Is Bitmining Raising Your Electric Bill?; It's Time to Try High Fidelity Automated Attack Disruption Techniques; Password Manager Vendor LastPass Breached Was Caused By Engineer’s Use of Reusable Passwords for Remote Access

I’m sure this will be a Netflix mini-series in a few weeks! Remember the days of having to check the PBX phone bills for employee misuse? “Bitmining” means doing that for the electric bill. But, a good overall reminder that unauthorized use (by employees or intruders) of computing systems needs to be detected.

John Pescatore

Cryptocurrency mining requires a lot of electricity to both power and cool the equipment. If you can figure that piece out, then the mining operation can be profitable. I am a bit surprised that in a high energy cost state like Massachusetts, government officials didn’t notice the spike in electricity costs sooner, to bring this crypto mining capper to a close.

Curtis Dukes

Cryptomining uses a lot of power, so in places like New England where power is expensive, it's hard to be profitable unless you find a way to offset that cost. In this case, about $17.5K of power was purloined from the school. If you're not already watching for unexplained spikes in your power bill to detect mining, add that to your list.

Lee Neely

Can you imagine you and a friend setup a crypto miner in high school and the US Coast Guard is called? I am sure some 15-year-olds are completely freaked out right now. The question is what happens next? Hopefully, they are guided in the right direction and not treated solely as criminals.

Moses Frost

It’s one thing to speak to the need for strong security by ICT vendors, another entirely to measure for compliance. The US is a signatory to the International Common Criteria Recognition Arrangement, which sets the requirements for evaluation of ICT products. It’s mostly been a failure: high cost to the product vendor, lengthy evaluation process, lack of demand by consumers, stifled innovation, and inability to maintain state of security. Until we develop and mandate new criteria for implementing “strong security as a standard feature in [vendor] products,” adherence to cybersecurity best practices, such as the CIS Critical Security Controls, is the only defense.

Curtis Dukes

The lack of effective self-regulation and focus by vendors, including cybersecurity vendors, on good cybersecurity is coming home to roost for those vendors. It is interesting to see how governments are now looking at introducing regulations to force vendors to improve their cybersecurity. The EU is already implementing this with its EU Cybersecurity Certification (https://www.enisa.europa.eu/topics/certification/eu-cybersecurity-certification-faq) which requires vendors to meet minimal cybersecurity requirements for at least 5 years for the product or service.

Brian Honan

In-depth testing, unit/acceptance testing should be verifying both function and security features in products. With pressure to deliver faster, at all costs, the temptation is to let users find the issues. While I like the analogy of users being "crash test dummies", the reality is in the automotive industry, testing is risk based, life-safety is well vetted, while IT security is less so, as evidenced by car hacking activities. Your risk model has to be modified to include not only cyber security in development and testing, but also consider the impacts and potential liability for customers (internal and external) damaged by security flaws from your product.

Lee Neely

We have been saying this for almost as long as many of the readers here have been alive. I am not sure if this is a good or bad thing at this point. What I can tell you is that we will see how much security matters over the next few years as the world is trending into a much larger war footing.

Moses Frost

Hear, hear! While the market has demonstrated a clear preference for openness, generality, flexibility, feature rich, and early, the quality of our most popular software is an embarrassment to its authors, not to say a disgrace. Patches are so numerous and frequent as to suggest a reservoir of vulnerabilities both known and unknown. The result is a fragile infrastructure that makes us vulnerable both to criminals, all the time, and to nation state adversaries in times of armed conflict.

Moses Frost