Our cyber security columnist, Davey Winder, explains why security conversations surrounding connected medical devices are not over yet.

Ive been warning about the Internet of Medical Things (IoT) from the threat-mapping perspective since I first started writing on cybersecurity for Digital Health six years ago.

A lot has changed since 2016 and, sadly, much has stayed the same. On the positive side of the connected-device security landscape fence sits the Product Security and Telecommunications Infrastructure (PSTI) Bill which, as of 23 March 2022, according to the parliamentary bills status site remains at the report stage. Assuming this passes into law before the end of the year, this would prohibit the use of factory set weak default passwords for IoT devices. Thats a really good move. Hop to the other side of the fence and you quickly learn that the PSTI Bill is consumer legislation and wont cover medical devices. OK, lets try and find some positives in that.

Is existing legislation enough?

At the end of last year, I interviewed David Rogers MBE for a Forbes article about the PSTI Bill. Rogers, as well as being CEO of IoT security outfit Copper Horse is also chair of the GSM Association (GSMA) Fraud and Security Group as well as sitting on the executive board of the Internet of Things Security Foundation. Most notably, however, he drafted a set of technical requirements that eventually became what is now the UK Code of Practice for Consumer IoT Security. In other words, hes an IoT security expert of the highest calibre. So, why was he not too concerned about medical devices not being included in the proposed legislation? Rogers spoke to the clear sectoral differences and already existing regulation, particularly in the medical sector, which cover safety aspects and go above and beyond where we are here, and it doesnt seem to make sense to land grab those spaces.

Indeed, the Medicines and Medical Devices Act 2021 was granted Royal Assent last year and built upon the Medical Devices Regulations 2002 to update the regulatory system for medical devices as and when required, according to the Department of Health and Social Care. Whether this actually does ensure an effective system for regulating medical devices remains to be seen. Im skeptical not least because while the Medicines and Healthcare products Regulatory Agency (MHRA) has oversight when it comes to the safety, quality and performance of medical devices, theres a world of difference between measuring clinical effectiveness and potential cybersecurity vulnerability. Im inclined to think that excluding these devices from the PSTI Bill is, actually, regrettable.

Research found 75% of medical IoT devices had known security gaps

As we all know how vulnerable medial IoT devices can be. If you want some examples of what happens when they are, look no further (although this particular research was US-based so it is admittedly a fair way) than a recent study by Unit 42 researchers with Palo Alto Networks of data from 200,000 healthcare network-connected medical infusion pumps that found:

As the NHS urges hospitals to reinforce cybersecurity amid the current international conflict, many in healthcare will remember the devastating effects of the WannaCry ransomware attacks, says Keiron Holyome, VP UK, Ireland, and Middle East, at BlackBerry.

Poorly protected endpoints are a major red flag when it comes to ransomware, a threat that most certainly has not gone away although efforts by NHS Digital and individual trusts have certainly reduced the risk.

To prevent attacks, healthcare organisations must ensure that every device is safe, reliable, secure and safety certifiable, Holyome continues, and that includes IoT-connected medical devices such as ventilators or robotic surgery arms. T

he problem there being, amongst others, that much of this medical device footprint will be legacy-based and cost-issues will prohibit replacement, and patching isnt even doable for many bits of IoT kit.

Are we shouting loudly enough?

This is a very complex conversation, theres no doubt about it, and one that NHS Digital is absolutely engaged in. The latest security guidance for healthcare providers when it comes to procuring and deploying connected medical devices (CMDs) includes legacy devices with inadequate support.

Top of the list of resources is the Data Security and Protection Toolkit (DSPT). At the end of last year this was updated to include a requirement for up-to-date records of such CMDs. While this doesnt solve the problem, there are no silver bullets, it does mean the conversation is being had loud and clear at trusts and providers who understand what DSPT compliance really means. Anything that helps focus attention on this particular piece of an overall security posture gets two thumbs up from me. Is it enough? No, no way.

Allow me to finish where I began, straddling that connected-device security landscape fence. The NHS Digital guidance makes it very clear that the guidance is more applicable to large devices and this represents a gap in the guidance currently available.

The kind of CMD referred to include low-cost and legacy ones where risk-reduction measures are not viable as well as those devices with inflexible supporting network architecture. I have the feeling that both the threats and the conversation will be continuing for some time to come.

Read the original post:
The security conversation on connected medical devices is far from over - Digital Health

Canberra is significantly boosting the cyber capabilities of the Australian Signals Directorate (ASD) the government agency responsible for signals intelligence, support to military operations, cyber warfare and information security. Project Redspice, announced in March, will increase ASDs budget by almost $10 billion over 10 years.

Unfortunately, ASDs 21-page Blueprint offers few insights into how the new money will be spent. In essence, we know only that the organisations staffing will almost double, its persistent cyber hunt activities will expand at the same rate, and its offensive cyber capability will grow even faster; tripling over the same period.

Hardly shy of criticising China, the government remains peculiarly leery of identifying Beijing as the source of constant cyber operations against Australia.

Prime Minister Scott Morrison has explained this move as necessary in order to be prepared for war: the first shot fired in any conflict that Australia might be involved in won't be in a metal casing, it'll be in bits and bytes. According to Defence Minister Peter Dutton, that was most recently demonstrated by offensive cyber activity against Ukraine.

Thats all true, but the cyber threat is more immediate and its coming from China. Hardly shy of criticising China, the government remains peculiarly leery of identifying Beijing as the source of constant cyber operations against Australia. Canberra joined allies to name China as the perpetrator of a Microsoft Exchange hack identified in January 2021, but still generally prefers euphemisms such as state-based actor (or allusions like Redspice).

Canberras focus on a future war is also misleading. Chinas aggressive actions in cyberspace are part of a growing competition short of war in what is often, if unhelpfully, described as the grey zone. Australias goal in this contest is not simply to win cyber battles by having superior offensive capabilities but to prevent cyberspace being transformed into a battlespace.

Australia wants an open and secure global internet in which states behave according to accepted rules. So Canberra must use its growing offensive cyber capability strategically to avoid undermining this greater goal.

Public messaging is an essential part of this strategic approach, not least because the opacity of cyberspace can foster misunderstanding. Clear communication is essential to both deter adversaries and reassure international partners.

There are, of course, limits on what the government can say about the activities its intelligence organisations perform. But in 2016, Australia was among the first countries to reveal its offensive cyber capability. In doing so, then Prime Minister Malcolm Turnbull said this would add a level of deterrence [and] adds to our credibility as we promote norms of good behaviour on the international stage.

ASDs leaders have since then slowly added to the picture. Theyve explained that offensive cyber (which doesnt include reconnaissance or espionage) encompasses anything from sabotage of critical infrastructure down to subtle manipulation of data. ASDs former Director-General Mike Burgess has emphasised that most of the agencys operations are low key: our targets may find their communications dont work at a critical moment rather than being destroyed completely. Burgess and his successor Rachel Noble have described ASDs operations against non-state actors (terrorists and criminals), but not other states.

Still, its clear that ASD is legally able to undertake offensive cyber activity against other states in situations short of war. ASD may conduct offensive cyber operations to disrupt criminal activity. Cybercrime is defined broadly enough to include other states cyber intrusions. ASD Director-General Rachel Noble last year underscored that we consider both state actors and serious and organised criminals to be undertaking criminal activity when going after Australian networks.

Canberra often emphasises that its offensive cyber operations accord with international and domestic law. The bigger question is whether Australia should use its offensive cyber capabilities against other states and, if so, how?

US public discussion of these issues has evolved faster than Australias in recent years. When Turnbull revealed Australias capability, President Barack Obama was still keeping tight control over US cyber operations. President Donald Trump reversed this approach in 2018, partly because that was his modus operandi and partly because cyber security agencies argued for a new approach.

Advocates argue that America can only counter its adversaries continual cyberattacks by operating in their networks.

President Joe Biden appears to have maintained the policy of defend forward, articulated in Trumps2018 Department of Defense Cyber Strategy. Washingtons current approach to competition in cyberspace is described as persistent engagement by Paul Nakasone, the dual-hatted head of the National Security Agency (NSA) and Cyber Command (both of which are ASDs close American counterparts.)

Still, the US debate about persistent engagement continues. Advocates argue that America can only counter its adversaries continual cyberattacks by operating in their networks. Opponents maintain that the risks of unintended consequences and escalation are too great. But most of them would acknowledge that those risks are at least mitigated by Washingtons relatively transparent discussion of cyber strategy.

Australias offensive cyber capability is now growing faster than its public discussion about why these tools are needed and how they should be used. Because Australian cyber competition with China will almost inevitably intensify, so too will the need to publicly air the complex questions of strategy and values that this raises. At minimum, Canberra should say whether ASD has also adopted persistent engagement.

Read more:
Australian cyber: What's Redspice for? | The Interpreter - The Interpreter

India ranks third in global data breaches in 2021, a 356% increase from the previous year. Since we do not currently have a national data protection or data privacy law, such cybersecurity failures pose massive threats of financial fraud and identity thefts on citizens. There needs to be a better mechanism that incentivises organisations that are collecting and storing citizen data to maintain stronger internet security measures.

Neither the proposed Data Protection Bill nor the amendment to the Information Technology Act, speaks about the responsibility of cybersecurity compromises. The Data Protection Bill mandates that companies need to report breaches within 72 hours of the occurrence, but there is no requirement for companies to secure citizen data. India had also introduced the National Cybersecurity Policy in 2013 which suggested several broad strategies including the provision of fiscal schemes and incentives to encourage entities to install, strengthen and upgrade information infrastructure for cybersecurity. As the government changed in 2014, not much has been done to implement the policy or to extend it to legal accountability and enforcement.

Indias e-commerce sector has witnessed tremendous growth in recent years. It is expected to grow to $188 billion by 2025. The Fintech market in the country is estimated to be the third-largest in the world. India is also the worlds second-largest telecommunication market.

This rapid and accelerated digitisation over the past few years has meant personal data collection at an equally rapid, yet unregulated, pace. The data collected online ranges from basic information (such as name, address, age, gender and phone number) to sensitive details (such as bank account numbers, credit/debit card numbers, government ID numbers, and so on). Added to this information that is directly collected and stored, there is metadata that can reveal deeper insights about customers (such as personality types, spending patterns, personal interests, political inclinations, food preferences, schedules, physical and mental health). However, other than the informal trust that the customer puts into these companies, there is no legal or policy promise requiring these companies to ensure customer data is safe, secure, and only used for purposes informed to the customer.

For a solution, we can look to banking regulation. There, policies of zero liability and limited liability for cards and online financial frauds made the banks responsible for unauthorised financial transactions. Similarly, we need to push accountability for data security on all companies collecting and storing citizen data.

The need for economic growth, and hopes for foreign investments, should not deter us from enforcing internet security. All companies, public and private, should be required to report to the government the measures taken by them to ensure data security and information regarding potential threats and targets. There needs to be a channel to facilitate information exchange between companies facing similar threats. For companies that fail to show serious efforts for internet security or lack compliance with standards set by the government, customers should be actively notified of the risks while sharing their data with them. The required standards of internet security measures can also vary basis the sensitivity of the data being collected.

This added accountability is often seen as an additional cost, especially for small and medium enterprises. But this can also be an opportunity where the government guides and assists SMEs to choose cloud services wisely, safeguard their websites and portals, and ensure that they are protected from ransomware attackers as well as other threats over the internet.

Over the last decade, many countries have established agencies to focus on cybersecurity and a safe national digital infrastructure: Singapore, the United States, and Israel are examples. India does have the National Cyber Coordination Centre, but this agency is an internet scanning agency for real-time assessments of cyber threats and report generation. It lacks real-time partnerships with domestic and international private and government agencies. It also does not act as a mentor on matters of cybersecurity or enforce guidelines around data protection and overreach. Without proactive measures, partnership with private enterprises, collaborative efforts and legal accountability, effective execution and results may prove difficult.

Government guidance and support are not interchangeable with government surveillance or government overreach. The Indian government needs to put in place standards to protect citizen privacy and digital security, from all domestic and international malicious players online, and itself.

Data is the new oil, the new weapon of war, and the new gold. 54% of Indias 1.2 billion population is estimated to have access to the internet. A large push to Indias growth has been from its accelerated development and adoption of digital public infrastructure and digital public goods. Internet security has been an elephant in the room and it's time it is seen as urgent and crucial for continued growth propelled by digitisation, internet penetration, and innovation.

Avni Sinha is at the Harvard Kennedy School of Government

The views expressed are personal

More:
Why legal intervention is the way forward for safe digital public infrastructure - Hindustan Times

On March 24th, EU governing bodies announced that they had reached a deal on the most sweeping legislation to target Big Tech in Europe, known as the Digital Markets Act (DMA). Seen as an ambitious law with far-reaching implications, the most eye-catching measure in the bill would require that every large tech company defined as having a market capitalization of more than 75 billion and a user base of more than 45 million people in the EU create products that are interoperable with smaller platforms. For messaging apps, that would mean letting end-to-end encrypted services like WhatsApp mingle with less secure protocols like SMS which security experts worry will undermine hard-won gains in the field of message encryption.

The main focus of the DMA is a class of large tech companies termed gatekeepers, defined by the size of their audience or revenue and, by extension, the structural power they are able to wield against smaller competitors. Through the new regulations, the government is hoping to break open some of the services provided by such companies to allow smaller businesses to compete. That could mean letting users install third-party apps outside of the App Store, letting outside sellers rank higher in Amazon searches, or requiring messaging apps to send texts across multiple protocols.

But this could pose a real problem for services promising end-to-end encryption: the consensus among cryptographers is that it will be difficult, if not impossible, to maintain encryption between apps, with potentially enormous implications for users. Signal is small enough that it wouldnt be affected by the DMA provisions, but WhatsApp which uses the Signal protocol and is owned by Meta certainly would be. The result could be that some, if not all, of WhatsApps end-to-end messaging encryption is weakened or removed, robbing a billion users of the protections of private messaging.

Given the need for precise implementation of cryptographic standards, experts say that theres no simple fix that can reconcile security and interoperability for encrypted messaging services. Effectively, there would be no way to fuse together different forms of encryption across apps with different design features, said Steven Bellovin, an acclaimed internet security researcher and professor of computer science at Columbia University.

Trying to reconcile two different cryptographic architectures simply cant be done; one side or the other will have to make major changes, Bellovin said. A design that works only when both parties are online will look very different than one that works with stored messages .... How do you make those two systems interoperate?

Making different messaging services compatible can lead to a lowest common denominator approach to design, Bellovin says, in which the unique features that made certain apps valuable to users are stripped back until a shared level of compatibility is reached. For example, if one app supports encrypted multi-party communication and another does not, maintaining communications between them would usually require that the encryption be dropped.

Alternatively, the DMA suggests another approach equally unsatisfactory to privacy advocates in which messages sent between two platforms with incompatible encryption schemes are decrypted and re-encrypted when passed between them, breaking the chain of end-to-end encryption and creating a point of vulnerability for interception by a bad actor.

Alec Muffett, an internet security expert and former Facebook engineer who recently helped Twitter launch an encrypted Tor service, told The Verge that it would be a mistake to think that Apple, Google, Facebook, and other tech companies were making identical and interchangeable products that could easily be combined.

If you went into a McDonalds and said, In the interest of breaking corporate monopolies, I demand that you include a sushi platter from some other restaurant with my order, they would rightly just stare at you, Muffett said. What happens when the requested sushi arrives by courier at McDonalds from the ostensibly requested sushi restaurant? Can and should McDonalds serve that sushi to the customer? Was the courier legitimate? Was it prepared safely?

Currently, every messaging service takes responsibility for its own security and Muffett and others have argued that by demanding interoperability, users of one service are exposed to vulnerabilities that may have been introduced by another. In the end, overall security is only as strong as the weakest link.

Another point of concern raised by security experts is the problem of maintaining a coherent namespace, the set of identifiers that are used to designate different devices in any networked system. A basic principle of encryption is that messages are encoded in a way that is unique to a known cryptographic identity, so doing a good job of identity management is fundamental to maintaining security.

How do you tell your phone who you want to talk to, and how does the phone find that person? said Alex Stamos, director of the Stanford Internet Observatory and former chief security officer at Facebook. There is no way to allow for end-to-end encryption without trusting every provider to handle the identity management... If the goal is for all of the messaging systems to treat each others users exactly the same, then this is a privacy and security nightmare.

Not all security experts have responded so negatively to the DMA. Some of the objections shared previously by Muffett and Stamos have been addressed in a blog post from Matrix, a project geared around the development of an open-source, secure communications standard.

The post, written by Matrix co-founder Matthew Hodgson, acknowledges the challenges that come with mandated interoperability but argues that they are outweighed by benefits that will come from challenging the tech giants insistence on closed messaging ecosystems.

In the past, gatekeepers dismissed the effort of [interoperability] as not being worthwhile, Hodgson told The Verge. After all, the default course of action is to build a walled garden, and having built one, the temptation is to try to trap as many users as possible.

But with users generally happy to centralize trust and a social graph in one app, its unclear whether the top-down imposition of cross-platform messaging is mirrored by demand from below.

iMessage already has interop: its called SMS, and users really dislike it, said Alex Stamos. And it has really bad security properties that arent explained by green bubbles.

More here:
Security experts fear the DMA will break WhatsApp encryption - The Verge

In 2017, Russia vowed to make its Internet sustainable and self-sufficient. In reality, the Kremlin undertook its first systematic effort to control its cyberspace.

As Russia sends tanks and soldiers to take over Ukraine, it is also dispatching censors and regulators to strangle the Internet. In this special series by the Center for European Policy Analysis, The New Iron Curtain, Senior Fellows Andrei Soldatov and Irina Borogan argue that both invasions are linked and represent the culmination of a more than a decade-long trend to throttle the free and open flow of information in Russia.

For years, former KGB generals watched the growth of the Internet with suspicion, believing it was a threat to Russias national security. They vowed to disable it.

Their leader was Vladislav Sherstyuk, a career KGB officer. In 1998, he became director of FAPSI, the division of the intelligence service in charge of spying on foreign communications and the protection of the governments most sensitive networks. The next year, President Putin promoted Sherstyuk to the powerful Security Council, where he supervised the information security department. In 2000, his team composed the Information Security Doctrine of the Russian Federation, a plan for the future of the Russian internet.

Its doctrine reflects the KGB mindset: the free flow of information, coming from the West, poses a threat to Russias national security. Threats ranged from a devaluation of spiritual values to a reduction of the spiritual, moral and creative potential of the Russian population, as well as the manipulation of information (disinformation, concealment or misrepresentation). Putin signed the document, and the Security Council became the ideological center of operations to curb Russian Internet freedom and the force behind the nascent Sovereign Internet.

In November 2017, the Security Council instructed the Ministry of Communications to submit proposals for the creation and implementation of a state information system to ensure the integrity, stability, and security of the Russian segment of the Internet, as well as replacement root servers for national top-level domain names." The Security Council warned: A serious threat to the security of the Russian Federation is the increased capabilities of Western countries to conduct offensive operations in the information space and readiness to use them.

Officially, the Security Council aimed to make the Russian Internet sustainable end self-sufficient. In fact, the Kremlin wanted to build an effective system of control. The Kremlin identified six challenges to overcome:

During the Cold War, the Kremlin saw the most dangerous content coming from Western media. This content could be found on the Internet, but Russians preferred and trusted domestic content.

Opposition leader Alexei Navalnys documentaries about Kremlin corruption attracted record YouTube audiences. In 2017, Navalnys YouTube video about Russian Prime Minister Dmitri Medvedevs alleged corruption was viewed more than 22 million times. Since then, Navalnys organization has produced anti-corruption videos on YouTube on an industrial scale. These videos are more popular than content created by Radio Free Europe, Voice of America, or the BBC.

The Kremlin began to pressure both local and Western technology companies to take down opposition content critical to authorities.

When ordinary people witness a natural disaster, a technical catastrophe, or police brutality and share the evidence through video or photos -- the posts go viral. The information spreads too quickly for the censorship system to address.

The Kremlin began to set up a Moscow control center, giving it the ability to oversee access to the entire Russian Internet.

Censors understand that activists use apps such as Signal or software such as Tor to obscure their communications, but ordinary Russians depend on mainstream consumer apps such as WhatsApp, Viber (a communications app owned by the Japanese company Rakuten), Telegram, and TikTok.

The Kremlin aimed to change reliance on Western apps to local ones that the security services could control and suppress.

YouTube and TikToks explosive growth took Russian authorities by surprise. In 2017, Navalny's documentary about Medvedevs corruption encouraged Russian YouTubers to spread videos showing police brutality used to crack down on protests. Russian schoolchildren filmed their teachers raging about enemies of the state and posted the videos.

The Kremlin concentrated its censorship efforts on video posts, filing numerous complaints to YouTube about the Navalny videos, and arresting the editor of Navalny Live.

In August 2018, tensions rose in the majority Muslim region of Ingushetia over a Kremlin-supported border-swap agreement with neighboring Chechnya. On the day of the agreements signing, about a hundred people gathered to protest in the Ingush capital, Magas.

Ingushetia's Internet was cut. Authorities suppressed live streaming. In the following weeks, the Ingush kept going to the streets to protest, and the FSB secret service enforced web shutdowns.

Despite the efforts, information about protests kept leaking. The Kremlins new system, controlled through a single center in Moscow, was built to shut down the Internet to entire regions, allowing it to act without relying on regional enforcers.

Starting in the 1990s, Russian telecom companies were required to buy and update equipment for online surveillance. Starting in 2018, Russians were obliged to store the complete data of all users for six months, and their metadata for three years.

Telecom companies protested. Sometimes, their resistance became public company officials expressed their concerns at conferences and to journalists. In most cases, the resistance stayed private. Companies attempted to find a way around the legislation, for instance, by renting surveillance equipment from large operators. This resistance undermined the effectiveness of the Russian nationwide surveillance and filtering.

Kremlin censors realized that they needed to pay companies to install censorship and surveillance tools. They began providing Internet service providers with special equipment which gave the government the means to suppress and redirect the traffic to the control center in Moscow.

The Sovereign Internet was born. It would be built out over the next few years, in advance of the decision to invade Ukraine.

Andrei Soldatov is a nonresident senior fellow with the Center for European Policy Analysis. Andrei is a Russian investigative journalist, co-founder, and editor of Agentura.ru, a watchdog of the Russian secret services activities. He has been covering security services and terrorism issues since 1999.

Irina Borogan is a nonresident senior fellow with the Center for European Policy Analysis. Irina is a Russian investigative journalist, co-founder, and deputy editor of Agentura.ru, a watchdog of the Russian secret services activities.

Visit link:
For the Kremlin, the Internet is a Western Plot - Center for European Policy Analysis