It’s not surprising that some Yahoo users have decided to sue the company for negligence over a 2014 breach that was only recently discovered and announced. But before we blame Yahoo for this, we need to understand how hackers accomplish such breaches — and what all of us should be doing better to prevent such breaches.

A version of this post appeared on CNN: https://www.cnn.com/2016/09/30/opinions/yahoo-data-breach-vishwanath/

There is a common thread that connects the hack into the sluicegate controllers of the Bowman Avenue dam in Rye, New York; the breach that compromised 20 million federal employee records at the Office of Personnel Management; and the recent spate of “ransomware” attacks that in three months this year have already cost us over US$200 million: they were all due to successful “spearphishing” attacks.

Generic – or what is now considered “old school” – phishing attacks typically took the form of the infamous “Nigerian prince” type emails, trying to trick recipients into responding with some personal financial information. “Spearphishing” attacks are similar but far more vicious. They seek to persuade victims to click on a hyperlink or an attachment that usually deploys software (called “malware”) allowing attackers access to the user’s computer or even to an entire corporate network. Sometimes attacks like this also come through text messages, social media messages or infected thumb drives.

The sobering reality is there isn’t much we can do to stop these types of attacks. This is partly because spearphishing involves a practice called social engineering, in which attacks are highly personalized, making it particularly hard for victims to detect the deception. Existing technical defenses, like antivirus software and network security monitoring, are designed to protect against attacks from outside the computer or network. Once attackers gain entry through spearphishing, they assume the role of trusted insiders, legitimate users against whom protective software is useless.

This makes all of us Internet users the sole guardians of our computers and organizational networks – and the weakest links in cyberspace security.

The real target is humans

Stopping spearphishing requires us to build better defenses around people. This, in turn, requires an understanding of why people fall victim to these sorts of attacks. My team’s recent research into the psychology of people who use computers developed a way to understand exactly how spearphishing attacks take advantage of the weaknesses in people’s online behaviors. It’s called the Suspicion, Cognition, Automaticity Model (SCAM).

We built SCAM using simulated spearphishing attacks – conducted after securing permission from university research supervision groups who regulate experiments on human subjects to ensure nothing inappropriate is happening – on people who volunteered to participate in our tests.

We found two primary reasons people are victimized. One factor appears to be that people naturally seek what is called “cognitive efficiency” – maximal information for minimal brain effort. As a result, they take mental shortcuts that are triggered by logos, brand names or even simple phrases such as “Sent from my iPhone” that phishers often include in their messages. People see those triggers – such as their bank’s logo – and assume a message is more likely to be legitimate. As a result, they don’t properly scrutinize those elements of the phisher’s request, such as the typos in the message, its intent, or the message’s header information, that could help reveal the deception.

Compounding this problem are people’s beliefs that online actions are inherently safe. Sensing (wrongly) that they are at low risk causes them to put relatively little effort into closely reviewing the message in the first place.

Our research shows that news coverage that has mostly focused on malware attacks on computers has caused many people to mistakenly believe that mobile operating systems are somehow more secure. Many others wrongly believe that Adobe’s PDF is safer than a Microsoft Word document, thinking that their inability to edit a PDF translates to its inability to be infected with malware. Still others erroneously think Google’s free Wi-Fi, which is available in some popular coffee shops, is inherently more secure than other free Wi-Fi services. Those kinds of misunderstandings make users more cavalier about opening certain file formats, and more careless while using certain devices or networks – all of which significantly enhances their risk of infection.

Habits weaken security

Another often-ignored factor involves the habitual ways people use technology. Many individuals use email, social media and texting so often that they eventually do so largely without thinking. Ask people who drive the same route each day how many stop lights they saw or stopped at along the way and they often cannot recall. Likewise, when media use becomes routine, people become less and less conscious of which emails they opened and what links or attachments they clicked on, ultimately becoming barely aware at all. It can happen to anyone, even the director of the FBI.

When technology use becomes a habit rather than a conscious act, people are more likely to check and even respond to messages while walking, talking or, worse yet, driving. Just as this lack of mindfulness leads to accidents, it also leads to people opening phishing emails and clicking on malicious hyperlinks and attachments without thinking.

Currently, the only real way to prevent spearphishing is to train users, typically by simulating phishing attacks and going over the results afterward, highlighting attack elements a user missed. Some organizations punish employees who repeatedly fail these tests. This method, though, is akin to sending bad drivers out into a hazard-filled roadway, demanding they avoid every obstacle and ticketing them when they don’t. It is much better to actually figure out where their skills are lacking and teach them how to drive properly.

Identifying the problems

That is where our model comes in. It provides a framework for pinpointing why individuals fall victim to different types of cyberattacks. At its most basic level, the model lets companies measure each employee’s susceptibility to spearphishing attacks and identify individuals and workgroups who are most at risk.

When used in conjunction with simulated phishing attack tests, our model lets organizations identify how an employee is likely to fall prey to a cyberattack and determine how to reduce that person’s specific risks. For example, if an individual doesn’t focus on email and checks it while doing other things, he could be taught to change that habit and pay closer attention. If another person wrongly believed she was safe online, she could be taught otherwise. If other people were taking mental shortcuts triggered by logos, the company could help them work to change that behavior.

Finally, our method can help companies pinpoint the “super detectors” – people who consistently detect the deception in simulated attacks. We can identify the specific aspects of their thinking or behaviors that aid them in their detection and urge others to adopt those approaches. For instance, perhaps good detectors examine email messages’ header information, which can reveal the sender’s actual identity. Others earmark certain times of their day to respond to important emails, giving them more time to examine emails in detail. Identifying those and other security-enhancing habits can help develop best-practice guidelines for other employees.

Yes, people are the weakest links in cybersecurity. But they don’t have to be. With smarter, individualized training, we could convert many of these weak links into strong detectors – and in doing so, significantly strengthen cybersecurity.

A version of this post appeared here and on other leading media: https://theconversation.com/cybersecuritys-weakest-link-humans-57455

To prevent stolen credentials from undermining these, the government implemented a “Public Key Infrastructure” (PKI), basically a nationwide electronic ID card with an encrypted key that securely identifies users to servers online. Swiping the card in addition to entering login credentials works like a real-world authentication system, where individuals present their credentials along with something only they can possess.

*A version of this post pear on CNN: https://www.cnn.com/2016/05/02/opinions/build-cyber-wall-vishwanath/

Even Steve Jobs could not see the potential of third-party mobile apps: those little software programs that turned our mobile phones into smartphones. Jobs had famously argued against such apps, instead advocating for the use of mobile web pages that could be accessed using iPhone’s Safari browser. It reportedly wasn’t until users began jail-breaking and creating third-party apps anyway — literally reinventing the iPhone — that he came around to the idea and launched the official Apple App Store in 2008.

*A version of this post appeared on CNN: https://www.cnn.com/2016/04/01/opinions/problem-app-security-vishwanath/index.html

All this makes anyone with minimal programming skills and a free email account capable of inflicting significant damage, and with everyone from presidents to pensioners using emails today, the virtual pool of potential victims is limitless. No surprise then that cybersecurity experts believe that 2016 could well be the “Year of Online Extortion.”

A version this post appeared on CNN: https://www.cnn.com/2016/03/25/opinions/preventing-ransomware-attacks-vishwanath/

Tuesday at the first congressional hearing on the issue of iPhone encryption, Apple’s general counsel argued against the FBI’s call for creating a backdoor into the company’s technology, a door that could allow the government — and hackers — to intrude on our privacy in the future.

• A version of this post appeared on CNN: https://www.cnn.com/2016/03/02/opinions/can-apple-protect-us-from-hacking-vishwanath/index.html

First, for efficiency reasons, many cyberattacks utilize the same attack pattern. From the attack on the Justice Department to the one crippling Ukraine, most utilize spear phishing.

A version of this post appeared on CNN: https://www.cnn.com/2016/02/11/opinions/cyber-infrastructure-attacks-vishwanath/

Cybersecurity was in the news again this week as hackers released contact details of thousands of FBI and Homeland Security employees after claiming to have taken 200 GB of data from Department of Justice computers. But even as such breaches have started to feel almost routine, they are also taking a more troubling turn.

Imagine traffic being halted, subway trains going berserk, furnaces and cooling systems firing out of control, or worse yet, a nuclear power plant melting down — all due to a cyberattack. This is by no means a hypothetical concern. The first wave of infrastructure attacks has already demonstrated the harm that can be done as governments face the reality that the hacking threat is increasingly about more than stolen information.

Late last year, in a first of its kind, a major cyberattack crippled Ukraine’s electricity grid, freezing the computer terminals of operators trying to restart the grid and blocking the telephone lines so consumers couldn’t call in. Last month, Israel’s Public Utility Authority was reportedly attacked. And Germany reported extensive damage to an industrial plant from a hacked blast furnace that couldn’t be stopped.

Closer to home, the Department of Homeland Security received reports of close to 250 infrastructure incursions in fiscal 2014, while Iranian hackers in December 2013 reportedly infiltrated the sluice gate controllers of the Bowman Avenue Dam in Rye, New York.

The potential losses in terms of time, money and possibly even lives from increasingly sophisticated attacks are hard to calculate. But one thing is clear: These attacks can only be stopped if we enlist the help of every Internet user.

And there is a good reason to follow this approach, because although cyberattacks weave their way through computer networks in different ways, there is a common thread that runs across many of them — something that we could exploit to stop them.

First, for efficiency reasons, many cyberattacks utilize the same attack pattern. From the attack on the Justice Department to the one crippling Ukraine, most utilize spear phishing.

The hacker hides a malware payload in the attachment of an email, which when clicked opens a back door into computer networks that are then used to hijack system controllers or extract data. Some phishing attacks direct individuals to fraudulent websites that run malicious scripts or directly solicit login and other credentials by spoofing a real website. Such attacks are often repeated, with minor changes to the request; many even carry the same payload or direct people to the same phony website.

A second important aspect of cyberattacks is that not all the attacks are successful. In fact, targeted spear-phishing attacks tend to have success rates ranging from 30% to 55%. So while many people fall prey to the attack, many more don’t — and a breach could be stopped by just one person reporting it.

With that in mind, if we could provide a mechanism for the many individuals who detect an attack to report it, and if we could quickly disseminate the information to its likely targets, we could stop most attacks from spreading.

But the problem today is that there are many different agencies that collect cyberbreach reports.

For example, anyone receiving a spear-phishing email claiming to be from the IRS can report it to the IRS, to the state attorney general, the local police, and the IT department of their organization. Other entities that could be reported to include the Anti Phishing Work Group and the FBI’s Internet Crime Complaint Center. Each of these organizations allows for reporting using different forms and mechanisms, with some merely collecting reports, others providing emailed feedback, and some others having investigative authority. This is a problem for the average person, whose report is the first line of defense against the attack.

What we need instead is a simple, one-stop, city- or county-level solution: one that is well-publicized, so everyone in a region can be easily made aware of this service; one that is convenient and allows for reporting using a variety of mechanisms; and one that not only collects fraud information but also disseminates information about how to protect and, if necessary, remediate the breach, so people can get localized help.

What would such a system look like in practice? In fact, many cities throughout the nation already have one system in place that we could potentially leverage: the 311 system for reporting nonemergency municipal service issues. This system has been adopted by more than 60 cities and provides a ready platform for cyberbreach reporting. In many areas, the system allows for complaints via email, phone, and smartphone. Leveraging the existing 311 system is therefore convenient and has the added advantage that the system is already known in most areas.

Of course, the current systems would need to be strengthened by adding staff with expertise in dealing with cyberattacks. But this could be easily accomplished by transferring some resources from fighting traditional crime — which in much of the nation remains at an all-time low — toward fighting the exponentially growing problem of cybercrime.

Reports from various regional 311 systems could then be aggregated by an agency like the FBI’s IC3, providing a means for centralized tracking and attack containment. In much the same way the Centers for Disease Control and Prevention protects public health in the United States, many cyberoutbreaks could be stopped before they crippled our homes or our critical infrastructure — if people reported them early, if their likely victims were warned about them, and if law enforcement began to remedy them right away.

The democratized Internet gives everyone a voice. But it also makes just about anyone capable of inflicting massive damage. We need everyone’s help to protect this increasingly wired world we live in.

• A version of this post appeared on CNN: https://www.cnn.com/2016/02/11/opinions/cyber-infrastructure-attacks-vishwanath/

Last week, we learned that hackers allegedly working for the Chinese government breached personal information of some 4 million current and former federal employees. This latest episode is shocking in its scope, but security experts have long known about China’s military-level cyberoffensive capabilities, with reports of an entire division of its army being devoted to cyberattacks.

And China is not alone. Russian government-sponsored hackers were blamed for the recent breach of the White House’s email system; North Korean hackers were believed to be behind the Sony Pictures’ hack. And state actors aside, there are also nonstate criminal enterprises and a smorgasbord of “hactivists” all focused on breaching, stealing or releasing compromised information. In fact by merely cumulating the number of successful breaches since 2014 we reach a sobering conclusion: All of us, by now, have been the victims of a cyberattack of one kind or another.

How are these attacks happening?

The vast majority of these hacks utilize simple phishing attacks — hackers craft emails that appear to come from a trusted source such as the Internal Revenue Service or a company’s information technology department with an innocuous-looking hyperlink or attachment that, once clicked, opens virtual backdoors into the individual’s computer. Once compromised, requests appear to come from inside the organization’s computer networks, which make them hard to detect using security software programmed to protect networks from outside incursions, not insider requests. This is why it is virtually impossible to stop cyberattacks — because we are the ones who inadvertently open these emails and click on the links. We act as the unintentional insiders who hand over the keys to the network.

To have any chance of halting cyberattacks, we need to understand why people click on phishing links in the first place. There are two main reasons:

The first stems from how we relate to network security. Most of us who don’t work as IT administrators see network security as an impediment to getting work done. After all, our organizational performance is seldom measured in terms of how safe we are or how many rules we follow. Consequently, many of us disregard warnings, circumvent rules and connect in places we shouldn’t, oftentimes using unauthorized devices and software. Supporting such actions are mistaken beliefs about the security of certain operating systems, devices and file-formats that lead many people to be cavalier about what sites they visit and what they open on certain devices.

The second problem stems from people’s cyber habits, where many online actions such as checking emails and texting have become so routine that people are often unaware of when they perform these behaviors. As a result, many people quickly open emails or mindlessly click on links and attachments with nary a thought of its consequences. Smartphones, which the majority of us now use to connect to the Internet, have further exacerbated the problem by making it possible for people to check email frequently while simultaneously being engaged in a number of other activities. Smartphone apps and screen sizes also restrict how much information is presented, which can make it difficult to check the veracity of an email even if one is so inclined.

With all this in mind, fixing the people problem of cybersecurity is going to require a three-pronged approach.

First, we must educate people on how to protect themselves better online. Cybersecurity education must be accessible, universal and a mandatory part of K-12 education. It must focus on teaching people safe browsing habits, replace flawed cyber beliefs with objective knowledge and teach people ways to protect their information online better — in short, it must help them develop better cyber hygiene.

Second, we must train people on how to spot a fraudulent email quickly, on strategies for effectively sequestering it and on replacing poor cyber habits with better ones. Hand in hand with this, we must also work on developing a more dynamic system of according IT-access privileges to people in organizations. The current system was developed when computers were newer, software limited and devices fewer. Today we need a system that is not too restrictive, one that takes into account people’s varying device use needs but also fosters security consciousness. One solution might be to provide people access based on their cybersecurity behaviors, risk beliefs and online habits rather than merely on who they are in the organization.

Finally, we must make it easy for people to report suspected breaches and malicious emails. Efforts by President Barack Obama to make the reporting of data breaches mandatory for organizations are a good step, but there is a pressing need to establish a national clearinghouse where people can quickly report a breach and find help. The current system requires individuals to sift through a host of law enforcement agency websites to find a contact to report a breach, and oftentimes there is little to no feedback or remedial help in return, which reduces people’s motivation to report.

Instead, we need to create a single, centralized agency, similar perhaps to the Action Fraud center and specialized FALCON response team that police in London have created, where people can both report a breach and find someone who can immediately redress it.

Ultimately, this latest attack was likely successful because we are the weakest links in the nation’s cyber infrastructure. Technology alone cannot fix this problem — only we can stop the next attack. And it’s likely already underway.

*A version of this post appeared in CNN: https://edition.cnn.com/2015/06/08/opinions/vishwanath-stopping-hacking/

The theft of 80 million customer records from health insurance company Anthem earlier this month would be more shocking if it were not part of a larger trend. In 2013, the Department of Defense and some US states were receiving 10–20 million cyberattacks per day. By 2014, there was a 27% increase in successful attacks, culminating with the infamous hack of Sony Pictures.

Much of the media focus is on the losses rather than the process by which such breaches take place. Consequently, instead of talking about how we could stop the next attack, people and policymakers are discussing punitive actions. But not enough attention is given to the actions of individual end users in these cyberattacks.

We are the unintentional insiders

Many of these hacking attacks employ simple phishing schemes, such as an e-card on Valentine’s Day or a notice from the IRS about your tax refund. They look innocuous but when clicked, they open virtual back doors into our organizations.

It is you and I who click on these links and become the “unintentional insiders” giving the hackers access and helping spread the infection. Such attacks are hard to detect using existing anti-virus programs that, like vaccines, are good at protecting systems from known external threats — not threats from within.

Clearly, this virtual battle cannot be won using software alone. In the same way personal hygiene stymies the spread of infectious disease, fixing this cyber quandary will require all of us to develop better cyberhygiene. We need to begin by considering the cyberbehaviors that lead to breaches.

My research on phishing points to three. Firstly, most of us pay limited attention to email content, focusing instead on quick clues that help expedite judgment. A picture of an inexpensive heart-shaped valentine gift gets attention, oftentimes at the cost of looking at the sender’s email address.

This is coupled by our ritualized media habits that our always-on and accessible smartphones and tablets enable. Many of us check emails throughout the day whenever an opportunity or notification arises, even when we know it is dangerous to do so, such as while driving. Such habitual usage significantly increases the likelihood of someone opening an email as matter of routine.

And finally, many of us just aren’t knowledgeable about online risks. We tend to hold what I call “cyber risk beliefs” about the security of an operating system, the safety of a program, or the vulnerability of an online action, most of which are flawed.

Cleaning up our cyberhygiene act

Developing cyberhygiene requires all of us — netizens, educators, local government, and federal policymakers — to actively engage in creating it.

To begin, we must focus on educating everyone about the risks of online actions. Most children don’t learn about cybersafety until they reach high school; many until college. More troublingly, some learn through risky trials or the reports of someone else’s errors.

In an age where online data remain on servers perpetually, the consequences of a privacy breach could haunt a victim forever. Expanding federal programs such as the National Initiative for Cybersecurity Education, which presently aims to inspire students to pursue cybersecurity careers, could help achieve universal cybersecurity education.

Second, we must train people to become better at detecting online fraud. At the very least, all of us must be made aware of online security protocols, safe browsing practices, secure password creation and storage, and on procedures for sequestering or reporting suspicious activity. Flawed cyber-risk beliefs must be replaced with objective knowledge through training.

Although some training programs address these issues, most target businesses that can pay for training. Left out are households and other vulnerable groups, which, given the recent “bring your own device to work” (BYOD) trend, increases the chances that a compromised personal device brings a virus into the workplace. Initiatives such as the Federal Cybersecurity Training Events that presently offer free workshops to IT professionals are steps in this direction, but the emphasis must move beyond training specialists to training the average netizen.

Finally, we must centralize the reporting of cyber breaches. The President’s proposed Personal Data Notification and Protection Act would make it mandatory for companies to report data breaches within 30 days. But it still doesn’t address who within the vast network of enforcement agencies is responsible for resolution. Having a single clearing house that centralizes and tracks breaches, just like the Centers for Disease Control and Preventiontracks disease outbreaks across the nation, would make remediation and resource allocation easier.

Across the Atlantic, the City of London Police created a system called Action Fraud, which serves as a single site for reporting all types of cyberattacks, along with a specialized team called FALCON to quickly respond to and even address impending cyberattacks. Our city and state police forces could do likewise by channeling some resource away from fighting offline crime. After all, real world crime is at a historically low rate while cybercrimes have grown exponentially.

*A version of this post appeared here and in other leading media outlets: https://www.weforum.org/agenda/2015/02/who-is-to-blame-for-cyberattacks/