UTICA — Premera, Anthem Health, SONY, Staples, Home Depot, JPMorgan Chase, Michaels, Target, the Pentagon, Westinghouse Electric, U.S. Steel, the United Steelworkers union, and Community Health Systems. What do these organizations have in common? It turns out that the above entities have all suffered a security breach of their computer systems, with hackers enjoying […]
UTICA — Premera, Anthem Health, SONY, Staples, Home Depot, JPMorgan Chase, Michaels, Target, the Pentagon, Westinghouse Electric, U.S. Steel, the United Steelworkers union, and Community Health Systems. What do these organizations have in common?
It turns out that the above entities have all suffered a security breach of their computer systems, with hackers enjoying access to hundreds of millions of sensitive, private records. The U.S. Department of Health and Human Services’ website states that since September 2009, the health-care industry alone has recorded “133.2 million breach victims.” (The website lists only health-data breaches affecting 500 or more individuals.) Usually, the offenders are intent upon committing economic crime, but an increasing number are focusing on penetrating national security.
“Today, cybersecurity is involved in most economic crimes,” says Raymond L. Philo, a professor of practice in criminal justice at Utica College and the executive director of the college’s Economic Crime and Cybersecurity Institute (ECCI). “Both the public and private sectors are starting to realize just how big the problem is.”
In a research report issued in October 2014, the Ponemon Institute — a Michigan–based research firm focused on privacy, data protection, and information-security policy — quantified the economic impact of cyber attacks conducted via the Internet. (The report dealt only with those costs associated with detecting, investigating, managing incident responses, business disruption, and loss of customers. Costs associated with maintaining a security posture or compliance were excluded from the study.) Ponemon estimated cybercrime cost the U.S. $12.69 billion last year, an average increase of 9.3 percent over the previous year. All industries fall victim to cybercrime, but energy and utilities, defense, and financial services experience the highest costs. Information theft represents the largest external cost followed by the costs associated with business disruption. The mean number of days to resolve or contain cyber attacks is 45, at an average cost of $35,647 per day, a 33 percent cost increase over last year. Cybercrime detection and recovery costs represent about half of all costs associated with a breach, highlighting a significant cost-reduction opportunity for government and business.
ECCI
Utica College is focused on the opportunity. “The growing trend of cybercrime is drawing attention to economic-crime issues,” says Philo, “and consequently leading corporate, government, and law-enforcement organizations to the Institute. ECCI was established back in 1988 as the Economic Crime Institute (ECI), in a world then dominated by mainframe and mini-computers; personal computers were still new and far from … [ubiquitous]. Our role was to serve as a think-tank that supports leading-edge thinking on economic-crime issues faced by business, government, and enforcement agencies and that offers educational programs, policy guidance, research, and solutions. In short, we were and continue to be a forum for the exchange of ideas, innovative solutions, and technology that manages the risk of economic crime and serves as a resource for investigation and prevention of cybercrime.
ECCI also supports the college faculty in the development of academic programs to foster the next generation of leaders in this field. We added ‘cybersecurity’ to our name in 2013 to reflect the growing awareness of cybercrime. This change came from a recommendation of our board of advisers, a group of approximately 30 practitioners who help to guide the Institution.”
NCFC
Complementing ECCI’s role as a think-tank is the Northeast Cybersecurity and Forensics Center (NCFC). Located on the Utica College campus in the same building as ECCI, NCFC operates two laboratories — one that focuses on forensics and the other on cybersecurity.
“We are a partnership of academic, government, and private-sector resources,” says Anthony Martino, NCFC director and an adjunct instructor at Utica College, “that provides digital-forensic services as well as the operation of a state-of-the-art computer-crime laboratory. The forensics lab has long been a resource to law-enforcement agencies, including all agencies in Oneida County, the FBI, Homeland Security, the Secret Service, and other state and local agencies.”
On the cybersecurity side, “… we are now processing more work for the private than the public sector. The rise in data breaches has been the impetus for corporations to use our vulnerability assessments where we test-penetrate a company’s computer-security system. With the rise of mobile banking, financial services is becoming a major area of concentration followed by manufacturing, insurance, small business, and health care,” Martino says. “Also, many of our private-sector clients are coming to us because growing cybersecurity regulations demand strict compliance. Our clients are not usually technical people, so they come to the center for help. For example, ECCI is currently working with a financial-services firm to develop policy and procedures to be in compliance with mounting regulation. Our responsibility is not only to develop the plan but also to train the company’s staff.”
NCFC grew from an alliance between Utica College and the Utica Police Department. “The college provided the lab space on campus and the police department ran the operation,” recalls Martino, a 20-year veteran of the police department. “When I retired from the Utica Police Department, Utica College took over the responsibility for the crime lab (June 2013), which today… [boasts] an outstanding skill set. NCFC has built a reputation for expertise and quick turnaround times, all based on a proven track record. On the forensic side, we are working more with law firms and individuals in litigation support and in internal investigations. There is a growing demand for digital forensics, and fortunately I have half-a-dozen, full-time [Utica College] faculty plus adjuncts and students to support the center.”
Martino has ambitious plans for NCFC. “The demand from companies has pushed us to create a new program called ‘Cybersecurity for Managers,’ ” he says. “This September, we will kick off a three-day boot camp here on campus to teach managers how to talk the talk with employees and regulators. The boot camp is designed to give them a working knowledge of and solutions for cyber threats. The session will provide hands-on, practical course work and is limited to 25 registrants. If the demand is there, we will schedule additional sessions later in the year.”
Small-business incubator
While the boot camp is on Martino’s front burner, he is also turning his attention to another idea, one that has been simmering for a long time. “I want to create a small-business incubator for students with entrepreneurial interests. I would make it part of the academic programs here at the college for those who would like to start a business. [Utica College] has a large body of alumni who could help mentor the students in business areas and a number of alumni from the School of Economic Crime and Justice Studies who bring cybersecurity experience. The college also has a large faculty to act as mentors. I would like to see this project launched next year.” Martino is already thinking about potential sites for the incubator.
Students in the Economic Crime, Justice Studies, and Cybersecurity program at Utica College get hands-on experience both at ECCI and NCFC. “We work with undergraduate and graduate students,” affirms Philo. “The idea is to encourage student engagement and provide real-world experience.” Martino echoes the sentiment. “NCFC encourages 15-week internships, typically for seniors.” He cites the following example. “Some of the students at the center are currently engaged in a research project for the Air Force Research Laboratory, testing the security of desktop computers. There is no doubt that this practical work makes our students more marketable.” In an interview last September with this reporter and James Norrie, dean of the School of Business and Justice Studies, the dean pointed out that 93 percent of the school’s recent graduates found jobs and the other 7 percent went on to graduate school. The industry currently has a 1 percent unemployment rate nationally.
Philo also points to the recent college valedictorian as another example of student marketability. Jared Platt, who majored in economic crime and who carried a 4.0 GPA, was a student researcher and volunteered in the Oneida Country District Attorney’s office. He attended a mock interview on campus with a member of ECCI’s board of advisors, Matthew Quinn, who is a cybersecurity officer at the Boston office of Santander Bank, N.A. (The Santander Group, headquartered in Spain, has 190,000 employees in Europe and the Americas, 14,500 branches, and 102 million customers.) The mock interview became a real interview, and Platt was hired on the spot for a position as a financial analyst. “That’s how good our students are,” exclaims Philo.
Both Philo and Martino bring strong credentials to their director positions. Prior to joining Utica College, Philo was a law-enforcement administrator, retiring as the chief of police of the New Hartford Police Department. He received a bachelor’s degree in political science from Utica College and earned a master’s degree in public administration from Marist College in Poughkeepsie. A faculty member at Utica College since 2001, he also serves as director of research for the college’s department of Economic Crime, Justice Studies, and Cybersecurity. Philo is currently a consultant with the New York State Division of Criminal Justice Services, a member of the Association of Certified Fraud Examiners, a member of the International Association of Chiefs of Police, and a director of the Griffiss Institute.
Martino earned a bachelor’s degree in communications from SUNY Geneseo in 1992 and a master’s degree in economic-crime management from Utica College in 2004. In his two-decade career at the Utica Police Department, he supervised four units and conducted 100 digital forensic examinations a year. His professional experience also includes work with the U.S. Secret Service and the Department of Homeland Security. Martino has headed NCFC since 2013.