Cybersecurity research
Budget: $30 – $250 USD
I would like some lists and some research/information about the following cybersecurity matters-
• A List of iot devices or other products hacked in 2021, 2022 and 2023 (cars, planes, toys, ships, farm or food processing equipment) with a photo/picture of the device and a brief description of what was done. Compile 15-20 of the most important or interesting ones
• A List of industrial hacks in 2021, 2022, 2023 (power grids, water supplies, gas pipelines industrial businesses), a relevant photo and a description of what happened (what damage was done or did they try to do). Compile 15-20 of the most important or interesting ones
• A List of ransomware attacks in 2021, 2022, 2023 with info about attack vector(how did they get in), scope(how many people/computers/data was affected), cost if available – amount of ransom demanded and/or paid, outcome – did they pay? Did the system get restored? What happened? Compile a list of 10-15 major attacks from different industries (healthcare/hospitals, schools, government/law enforcement, banks/financial services, insurance, stock exchanges, etc.)
• AI cyber attacks and considerations:
o What is the list of hacks of AI systems (chatGPT and others) (the 5-10 largest/most critical ones)
o What are the risks with AI intrusions/hacks – what kind of damage have hackers done
o What are ‘best practices’ for protecting AI systems from hacks
• What are best practices for who the CISO should report to (such as the CIO or CTO or COO or President or CEO or General Counsel) and what are the pro’s and con’s of each approach
• What requirements are insurance companies imposing on their clients in order to provide cybersecurity and ransomware coverage. Provide an example of a current insurance company cybersecurity questionnaire for a large company. (This is the questionnaire that the company must fill out to show what their cybersecurity practices are in order to get insurance coverage)
• A list of state sponsored attacks (or suspected attacks). 3-5 significant ones from each of Russia, China, Iran, North Korea. And 5 from other countries. This can include specific Russian attacks on the Ukraine (such as an attack on their power grid).
• Current Cybersecurity/Data protection requirements published by the Department of Financial Services (DFS) in NY State (this can just be a link or a complete document)
• Current NIST cybersecurity framework (this can just be a link or a complete document)
• Current SEC guidance on cybersecurity (office of compliance and examination: OCIE)(this can be a link or a complete document)
• Current requirements for the notification of affected individuals – how much time does the affected company have to notify its customers that their data has been compromised:
o In the US
o In the EU
• What are the potential penalties for failure to notify in a timely manner:
o In the US
o In the EU
• A List of iot devices or other products hacked in 2021, 2022 and 2023 (cars, planes, toys, ships, farm or food processing equipment) with a photo/picture of the device and a brief description of what was done. Compile 15-20 of the most important or interesting ones
• A List of industrial hacks in 2021, 2022, 2023 (power grids, water supplies, gas pipelines industrial businesses), a relevant photo and a description of what happened (what damage was done or did they try to do). Compile 15-20 of the most important or interesting ones
• A List of ransomware attacks in 2021, 2022, 2023 with info about attack vector(how did they get in), scope(how many people/computers/data was affected), cost if available – amount of ransom demanded and/or paid, outcome – did they pay? Did the system get restored? What happened? Compile a list of 10-15 major attacks from different industries (healthcare/hospitals, schools, government/law enforcement, banks/financial services, insurance, stock exchanges, etc.)
• AI cyber attacks and considerations:
o What is the list of hacks of AI systems (chatGPT and others) (the 5-10 largest/most critical ones)
o What are the risks with AI intrusions/hacks – what kind of damage have hackers done
o What are ‘best practices’ for protecting AI systems from hacks
• What are best practices for who the CISO should report to (such as the CIO or CTO or COO or President or CEO or General Counsel) and what are the pro’s and con’s of each approach
• What requirements are insurance companies imposing on their clients in order to provide cybersecurity and ransomware coverage. Provide an example of a current insurance company cybersecurity questionnaire for a large company. (This is the questionnaire that the company must fill out to show what their cybersecurity practices are in order to get insurance coverage)
• A list of state sponsored attacks (or suspected attacks). 3-5 significant ones from each of Russia, China, Iran, North Korea. And 5 from other countries. This can include specific Russian attacks on the Ukraine (such as an attack on their power grid).
• Current Cybersecurity/Data protection requirements published by the Department of Financial Services (DFS) in NY State (this can just be a link or a complete document)
• Current NIST cybersecurity framework (this can just be a link or a complete document)
• Current SEC guidance on cybersecurity (office of compliance and examination: OCIE)(this can be a link or a complete document)
• Current requirements for the notification of affected individuals – how much time does the affected company have to notify its customers that their data has been compromised:
o In the US
o In the EU
• What are the potential penalties for failure to notify in a timely manner:
o In the US
o In the EU