In the past year, dozens of companies have faced cyber attacks and hacks, with the most recently announced attack affecting half a billion Yahoo accounts.

Rick Forno, assistant director of the UMBC Center for Cybersecurity and director of the Cybersecurity Graduate Program at UMBC, joined Nicole Perlroth, technology reporter for The New York Times, on WHYY to discuss this recent breach with Mary Cummings-Jordan, host of Radio Talk.

Although the Yahoo cyber attack happened two years ago, users are just learning about this breach now. These hacks can expose important identifying information.. Despite the level of sensitive information personal accounts can include, they often do not have the same types of security that employers typically ensure for work email accounts.

“The email address disclosures is bad enough, but if you have little bits of information like zip codes and birthdates, you can use these little tidbits to try to reset an account password and try to get in that way,” Forno explains. He adds that once a hacker enters an account they can access substantially more personal details and potentially hack into the user’s accounts on other sites.

Hacks of this nature should encourage people to use good cybersecurity practices, Forno suggests. “This that we’ve been preaching…[that] basic practices are just as valuable today as they were 20 years ago,” he says.”

To protect their email accounts, people should be vigilant when it comes account activity, change passwords regularly, and not share passwords between websites. Both Forno and Perlroth agree that enabling dual authentication, if available, is another way to protect accounts from being hacked. Writing out passwords and keeping them somewhere at home is one way to have different passwords for each account and not have to store them electronically, reducing the risk that a hacker may obtain the login information, says Forno.

Even with these preventative actions in place, cyber hacks will continue to be issues, he says. “The minute you learn of a problem, you’re already behind the curve in responding to it.”

Listen to the full interview “Cybersecurity and consumer protection online” on WHYY, Philadelphia’s NPR station. Forno also spoke with WOSU, Columbus, Ohio’s NPR station. The full interview “Tech Tuesday: Election Cybersecurity and Futuristic Fiction” is available. 

Image: Rick Forno. Photo by Marlayna Demond ’11 for UMBC.

In recent months, as the U.S. presidential election has approached, concerns over email hacks and the security of voting systems have frequently appeared in the news. Rick Forno, assistant director of the UMBC Center for Cybersecurity and director of the Cybersecurity Graduate Program at UMBC, recently described to WYPR’s Sheilah Kast that voting machines are just one part of a system that has concerning vulnerabilities.

“I think we have to separate the issue between voting machines and the overall voting process, because the two are related but have very different threat and vulnerability characteristics,” said Forno, who is particularly interested in the voting process and technologies used to collect data, as well as how that data is collected, counted, and reported.

A voting machine might report votes to a laptop across the room at a polling location, and that computer might then share data from the single polling place with a computer in a regional or state hub to be aggregated. In this scenario, Forno wonders how the laptop—as one small but crucial piece in the full chain of data transfer—is protected.

Data can be corrupted at moments when it is moving, and also when it is stationary, he says. “You’re looking at a range of security concerns that start with the individual voting machine in the voting booth, all the way up through the systems that officially record and report out the outcomes of an election.”

Voting machines include computers and other hardware that need to be maintained on a regular basis, much like computers that people use at work or at home. Forno warns that not regularly updating the technologies used in voting systems, can give hackers and researchers the opportunity to identify weaknesses and potential vulnerabilities in those systems.

Listen to the full segment “Cybersecurity and the Ballot Box” on the WYPR website.

Image: Rick Forno. Photo by Marlayna Demond ’11.

A delegation from Portugal visited UMBC earlier this month to sign a Memorandum of Understanding (MOU) outlining plans to develop collaborative exchange programs for teaching, learning, and research between the Portuguese Naval Academy (PNA) and UMBC. Initial projects will focus on cybersecurity, an area of strength for both schools.

Antonio Moreira, vice provost for academic affairs at UMBC, earlier named an “advisor of Portugal in the world” by that nation’s president, spearheaded the formal collaboration after meeting Admiral Torres Sobral from the Portuguese National Security Agency at a conference in Lisbon. Similarities emerged between the PNA and UMBC in their conversation, especially in cybersecurity and naval science. Moreira shared, “It became natural to focus on collaborations between the two institutions.”

High-level Portuguese officials have embraced the collaboration. “I think it is important to be here and be aware of what’s happening in our two countries,” said Navy Captain Afonso Galrito, Portugal naval and air attaché, at the signing event. “As soon as I heard we were taking this next step I asked, ‘Can I go?’”

The newly formalized relationship, which will initially last five years and is slated for automatic renewal, will support faculty exchanges for research and teaching, student exchanges at the undergraduate and graduate levels, joint seminars and conferences, and collaborative publication efforts.

UMBC is particularly excited to collaborate with the PNA this year, as the university’s Naval Reserve Officer Training Corps (NROTC) program kicks off. “It is fitting we are signing on the first day of classes and on the first day of our new NROTC program,” Moreira said. In addition, UMBC has strong ties with the U.S. Naval Academy, and the PNA signed an MOU with the Annapolis, MD institution in February 2016, providing opportunities for triangular collaboration.

UMBC President Freeman Hrabowski emphasized to the Portuguese dignitaries that an NROTC program within the University System of Maryland offers local students a compelling new path to military service and leadership development. “I am so proud of getting this program,” Hrabowski shared, having worked for many years to bring NROTC to UMBC.

While the initial collaborative focus is on cybersecurity, “What we sign here is just a start of the collaboration between these two institutions,” said Commodore Henriques Gomes, superintendent of the Portuguese Naval Academy, “We look forward to expanding it to other fields.”

Image: Antonio Moreira (r), UMBC’s vice provost for academic affairs, and Commodore Henriques Gomes (l),  superintendent of the Portuguese Naval Academy, shake hands after signing the MOU between their two institutions in the presence of other UMBC and PNA representatives. Marlayna Demond ’11 for UMBC.

Eight administrators and faculty members from the University of Kassel in central Germany visited UMBC from August 29 to September 2 to build on a thriving university partnership between the two schools by continuing to cultivate broader research collaborations and student exchange programs.

Both UMBC and Kassel are young, innovative institutions known for promoting interdisciplinary programs and with particular strengths in STEM fields and the arts. “This visit is very important for us, as Kassel recognizes UMBC to be an international partner of strategic importance,” shares David diFuccia, professor of chemistry education at Kassel, at a lunch celebrating the partnership. “I hope our cooperation will grow and deepen, and that with every meeting we will take a step further.”

The partnership began when Matthias Gobbert, professor of mathematics at UMBC and a Kassel native, spent his sabbatical at Kassel during the 2011–2012 academic year. A memorandum of understanding (MOU) between the two universities’ math departments grew out of that visit, leading to fruitful exchanges of graduate students and faculty. In 2014, the MOU expanded to the university level, and undergraduate students have been studying abroad at each institution since fall 2015.

Karl Steiner, UMBC vice president for research, and Antonio Moreira, vice provost for academic affairs, have visited Kassel and discussed ways to grow the relationship, including development of a streamlined study abroad program. Now, Moreira says, “It’s truly expanding to the whole campus here at UMBC and at Kassel.”

Fields of study where UMBC and Kassel teams are already conducting complementary research and which are rife for collaboration include renewable energy, cybersecurity, nanoscience, remote sensing, and education. Other departments such as visual arts; economics; modern languages, linguistics, and intercultural communication (MLLI); and computer science are also exploring opportunities to partner.

Ellen Hemmerly, executive director of the bwtech@UMBC Research and Technology Park, discussed potential future business collaborations with the German guests. “We think global opportunities are really significant for companies,” she says, “so we’re always looking for natural ways to form partnerships.”

Both universities also see student academic exchange, beyond language classes, as a major priority in the partnership. Given course and lab research requirements, many students with majors in the hard sciences and engineering perceive study abroad as unrealistic—an option not truly available to them. However, UMBC and Kassel are committed to making it a clear and accessible process for students of any major. Julie Ross, dean of the College of Engineering and Information Technology, notes, “The things they’ll be working on in engineering and IT are global issues,” so it’s important for students to gain international exposure.

Susanne Sutton, coordinator of German in MLLI at UMBC, adds, “We have many STEM majors in our German classes. This is a tremendous opportunity for them to study abroad, as well as for students who are less familiar with the language and culture of Germany but have an interest in exploring it.”

Scott Casper, dean of the College of Arts, Humanities, and Social Sciences, is particularly excited to see his global studies students and Humanities Scholars travel abroad. “The problems our students are tackling are not limited to the U.S.,” he says.

Students in UMBC’s teacher education program, including those in the Sherman STEM Teacher Scholars Program, will also have opportunities to visit German schools and learn about teaching methods in Germany through collaboration with Kassel. In this digital age, “the students they will be teaching are global students,” says Casper, so it’s important teachers come to the classroom with a global perspective. The delegation also met with leaders of the Meyerhoff Scholars Program, who see excellent opportunities for their students to study abroad at Kassel.

The next step for the burgeoning UMBC–Kassel relationship is to expand the undergraduate exchange component. Already, many courses at the German university are taught in English, expanding the number of UMBC students who are able to complete discipline-specific coursework through an international exchange experience.

UMBC and Kassel are growing their cooperation steadily in many directions, with over a dozen faculty and staff working to make productive international exchanges possible for faculty and students on each side of the Atlantic. “When something comes together and it seems effortless,” says UMBC Provost Philip Rous, “you know that means a tremendous amount of effort has gone into it.”

UMBC students interested in learning more about study abroad should attend a Study Abroad 101 seminar offered twice a week by the Study Abroad Office, 2^nd floor Administration building. Apply by October 10 to study abroad in the following spring semester.

Images: The University of Kassel delegation and UMBC representatives, August 30, 2016; students at UMBC’s Study Abroad Fair, September 2, 2016, interact with University of Kassel representatives. Photos by Marlayna Demond ’11 for UMBC.

With the presidential election just a few months away, and a recent hack against the Democratic National Committee making headlines worldwide, many are asking tough questions about the security of the U.S. election infrastructure.

Rick Forno, assistant director of the UMBC Center for Cybersecurity and director of the Cybersecurity Graduate Program at UMBC, explains how electronic ballot boxes are vulnerable to attacks, and some tactics that the U.S. can use to secure the voting machines and protect the data it collects, in The Conversation (also published by Salon and U.S. News).

“One of the most obvious, direct ways to affect a country’s election is to interfere with the way citizens actually cast votes,” Forno writes.

The U.S. electronic voting network is spread out across the country, with many points of potential entry, which heightens the vulnerabilities of the system. Increasing risk of a hack to impact an election, one factor that has changed recently  “is the ability of individuals, governments, militaries and criminal or terrorist organizations to use internet-based tools—commonly called cyberweapons—not only to gather information but also to generate influence within a target group,” says Forno.” But implementing best practices for cybersecurity, data collection, and information access can make it “more difficult for adversaries to conduct cyber mischief,” he suggests.

When citizens go to the polls to vote, they expect that the equipment, process, and people involved to be secure and trustworthy, as a cornerstone of the democratic system. “That trust must not be broken by complacency, lack of resources, or the intentional actions of a foreign power,” Forno writes.

Read the full article “How vulnerable to hacking is the US election cyber infrastructure?,” in The Conversation. 

Forno also did a radio interview about the possibility of the voting systems in the U.S. being hacked. Listen to the “Hacked Voting Machines” segment on BYU Radio. Forno wrote “This election was not hacked – but it was attacked.” which appeared in The Conversation. 

Image: Rick Forno. Photo by Marlayna Demond ’11.

On June 14, the Democratic National Committee announced that its computer system had been hacked. Rick Forno, director of UMBC’s graduate program in cybersecurity and assistant director of the UMBC Center for Cybersecurity, discussed the “ongoing process” of stopping such attacks during a segment on the WOSU Radio’s “All Sides” show.

Forno made clear that there is no single, permanent solution to thwarting cyber threats, and a single mistake or vulnerability can have a major impact on digital security.. “All it takes is one person who does something wrong”—opening an email or plugging in a thumb-drive containing malware—“to place the entire organization at risk,” he says.

Forno also focused on the challenge of educating people about how to practice safe computing, and turning those practices into regular habits. The issues that arise with computing are as much human-based as they are technology-based, he suggests, plus, “You attack one problem and three more pop up the next day.”

To understand how a hack happened and to prevent hackers from taking advantage of vulnerabilities in the future, Forno suggests collecting and analyzing “artifacts” of the attack—things the hackers left behind—and heightening ongoing monitoring of key systems, approaches the DNC is likely now taking.

Listen to the full All Sides show. Forno’s remarks begin around 26:00.

Image: Rick Forno. Photo by Marlayna Demond ’11 for UMBC.

As they navigate the internet, people leave digital fingerprints in their wake, and companies regularly use this data to learn more about their customers and target audiences. If this data ends up in the hands of hackers, however, the information can be compromised, and as more data is stored electronically the risk of identity theft increases.

Rick Forno, assistant director of the UMBC Center for Cybersecurity and director of the Cybersecurity Graduate Program at UMBC, describes in The Daily Record tools to disguise digital fingerprints and protect personal information online. TrackOFF, a Baltimore-based software company, is one example highlighted in the piece, but Forno also notes that there are a variety of ways to keep online information private.

Forno says that younger generations are “more comfortable sharing material on the internet,” and recommends internet users balance the convenience of data sharing with care to protect their identities.

“I think the benefits of sharing is sort of the attraction, but people don’t think about ‘what am I giving up along the way?’,” cautions Forno.

Read the full article “Baltimore cyber company disguises digital fingerprints,”in The Daily Record.

Update: Forno also spoke with The Baltimore Sun about technologies that help protect data online, such as the ones created by TrackOFF. The article appeared in Government Technology.

Image: Rick Forno. Photo by Marlayna Demond ’11 for UMBC. 

U.S. Deputy Defense Secretary Robert Work recently spoke about cyberwarfare and U.S. efforts to fight online security threats, leaving analysts wondering about the nature of today’s battles in cyberspace. UMBC’s Anupam Joshi and Rick Forno  shed light on this world in a new Scientific American article that explains how online tactics known as “cyberbombs” work to prevent potential attacks, or could potentially be directed at U.S. targets.

Joshi is director of UMBC’s Center for Cybersecurity and professor and chair of the department of computer science and electrical engineering, and Forno serves as assistant director of the UMBC Center for Cybersecurity and director of UMBC’s graduate program in cybersecurity.

Cyberattacks can disrupt essential components of infrastructure people use every day, from cell phone networks to electric network generators, Joshi and Forno explain. They point out that “a ‘cyberbomb’ is not a single weapon,” but rather a collection of computer hardware and software that can be used to protect against cyber threats. This work might involve a broad range of professionals, including technological experts, military strategists, researchers, policy analysts, and lawyers, and as technology changes so do cyber weapons and tactics.

“We can analyze the underlying technologies and look at the global strategic considerations of those of those seeking to wage cyber warfare,” Joshi and Forno write. “That work allows us to offer ideas about cyber weapons and how they might be used.”

Read the full article, “America is ‘dropping cyberbombs’—but how do they work?” originally published in The Conversation. The original article was also mentioned in Tech Republic.

Images: Anupam Joshi presenting during cybersecurity forum hosted by the School of Public Policy. Photo by Marlayna Demond ’11 for UMBC. 

As the academic year draws to a close, we thought we might take the time to introduce you to some of our Alumni Association Scholarship recipients. Today, we hear from Michael Wallace Karugu ’15, information systems, who is currently working toward a master’s degree in cybersecurity here at UMBC.

Name: Michael Wallace Karugu

Major: Information Systems (current master’s student in Cybersecurity)

Grad Year: 2015, 2017

Extracurriculars: Soccer and billiards

Why did you decide to attend UMBC? UMBC is a renowned institution offering recognized STEM programs. I wanted to experience the learning environment and opportunities offered by UMBC. Furthermore, since I was a transfer student, UMBC was ready to accommodate the credits that I wanted to transfer.

What’s been the most amazing discovery you’ve made so far as a student here? The faculty, staff and students at UMBC are very friendly and always willing to assist. This friendly environment promotes a healthy learning environment.

What are you most proud of accomplishing in your time at UMBC? I am currently the student manager of the Desktop Student Support section in DoIT. Having started as a regular student employee here two years ago, I feel this is my most proud accomplishment during my time at UMBC.

What would you say to the people who provided your scholarship? I would like to thank them from the bottom of my heart for supporting me financially. This assistance enabled me to focus more on my studies as compared to stressing about how I would meet my school related costs. This assistance goes a long way in nurturing deserving students.

What do you hope to do after graduation? I graduated from my undergraduate program in fall 2015 and I am now pursuing a master’s program in cybersecurity here at UMBC. I plan on graduating in the Spring of 2017. After earning my master’s degree, I will pursue employment from the private sector as a cybersecurity specialist, and in future I plan on establishing a cybersecurity consultancy firm.

Students like Michael rely on the financial support of our donors. Please consider making a contribution today.

UMBC and IBM Research have announced an exciting new collaboration to create the Accelerated Cognitive Cybersecurity Lab (ACCL), opening at UMBC in fall 2016. Housed within the College of Engineering and Information Technology, the ACCL will advance scientific frontiers in cybersecurity and machine learning. The new lab is supported by a multi-year commitment from IBM.

“UMBC faculty and students in the College of Engineering and Information Technology are excited to expand our work on global scientific and cybersecurity challenges in collaboration with world class partners like IBM,” says Julie Ross, dean of the UMBC’s College of Engineering and Information Technology.

Anupam Joshi, director of UMBC’s Center for Cybersecurity and chair of computer science and electrical engineering, will lead the ACCL. Building on prior research, faculty and students working in the ACCL will apply cognitive computing to complex challenges in the rapidly expanding field of cybersecurity. They will collaborate with IBM scientists and leverage IBM’s advanced computing systems to add speed and scale to the cybersecurity solutions they develop.

UMBC is also one of eight universities working to train IBM’s Watson computer system, internationally famous for its capacity to answer questions delivered in natural language, for application in the cybersecurity sphere. This work seeks to increase the capacity of cybersecurity professionals to quickly detect and respond to emerging threats. The other universities involved with training Watson include California State Polytechnic University, Pomona; Pennsylvania State University; Massachusetts Institute of Technology; New York University; the University of New Brunswick; the University of Ottawa, and the University of Waterloo.

Beyond moving forward a research mission with great public impact, the ACCL collaboration will also help IBM establish itself as an employer of choice for UMBC graduate and undergraduate students.

Joshi shares, “This collaboration will allow our students and faculty to work with IBM to advance the state-of-the-art in cognitive computing and cybersecurity.”

Update: UMBC is one of six institutions working with IBM as part of the Cognitive Horizons Network.

Media coverage:
The Washington Post: IBM is training Watson to hunt hackers
Fortune: IBM Watson brings AI wonders to cybersecurity
Baltimore Business Journal: UMBC partners with IBM Research for cybersecurity lab
The Daily Record: UMBC to help IBM’s Watson fight cybercrime
Tech Times: IBM Research And UMBC Team Up To Create Cognitive Computing Cybersecurity Lab
International Business Times: IBM Watson supercomputer teams up with top universities to fight cybercriminals
Christian Science Monitor: Can IBM’s Watson fight cybercrime?

Image: Anupam Joshi and Yelena Yesha working with several UMBC students, top; Ph.D. student Lisa Mathews, Dean Julie Ross, and IBM’s Jeb Linton (l-r) view a Watson interface, second photo. Photos by Mitro Hood/Feature Photo Service.