Security by Obscurity has been and still is something that many smaller organizations practice. There is a good reason for this as many smaller businesses believe they cannot afford all the tools and staff they have been told they need. As a consultant in the SMB space, I hear this a lot during client calls, and it can be disappointing to hear what some organizations believe they must have to be more secure…. However, that is not the point of this article, so I won’t belabor that point. Instead, let’s pivot to how the current target rich environment (for attackers) might be making security by obscurity less helpful.
Encryption at rest, encryption in flight, encryption on disk, encryption, encryption, encryption… even post quantum encryption. If you are not hearing about encryption, you might either be living under a rock, or perhaps leading an idyllic life somewhere in the mountains with a stream and nice walking path and are not the target audience for this article. Instead, allow me to shift to those poor souls who are bombarded by the term encryption from sunup to sundown.
RSA Conference 2024 has come and done and during their event there were some highlights and some pretty serious cringe. What is concerning is that the cringe moments were not just chuckle and move on but seemed to show a complete lack of awareness on the part of speakers, and marketing teams.
Going back a way, I have talked at length about the concerning skill set gaps which seem to increase over time in many industries. The gap appears when the highly skilled people move on, or up and after automations in that area appear. You end up in a situation where the staff you have cannot function without the tool operating at 100%. It is alarming to see it playout in real-time. Still even with technical skill set gaps, there is potentially a larger issue at play; a communication skill set gap.
Although it might seem like rehashing things about the UnitedHealth ransomware event is a bit out of touch and old news, there are still some things that apply today. The attack took place back in February and was quickly attributed to the Blackcat (AlphV) ransomware group. The attack had some significant ripple effects across the US healthcare landscape. This is in part due to how US healthcare companies have been allowed to be acquired and subsumed under a single umbrella and the way Blackcat attacked UnitedHealth’s subsidiary Change Healthcare.
Page 3 of 33