One Page to Share with Your Management
I thought this brief question-and-answer session, Richard Clarke: Preparing For A Future Cyberwar by Kim S. Nash extracted the essence of advanced persistent threat problems and how to address them. I'd like to publish the whole article, but instead I'll highlight my favorite sections:Nash: How can the federal government protect companies?
Clarke: Do more. As a matter of law and policy, the federal government should actively counter industrial espionage.
Most U.S. government counterintelligence operations are focused on intelligence against the government, not companies, and most of those are focused on spies. It's a very 20th-century approach.
Until someone makes law or policy changes that say the U.S. Cyber Command can defend AT&T or Bank of America, it doesn't have the legal authority to do that. I think it should. The government also has to explain the threat to corporations.
Also:
Clarke: Until CEOs and boards of directors are faced with black-and-white evidence that they have lost a terabyte of information and that this has resulted in some other company beating them to market, until they have their noses rubbed in it, they're reluctant to do anything special...
Often, the CIO really needs board-level commitment and CEO commitment, not just of resources but to policies necessary for protection. Most of the time, all people want the CIO to do is keep the network up and costs down. As a result, many CIOs have been hired for their expertise in those areas, not for expertise in figuring out how to make a resilient network that resists attack.
Finally:
Clarke: It should be the federal government's responsibility to tell companies not only when they've been attacked but when others have been, such as their competitors, so they realize this sort of thing is going on...
[S]ometimes companies don't know they've been hacked. But frequently they realize after the fact. You don't know you've lost information until a knockoff of your product or some competing products start showing up in the marketplace.
I agree with all of these sentiments.
Incidentally I started read the library copy of Cyber War but decided I needed to take notes in the margins. So, I bought a copy from Amazon.com. I plan to finish it and review it by the end of the month.
Tweet
Comments
Very interested to see your opinion/review of it!
Great point made here and very similar to what we (Verizon) have seen in our DBIR series. Usually a company doesn't know they have been breached until they are notified by a 3rd party. The 3rd party discovers the breach because the attacker fradulently uses the data that was stolen.
I agree with all of these sentiments.
I don't. :)
1. It's not the government's place to tell me when my TV has been stolen either.
2. This is the problem with things like Infraguard. The intel you get is either so generic and sanitized that it is worthless and 6 months out of date, or it is so specific that no one will share it (neither the feds or the victims). It's, IMO, insane to think that companies will willingly share this info with their competitors or that they will be ok with it being shared by the government.
In response to 1, when you're TV gets stolen, it's something physical that's taken, that you will be able to easily notice. If someone came into your house, photocopied all of your personal records so they could steal your identity, wouldn't you want the government to let you know if they had the means?
What I would see as working more successfully would be if the government could be responsible for feeding data to businesses. Working with organizations such as the Open Security Foundation are a step in the right direction. In this case businesses are still responsible for defending their own network but the ability to share data still exists. Working within the community is better then building a new community which is what the government is trying to do.
If someone steals your TV, you probably know about it. but it's a TV, not like anyone can do anything but try to sell it.
If someone steals your car in the middle of the night while you sleep, goes on a robbery spree, and returns the car later, wouldn't you want to know why the seat was left scooted all the way back? more importantly, why are there bullet holes in the trunk?
This is the most ridiculous stance on corporate network security i have ever read. Why don't we all take a step back and start taking responsibility for our own actions and not rely on the government for everything. The guy from Verizon above, it's Verizon's fault that their product info was hacked... not the feds. Go hire someone that knows what the hell they are doing.
This cyber war guy may know what he is talking about when it comes to hardening infrastructure, but you need to learn some self-worth and start relying on yourself to accomplish goals. Not the government. I'm all about sharing information to make this country a better place, but our legislature is not the end all be all to make sure our personal information is safe.
Without a shadow of doubt global organizations would have to invest heavily to actively counter industrial espionage. Persistent security tools would play a dominant role to counter this new warfare. Some organisations get it, and some don't but it only takes a few examples for the other organizations to get it.