Information-sharing about vulnerabilities critical for all industries
Jan. 19, 2022
This paid piece is sponsored by Dakota State University.
Sharing computer vulnerabilities can be dangerous, but sharing information about these vulnerabilities can be advantageous.
Information-sharing is Katie Shuck’s role as the cyber intel analyst at the South Dakota Fusion Center.
“My role is to provide relevant and timely intelligence to critical infrastructure organizations within the state,” she said. This includes sectors such as city and county governments, health care, critical infrastructure and other important businesses that may be impacted by this vulnerability.
A prime example is Log4j, a rapidly evolving threat. Log4j has been plaguing users since early December. It is a JavaScript, open-source vulnerability and is widespread and severe. It is not a new vulnerability — it has been talked about at cyber defense conferences since 2016 — but it is only 12 characters long.
“When a vulnerability can fit in a tweet, it can be bad,” Shuck said.
“This shows the need for ongoing communication among cyber workers in all industries, from academia down to industry,” she said.
The cyber intel analyst position was created through a partnership of Dakota State University, the city of Sioux Falls and the Department of Public Safety, which oversees the Fusion Center, said Dr. Arica Kulm, director of digital forensics services at DSU.
“The importance of information-sharing in these situations can be critical,” Kulm said, so Shuck “works with these local, state and federal agencies to gather the information and then route it to the affected parties.”
Making sure users understand the threats is important, Shuck said. This includes all members of cyber teams — from directors to support staff — so that information can be shared as quickly as possible.
In addition to sharing information on specific vulnerabilities, Shuck gives presentations on good technology practices. Because information changes quickly in the cyber defense field, she has to stay current.
“Every week, I have to change the programs I give because things change so fast,” she said.
But some information is always pertinent. For example, vulnerabilities are not only a technology problem but also a people problem, she shared, so she reminds companies to increase cyber hygiene, defined as practices that ensure safe handling of critical data and securing networks, habits such as installing antivirus software or using firewalls.
It is also important to use strong passwords and two-factor identification, and if a company has the capacity, it should segment networks so critical systems are separated, she pointed out.
Shuck’s position with Fusion serves as her graduate assistantship in the Ph.D. in Cyber Defense program. She expects to graduate this summer with a dissertation on open-source protection from ransomware.
Businesses or organizations who have questions or would like to request a presentation can contact Shuck at 605-201-6561, or through the South Dakota Better Business Bureau. Individuals also can contact Kulm at 605-256-5148.
