Think like a modern superhero

In a presentation hosted by Bal Chem, Andrew Rose of the nonprofit organization Bioeconomy Information Sharing & Analysis Center (BIO-ISAC), discussed a critical and timely question: Could your operation survive a cyberattack?

Rose refers to himself as an “accidental expert” in cybersecurity. He was curious about what was happening in agriculture and whether it was adequately protected. Hoping to uncover gaps, Rose pursued ransomware.

Ransomware is malicious software that encrypts files and blocks access to systems. It spreads through malicious links such as phishing emails (those that are unfamiliar and often demand payment), stolen credentials or a computer system that hasn’t been updated or protected.

Rose mentioned a friend who said, “If you have an emotional response to information, you are being manipulated. Stop and ask yourself why.”

That response comes from the limbic system (or “reptile brain”), which doesn’t have the capacity for rational thought, said Rose. It’s just feelings and emotions. This sounds like something from a basic psychology course, but it’s an important cybersecurity concept that traces back to Stalin.

After World War I, Stalin ruling the Soviet Union, wanted to understand the minimal effort it took to brainwash a human. After experimenting with hundreds of thousands of people, what he found was simple: if a human is subjected to two months of outrage, their brain begins excreting a chemical that inhibits the ability to use the neocortex, said Rose.

“When someone has an emotional response and asks ‘why,’ it leaves the reptilian brain and goes to the neocortex. You can normally rationalize and understand ‘who benefits from me feeling this way?’ But if you have had two months of outrage, the chemical secretion inhibits the ability for the limbic system to communicate with the neocortex, and beliefs become more emotionally embedded.”

Rose mentioned the sense of urgency that comes with an email that informs the recipient their bank account has been compromised and instructs them to “click here to reset.”

“There’s urgency because it’s scary,” said Rose. “Then a phone call comes in, followed by another email, and the recipient is more likely to act on it without rational thinking. Another email may state ‘your Amazon purchase is ready to ship – click here to see your order’ but the recipient doesn’t recall ordering anything.”

Other common phishing emails come from Geek Squad, PayPal and turnpike authorities.

Sometimes malcontents reach out to sales and marketing teams to gather information. Because such people are wired to be helpful, players often get the information they’re seeking.

Over the past 10 years, Rose found that agriculture is still becoming aware of what’s out there and what they intend to do. He now concentrates on future threat modeling to determine who and what the next attack could be, what weapons they might use and the potential secondary effects.

“We exist in a world of gray zone warfare,” said Rose. “In the U.S., we view warfare as kinetics – boots on the ground, bullets and bombs. Our adversaries view the domain as warfare across everything, including education, finance and legal. As an open and transparent society, we haven’t really girded ourselves.”

Disinformation is also in the gray zone. “With AI, it’s difficult to trust anything in a digital format,” said Rose. It’s important to include China in the cybersecurity discussion. Their primary activity is gathering information – collecting every data point they can find, regardless of whether the information is useful at the time. These data go into a giant database that can be sorted and searched.

“China loves to demonstrate capabilities,” said Rose, quoting a report on an attack on a municipal water supply in Massachusetts. “They interviewed the manager of the water supply who said, ‘I can’t figure out why China would want to attack us – we’re only 10,000 people.’” While there is no confirmation for his theory, Rose suspects diplomatic, geopolitical negotiations were occurring and China wanted to demonstrate what they can do.

The town did an exercise to see if they could still move water and waste and tested whether people knew how to use an analog backup. Without an analog backup, how quickly could it be in place?

Rose explained two threat tactics used by China. The “volt typhoon” involves China prepositioning our entire critical infrastructure with their fingers over the “off buttons.” The “salt typhoon” is China embedding themselves in every communication device we have. Whether the information they gain is useful or not, Rose said they will keep it to themselves.

China is governed by a series of five-year plans focused on acquiring genetics and agriculture technology – the very basics the country needs to sustain food security for their population. Their 15th five-year plan will be released soon.

“Some of the pre-reads [of the plan] show that China will pivot a little bit,” Rose said. “They aren’t going to wait for us to improve; they’re going to use own abilities and improve on what they have already acquired.”

One area of concern is the grain supply system. Rose’s group ran an exercise in Fargo, ND, to envision what would happen if the digital underpinnings of the grain supply system were compromised. Could we still operate, and what would be the secondary effects? Do we still have paper tickets and people who know how to use a paper ticket? The critical piece was that if an attack occurred, trucks could still go across a scale and grain could move.

“It would be like the Colonial Pipeline attack,” said Rose. “When that happened, they didn’t knock out the valves and flows, they took out the billing system. They could no longer account for oil going through the system. The same thing would happen if the digital underpinnings of the grain supply went away. It would be a catastrophic event.”

Producers and processors should consider what they rely on that’s tied to the internet, and without it, would they be able to function? Who would be liable if the system fails? Rose suggested shortening supply chains wherever possible.

“Be skeptical,” said Rose. “If you get an email, a text, a video or phone call, even if it’s a voice you know and trust, be a little skeptical and keep your ‘Spidey senses’ up. Many AI-enabled attacks have been thwarted by someone’s Spidey sense – something just doesn’t feel quite right.”

If you suspect internet crime, contact the official U.S. government site for internet crime at ic3.gov.

by Sally Colby