Looks Like U.S. is Finally Getting Its Cyber Act Together
U.S. Government Finally Starting to Coordinate a National Proactive Response
With the various branches engaged and involved. It'll take a while before we see a real impact but so far things are looking promising and in its early days they're coming out swinging.

Creating an Ambassador, coordinating a global 30-country summit, the FBI proactively raiding a huge Chinese POS vendor in Florida, warning companies about who to work with worldwide in the cyber space, and pushing the NSC to work with public firms and unite our efforts. Those are some big moves in just one month of news. -Gus Downing

New Position: Cyberspace & Digital Policy Ambassador
U.S. continues it's build-out of Cybersecurity effort

State Department to Form New Cyber Office to Face Proliferating Global Challenges

Changes are part of Biden administration's treatment of cybersecurity as a critical national security issue

WASHINGTON-The State Department plans organizational changes to confront international cybersecurity challenges such as ransomware and waning global digital freedom, U.S. officials said, the latest overhaul by the Biden administration aimed at treating cyber threats as a top-tier national-security issue.

The restructuring will include the creation of a new bureau of cyberspace and digital policy to be led by a Senate-confirmed ambassador-at-large and a new, separate special envoy for critical and emerging technology, officials said. Both positions will report directly to Deputy Secretary of State Wendy Sherman for at least the first year, the officials said. The administration hasn't decided who will fill either role.

The changes, which are expected to be announced by Secretary of State Antony Blinken later this week, are the latest in a series of reshufflings at the State Department over at least the past three presidential administrations designed to better respond to proliferating and evolving international cybersecurity problems.

The new structure is meant to reflect Mr. Blinken's view that the U.S. has entered a "fundamentally new era in global affairs" where 21st-century challenges like climate change and emerging technology are at the forefront of international cooperation and competition with allies and adversaries alike, a senior State Department official said. wsj.com

Editor's Note: They're finally attacking this cybersecurity problem from every angle. From following the money - cryptocurrency to proactive offensive law enforcement action to sharing and distributing responsibilities throughout the cybersecurity lifecycle to finally creating a chief state department level government official that can maneuver and represent U.S. concerns worldwide. It's about time we develop a plan from the government prospective. And with this recent 30-country summit, this may be the beginning of taking control.

Which may be why Putin is now popping up wanting to get involved and put together his own group. However, that could end up being a group of already well-known adversaries. Hope not. Just some thoughts -Gus Downing

Sounds Like the 30 Countries Have Had Enough of Ransomware Gangs
Ransomware has proliferated because it's 'largely uncontested', says the UK's GCHQ boss

Ransomware gangs are making big money today because there has been no coordinated effort to halt the profits, says Sir Jeremy Fleming.

If you've wondered why ransomware has proliferated in recent years, it's because until recently it has remained unchallenged, according to Sir Jeremy Fleming, director of British signals intelligence agency GCHQ.

"We've seen twice as many [ransomware] attacks this year as last year in the UK - but the reason it is proliferating is because it works," Fleming told the US Cipher Brief threat conference.

Last month, the UK launched the National Cyber Force (NCF), a group with offensive capabilities that unites personnel from the Ministry of Defence (MoD), GCHQ, the Secret Intelligence Service (MI6), and the Defence Science and Technology Laboratory (DSTL).

The way to address ransomware profits is through regulating and controlling cryptocurrencies, Fleming suggested

I can see in the policy debate on the US side and I see the policy debate here, and you quite quickly get into the ways in which criminals profit -- you quite quickly get into cryptocurrencies and how those are regulated and controlled," he said.

At US President Joe Biden's recent cybersecurity summit with 30 countries, participating nations agreed to cooperate to target the abuse of financial mechanisms to launder ransom payments or conduct other activities that make ransomware profitable. zdnet.com

Talk About Proactive Offensive Law Enforcement Action
FBI Raids Chinese Point-of-Sale Giant PAX Technology
U.S. federal investigators today raided the Florida offices of PAX Technology, a Chinese provider of point-of-sale devices used by millions of businesses and retailers globally. KrebsOnSecurity has learned the raid is tied to reports that PAX's systems may have been involved in cyberattacks on U.S. and E.U. organizations.

Headquartered in Shenzhen, China, PAX Technology Inc. has more than 60 million point-of-sale terminals in use throughout 120 countries. Earlier today, Jacksonville, Fla. based WOKV.com reported that agents with the FBI and Department of Homeland Security (DHS) had raided a local PAX Technology warehouse.

In an official statement, investigators told WOKV only that they were executing a court-authorized search at the warehouse as a part of a federal investigation, and that the inquiry included the Department of Customs and Border Protection and the Naval Criminal Investigative Services (NCIS). The FBI has not responded to requests for comment.

According to that source, the payment processor found that the PAX terminals were being used both as a malware "dropper" - a repository for malicious files - and as "command-and-control" locations for staging attacks and collecting information.

"FBI and MI5 are conducting an intensive investigation into PAX," the source said. "A major US payment processor began asking questions about network packets originating from PAX terminals and were not given any good answers."

The source said two major financial providers - one in the United States and one in the United Kingdom - had already begun pulling PAX terminals from their payment infrastructure, a claim that was verified by two different sources.

Even if it were publicly proven today that the company's technology was in fact a security risk, my guess is few retailers would be quick to do much about it in the short run. The investigation into PAX Technology comes at a dicey time for retailers, many of whom are gearing up for the busy holiday shopping season. What's more, global computer chip shortages are causing lengthy delays in procuring new electronics. krebsonsecurity.com

U.S. Companies Are Hacked More & Less Prepared & The Consequences
Are More Costly
It's time to change this picture

Nearly all US execs have experienced a cybersecurity threat, but some say there's still no plan
On Tuesday, Deloitte published the results of a new survey, taking place between June 6 and August 24, 2021, which includes the responses of 577 C-suite executives worldwide (159 in the US) on today's cybersecurity threats.

The research -- including insight from those in CEO, CISO, and other leadership roles -- suggests that nearly all US executives have come across at least one cybersecurity event over the past year, 98%, in comparison to 84% internationally.

The COVID-19 pandemic has led to an increase in cybersecurity incidents and it appears that the event rate may disproportionately have impacted organizations in the United States.

Despite the ongoing risk of cyberattacks, US enterprise firms are not up to par when it comes to implementing defense and incident response initiatives. In total, 14% of US executives have no such plans, in comparison to 6% of non-US executives.

Problems including data management issues, infrastructure complexities, failures to keep up with technological advances, and missteps in prioritizing cybersecurity are all cited as challenges in coming up with workable cybersecurity plans.

However, only 41% of organizations say they have implemented solutions to track and monitor the risk factors associated with staff access and behavior.

The research suggests that the common consequences experienced by today's firms after an incident include disruption (28%), a drop in share value (24%), intellectual property theft (22%), and damage to reputation that prompts a loss in customer trust (22%). zdnet.com

5 steps to security incident response planning

Microsoft warns over uptick in password spraying attacks

Pandemic Assistance Extended for Retailers
Concerns Despite Announced Federal Government Extension of Wage and Rent Subsidies for Retailers and Businesses in Canada
The Canadian Federation of Independent Business is relieved that some broad-based business supports will remain in place following Thursday's federal announcement on wage and rent subsidies for businesses affected by COVID-19, but concerned that the eligibility rules and thresholds will put them out of reach for many.

"Restaurants and tourism businesses will need to see a revenue drop of 40 per cent and all other businesses a 50 per cent drop in order to access these critical programs. This means small businesses that see revenues lower by one-third will not be able to access the previous wage and rent subsidies - potentially signing them up to lose money every single day they are open and putting them at risk of permanent closure," said Dan Kelly, President and CEO of the CFIB, Canada's largest association of small and medium-sized businesses with 95,000 members across every industry and region.

"CFIB will be pushing the federal government to be flexible in how it defines businesses in the tourism, restaurant and hospitality sectors for its targeted programs. Gyms, recreation facilities like bowling alleys, dance studios, dry cleaners all continue to suffer massive COVID-related losses but may be ineligible for the higher levels of support.

"New businesses that started after March 2020 must be included in any new government support programs if they meet the eligibility criteria. As it stands, they have not been able to access any of the government support programs, despite facing the same challenges and restrictions as other businesses." retail-insider.com

No Unemployment $$ for Employees Who Quit Over Vax Mandate
Workers who resist vaccine mandates may not be eligible for EI, according to feds
Workers who lose their job over a refusal to vaccinate against COVID-19 may not be eligible for employment insurance benefits, according to updated guidelines from the federal government.

Employment and Social Development Canada (ESDC) has issued a notice to employers enforcing vaccine mandates to help them fill out records of employment, a document needed to apply for EI benefits.

The department said if an employee doesn't report to work or is suspended or terminated for refusing to comply with a vaccine mandate, the employer should indicate that they quit, took a leave of absence or were dismissed -- potentially disqualifying them from EI.

The notice also laid out multiple factors that could be considered, including whether the vaccine policy was clearly communicated, if it was reasonable within the workplace context and potential exemptions. ctvnews.ca

Canada lifts advisory against non-essential travel introduced amid COVID-19
The federal government has quietly lifted its advisory against all non-essential travel abroad that was introduced in March 2020 due to the COVID-19 pandemic - as long as those travellers are fully vaccinated. The advisory was lifted on the same day Prime Minister Justin Trudeau unveiled Canada's international proof of vaccination system. globalnews.ca

Canada imposes COVID-19 vaccine mandate on federal workers, transportation

The Yukon Territory imposes a vaccine mandate as cases surge in northern Canada
 

Amazon Spying Partnership
Amazon strikes deal with UK spy agencies to host top-secret material

Cloud contract for GCHQ, MI5 and MI6 with US tech group aims to speed analysis but likely to ignite sovereignty fears

The UK's three spy agencies have contracted AWS, Amazon's cloud computing arm, to host classified material in a deal aimed at boosting the use of data analytics and artificial intelligence for espionage.

The procurement of a high-security cloud system has been championed by GCHQ, the UK's signals intelligence body, and will be used by sister services MI5 and MI6, as well as other government departments such as the Ministry of Defence during joint operations.

The contract is likely to ignite concerns over sovereignty given that a vast amount of the UK's most secret data will be hosted by a single US tech company. The agreement, estimated by industry experts to be worth £500m to £1bn over the next decade, was signed this year, according to four people familiar with the discussions. However, the details are closely guarded and were not intended to be made public.

Although AWS is a US company, all the agencies' data will be held in Britain, according to those with knowledge of the deal. Amazon will not have any access to information held on the cloud platform, those people said.

Jeremy Fleming, GCHQ director, has previously said that making use of AI will be "at the heart" of his agency's transformation to keep the country safe as spying moves into a digital age. ft.com

USPS beefs up operations to handle more holiday packages
Postmaster General Louis DeJoy Plans to Deliver for the Holidays

The Postal Service promises to add 45 facilities and new equipment that can handle 35% more daily packages despite supply-chain challenges

The US Postal Service will hire 40,000 seasonal employees, add 112 new sorting machines and open 45 new facilities to manage spillover packages, all in an effort to ensure on-time delivery for online holiday shoppers wsj.com

Online shopping bummer: Out-of-stock products surged 172% from pre-pandemic

'The holy grail of e-commerce advertising': Why DoorDash is bolstering its advertising offerings

Insider Threat
DOJ: Boston Man Pleads Guilty to Fraud - Hitting Staples 60 Times for Store Credit
Ricardo Voltaire, 35, pleaded guilty to one count of conspiracy to commit wire fraud.

Voltaire was a sales manager at Staples locations in Dedham and Braintree. On at least 60 occasions, Voltaire processed fraudulent Staples' store credit account applications that were submitted by Wagner Sozi and his co-conspirator - each of which contained stolen personal identifying information of another individual. Voltaire knew that his co-conspirators were not in fact the individuals named on the applications and opened store credit accounts under the stolen identities, which were then used to purchase more than $81,000 in Visa gift cards. Voltaire accepted approximately $8,000 in kickbacks from Sozi and his co-conspirator.

In May 2021, Sozi pleaded guilty to two counts of wire fraud, one count of aggravated identity theft and one count of making a false claim. He is pending sentencing which is scheduled for Oct. 28, 2021.

The charges of conspiracy to commit wire fraud provides for a sentence of up to 20 years in prison, three years of supervised release and a fine of up to $250,000. justice.gov

Thieves cut through store wall, steal 30,000 cellphones worth $2M,
Michigan cops say
Surveillance cameras, an alarm system and a cinderblock wall didn't stop thieves from breaking into a Michigan store and making off with over $2 million in merchandise, police said. According to the Troy Police Department, multiple burglars cut a hole, roughly 3 feet high and 3 feet wide, through the wall of Super Fair Cellular the night of Oct. 16, and slipped inside, WJBK reported. The crew robbed the store sometime between about 7 p.m. and midnight, police said. Once inside, the suspects stole 30,000 cellphones, police told WDIV. They also took some bins and equipment from the store, including a pallet jack. Investigators estimate the total value of the phones at $2 million, outlets reported. The alarm and camera systems were damaged during the burglary, according to The Oakland Press. newsobserver.com

While retail thefts skyrocket across the nation, metro Detroit hasn't seen a spike
Retail theft is up across the nation, from big cities like New York, Minneapolis, Chicago and San Francisco. Some stores are locking up merchandise, while others are closing up shop and moving out of cities. Walgreens announced they're closing five stores in San Francisco. Their reasoning was organized retail crime. With the holidays right around the corner, it could get worse. In metro Detroit, we are not seeing what other major cities are seeing, but retail theft is happening in our area still. Roseville Police Chief Ryan Monroe said shoplifting is a problem, and a movement for less harsh sentences is also adding fuel to the fire. "Traditionally we have always seen a lot of shoplifting with some of our retailers and outlets in the city. The only difference is that Michigan's law on shoplifting it's all dependent on the dollar value. Under a certain dollar value, you go to jail," Monroe said. In Michigan, laws are harsher for a person who steals over $1,000 of property. It's a felony and they can face a $10,000 fine and up to five years in prison. The organized retail crime in Michigan is a felony, with a max fine of $5,000 and five years in prison. wxyz.com

Carlsbad, CA: Suspects set off a firework during robbery at Coach store
Smoke filled a Coach outlet store in Carlsbad Saturday night when two men and a woman allegedly set off a firework before taking several items and fleeing, police said. The suspects apparently used a firework that emits smoke as a distraction, placing it in a display shoe, said Carlsbad Lt. Reid Shipley. Amid the smoke, they allegedly grabbed several display items, Shipley said, and then fled the store, located in the Carlsbad Premium Outlets on Paseo del Norte. There were no injuries nor was there any damage to the store as a result of the incident, which occurred at 6:45 p.m., Shipley said. The smoke from the firecracker led a number of people to call 911, he added. The suspects, described as being in their mid-20s, fled in a late 1990s Toyota, Shipley said. Police are working with store employees and mall security as part of the ongoing investigation. sandiegouniontribune.com

Grand Island Suspects leave Home Depot with $4,500 in power tools
The suspects loaded the items, valued at $4,500, into a black minivan and left the area at a high rate of speed. A witness told the Grand Island Police about the crime, which occurred at 10:30 a.m. Not only will GIPD soon have video evidence from the store, but also from a customer who recorded the theft on dashcam video from his car in the parking lot, said Capt. Jim Duering. theindependent.com