Risk
10/11/2013
10:21 AM
Connect Directly
RSS
E-Mail
50%
50%

Cyberthreats Grow More Ominous: Former NSA Chief

Microsoft's Craig Mundie, former NSA and CIA chief Gen. Michael Hayden and other experts say cybersecurity attacks are getting more dangerous.

The nature of cybersecurity attacks is becoming more dangerous and the threats on business and government more disturbing, a group of IT and cybersecurity experts said at a Cybersecurity Summit, held by the Washington Post Oct. 3.

"I think that people need to understand that in the last 12 months there's been a qualitative change," said Craig Mundie, senior adviser to the CEO at Microsoft. "The threats are moving to destructive attacks. Unlike conventional weapons, every time someone shoots one of these weapons, the bad guys get to watch it, then clone it."

Gen. Michael Hayden, former director of both the National Security Agency and the CIA, told attendees that U.S. computer networks -- not just government systems, but corporate systems and ordinary citizens' computers -- face layers of threats. While concerns about systematic penetration by nation states such as China, India and Russia are well recognized, that threat primarily is of intellectual property theft.

"We steal stuff, I admit that," he said of U.S. intelligence community efforts, "but we do it to protect citizens, not to get rich."

[ For more info on protecting your systems, see Don't Let 'Spooks' Get Your Cloud Data. ]

More concerning are the emerging threats that want to damage systems, such as the cyber attack against the Saudi Arabian national gas company Aramco. Hayden pointed out that about 35,000 hard drives were wiped clean in that attack.

The emerging new groups of attackers act on a wide range of motives. They are "just mad, mad at the world. Blessedly, they are the least capable right now," Hayden said, but "they may acquire capabilities comparable to nation states and criminals."

Ellen Richey, chief enterprise risk officer for Visa, the global credit card company, said her industry loses about $10 billion every year to theft and fraud. While the industry actively works to strengthen its security measures, law enforcement around the world has not adapted to the new Internet environment.

"We know who some of these big players are, and they are specifically attacking American and western European companies," Richey said. "If someone came and bombed my data center, I presume the government would protect me, but if an enemy country sent hackers to attack me," the company is on its own.

The rules of cyber warfare are evolving slowly as governments and companies around the world work to address these threats, but the concept of "self-defense" does not apply.

"It's illegal to chase bad guys up the wire, even if you have the capability to do so -- it's illegal to shoot back," Mundie said. There is no "self-defense" argument a company can make. These legal limits, and other constraints, make for uneasy relations between government agencies tasked with cybersecurity and the industries that get targeted by hackers.

For instance, Howard Schmidt, former White House cybersecurity coordinator, said, "If you go to small co-ops that provide electric power ... the government almost becomes an enemy because these utilities have done a lot and they're not being recognized. There is a maturity model for the energy sector ... but to constantly say 'the private sector has failed,' makes it very difficult to have a dialogue."

Rather than simply lamenting the state of affairs, the panelists suggested repeatedly that good computer hygiene -- firewalls, prompt software upgrades and patch management, two-factor identification, limiting administrative permissions, and other fundamentals of cybersecurity -- would address 80% of the threats faced by computer users and networks, whether in the public or private sector. This would allow cyber resources to be dedicated to the all-important 20% of threats, from new zero-day exploits to threats against critical infrastructure such as the electrical grid.

To that end, Jane Lute, former deputy secretary at the Department of Homeland Security and now president and CEO of the Council on Cyber Security, said her organization is going to convene the first meeting of law enforcement officials from around the world to discuss cybersecurity and threats.

"Can we prioritize cyber intrusions ... as a diplomatic priority?" she said. "Quite frankly, the business sector has been slow off the mark. They need to be incentivized. Good business practice isn't an incentive, the protection of people's privacy isn't an incentive."

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Chuck Brooks
50%
50%
Chuck Brooks,
User Rank: Apprentice
10/14/2013 | 8:04:09 PM
re: Cyberthreats Grow More Ominous: Former NSA Chief
I attended the Washington Post conference (which was informative and eye opening). Patience's summary of the highlights of the conference are concise. The biggest takeaway is that cyber threats are expanding exponentially and it is very difficult to maintain a current/heightened level of security. Good computer hygiene and awareness are often overlooked and are an increasingly more important part of mitigating threats.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7298
Published: 2014-10-24
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.

CVE-2014-8346
Published: 2014-10-24
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.

CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.