Home Sections Archive by category Cybersecurity

Cybersecurity

Cybersecurity Summit to Focus on Workforce, Ecosystem

By
Cybersecurity

Strengthening the Lines of Defense

Peter Sherlock says the numbers certainly help tell the story.

There are roughly 26,000 employed in Massachusetts today in what would be called the cybersecurity sector. And there were, at the precise moment we talked with him, exactly 18,263 openings in that realm, a number that goes up seemingly every day.

That means this sector has about two-thirds the number of qualified individuals it needs, said Sherlock, adding that the dire need to close that gap was one of the motivations behind the creation of CyberTrust Massachusetts, which he now serves as CEO.

Another motivation was to make the state’s businesses, institutions, and municipalities more cyber-secure at a time when the number of victims of cyber and ransomware attacks — like the number of job openings in this sector — keeps going up.

Peter Sherlock

Peter Sherlock

“As we put these students into these SOCs, they’re going to be working under the supervision of cyber professionals. We’re going to put them to work making cities and towns more cybersecure.”

How CyberTrust is going about these assignments, which overlap in many different ways, as we’ll see, will be among the focal points of Sherlock’s presentation at the 11th annual Cybersecurity Summit at Bay Path University, set for Friday, Oct. 13 at the Mills Theatre in Carr Hall on the school’s Longmeadow campus.

Registration for the event, which has been drawing steadily larger audiences because of the importance of the subject matter, is required. Individuals can register at baypath.edu/summit, and attend either in-person or remotely.

The working title for the program is “Who’s Next? How a Stronger Cyber Ecosystem is the First Line of Defense.” And Sherlock told BusinessWest that there are many elements that comprise this ecosystem, including the business sector, government, and education (the state’s colleges and universities, and even its high schools and middle schools). Together, they work on those twin assignments of building the workforce and making entities more cyber-secure.

At the forefront of these efforts is CyberTrust Massachusetts, a nonprofit committed to building both opportunity and security through a consortium of statewide businesses and colleges.

“CyberTrust arose out of a long-running dialogue among business and academic leaders, with some folks in government; these were discussions centered around workforce,” he said, adding that he understands first-hand the challenges of hiring — and retaining — within this sector.

Indeed, he previously served as chief operating officer of MITRE, as well as senior vice president responsible for MITRE’s defense and intelligence business.

“In my roles there, I had to worry about our annual hiring programs; trying to hire 1,000 STEM professionals every year was quite a challenge, as was retaining them,” he explained. “I would talk a lot with other executives in the Massachusetts area about the challenges of growing the pipelines in some of these technologies to keep up with the demand.

“And as the pandemic disrupted the workforce a bit more, those problems have become even more urgent,” he went on, adding that this urgency helped bring business and education together in the CyberTrust Massachusetts consortium to “move the needle,” as Sherlock put it, on not only these workforce issues, but the growing threat — in the form of cyber and ransomware attacks — to businesses of all sizes, nonprofits, institutions, and municipalities.

In his presentation at the Cybersecurity Summit, which will followed by what is expected to be a robust question-and-answer period, Sherlock said he will address a number of issues and initiatives, including the workforce challenges, efforts to activate new pathways for the talent pipeline in order to both grow and diversify and workforce, and cybersecurity approaches for municipalities across the Commonwealth.

While doing so, he will discuss how these problems intersect, and also about efforts to address them jointly, such as the security operation center, or SOC (pronounced ‘sock’ by those within this sector) that is taking shape at Springfield’s Union Station. This SOC, to be established by Springfield Technical Community College, will provide threat monitoring and other cybersecurity services for the state’s municipalities, small businesses, and nonprofits, while also creating learning opportunities for those in or seeking to join this sector at a ‘cyber range,’ a new testing lab that will mirror real-world IT environments to provide hands-on training opportunities to local companies, universities, and other cyber-focused organizations.

“We need to introduce new people to the cyber career field, whether it’s recruiting them from high school or getting adult career changers, and making non-cyber majors credentialed in cyber.”

“While focusing on workforce, we decided we could be serving another purpose at the same time,” he explained. “As we’re training our cyber learners with hands-on experiences, we could actually put them to work securing cities and towns, nonprofits, and small businesses. We put together this rather ambitious plan to set up security operations centers at a number of universities across the Commonwealth and to infuse new cyber-range technology into these colleges and universities and enlist cyber employers from across the state into this activity.

“As we put these students into these SOCs, they’re going to be working under the supervision of cyber professionals,” he went on. “We’re going to put them to work making cities and towns more cybersecure.”

Overall, Sherlock said the workforce issue requires creative, outside-the-box thinking and efforts to encourage individuals to consider this field while they are still in high school or even middle school.

“We need to introduce new people to the cyber career field, whether it’s recruiting them from high school or getting adult career changers, and making non-cyber majors credentialed in cyber,” he said. “There are a lot of different ways to get people into the field that we weren’t working at too much.”

Sherlock said he would go into much more detail at the summit, which grew out of the growing importance of cybersecurity in today’s society, the emergence of that sector, and the need to keep businesses and the community at large informed when it comes to new trends, new initiatives — and new threats, said Tom Loper, associate provost and dean in the School of Management and Technology at Bay Path.

Loper said he hopes, and expects, this year’s summit to be well-attended because of its focus on businesses and municipalities, the efforts to keep them safe from cyberattacks, and the role that they play within the emerging cyber ecosystem.

 

Cyber Criminals Exploit Preventable Human Failures

By
Cybersecurity Special Coverage

Easy Targets

 

While the technology used to prevent cybercrime has certainly become more sophisticated over the years, Paul Savas has two simple words when it comes to the human side of cybersecurity.

“Be smart.”

Unfortunately, too many people simply choose not to.

“If it looks like something’s suspect, don’t open it. Don’t click on the links. So many times, these attacks happen to people who are letting their guard down,” said Savas, vice president of Comcast Business’ Western New England Region.

“How many of us get that Amazon text — ‘there’s a question about the order in your account.’ It’s a bogus text, and you should delete it right away,” he continued. “But so many people don’t. They’re curious. ‘There’s a link … I’ll click it.’ But you have to be smarter than that.”

Then there’s the problem of password laziness.

“They keep creating their own passwords. They’ll even keep a file on their desktop that says ‘passwords,’ kind of a spreadsheet. If I’m a hacker, I love that.”

“The biggest problem is common passwords,” said Sean Hogan, president of Hogan Technology in Easthampton. “So many people reuse passwords; they have a password that they’ve used forever, and they’ll do variations of that password. The problem is, once all the bots out there have that password or something close, they will figure out all your passwords within seconds.”

And he’s run into stubbornness when it comes to changing password habits.

“When I go out to see clients, it’s a constant struggle. One of our hardest adaptations is getting them to start going with password management or password vaulting. They keep creating their own passwords. They’ll even keep a file on their desktop that says ‘passwords,’ kind of a spreadsheet. If I’m a hacker, I love that.”

Allen Reed, assistant vice president and Information Security officer at Freedom Credit Union, has run into similar frustrations.

Allen Reed

Allen Reed says ‘trust, but verify first’ is a good rule of thumb for clicking email links.

“At the credit union, I’m always hammering employees: ‘don’t click that link, don’t open that attachment, don’t ever click until you have verified. Trust, but verify first.’ Yes, it’s inconvenient to make a phone call to someone: ‘did I receive an email from you?’ But that’s the world we live in.”

When he talks about cybersecurity with Freedom employees, Reed says he tries to “put a little fear in them” with examples of mistakes other businesses have made, and the financial consequences. “It gets them to think a little more clearly.”

But the topic isn’t just an occasional one at the credit union. “We institute cybersecurity-awareness training on day one of their employment. In fact, we’re audited from the federal financial sector every year to make sure every employee has had security-awareness training — at least annually, but most importantly, on day one.”

Even then, Reed regularly uses his metaphorical hammer.

“We all receive email all day, every day. And the staff has to be trained over and over,” he said. “It’s like when we were young children at the stove, and we were told, ‘don’t touch the stove.’ We had to be told a thousand times before it sunk in.”

And hopefully, the message took root before a serious burn. That’s what companies of all sizes and from all sectors are dealing with today: the possibility of being badly burned by a breach.

For this issue’s emphasis on cybersecurity, BusinessWest examines why even the best-equipped networks can be compromised because of simple human error — and what employers are doing to drive that message home.

 

Growing Threats

One problem, Reed said, is that cyberthreats have changed over the years.

“In 2005, you were worried about your average teenager sitting in the bedroom after school thinking about how hack into the CIA mainframe; they did it more for the joy of it, to be proud of it.

“Today, we’re talking about nation-states attacking. We’re talking about a government providing monetary resources, building out multi-story buildings, hiring their own citizens and providing them with pay, to attack other nations. That’s what we’re dealing with today. They attack 24/7/365.”

And their efforts have become savvier, Savas said.

“Don’t underestimate the bad actors, because they are so far ahead when it comes to social engineering and how to employ technology. They do research on social media, and they know things about you, like your dog’s name. That’s a pretty easy password to figure out. So don’t make it easy to guess.”

Sean Hogan

Sean Hogan

“You know the environment that the client has is pretty darn secure, but when you’re having people from the outside log in from their own equipment that is not secure, you’re really running the risk of a breach.”

Some companies have unknowingly voided their cybersecurity insurance policies because they lacked a certain level of protection — not just hardware and software, but training and compliance. “Every level of protection has a cost,” Savas added, “and some companies are gambling and not being fully protected.”

Indeed, Hogan said many advances in cybersecurity are being driven by insurance companies, which are not happy about paying out for preventable mistakes.

“They don’t want the exposure,” he went on. “And they’re going make it harder to pay off cybersecurity insurance — because that is paying out constantly. They are losing money on that; they’re realizing they sold a lot of policies where people are not doing what they should be doing. And the hackers have caught up.”

Reed noted that, going forward, most businesses will not be able to get cyber insurance coverage until they move to minimum 15-character passwords. “We moved to that four years ago because I knew it was coming.”

And not just longer passwords — or, preferably, pass phrases that are easy for the user to remember but impossible to guess — but two-factor authentication, like a code sent via text or email to the user’s phone. “You have to do that,” Hogan added. “When we install a new environment for a client, they have to do multi-factor no matter what.”

In addition, “there are paid software programs that manage passwords for you and give you different passwords you can copy and paste into the program you’re trying to log into,” Reed said.

For those who choose their own passwords, replacing letters with symbols in a recognizable word — $ for S, ! for I, etc. — makes the password exponentially safer, Savas said, adding that length is still a better safeguard than complexity.

Hogan encourages password vaulting in password generation. “I never generate my own passwords. The client shouldn’t either. So when I go to create that password, I’m going to generate a password that’s going to be random; it’s going to be extremely complex. It’s not the name of my dog. It’s not the name of my car. It’s got nothing to do with me. And it’s going to be a password just for that one website, for that one portal. And then it gets saved to a secure vault.”

 

Common Sense

While all these procedures are smart, Hogan went on, they only work as long as a company’s employees follow them.

“Can I ensure that everybody’s doing this? No. Can it be a procedure that you mandate? Yes, you can mandate it. But tracking it is a little different. So we add a couple more things on top of all this. Besides password management, vaulting, and multi-factor authentication, then we do the dark-web monitoring and security-awareness training.”

But a lot of cyber protection still comes down to common sense. That includes what people choose to share online, Reed said.

“If you have your entire dossier of who you are on Facebook, Twitter, Snapchat, whatever, once that dossier is out there, that’s what criminals leverage,” he told BusinessWest. “That’s what’s going to convince your grandmother that you need help, because it really sounds like you.”

Or, convince you that your CEO wants you to click a dangerous email link.

“The hackers look at people that can approve wire transfers, ACH batches, you name it,” Hogan said. “They’re looking at owners, they’re looking at CFOs, they’re looking at controllers. We call that ‘whaling’ or ‘spear phishing,’ where they actually target a certain individual. And they’re very sophisticated. They come up with real information.”

Reed agreed. “If they’re going to impersonate the president or the CEO, the only way they’re able to leverage that person, with that crafty email, is if they spend months on social media learning about that person, gathering information to formulate the email. That’s what gets employees to click — because we all want to do what the CEO wants us to do.”

Much of this behavior, from smart password creation to avoiding phishing attacks, comes down to training, Hogan noted. And sometimes, even that’s not enough.

“We can talk until we’re blue in the face, but that doesn’t mean that somebody working at that company is going to follow those procedures properly,” he said, recalling a recent incident when a remote worker for a client used his own laptop to log into the company portal from a remote site, got a suspicious pop-up, and clicked on it, allowing a cyber attacker to navigate the company’s system.

“That’s a big issue. You know the environment that the client has is pretty darn secure, but when you’re having people from the outside log in from their own equipment that is not secure, you’re really running the risk of a breach.”

And many times, Savas said, companies don’t even know they’ve been breached. “The bad actors go in, look around, see if there’s anything worthwhile, then map out a strategy. And that, to me, is scary.”

On the plus side, he believes the message is getting across, and companies are buttoning up with proper training.

“More education is happening within organizations. Attempts are being made, but it all comes down to that individual user being educated, heeding those warnings, and being smart about the things they can control,” Savas explained.

“Confidentiality of the password, not opening attachments, not clicking those links. Those are the three elements that open up an intrusion,” he added. “A lot of it is preventable. The majority is preventable.”

Massachusetts Awards $14 Million to Address Digital Equity

By Contributor
Cybersecurity

Bridging the Divide

Leaders from the Commonwealth’s Executive Office of Economic Development and the Massachusetts Broadband Institute (MBI) at MassTech recently announced $14 million in new grants from the state’s Digital Equity Partnership Program to address statewide digital-equity gaps during an event at Tech Foundry in Springfield.

The three grants were announced by Economic Development Secretary Yvonne Hao, who highlighted selected projects from Tech Goes Home, which will receive $4.5 million; Vinfen, on behalf of the Human Services Alliance for Digital Equity, which will receive $4.3 million; and Baystate Health, on behalf of the Western Massachusetts Alliance for Digital Equity, which will receive $5.1 million.

“Massachusetts has a real opportunity to close the digital divide and ensure all people in our state can participate in the digital economy,” Hao said. “These grants will help residents build their digital skills and get online affordably, thereby expanding their connections to job and training opportunities, healthcare resources, social connections, and so much more. We are grateful to the Massachusetts Broadband Institute for its work to make affordable high-speed internet available to residents across the state.”

The secretary was joined at the event by business and nonprofit leaders from across the state, highlighting the critical need for increased digital connectivity for residents statewide, an issue that grew in importance during the COVID-19 public-health crisis. Following the secretary’s remarks, MassMutual Chairman, President, and CEO Roger Crandall spoke about the issue, appearing in his role as a board member of the Massachusetts Competitive Partnership, which published a report last year titled “Connecting Communities through Digital Equity,” highlighting the importance of addressing digital equity statewide.

“Internet access is a crucial driver of economic and social advancement, from fostering innovation and creating new jobs to utilizing government and community services,” Crandall said. “Yet, far too many households in Massachusetts lack broadband service, creating a significant barrier to many career and educational opportunities. The business community has a collective responsibility to help address this inequity by continuing to invest in and expand access to digital infrastructure, literacy programs, and affordable digital tools for all residents throughout the Commonwealth.”

The event included a roundtable discussion with executives from the three grant-recipient organizations, which pointed to the digital-equity challenges Massachusetts citizens face each day and how the awarded projects aim to increase connectivity and access. The grants will support two years of critical digital-equity project development and implementation across the state.

“The genesis of the Alliance for Digital Equity in June 2020 was a direct response to digital disparity — not new — and our societal dependence on the internet to address to meeting basic material needs as the COVID-19 pandemic surfaced,” said Dr. Frank Robinson, vice president of Public Health at Baystate Health. “It was embarrassingly obvious that digital marginalization for already-marginalized people would exacerbate negative health outcomes, economic oppression, and racial injustice. Digital equity and inclusion is truly a super-social determinant of health, critical to our meaningful progress toward health equity and satisfying basic human rights in this connected society, linking people to vital resources, such as jobs, education, healthcare, food, and information.”

The Digital Equity Partnerships Program was launched in September 2022 with the goal of designating qualified organizations to implement projects that meet the goals outlined in the Commonwealth’s ARPA COVID recovery legislation, which created a $50 million fund to bridge the digital divide in the state.

“I am thrilled to see that Baystate Health, in partnership with the Western Massachusetts Alliance for Digital Equity, have been recognized by the Commonwealth’s Digital Equity Partnership Program and received a grant of $5.1 million to continue addressing the digital divide,” state Sen. Jo Comerford said.

State Sen. Adam Gomez added that “the funds created by the ARPA COVID recovery legislation of 2021 represented a momentous step toward bridging the digital-equity divide for Western Massachusetts. There are far too many unserved communities in this region of the Commonwealth who do not have simple access to WiFi. Communities in this region will now have substantially increased access to not only WiFi, but also support for key programming areas such as digital literacy, public-space internet modernization, and connectivity initiatives for economic hardship. Eliminating the digital-equity divide in Western Mass. is absolutely crucial to supporting a thriving economy.”

While the state has made trides to improve broadband and WiFi access, state Rep. Lindsay Sabadosa noted, many communities have been left behind, much public housing remains unwired, and towns that don’t know how to fund projects that would level the playing field for all residents. “The Digital Equity Partnership Program will assist these communities, providing important funding and assistance in learning how to incorporate this technology into their daily lives.”

Springfield Mayor Domenic Sarno said the Digital Equity Partnership Program will help eliminate or mitigate the barriers faced in accessing digital equity and help close the digital divide. “Access to affordable and reliable internet is essential for our residents, and achieving this goal will not only enhance the quality of life for many, but will also help advance vital economic-development projects and educational initiatives, not only here in Springfield, but across the Commonwealth.”

The state’s digital-equity programs build on initiatives launched in response to the COVID-19 public-health crisis, which included public WiFi hotspots in unserved towns in Western and Central Mass., as well as the Mass Internet Connect program, which worked with MassHire to provide financial support and digital-literacy tools to help get unemployed residents back to work.

The MBI has also launched a Municipal Digital Equity Planning Program to support Massachusetts communities with planning activities that will help build a broad understanding of how a lack of internet access is impacting residents in their community, as well as a Broadband and Digital Equity Working Group comprised of stakeholders from across the state that will inform the makeup and focus of state programs, providing key technical expertise and representation of target populations.

“Our partner organizations are leaders in the digital-equity field and have cultivated an incredible network of local stakeholders who will ensure these funds have maximum benefit to the communities they are designed to serve,” said Michael Baldino, MBI director. “Today’s grants, coupled with our municipal planning program and the engagement of our dedicated working-group members, will ensure that the dollars invested lead to the desired impact — more residents will not only gain access to devices, digital skills, and more affordable internet, they will have access to a wider range of social, educational, and healthcare resources.”

AI Promises to Impact the Workforce in Unexpected Ways

By
Cover Story Cybersecurity

Rise of the Machines

 

Twice a year, Tom Loper participates in a Cybersecurity Advisory Council meeting. The last one was … different.

“I would say there was a sense of concern that I hadn’t seen before at that council because of ChatGPT and the phishing potential,” said Loper, dean of the School of Arts, Sciences and Management at Bay Path University.

He explained that people can use ChatGPT, the AI chatbot that has drawn major worldwide attention since its unveiling last fall, to input information from any website, or emails from an organization, to generate a phishing episode much more realistic, and much more likely to draw a response, than its target had ever received.

“These are people — from Facebook, from Fidelity, from the Hartford, from every major organization you can think of in our area and beyond — who were taken aback by the capabilities of ChatGPT,” Loper said.

“It really scares the hell out of all of us, because we know the biggest problem that we have in cybersecurity, the biggest challenge, comes between the brain and the keyboard. Human beings allow people in.”

“It really scares the hell out of all of us, because we know the biggest problem that we have in cybersecurity, the biggest challenge, comes between the brain and the keyboard,” he explained. “Human beings allow people in. The systems are very good at stopping people from breaching — flags go off, bells and whistles go off. But the biggest problem we have is the human intervention that has to take place. And human beings make mistakes. Especially when we’re connected to the outside world, we make mistakes that allow phishing to take place.”

Tom Loper says ChatGPT is already making work easier

Tom Loper says ChatGPT is already making work easier for students and professionals, but that raises issues ranging from plagiarism to how jobs might change.

And ChatGPT just made that challenge even more daunting.

But the impact of this and other AI tools extend far beyond cyberthreats.

“AI has the ability to be as impactful as the internet — possibly even as impactful as electricity — on the way business is conducted,” said Delcie Bean, president and CEO of Paragus Strategic IT in Hadley. “We all knew this day was coming for a long time, but now it’s here, and by the end of this decade, the only businesses that will still be in business are the ones that embrace the change.”

Bean explained that these tools allow enormous amounts of work previously done by humans to be completely automated, often in a fraction of the time and with much greater accuracy — and not just basic administrative work.

“We are also talking about highly complex work like computer coding, law, and even practicing medicine,” Bean related. “In a recent demonstration, AI correctly diagnosed 225 cancer cases within 18 minutes and at 85% accuracy, while human doctors took 50 minutes and only achieved a 64% accuracy rate with the same cases. Between now and the end of the decade, we are going to see dozens of new companies and technologies emerging, displacing a lot of legacy processes and technologies at a rapid pace.”

What does that mean for employers, the workforce, and job opportunities in the future? No one has all the answers to that question — although ChatGPT itself took a stab at it for us  — but there is broad agreement that change is coming.

“AI has the ability to be as impactful as the internet — possibly even as impactful as electricity — on the way business is conducted. We all knew this day was coming for a long time, but now it’s here, and by the end of this decade, the only businesses that will still be in business are the ones that embrace the change.”

“This really challenges all forms of expertise because it’s drawing on this incredible domain of knowledge,” said James Wilson, professor of Business at Bay Path. “Now, the accuracy of it, the citing of it, all that is not there yet. But it will come.”

Wilson recently started teaching courses in a certificate program on digital transformation, which includes discussion of the impact of AI on the workplace.

“It started as a therapy session because the students were like, ‘what’s the future going to be? What skills do I need to have? What’s going to happen?’ It’s very uncertain. We have these things called human skills … which are presumably going to differentiate us from this artificial intelligence — that is, creative thinking, inquiry, critical thinking, collaboration. You’re not going to run your business on ChatGPT.”

Delcie Bean says AI promises to disrupt

Delcie Bean says AI promises to disrupt not only administrative and computer careers, but law, medicine, and a wide range of other fields.

But that’s not the only viewpoint. “The most pessimistic view of this is that AI will do for humans what the automobile did for horses,” Wilson said. “There are some dire projections.”

 

Future … Tense

Loper and Wilson have delved into the capabilities and possibilities of ChatGPT and other AI tools on the higher-education level, and they’ve been impressed.

“ChatGPT is the hot topic because it’s a breakthrough in the way it uses large language processing,” Loper said. “It’s never been made available to the public like this before. The exciting part is how it processes data at a phenomenal speed — it’s absolutely amazing.”

And it’s not just regurgitating knowledge, he stressed. Xiaoxia Liu, assistant professor and director of Applied Data Science at Bay Path, has been using ChatGPT in her classes, helping students finish programming projects.

A Brief ‘Interview’ with ChatGPT

We went right to the source and asked ChatGPT for its take on this article’s topic. These are the answers it provided within seconds.

How will ChatGPT and other AI tools threaten the job market in the coming years?

AI tools and automation have already impacted the job market in many ways, and it is likely that this trend will continue in the coming years. ChatGPT and other AI tools can automate repetitive or low-level tasks, leading to job displacement for those whose work can be automated.

However, it’s essential to note that AI tools and automation can also create new job opportunities, particularly in areas that require specialized skills or expertise in implementing and managing AI technology. Additionally, the use of AI tools can increase productivity and reduce costs, which can result in businesses expanding and creating new job positions.

Overall, the impact of AI on the job market is complex and multi-faceted. While some jobs may be replaced by automation, new opportunities may arise, and existing roles may evolve and require different skill sets. It is essential for individuals and businesses to adapt to these changes by acquiring new skills and embracing the opportunities presented by AI.

What are some jobs that ChatGPT and other AI tools will impact the most?

ChatGPT and other AI tools are likely to impact a range of jobs, particularly those that involve repetitive or low-level tasks that can be automated. Some examples of jobs that may be impacted the most include:

• Customer-service representatives: ChatGPT can automate many customer service tasks, such as answering common questions or directing customers to the appropriate department.

• Data-entry clerks: AI tools can be used to scan and input data, reducing the need for manual data-entry clerks.

• Factory workers: AI-powered robots can perform tasks such as assembly-line work, reducing the need for human workers.

• Drivers: The use of self-driving cars and trucks may impact the job market for drivers in the coming years.

• Financial analysts: AI tools can analyze financial data and identify patterns, potentially reducing the need for human financial analysts.

• Retail salespeople: The rise of e-commerce and automated checkout systems may reduce the need for human retail salespeople.

• Administrative assistants: AI tools can be used to automate tasks such as scheduling appointments, managing email, and organizing files, reducing the need for human administrative assistants.

It’s important to note that the impact of AI on these jobs may vary depending on the industry, location, and other factors. While AI may automate some tasks, it may also create new job opportunities in areas such as data analysis, AI development and maintenance, and other specialized roles.

Write a haiku about how AI might change the way people work.

Machines learn and grow.
Work becomes more efficient.
Humans thrive with ease.

“She gives them a start, and then they have to finish it; they use Python or whatever to finish it,” Loper explained. “Now, she’s letting them use ChatGPT, and they’re finishing it in seconds. And it’s very accurate, very fast. She’s excited about that. That’s an example where ChatGPT uses large language learning to help it finish something that you started without you giving it much guidance at all, other than the start of the program.”

Loper noted that ChatGPT also gives different answers to questions based on who’s asking and in what way.

“The algorithm, for whatever reason, is drawing on what it thinks is ideal, but your past references influence the way that it searches. The type of question you ask generates a certain type of format and answer. So if you’re asking a business question, you get an answer in a business format. If you’re asking a question for a literary magazine, you get a different format.”

And that raises issues with academic plagiarism, Loper noted, because professors can no longer throw a chunk of a student’s work into Google to get a definite take on whether something was lifted, verbatim, from another source.

He has experimented with generating presentations from ChatGPT based on a series of prompts, and recognizes the ramifications for students. “It was logically laid out and put in a format that, if a student gave it to me, I would say, ‘damn, that’s good. You really learned this material.’”

When it comes to cracking down on plagiarism, Wilson added, “we might have to abandon ship on that in a way, because it’s not so much about being original anymore as being creative in your inquiry and critical in your understanding of it.”

Wilson called up other AI tools as well during his talk with BusinessWest, from Butternut AI, which can build a website in 20 seconds, to Pictory AI, which generates videos, to Wondercraft AI, which asks for discussion prompts and will generate a full podcast, featuring multiple voices.

“I teach a business-analytics class, where it was all research, research, research. I don’t think it’s about research anymore,” he said of the way AI will affect academia. “I think it’s about asking the right questions. It’s about the right inquiry. It may not be about writing anymore. It may be about editing and getting a draft from the AI expert and then adjusting it. The amount of content that can be created is staggering.”

Even classroom lectures can benefit, he added. “I can put in a few prompts, and it generates an entire lecture. I can go in and change the text, which will then be re-narrated through AI. Suddenly, all my content is better organized.”

Amid all these implications is the compelling idea that AI will only get sharper.

James Wilson

James Wilson

“We’ve all gotten used to Siri, and we’ve all gotten used to Google, but now you’re going to have this super-intelligent, conversational assistant with you,” Wilson said.

Loper added that these discussions are no longer theoretical. He noted that speakers at the Davos World Economic Forum, among others, have been thinking seriously about what types of work are going to be replaced by artificial intelligence and what careers will continue to be dominated by human beings, with their unique sensing and critical skills.

“Human beings aren’t going away any time soon, but we’re going to have a level of augmentation that we’ve never experienced, and we don’t know how to work with it yet. It’s so new,” he added. “James and I are playing with ChatGPT, and we’re kind of in awe of it, but we’re just skimming the surface compared to some of the ways people are using it. It’s just amazing.”

Added Wilson, “if you try to imagine this in a much smaller sense, it’s like when the smartphone came out — how did that change business? Texting and emailing and video chat reconfigured the way things are done, but in a smaller sense.”

Loper agreed. “This is much bigger than anything like that.”

 

Risk and Reward

Przemyslaw Grabowicz, a computer scientist in the College of Information and Computer Science at UMass Amherst, is heading up a research initiative called EQUATE (which stands for equity, accountability, trust, and explainability), which is currently developing a coordinated response to the Biden administration’s request for public comment on its AI Accountability Policy.

“As a computer scientist, I believe technology can make our lives better, maybe in some senses easier,” he told BusinessWest. “But I think there’s a risk that, if we step into new technologies too quickly, then society may develop a distrust for new technology that may, in the end, slow down developments.”

The National Telecommunications and Information Administration (NTIA), a Commerce Department agency that advises the White House on telecommunications and information policy, is studying whether there are measures that could be implemented assure that AI systems are “legal, effective, ethical, safe, and otherwise trustworthy.”

“Responsible AI systems could bring enormous benefits, but only if we address their potential consequences and harms,” NTIA Administrator Alan Davidson told Reuters. “For these systems to reach their full potential, companies and consumers need to be able to trust them.”

In crafting accountability policies, Grabowicz said, leaders in all areas of life need to think carefully about the consequences of technology development and ways in which profits from this development will be converted into long-term societal gain rather than short-term profits. If not, such technology may contribute to the growth of misinformation and polarization.

“As a society, nobody wants these kinds of consequences, but if corporations focus on short-term financial gain, they may not consider the potential harmful consequences of technology being used in a way that it wasn’t meant to when it was developed.”

Such questions, Bean noted, will be further accelerated by advances in other technologies, especially robotics. “We are rapidly approaching the day when there will be free-standing robots in our lives who are able to think, make decisions, and interact with the world around them.”

In terms of security, he went on, it is hard to quantify the threat. “With Microsoft’s new tool VALL-E, which can mimic a human voice with a sample size as small as three seconds; deepfakes being able to be produced in minutes by anyone with basic computer skills; and more and more data being available to be mined, we are going to need to rethink security.

“While it is possible to imagine how technology will respond to meet these threats, the risk to businesses is the gap that exists in between the threats coming online and the response being available and adopted,” he added. “A lot of businesses are likely to face real threats in that gap — not to mention physical security, things like hacking a moving vehicle or sending a robot to conduct a robbery.”

In short, Bean said, “while there is much to look forward to, there are certainly many threats that will need to be understood and addressed.”

Meanwhile, artificial intelligence continues to evolve — in ways we may not even see coming.

Don’t Make Yourself a Target with Easily Cracked Passwords

By
Cybersecurity

Guessing Game

 

NordPass, a password manager that provides users with an encrypted password vault, recently released its annual report on the most commonly used — and, therefore, most easily cracked — passwords.

The most common password globally? That would be ‘password.’ The rest of the top five: ‘123456,’ ‘123456789,’ ‘guest,’ and ‘qwerty.’

In the U.S., ‘guest’ takes the top spot, followed by ‘123456,’ ‘password,’ ‘12345,’ and ‘a1b2c3.’

Clearly, not a lot of effort is going into creating such passwords, and it doesn’t take a hacker much time — mere seconds, actually — to defeat them.

Popular films and TV shows also rank among the past year’s most popular passwords, including ‘batman,’ ‘euphoria,’ and ‘encanto.’

“While the worst passwords might change every year, human beings are creatures of habit,” NordPass notes. “Every year, researchers notice the same pattern — sports teams, movie characters, and food items dominate every password list.”

Here are a few tips from the Federal Trade Commission (FTC) to create strong, secure passwords.

 

Make Your Password Long and Strong

That means at least 12 characters. Making a password longer is generally the easiest way to make it stronger. Consider using a passphrase of random words so that your password is more memorable, but avoid using common words or phrases. If the service you are using does not allow long passwords, you can make your password stronger by mixing uppercase and lowercase letters, numbers, and symbols.

 

Don’t Reuse Passwords

Use different passwords for different accounts. That way, if a hacker gets your password for one account, they can’t use it to get into your other accounts.

 

“While the worst passwords might change every year, human beings are creatures of habit. Every year, researchers notice the same pattern — sports teams, movie characters, and food items dominate every password list.”

 

Use Multi-factor Authentication When Possible

Some accounts offer extra security by requiring something in addition to a password to log in to your account. This is called multi-factor authentication. The something extra you need to log into your account fall into two categories: something you have, like a passcode you get via an authentication app or a security key; or something you are, like a scan of your fingerprint, your retina, or your face.

 

Consider a Password Manager

Most people have trouble keeping track of all of their passwords. The longer and more complicated a password is, the stronger it is, but a longer password can also be more difficult to remember. Consider storing your passwords and security questions in a reputable password manager. To find a reputable password manager, search independent review sites, and talk to friends and family for ones they use. Make sure to use a strong password to secure the information in your password manager.

 

Pick Security Questions No One Else Can Guess

If a site asks you to answer security questions, avoid providing answers that are available in public records or easily found online, like your zip code, birthplace, or mother’s maiden name. And don’t use questions with a limited number of responses that attackers can easily guess, like the color of your first car. You can even use nonsense answers to make guessing more difficult — but if you do, make sure you can remember what they are.

 

Change Passwords Quickly If There’s a Breach

If a company tells you there was a data breach where a hacker could have gotten your password, change the password you use with that company right away, and on any account that uses a similar password. And if someone is using your information to open new accounts or make purchases, report it and get help at identitytheft.gov.

 

Bottom Line

“Passwords are the locks on your account doors,” the FTC notes. “You keep lots of personal information in your online accounts, including your email, bank account, and your tax returns, so you want good protections in place.”

What Does the Cybersecurity Landscape Look Like in 2023?

By
Cybersecurity Special Coverage

Defense Mechanism

 

The numbers are staggering. According to Cybersecurity Ventures’ 2022 cybercrime report, the cost of cybercrime is predicted to hit $8 trillion in 2023 and will grow to $10.5 trillion by 2025.

The impacts on businesses are already well-established. According to security.org, one in every six businesses that fell victim to cyberattacks faces ransomware, and about half of them pay the ransom. And according to a report last year by Security Intelligence, the share of data breaches caused by ransomware grew 41% in the previous year and took 49 days longer than the average breach to identify and contain.

A study conducted last year by Positive Technologies among financial organizations, fuel and energy organizations, government bodies, industrial businesses, IT companies, and other sectors found that cybercriminals are able to penetrate 93% of company networks and gain access to local network resources.

Such breaches, obviously, affect personal data. In 2020 alone, data breaches exposed more than 37 billion personal records, 82% of which came from only five breaches, security.org notes. Data breaches affect not only companies and organizations, but also the people whose information is in the exposed records. And identity-fraud losses in 2020 cost its 49 million victims $56 billion in total, or roughly $1,100 per victim.

“Cyber insurance premiums are climbing, and it’s becoming increasingly difficult for companies to afford or obtain coverage.”

Clearly, the threat is real, and growing. Here are a few trends to consider when looking at the cybersecurity landscape, and what tech media and organizations are saying about them.

 

Rising Threats, Rising Liability

With the rise in cybercrime has come increased risk for businesses, and that means a much larger cybersecurity sector. According to security.org, the global cyber insurance market was worth $7.8 billion in 2020 and is likely to grow into a $20 billion industry by 2025. About 75% of all cyber insurance premiums are for businesses, and the rest for individuals. But that could be shifting as well.

So, too, is the responsibility companies bear for their own data security, Forbes projects. “Cyber insurance premiums are climbing, and it’s becoming increasingly difficult for companies to afford or obtain coverage,” the publication notes. “To negotiate insurance premiums and better risk coverage, businesses will be required to present evidence across a broad spectrum of security areas in order to prove compliance with leading cybersecurity standards and best practices.”

Organizations will begin to conduct enterprise risk assessments that highlight the maturity level of their cybersecurity program and proactively address any underwriting concerns, it continues, noting that risk assessments can help determine decisions around insurance gaps, limits, and coverage.

“With the distinct possibility of a global recession on the horizon, we expect to see ransomware attacks spike in 2023. However, larger organizations in regions heavily impacted during the ransomware boom are the most prepared for this wave after investing time and money in fighting back.”

As for those internal efforts, Forbes also notes that cybersecurity has become too complex for many organizations to manage on their own, and most companies don’t have the skills or resources to manage a full-fledged security operations center (SOC). For these reasons, many businesses will be forced to think creatively and could decide to outsource their day-to-day security operations.

Locally, one such SOC is being developed at Springfield Union Station, part of a state- and federally funded project announced in November to establish a Cybersecurity Center of Excellence at the site, which will also include a ‘cyber range’ for training.

Mary Kaselouskas, vice president and chief information officer at Springfield Technical Community College (STCC), which will manage the center, noted recently that “a lot of companies don’t have the resources for a fully operational SOC, or can even afford to have managed SOC operations,” so the need for a local SOC is clear.

 

Zero Trust on the Rise

One way businesses are increasingly curtailing cyber threats is through a concept called ‘zero trust.’

According to IBM, the idea, developed by John Kindervag in 2010 while a principal analyst at Forrester Research, is a broad framework that promises effective protection of an organization’s most valuable assets. It works by assuming every connection and endpoint is considered a threat.

Essentially, a zero-trust network logs and inspects all corporate network traffic, limits and controls access to the network, and verifies and secures network resources. A zero-trust security model ensures data and resources are inaccessible by default, and users can only access them on a limited basis under the right circumstances, known as least-privilege access. The strategy also authenticates and authorizes every device, network flow, and connection.

“As hybrid work became a way of life, more organizations have started adopting zero-trust frameworks, meaning all users, apps, and devices that request access are assumed to be unauthorized until proven otherwise,” Security Intelligence notes. “Organizations with a zero-trust approach deployed saved nearly $1 million in average breach costs compared to organizations without zero trust deployed.”

 

Connecting the Globe

Perhaps no cybersecurity trend has been bigger in the last several years than the scourge of attacks related to the supply chain. Analyst firm Gartner predicted that, by 2025, 45% of global organizations will be impacted in some way by a supply-chain attack.

“Cyber criminals look for organizations or industries teetering at the edge and then make their move to tip them over,” said Charles Henderson, an IBM global managing partner and head of IBM Security X-Force. “Last year, we saw that with manufacturing — a strained industry viewed as the backbone of supply chains. With the distinct possibility of a global recession on the horizon, we expect to see ransomware attacks spike in 2023. However, larger organizations in regions heavily impacted during the ransomware boom are the most prepared for this wave after investing time and money in fighting back.”

Global threats often require a global response, which is why, last year, the U.S. State Department announced the launch of the Global Emerging Leaders in International Cyberspace Security (GEL-ICS) Fellowship, in partnership with the Meridian International Center.

The fellowship will support the development of a diverse global network of future cyber policy leaders who share the U.S. and other partners’ vision for cyberspace, and is designed to equip emerging leaders from the governments of these foreign partners with the knowledge and global connections to be advocates of the framework of responsible state behavior in cyberspace, as affirmed by the United Nations General Assembly.

The first cohort of 20 to 25 government officials will engage in a year-long program on international cyberspace policy in 2023. Fellows will visit Washington, D.C., New York City, and San Francisco to engage with U.S. and international leaders from government, industry, and civil society. They will also participate in a series of thematic webinars to support continuing education and foster networking among the fellows and stakeholders.

Additionally, fellows will reconvene on the margins of the 2023 Internet Governance Forum hosted in Japan to mark the end of the program. With each year, fellowship alumni will form a growing, global network of proponents for a stable and secure cyberspace for future generations.

 

Good Time for a Job Search

If there’s a plus to the increasing cyber threat landscape, it’s an explosion in job opportunities. Even at a time when the IT industry is seeing massive layoffs, cybersecurity appears to be a safer harbor than other tech careers.

The global cybersecurity workforce grew to encompass 4.7 million people last year, reaching its highest-ever levels, according to a workforce study by ISC2. However, the same study found there is still a need for more than 3.4 million security professionals, an increase of more than 26% from 2021’s numbers.

The U.S. Bureau of Labor Statistics projects similarly robust need, estimating that the number of cybersecurity jobs will grow by 35% between 2021 and 2031. According to Cyberseek, of those 3.4 million professionals needed globally, about 770,000 opportunities are in the U.S. alone.

Opportunities Abound for Graduates of Cybersecurity Programs

By
Brian Levine says the UMass Cybersecurity Institute
Cybersecurity Special Coverage

Threat Level: Constant

Brian Levine says the UMass Cybersecurity Institute

Brian Levine says the UMass Cybersecurity Institute’s work is “security for the common good.”

 

Make no mistake, we live in an increasingly interconnected world, and the technology that makes that possible is always under threat from those who would mine, expose, and exploit data — often in life-altering ways. So while it’s no surprise that the cybersecurity field is rife with job opportunity, exactly how much opportunity (a half-million open jobs nationally, according to one study) may still raise eyebrows. Area universities with cybersecurity degree programs hope those statistics also raise interest in a challenging field that offers good pay and the chance to do some truly meaningful work.

It’s impossible to envision a world that doesn’t need cybersecurity, Brian Levine said, and that’s not exactly good news.

“I don’t think there’s any way this will go away, unfortunately,” he said, after listing common threats ranging from malware and ransomware attacks to massive breaches of consumer data. “It’s an ever-present problem. So what we do here is really important.”

He was referring to the UMass Cybersecurity Institute on the Amherst campus, which launched in 2015 with the mission of advancing what it calls “security for the common good,” said Levine, the institute’s director. For example, he has worked over the past decade to build tools used by law enforcement around the country — and the world — on cases of internet-based child sexual abuse (for example, the sharing of exploitative photographs).

“That’s a privacy issue, and a forensics issue,” he said, stressing that the institute’s researchers never lose focus on the human benefits of their work — in other words, it’s never just a technical exercise.

“The courses we offer are influenced by research that we do,” he went on. “We have a lot of pride in moving the research we’re doing into the classroom.”

That high-impact work is appealing to many who enter this profession, but one of the most obvious draws is the career opportunity. Matt Smith, director of Cybersecurity programs at Bay Path University, noted that a half-million jobs in cybersecurity are open across the U.S. — more than 20,000 of them in New England, and roughly two-thirds of those (13,389, according to the national CyberSeek research project) in Massachusetts — the 12th-highest total among all U.S. states.

“The industry is changing so rapidly.Turn on the news — one day they’re talking about ransomware, another day it’s the Colonial Pipeline attack … it’s all about security. So, workforce in this industry is in demand.”

“The industry is changing so rapidly,” Smith said. “Turn on the news — one day they’re talking about ransomware, another day it’s the Colonial Pipeline attack … it’s all about security. So, workforce in this industry is in demand.”

That’s the other side of the ‘bad news’ coin — at least for people who want to make a career of defending against threats that will only continue. “It’s real job security, with high starting salaries. You’re going to retain employment and have opportunities to upscale.”

Reflecting the many different niches in cybersecurity, Bay Path offers three undergraduate degrees in the field — digital forensics and incident response, information assurance, and risk management — as well as a master’s degree in cybersecurity management.

“We renew the courses every time we go live, sometimes two times a year,” Smith said. “Every time it’s being presented to another cohort, we look at the information being presented and decide if it’s still applicable, or how it can be improved upon.”

Matt Smith says the constantly evolving nature of threats means job security

Matt Smith says the constantly evolving nature of threats means job security and advancement opportunities for today’s cybersecurity professionals.

For example, “the Colonial Pipeline incident hadn’t happened two years ago — so, let’s talk about that this year and remove something else from the course. We’re always going through the courses, tweaking them, fine-tuning them, and I think that sets us apart from other universities. We handpick the material we incorporate, and we update it, and we use the best forensic software we can.”

And that’s a challenge, said Beverly Benson, Cybersecurity program director for the American Women’s College, Bay Path’s all-online arm, which offers intensive, accelerated versions of the undergraduate cybersecurity programs taught at the main campus.

“I am constantly doing research on threats, making sure my curriculum and content is fresh, because the reality is, those individuals who are trying to attack systems, they don’t take vacations,” she told BusinessWest. “We need to stay abreast of everything to make sure students are getting as up-to-date a curriculum as possible.”

The industry’s constantly evolving nature makes it attractive to many career seekers, she added.

“It’s not a repetitive type of field. There may be a framework to adhere to, but as technology advances, so does the work that needs to be done. Our world is becoming more connected and interconnected, and data is everything. Think about the gadgets in our homes — even washing machines, dryers, and stoves are connected to the internet. We need people to understand how to keep that data safe.”

For that reason, Benson went on, “cybersecurity touches everyone, whether it’s healthcare, financial services, food service, the travel industry, the Department of Defense, you name it. We’re a very interconnected world, and we’re able to do things faster because of data — so we need to protect that data, whether it’s at rest, in transit, or in use.”

 

Defending Data

Levine listed a number of ways the cybersecurity research — and classwork — at UMass affects real people.

“One professor looks at ensuring that people have censorship-free access to information on the internet, which can be very important if you’re a dissident in a country that has censored or filtered it,” he said. “Another professor works with differential privacy, and his technology is being used by the U.S. Census.”

That term refers to technology that allows the government, corporations, or anyone else to release statistical information while not exposing people’s individual data.

Beverly Benson

Beverly Benson

“It’s not a repetitive type of field. There may be a framework to adhere to, but as technology advances, so does the work that needs to be done. Our world is becoming more connected and interconnected, and data is everything.”

“One problem with studies that collect information about you and release it later is the possibility that someone’s personal details can be inferred by looking at the data set,” Levine said, noting that differential-privacy measures ‘fuzz’ the information so the statistics are accurate, but don’t reveal information about any one person.

“We have courses on what some people call ‘ethical hacking’ — how to analyze a computer for its vulnerabilities and learn to defend those vulnerabilities. It’s teaching students to be white hats,” he explained, adding that other classes delve into reverse-engineering security, digital forensics, ethics and law, and securing distributed systems — which, these days, means cryptocurrency.

“Cryptocurrencies are one of the hardest challenges — no one is in charge, and people are exchanging things of value,” Levine said, adding that, whatever the topic, UMass brings in experts with practical experience in the field to teach students. “We don’t want everything taught from an ivory-tower point of view. And we want to teach techniques that will survive past graduation in a quickly evolving field. It’s not just computer science.”

At the American Women’s College, Benson said the average age of a cybersecurity student is 35, many no doubt drawn by the expansive opportunities in the field. “We have career changers, we have people in IT fields who are looking to specialize, and some are new to it, looking to learn more about cybersecurity and join the workforce.”

She’s also gratified that the program is making a small dent in what is currently a male-dominated workforce, to the tune of 80%. Part of the pitch, she said, is the reality that work in this field is wildly varied.

“We have the opportunity to demystify cybersecurity,” she said. “I explain to our women that cybersecurity is more than someone being in a basement coding. Part of cybersecurity is things like risk management, which can be a more consultative approach, helping someone understand assets, risks, and how to protect against vulnerabilities. Those are not technical skills; those are essential business skills.”

Smith agreed. “This hits on financial services, healthcare, government, you name it. Every industry has been affected in one way or another by cybersecurity.”

He should know, having worked in a number of sectors, ranging from the Pentagon to the financial-services world, and he often calls on professionals who actually work in those fields to bring their real-world expertise to Bay Path students. “A lot of programs are computer-science-driven; they’re experts in coding and programming. When you jump into cybersecurity, it’s a different animal.”

Introducing more women into the field, and all the sectors it influences, would be a healthy development, he said.

“I’m the program director, but also their cheerleader,” Benson agreed. “They know my motto is ‘dare to dream,’ and having a diverse workforce will bring about diversity of thought, diversity of problem solving, diversity in the ways people will collaborate. And I think that’s so needed.”

 

Making Connections

Another needed element is networking and making connections in the field early, Smith said. Many Bay Path students take advantage of a Mass Cyber Center mentorship program, working with large companies like Baystate Health, Travelers Insurance, and MassMutual.

“Networking doesn’t happen only when you go to conferences,” he said in explaining the value of such programs. “And most employers, after an internship, offer something on the spot — they’ll say, ‘please, when can you start?’”

That’s huge for new graduates, who typically enter the work world in significant debt. “We’re one of the industries that actually tackles that cohesively. We’re actually getting them employed at a very high-level-paying job, thus cutting down on student debt,” Smith noted, adding that a graduate’s employer will often pay for further education as well.

Speaking of connecting students with careers, the UMass Cybersecurity Institute recently secured a renewal of its CyberCorps Scholarship for Service program, sponsored by the National Science Foundation, which began in 2015.

The latest grant will support approximately 31 scholars at the undergraduate and graduate levels in the university’s computer science and electrical and computer engineering degree programs by offering them full tuition and fees, a stipend ranging from $25,000 per year for undergraduates to $34,000 per year for graduate students, and a professional-development fund for one to three years of their degree program. In addition, students complete an internship at a federal agency during the summers and, upon graduation, work full-time at a federal agency in a cybersecurity role for one to three years at full pay and benefits. Then they’re free to move on, but many don’t.

“We’ve done this for 34 students already, and the vast majority have stayed in the government after their service period is up,” Levine said, noting that federal opportunities range from working at the Pentagon to protecting land and wildlife with the Environmental Protection Agency; from tracking down cybercriminals with the FBI to joining the Cybersecurity and Infrastructure Security Agency, which swoops in to manage ransomware attacks.

“This program will help create a new generation of cybersecurity professionals and researchers to address novel and challenging problems facing society,” said Sanjay Raman, dean of the College of Engineering at UMass Amherst. “These students will help to modernize the executive-branch workforce, advance science and technology at government laboratories, and secure our national defense.”

It’s that kind of real-world impact that inspires those who teach the next generation of cybersecurity pros.

“This is why I get up in the morning,” said Bay Path’s Smith, who worked in counterintelligence around the time of 9/11 and remembers how the world changed. “We did a lot of things to protect our country, and I’m proud of that. Now, I want to give back to the students and help them pick up some of the stuff I’ve learned, so they can excel in a workforce that’s begging for anybody with interest in their field.”

His job, and that of his department, is to stay at the forefront of developments in the field — and, again, they are constant — and continue to hone and evolve the program so it remains relevant and on the cutting edge.

“We want our students to stand out in the industry and get hired,” he said. “And we’ve been very fortunate — our students are landing some amazing jobs.”

 

Joseph Bednar can be reached at [email protected]

Older Adults Are Increasingly Targeted by Online and E-mail Scams

By
Cybersecurity

Vulnerable Population

 

When people think about cybersecurity threats, Stephanie Helm said, they often think only about the technical side — the ways in which electronic devices can be compromised and data stolen.

They sometimes forget about the human side of the equation — but that’s where older adults are often especially at risk.

“There’s a technical vulnerability that can be exploited, whether it’s somebody’s password, exploiting a vulnerability because they failed to update the device to include a patch, or maybe they’re using an unsecured WiFi when they’re in a public location,” said Helm, director of the MassCyberCenter. “So there’s a technical component that everyone using the internet is facing today.”

Just as critical, however, is what she calls the “social engineering of the individual,” where a victim willingly divulges information based on the fact that somebody’s engaging them in a personal way.

Stephanie Helm

Stephanie Helm

“These are professional people who know how to hit those emotional buttons and continue that relationship with the hope that somebody is going to divulge information.”

“Older folks might not have the comfort level with the technology to secure their information,” she said, “and they may be more vulnerable to the social engineering.”

Helm shared these thoughts and others during a webinar presented last week by LeadingAge Massachusetts, titled “Cybersecurity: Helping Older Adults Stay Safer on the Internet.” She joined Rubesh Jacobs, managing director of 24/7 Techies USA, and Judy Miller, director of Technology and Accounting for Kendal at Oberlin in Ohio, to discuss the reasons seniors are increasingly falling prey to online and e-mail scams, and what can be done about it.

“The number of scams leading to financial loss has been dramatically increasing since 2019,” Jacobs said, citing a Federal Trade Commission (FTC) report that the number of online scams tripled between 2019 and 2020, outpacing phone-call scams — which actually declined slightly — for the first time. Meanwhile, e-mail scams more than doubled.

“The acuteness of that spike is shocking,” he added. “We’ve also noticed this trend in our own call centers; 28% of calls we get for help are somehow related to fraudulent activities online.”

According to the FTC, Americans age 60 and up are falling prey to tech-support scams — in which someone poses as a computer technician to gain remote access to the victim’s computer — about 475% more often than those ages 20 to 59. (By contrast, the younger group falls victim to online-shopping scams 60% more often than seniors.)

“Senior citizens are really in that nexus where a criminal can get at them through technical means, or they can get at them through social engineering” — and often a combination of both, Helm said. “The protections you put in place have to look at both of those aspects because you’re not quite sure which of those things a person might be most vulnerable for. I think that’s really troublesome.”

Judy Miller

Judy Miller

“Seniors lose an average of $500 or more when they’re scammed, sometimes due to the fact that they are often trusting and polite, they own their own home, and they have good credit, so they make a good target.”

Effective cybersecurity, she explained, considers people, processes, and technology working together to make someone more resilient and likely to recognize scams.

“The components of social engineering are worth thinking about,” she added, noting that a scam might begin with a realistic bot, either on the phone or online, that shifts over to a live scammer if the victim responds.

Those victims, Helm said, are often lonely and want to talk to someone, or they’re trusting and grateful that someone wants to help them solve a problem, which is why scammers try to establish trust.

One reason for the recent spike in cases is that many older adults were much more isolated starting early in 2020, with family members avoiding most visits until after COVID-19 vaccinations arrived, she noted. But families do need to engage with these topics. “Having an ability to ask questions or to talk about things they’ve been presented with in a safe manner is really important.”

But seniors are far from the only victims, Helm said. “If they continue the engagement, these are professional people who know how to hit those emotional buttons and continue that relationship with the hope that somebody is going to divulge information.”

 

It Takes a Village

Miller has worked for Kendal Corp. for 28 years, so she’s seen these threats evolve at her own facility, which offers units for independent and assisted living, memory care, and skilled nursing.

“Seniors lose an average of $500 or more when they’re scammed, sometimes due to the fact that they are often trusting and polite, they own their own home, and they have good credit, so they make a good target,” she explained. “They have also been falling prey to cyber incidents because of their increased use of the internet.”

Scams that have targeted her residents have taken many forms, from imposters posing as legitimate government agencies or companies requesting payments to fake but attractive offers for gift cards, and much more. Most originate from e-mail, she noted.

When Jacobs asked Miller how often she hears such things, she responded, “it’s almost more important how much we don’t hear about them.”

To make sure people stay educated, if she hears of a scam targeting a resident, all residents are alerted, and some tech-savvy residents will even spread the word themselves if they encounter a scam attempt. “It’s really engaging the entire community to help each other in preventing some of those things from happening.”

Once a scammer gains someone’s trust, Helm said, they often introduce an element of urgency — the idea that the victim has to act now to get a deal or avoid a penalty or legal trouble.

“We should talk about how these scams exist and give senior citizens the confidence that they can recognize when this doesn’t make sense and avoid that sense of urgency to act, because that’s where you make a mistake,” she explained. “It’s perfectly acceptable to say, ‘I do all my business by mail — put a letter in the mail to me, and I’ll respond to you.”

But it’s easier said than done, she admitted, especially at a time when many seniors — and younger people, for that matter — have been more isolated than usual.

“I think it’s difficult for anybody in society to be fully armed and resilient. I feel if people become isolated in their old age and are not as familiar with some of the technology, they can get intimidated. So this is an area where we’re trying to see if we can be more helpful to them.”

Family members can help educate their older loved ones by asking gentle but probing questions about what may be going on, the webinar participants noted, and encourage residents of senior-living communities to call an administrator if they encounter a suspicious e-mail or think their information may have been compromised. And, of course, they should emphasize the importance of protecting passwords and other sensitive information, not clicking suspicious links, and shopping only at reputable, well-known websites.

“If it sounds like it’s too good to be true, it probably isn’t true,” Helm said. “I like to talk with senior citizens about having confidence in the skeptical skills they had throughout life. These are scams that happen to be on a computer, but they’re scams we grew up with since we were kids — bait and switch, or acting like an imposter.”

She takes a broad view of threats, having served in the U.S. Navy for 29 years. After her retirement as a captain, she taught military operations, specifically on integrating cyberspace operations into wargames.

“That was an opportunity to talk about how cybersecurity or cyber operations can affect operations that you traditionally would not think they would impact,” she explained. Now, in her role with the Mass Cyber Center, she knows there are few areas cybersecurity doesn’t impact — and that older Americans are often especially at risk.

“Today,” she said, “we all know this has great consequences to our daily lives.”

 

Joseph Bednar can be reached at [email protected]

Why Working from Home Can Increase Cybersecurity Threats

By
Cybersecurity Special Coverage

Risk and Reward

If the COVID-19 pandemic has taught businesses anything, it’s that employees, in many cases, can do their jobs from home — which can, in theory, lead to cost savings. But also expenses — the type of expense that, if ignored, can lead to much bigger losses.

We’re talking about data security. And what remote workers need depends, in many cases, on how long they plan on staying home, said Sean Hogan, president and CEO of Hogan Communications in Easthampton.

“We have some clients investing in the home office and planning on shrinking their bricks and mortar, so they’re going to save money on bricks and mortar or the lease,” he told BusinessWest. “But then they have to invest in bandwidth and security for the remote office. It’s a huge issue.”

And a sometimes messy one. In a shared workplace, Hogan noted, “you might have great security, firewalls, routers, you have security installed, you make sure all the security is updated, you constantly have the latest patches and revisions.”

But working from home poses all kinds of issues with the unknown, the most pressing being, what programs are running on home devices, whether those devices are loaded with viruses, and whether they can infect the company’s servers when they connect remotely.

“We’re trying to control security at someone’s own bandwidth at the house, where three, four, or five people may be trying to jump on at the same time,” he added. “It’s not shaped at all; it doesn’t prioritize any applications or traffic. Now, there are ways to do that — we can install SD-WAN software that allows us to monitor the connection and prioritize traffic like Zoom, Microsoft Teams, or GoToMeeting. That way, you don’t have everyone breaking up and having issues.”

Sean Hogan

Sean Hogan

“We have some clients investing in the home office and planning on shrinking their bricks and mortar, so they’re going to save money on bricks and mortar or the lease. But then they have to invest in bandwidth and security for the remote office. It’s a huge issue.”

But that doesn’t solve the issues of security holes in the home wi-fi — which have weaker protocols, allowing hackers easier access to the network’s traffic — as well as the human element that makes workers vulnerable to phishing scams, which are the top cause of data breaches, and insecure passwords, which allow hackers easy access to multiple accounts in a short period of time.

“The Internet has become the Wild West over the last 10 years,” said Jeremiah Beaudry, president of Bloo Solutions in Chicopee, starting with scam e-mails — from phishing attacks to realistic-looking but nefarious sites that try to wrench passwords and data from users and install malware on their computers.

“I get e-mails from clients three or four times a day — it used to be once or twice a week — saying things like, ‘I got this e-mail asking me to wire money to a client,’” he noted. “You can’t stop people from pretending to be someone else, and the language is getting more and more clever.”

That combination of possibly flawed technology and human errors make the home office a particular concern in the world of cybersecurity.

“Nobody has the exact answers right now for how to make the most secure connection at a remote office,” Hogan said, adding that going to the cloud has been an effective measure for many businesses, while others have taken the more drastic step of setting up physical firewalls at remote sites for key employees — say, for the CEO or CFO. “We’ll lock them down if they’re actually connecting to files and servers that are really confidential.”

Possible solutions are plenty, he said — but it all begins with knowing exactly what equipment remote employees are dealing with, and what threats they pose.

Viral Spread

COVID-19 isn’t the only fast-spreading infection going around, Hogan said. In fact, “45% of home computers are infected with malware. That’s an eye opener for many people. It’s a huge issue, and removing it is a huge challenge.”

One problem is the human element — specifically, how users invite threats in by not recognizing them when they pop up. Take the broad realm of phishing — the setting in which people receive such pitches can actually make a difference in how they respond, Beaudry said.

“It’s harder to sift through it when working from home; it’s not natural. You’re out of your element when you’re sitting at our desk in your pajamas, as opposed to being in your office at work. You may not be reading your e-mail as carefully as you normally would. You may not be on alert.”

A big piece of the puzzle is end-user awareness, he said. “You want to have your employees educated about what’s out there, so they know how to spot forgeries.”

Alex Willis, BlackBerry’s vice president of Sales Engineering and ISV Partners, recently told Forbes that companies trust their employees to do the right thing, and workers are generally honest, but trust can be a dangerous thing.

“The problem with just trusting people is that employees don’t always do this on purpose,” Willis said. “Sometimes, it’s just purely unintentional. They are working on a home machine that’s riddled with malware. They need access to corporate data. For instance, if the company issues a slow laptop to an employee and the employee has to get their job done, they are going to use their home computer that is faster to do the job. In that scenario, the home computer might not be as secure.”

Jeremiah Beaudry

Jeremiah Beaudry says home networks aren’t typically built to run as efficiently — or safely — as those in a workplace.

Again, it’s that issue of the unknown, Beaudry told BusinessWest. “You don’t know what they have going on with their home networks. We didn’t set up the home connection, we don’t know what they have, and everyone has different people on it. Some are borrowing it from their apartment complex or sharing it with the neighbors, and they expect the internet to work perfectly. It’s not going to.”

In an office, on the other hand, everyone is using the same network, running at the same speed, with the same level of security and firewall protection. “Then, when they go home, there are so many variables.”

The best-case scenario is to give employer-owned devices to employees so they can remotely manage information.

“You can put antivirus on an employer-owned device; when they’re using their own devices, you don’t know what they’re doing to protect it,” Beaudry added. “And if the employee is laid off or fired, you would have the ability to control any employer-owned data.”

At the very least, he said, companies should encrypt the traffic between their network and individual users’ home computers.

“We put monitoring agents on remote clients that monitor for any viruses or malware and will update their antivirus and malware protection in some cases,” Hogan added.

Vigilant Approach

None of this completely addresses the speed and efficiency issues of home devices. “Usually, in a home office, they pay for their own bandwidth, and the business can’t say, ‘we don’t want your kid playing Fortnite,’” Hogan said. “That’s the challenge.”

“I get e-mails from clients three or four times a day — it used to be once or twice a week — saying things like, ‘I got this e-mail asking me to wire money to a client.’ You can’t stop people from pretending to be someone else, and the language is getting more and more clever.”

“Some clients will pay for a second, business-only connection for remote workers, he added. “But that’s pretty extreme; not many are doing that.”

More popular — and effective — is the move to a virtual environment. Working in the cloud, he noted, means not worrying about the hub-and-spoke relationship between physical servers and computers that’s the biggest weak point for security. “Most of my clients have eliminated that weakness.”

For some clients, the cybersecurity issue is especially critical — take medical businesses, for whom privacy is paramount in the HIPAA era. “That changes the game completely,” Hogan said, noting that one resource for companies handling sensitive data is a SOC, or security operations center.

“Clients who really value security can sign up with a SOC team that responds in case of a breach,” he explained. “It’s a lot of monitoring, detecting, and responding.”

Delcie Bean, CEO of Paragus IT, said any investment in platform migration and remote work has to be accompanied by investment in strong security tools — and education.

“The legacy tools and technologies used to secure networks for the past 10 years need not apply for this next wave of mobile workers,” he told BusinessWest. “Security of the future will be a lot more about multi-factor authentication, deep encryption, and will involve a lot more end-user training as well as testing than the command-and-control style approach of the past.”

Hogan agreed. “Password management is so massive,” he said, noting that people resist simple protections like multi-factor authentication, or even just using complicated passwords, or different passwords for different sites.

“We are also dark-web monitoring pretty consistently,” he added. “The dark web has been on fire lately — a lot of breaches.” Once data fall into those hands, the damage is done, he added, “but the important thing is to know what got breached, and if you can tell what credentials are out there, so you can change them.”

The bottom line, Beaudry said, is to make sure employees use unique passwords and encrypt connections remotely, and not using tools that are potentially vulnerable.

“And there’s a long list of tools known to be exploited by hackers, so it’s good to check with an IT professional before using any remote desktop method,” he added. “Some methods require you to open firewall ports that can leave you vulnerable to ransomware and all sorts of awful data breaches. The main thing is to make sure your firewall is locked down and no unnecessary ports are open, and you have backups of all data.”

That’s a lot to consider when moving into an era of expanded remote work — some of which comes at a cost. But the cost of ignoring it is much higher.

Joseph Bednar can be reached at [email protected]

News

Contact

Advertise

Events