Could IS Create A Cyber War?

The power is out. Gas stations are out of gas. Factories are going haywire. It sounds like an action movie, but some analysts say that US and western industries need to significantly ramp up their cyber security or risk having the Islamic State (IS) hack, attack and create mayhem inside their systems.

"This is definitely a threat to the US government and other western governments, but also to our industrial control systems, the ones that run our manufacturing plants, moving energy across the country, that have vulnerabilities," said Bob Gourley, the former chief technology officer of the Defense Intelligence Agency.

Unlike cyberattacks by Russia and China, Gourley said, groups like IS are less interested in just extracting information and more interested in disrupting essential systems.

As yet, he added, IS militants are not as capable as some criminal networks or rival nations, "but IS has more capabilities that any other terrorist organization that I know of. And they can gain more."

So far, IS has established itself as a leader in using Internet-based communications and social media to both send encrypted information and recruit thousands of people from more than 80 countries around the world.
"We are in a new age of this threat," Gourley said, "and the most important thing is we need to defend our systems better than they are currently being defended."

Clifton Triplett, recently named the Office of Personnel Management's senior cyber and information technology adviser, said he is already working to limit any kind of IS breach into the government department. "I think what I have to do is … assume that, at some point in time, they may be successful," Triplett said at a conference organised by Bloomberg Government. "So how do I minimize the impact of their success? Right now, that really comes into access control."

OPM suffered a major hack earlier in 2015, resulting in the disclosure of private information of some 21.5 million people, including those who applied for security clearances.

Anticipating IS
But Al Berman, president and CEO of Disaster Recovery Institute International, which covers IT disasters, said it would be dangerous to assume that IS would stop at communication and marketing.
 
This screen grab from an Islamic State group-affiliated Twitter account, taken Sept. 20, 2014, purports to show a military commander handing a flower to a child while visiting southern Iraq

One path of attack that IS could take, Berman said, would be to siphon money from institutions — perhaps in the US, perhaps in the Middle East — in order to increase their funding as the extremist group's oil and tax money streams start drying up. "Money is incredibly important, and they will find other means if we shut down their traditional means," Berman said. And IS does not have to do the hacking itself, it just needs to buy the information from hacking-obtained information auctions on the dark web.
Berman said IS could start to further refine their "social engineering" or "emotional marketing" techniques, basically by using the Internet in more sophisticated ways to track down and entice potential young recruits.

Vulnerable universities
For that, IS could hack into universities or buy information on the dark web from universities that have already been hacked. According to Privacy Rights Clearinghouse, a California-based nonprofit that focuses on privacy protection, in the last five years hackers have accessed more than 2.5 million records from colleges and universities in the United States alone.

John Matherly, founder of Shodan, a search engine for Internet-connected devices, said exploiting student information would be far more likely than an IS attack on a facility such as a water treatment plant.

"Universities and educational institutions tend to have the worst security by far because they have these giant IP ranges. So students use a public IP address that anyone can see, and everything is exposed," Matherly said.

But hackers such as IS do not have to be sophisticated to be damaging, Matherly said. Unpatched web-servers, unprotected utility software accounts, individuals not keeping up with security updates, and even Instagram accounts could be easily attacked.

Ein News:

 

« Understanding the Threat Intelligence Lifecycle
The Secure Perimeter Cybersecurity Model Is Broken »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

European Internet Forum (EIF)

European Internet Forum (EIF)

EIF’s mission is to help provide European political leadership for the political, economic and social challenges of the worldwide digital transformation.

CW Jobs

CW Jobs

CWJobs.co.uk is a leading specialist IT recruitment website covering all areas of IT including Cyber Security.

Cyberlytic

Cyberlytic

Cyberlytic applies artificial intelligence to combat the most sophisticated of web application threats, addressing the growing problem of high volumes of threat data.

LogmeOnce

LogmeOnce

LogmeOnce provides users with solution to multiple Password problems, Single Sign-On (SSO), and Identity Management.

Norwegian Information Security laboratory (NISlab)

Norwegian Information Security laboratory (NISlab)

NISlab conducts international competitive research in information and cyber security and operates study programs in this area.

Convercent

Convercent

We offer comprehensive and integrated compliance management, reporting, and analytics. A 360-degree view of compliance drives efficiency by aligning initiatives and data into a single dashboard.

Acuant

Acuant

Acuant is a leading global provider of identity verification, regulatory compliance (AML/KYC) and digital identity solutions.

Women in CyberSecurity (WiCyS)

Women in CyberSecurity (WiCyS)

Women in CyberSecurity (WiCyS) is a non-profit organization dedicated to the recruitment, retention and advancement of women in the cybersecurity field.

Atlantic Security Conference (AtlSecCon)

Atlantic Security Conference (AtlSecCon)

Atlantic Security Conference is a non-profit, annual, information security conference located in Halifax, Nova Scotia, Canada.

Datacentrix

Datacentrix

Datacentrix provides end-to-end cybersecurity services for the operational technology (OT) and IT environments to monitor, assess and defend our customers' information assets.

Periculus

Periculus

Periculus makes managing digital risk simple. Its integrated platform offers access to purchase cyber insurance and cyber security solutions uniquely tailored to fit the needs of every business.

Concourse Labs

Concourse Labs

Concourse Labs Security Guardrails continuously verify cloud infrastructure and workloads. Continuously assess clouds for security, resiliency, and regulatory compliance.

Davinsi Labs

Davinsi Labs

Davinsi Labs helps companies achieve Digital Service Excellence with specialized Security Intelligence and Service Intelligence solutions.

Orbis Cyber Security

Orbis Cyber Security

Orbis is one of the leading cybersecurity company in USA. Our cybersecurity specialist defends your data, combat threat, and modernize your compliance.

JLS Technology

JLS Technology

Since 2007, JLS Tech has been recognized as one of the world’s most innovative cybersecurity and technology operations leaders.

Custom Computer Specialist (CCS)

Custom Computer Specialist (CCS)

CCS offers an extensive range of services including cybersecurity solutions, consulting, implementation, and support to help our clients maximize the value derived from IT investments.