, respond and recover quickly from them.

Everest Group issues this call to action in its recently published “State of the Market Report” on cybersecurity services. The report focuses on differentiating cybersecurity from cyber resilience, emphasizing that these two concepts are often mistakenly considered synonymous in the business world.

“Cybersecurity is just one component of cyber resilience, but, unfortunately, many enterprises fail to understand the subtle difference,” said Kumar Avijit, practice director of Information Technology Services at Everest Group. “While a majority of C-suite executives concentrate on preventive controls and response, equal importance needs to be allocated to the recovery, revamp, and reinforcement stages of cyber resilience. For any business, having a comprehensive cyber resilience strategy is critical in safeguarding long-term viability and success.”

Everest Group rates current C-suite focus on the “5 Rs of cyber resilience” as follows:

These findings and more are detailed in Everest Group’s recently published report, “Cybersecurity Services State of the Market Report 2023: Cyber Secure to Cyber Resilient.” Download a complimentary abstract here.

The report provides an in-depth analysis of the global cybersecurity market, with special sections on North America and Europe. In addition, the report introduces a unique and easily understandable framework to assist enterprises, particularly the C-suite, in swiftly incorporating cyber resilience into their operations. Additionally, the report explores the implications for providers in key areas such as solutions, services, partnerships, talent, and engagement models, illustrating how they can enable enterprises to adopt cyber resilience.

Selected Highlights:

About Everest Group 

Everest Group is a leading research firm helping business leaders make confident decisions. We guide clients through today’s market challenges and strengthen their strategies by applying contextualized problem-solving to their unique situations. This drives maximized operational and financial performance and transformative experiences. Our deep expertise and tenacious research focused on technology, business processes, and engineering through the lenses of talent, sustainability, and sourcing delivers precise and action-oriented guidance. Find further details and in-depth content at http://www.everestgrp.com.