Monday, July 02, 2012

Thoughts on Lessons from Our Cyber Past: The First Cyber Cops

In May I was pleased to attend Lessons from Our Cyber Past: The First Cyber Cops hosted by Jay Healey at the Atlantic Council and featuring Steven R. Chabinsky, Shawn Henry, and Christopher M. Painter. The transcript as well as audio for the event are now online.

All of the attendees made great points, and I wanted to highlight a few.

Mr. Chabinsky:

I think that we’re getting to this point where we really have to reflect upon what risk mitigation looks like in this area, whether our policies that focus predominantly on vulnerability mitigation, are actually a successful long-term security model.

If you think of most security models, I think predominantly you’d find that they rely on threat deterrence, that the notion that the actor won’t act because there will be some penalty-based deterrent at the end of it – they’ll be captured, they’ll have some penalty. Here [in digital security] we have a model where people are predominantly focused on hardening the target, patching their systems. That’s not how we live in the real world. That’s called a fortress, right? I mean, the technology is not meant to be bunkered down.

And so it’s not surprising then, as we move further and further into this model of accepting devices that are not fortified and bunkered down, without a risk model that predominantly relies upon threat deterrence, we would fall further behind. I agree with that sentiment. As I've written before, Real Security Is Threat-Centric.

Mr. Painter emphasized that you need capacity, laws, and global cooperation to make a difference when fighting digital threats.

Mr. Henry:

What I wanted to do – because I’d talked to some people who were in the cyber space – what I wanted to do was to bring many of the things that we had done in the physical world successfully against organized crime groups and against terrorist organizations – white collar crime, public corruption cases – I wanted to take some of those investigative tactics and I wanted to apply them in the cyber realm.

Because I’ve always seen that there are actually more similarities between the physical space and cyber space than there are differences, and I can relate many things in the physical world to the cyber world, and vice versa. And I had a lot of experience working undercover operations and using authorized digital intercepts, using informants and the like.

That is an important point. I think law enforcement has made the most progress when they use old-fashioned infiltration methods and put less emphasis on technical measures to identify intruders.

1 comment:

Anonymous said...

http://www.nextgov.com/cybersecurity/2012/07/fbi-cyber-posse-goes-back-school/56632/?oref=ng-skybox

FBI cyber posse goes back to school By Aliya Sternstein July 5, 2012

The FBI is sending its cyber squad back to school to earn special certifications, according to a contract notice stating the SANS Institute will teach the 38-course curriculum.

The new syllabus, called the Cyber Career Path Program, was prompted by “a greater need within the FBI for cyber investigators with accredited training,” stated a justification for the sole source award. “An unaccredited certification cannot provide rational assurances that all material and tests are up to the highest standard.”