To go and you get it.
Okay. Check one two.
Are you rolling?
So, we have it for the camera, could
you introduce yourself with your
name and title?
I'm Zach Oster, I'm the Chair of
the Department of Computer Science
at University of
Wisconsin-Whitewater.
So about cyber security, it seems to
be a growing field.
Tell me about it as
a university program.
So here at UW-Whitewater,
we have a number of different
programs related to cyber security.
We have a cyber security major.
We've got about 120 students
studying that.
We also have cyber security programs
in our information technology
and supply chain department, our
College of Business and Economics.
So we are a
center of academic excellence in
cyber defense designated by the
federal government.
So we're active in outreach.
In that area, we've helped.
School districts, we've helped
agribusinesses secure
their systems.
Why is cybersecurity a growing
field? Why is it so important these
days?
It's so important because the
number of cyber attacks just keeps
growing.
There are more every year, they
become easier to do every year
with the advent of AI.
That makes cyber attacks even easier
to without as much specialized
knowledge.
And there are
more targets.
So tell me about the state of cyber
security, how would you describe how
secure we are?
Well, not secure enough and
you know, no system is ever
perfectly secure.
That's that's impossible
but there's
a lot of a lot places where
there's
trailing off into the distance.
Tell me about some areas
where
we're most vulnerable.
A lot of the areas where we're most
vulnerable are places you
might not expect.
So local governments tend to
have vulnerabilities because they
have small IT staffs,
they maybe don't have a lot of
funding for cyber security, it's
not a top priority.
The top priority is serving the
people of the city or the county or
the school district.
But they have valuable information.
They have information
about the police records.
They have property records,
all kinds of vital records
that are worth money on the open
market.
Okay.
Or on the black market maybe.
Yeah, yeah.
So what are the
major concerns around cybersecurity?
What kind of damage can be done?
The amount of damage that can be
done, it varies by the cyber attack.
A lot of cyber attacks these days
are ransomware.
I think I've seen a number that it's
about 70% of all
cyber attacks are ransom ware.
Not sure about that.
A lot of cyber attacks tend to be
ransomware, where
you have an attacker is
able to get access to a system,
encrypt all the data, lock other
people out, and
basically send them a ransom note,
a literal ransom note saying, pay
me this amount of money in
real money or more often in
Bitcoin, and
you might get
your data back.
And if not, your data
will just go away.
What are some, generally some kind
of the cyber attacks you mentioned
ran somewhere?
Tell us what are the other attacks?
So there's ransomware,
there are phishing attacks which can
be linked to ransomware.
You have,
you know, somebody sends you an
email pretending to be someone else.
There's often a link that you can
click that goes to a page that looks
like a real website where they're
asking you to change your password
or enter in your bank account
information, enter your social
security number, any number of
things.
And it's not the website you think
it is, it's somebody else.
If you enter the data.
They've captured those data and they
can do whatever they want with them.
Talked about it briefly but walk me
through it a ransomware
attack from start to finish how does
that look
Yeah, so with a ransomware attack,
normally there's some way
that the attacker can
get into a system.
Maybe it's an open
connection on the internet,
maybe it's a website
that's not fully secured.
It could even be
a building where someone's able to
walk into the right room and plug in
a device in the right computer.
So, regardless of how they do it,
there's a...
The attacker finds a way into a
system and that's easier to do than
ever before.
A lot of that scanning for
vulnerabilities for ways into a
system that can be done in
an automated way, it can be done
using AI to
simplify the process.
Once they're in, they find
a way to
scramble the data, to encrypt the
data.
They might also pull off a
copy for themselves before they do
that because They can go
sell those data on the dark web,
there are people willing to pay
money for that data.
And once they've done whatever they
want to do, they lock down the
data, or they lock down the system,
they locked down the network, and
they send a ransom note to
whoever they think will have the
money to pay.
What are the options from the
victim's standpoint of about what to
do?
So one option is
pay the ransom.
That's normally not encouraged,
partly because we don't want to
incentivize people
to do more ransomware attacks.
If people think they can make easy
money from this, they're more likely
to do it.
But partly because if you pay the
ransom, there's no guarantee they'll
actually give you access.
They might have actually destroyed
everything behind the scenes and now
they have your money and your data
and you still have nothing.
So there's a chance you might not
get what you pay for.
Another option, probably the best
option is to contact your local law
enforcement. That's something you
should do right away.
So law enforcement has special
cyber incident response teams.
There are several throughout the
state of Wisconsin, a lot of them
staffed by volunteers with cyber
experience.
The federal government also has
cyber incident response folks who
can help in some cases
navigate the process.
UW-Whitewater also has a cyber
security center for business that
can help with some of that outreach.
If we can't do the work ourselves,
we can certainly refer people to
those other resources to
help them
get help recovering their
data, hopefully,
and certainly developing
better practices to make themselves
and their organizations more
resistant to cyber attacks in the
future.
Places should be, is there hope
for getting the data back and
restoring things to the way they
used to be?
Are we talking about?
Not the specific, in general, just,
yeah. When there is a ransomware
attack,
is it possible to correct things?
If you or your organization
has backups of your data,
then yes, that's probably the best
case scenario.
If you already have your data backed
up, if you're updating those on a
regular basis, keeping them fresh,
then you can just
look at the ransomware note and say,
well, we already have a
copy backed up so
no thanks, we won't pay.
And then there is
some recovery time.
You'll have to probably take the old
system down.
Load those backups in, get
everything functioning.
A lot of the times, searching
for data becomes challenging because
you have to rebuild those
databases, the search systems,
get every thing re-indexed.
But that's probably the best case
scenario is if you have those
backups in place then
maybe you lose a day or
two of work, of
data, of transactions.
But you're able to recover what you
had to end.
Eventually get back up to speed
pretty close to where you were
before.
So having backups ahead of time is
really the best protection against
a ransomware attack or any other
kind of cyber attack.
Who are the targets of cyber
attacks?
Increasingly anyone is the target
of a cyber attack,
government agencies tend to be
more attractive targets because they
have those data that might be
confidential, they might be
protected.
They have a lot of personal
information about us.
Large companies are also attractive
targets to cyber attackers for the
same reason.
Lots of data
that are not publicly available that
can be valuable to other people.
But even individual people
like you and me are
potential victims of cyber attacks.
So we get phishing emails.
I personally get phishing emails
multiple times a week sometimes.
As a professor in computer science.
You mentioned this, but...
Are smaller government entities or
agencies or smaller
communities more vulnerable
attack, more
vulnerable victim for cyber attacks?
So smaller government agencies,
local governments, can be more
vulnerable victims.
And often, that's because they just
don't have as many resources to
devote to cybersecurity,
specifically. If you're the federal
government, if you're a state
government, you probably have
enough resources to
have dedicated cybersecurity
specialists working for you.
If you are a local government,
especially in a smaller locality, a
smaller city or county or school
district.
Uh... You're less likely to have
people who can just dedicate their
time to monitoring for cyber attacks
and intrusions and
data breaches
Is there something about their
computer systems that maybe also
make them more vulnerable?
So in a lot of cases,
smaller governments might have
older computer systems.
They might not be fully patched in
some cases.
Again, that's a resource limitation
in some cases, maybe they can't
afford the latest and greatest,
or they don't have people to make
sure that all the systems are
patched. They're getting the latest
security updates.
They're protected as well as we
would maybe want them to be.
How disruptive can these attacks
really be?
They can be very disruptive.
They can take an entire
county government or an entire city
government or organization down for
multiple days or part
of an organization.
Then what happens after the attack?
You mentioned they have to rebuild
the system.
Is that easy?
What happens after?
So rebuilding a system, it's
a lot easier if you have a backup.
If you don't have backups, it
becomes much more difficult because
now you're looking at possibly
reconstructing data from other
sources, maybe old paper
copies if you can have them.
But even if you do have good
backups, it does take time.
So initially when you're responding
to a cyber attack,
the first things you're doing are
figuring out what the damage is.
How far did the attackers get into
the system? What did they possibly
take? And then you're also doing
public notifications.
You're basically telling the public
as much as you can at
the time, making sure you're not
giving false information.
So there's often limits to how
much the public knows
after a cyber attack.
Sometimes it's because the
investigation's still ongoing.
They don't know how much damage
has been done. And sometimes it's...
Maybe there's a criminal
investigation going and
law enforcement doesn't want to tip
off the attackers.
So there can be any number of
reasons why not
much information is shared early on.
Is there insurance against cyber
attack?
There is cyber insurance,
and increasingly it's very much
recommended that
businesses have cyber insurance and
all kinds of organizations have
cyber-insurance.
That's something people can talk to
their insurance agents about.
Even a lot of personal insurance
policies have coverage for
cyber-attacks, so as
individuals it's worth checking
whether your home or your auto
insurance includes coverage for
cyber-attack.
I know personally I have
cyberinsurance on my auto insurance
coverage.
So it's definitely worth it for
people to talk to their insurance
agents.
There are private companies that
sell additional cyber insurance.
You've probably seen advertisements
for some of them.
And that can be a good choice too,
depending on individual people's
risk profiles,
what they feel they need to protect
themselves, or it may
not be necessary.
So I'd encourage people to talk to
their endurance agents.
And sometimes they can give tips on
ways to be more cyber prepared too.
How would that work if a government
entity wanted cyber insurance?
How would help protect them or
help them after an attack?
So, of course, with insurance,
part of what you're covering is
the costs of recovery.
That if you have cyber insurance,
you can make a claim to the
insurance company to pay back some
of, for example, the overtime that
you're paying IT people and
communications people to respond to
an incident like this.
But another thing that can give you
is access to experts.
So cyber insurance companies will
sometimes have their own experts
that can help you do some of
the investigation.
And they can also help you put you
in touch with law
enforcement folks who have more
resources to do cyber
forensic investigations.
Some numbers from the State
Department of Justice is showing
that there are more cyber attacks
being reported here in the state.
Do you know why we're seeing an
increase in cyber attacks?
In some ways cyber attacks are
getting easier.
I think that's a big reason
with especially with
AI Attackers
are using AI too, and
it means they can spread more
attacks more widely and
Basically, they just have to
get lucky once and they're into a
system and they can start doing
damage
Should victims consider paying the
ransom?
I wouldn't recommend that victims
consider paying the ransom.
There was the recent and
still ongoing case in Iowa
County where they
received a ransomware cyber attack.
Tell me what you think of that
attack and what's happening there.
Well, first
it's unfortunate that it happened,
but it looks like they
had backups for everything.
So one thing about Registers of
Deeds offices, they keep
good records, it's their job.
And so it looks they've been able to
reconstruct the records from what
they had, even if that has been
a time-consuming process.
They've slowly been able get things
back online and they're continuing
that process.
And that's.
I'm sure they're all putting in a
lot of extra hours.
So where do you see this all going
in the future?
Cyber security, ransomware, and
cyber attacks.
What do you, what do you see
happening down the line?
It's going to continue being a
problem.
So cyber security in general,
it's always an arms race.
So attackers get better at their
jobs, cyber defenders get
better at finding those attacks and
then attackers find new ways
into systems.
So it's a little bit of a game of
cat and mouse but there
will definitely still be
cyber attacks and still be a need
for people to be aware
of good practices in their own
lives for cyber hygiene.
In hindsight, after an attack,
what should
agencies or individuals even
have done?
Like immediately after an attack.
Yeah
If we had a magical time
machine, if somebody got attacked,
what should they have done to
prevent an attack?
Oh, to prevent it before.
Yeah.
So one really good way of
preventing an attempt.
I'll say it again.
One of the best ways to prevent
yourself from being attacked or your
organization is just be careful
before you click.
Think before you quick.
We all get a lot of emails.
We work quickly, we think
fast, and sometimes if
we're just not quite careful, making
sure that email is from the
people we think it's from, we can
click the wrong link and
end up giving our information to
someone who shouldn't have it and
that can be the way in that they
need.
Anything else on this topic that I
haven't asked about that's
important?
Mind if I check my notes?
Go ahead, yeah.
Is there anything you're thinking
of?
Sorry? Anything you're think of?
Let me mute that.
I forgot to mute that!
Oh, that's something I probably
could talk about, incident response,
planning, like planning for
something to happen.
Yeah. Okay.
So how should an organization or
an agency, a government agency,
plan for a cyber attack?
So there are steps
that you can follow to plan for a
cyber attack. First, assume
that you will get attacked
eventually.
So no system can ever be
perfectly secure.
No organization can ever beat
perfectly secure, essentially the
attackers just have to be lucky one
time.
So it's important to have plans
in place.
Think about when the attack
happens, who are you going to call?
Are you going call law enforcement
or are you gonna call your cyber
insurance provider if you have them?
Think about the messages that you're
going to put out to the public,
if you're an organization, to your
friends and family, if your a
person.
So probably the first and most
important step is know who you're
gonna call when there is an
attack.
Ways that systems can be
tested prior to an attack?
Is there something like penetration
testing? Is that?
So there are companies
that will do penetration testing.
There are other organizations that
will do it as well.
I'll start that again.
Sure, sure.
You can hire people to do
penetration testing.
It's essentially ethical hacking.
You're giving them permission to try
to get into your systems,
your databases, and
see what they can find, see
how they can get in.
That can include simulated
phishing attacks.
So I know here
at UW Whitewater, we have those.
Our IT folks will send out.
Phishing emails that they craft and
if people click the link it goes to
a training page that says you
clicked a phishing link.
Here's how to avoid that in the
future.
So training your people is a really
good way to prevent cyber attacks
and that can be a good way.
To do it those penetration
testers they'll give you
a report afterward they'll describe
to you how they got in step-by-step
to help you close those gaps.
Anything else?
I think we covered a lot of ground.
Okay, you want to do a little room
tone?
Sure. Okay.
We'll just sit here quietly for a
few seconds.