Risk
10/11/2013
10:21 AM
Connect Directly
RSS
E-Mail
50%
50%

Cyberthreats Grow More Ominous: Former NSA Chief

Microsoft's Craig Mundie, former NSA and CIA chief Gen. Michael Hayden and other experts say cybersecurity attacks are getting more dangerous.

The nature of cybersecurity attacks is becoming more dangerous and the threats on business and government more disturbing, a group of IT and cybersecurity experts said at a Cybersecurity Summit, held by the Washington Post Oct. 3.

"I think that people need to understand that in the last 12 months there's been a qualitative change," said Craig Mundie, senior adviser to the CEO at Microsoft. "The threats are moving to destructive attacks. Unlike conventional weapons, every time someone shoots one of these weapons, the bad guys get to watch it, then clone it."

Gen. Michael Hayden, former director of both the National Security Agency and the CIA, told attendees that U.S. computer networks -- not just government systems, but corporate systems and ordinary citizens' computers -- face layers of threats. While concerns about systematic penetration by nation states such as China, India and Russia are well recognized, that threat primarily is of intellectual property theft.

"We steal stuff, I admit that," he said of U.S. intelligence community efforts, "but we do it to protect citizens, not to get rich."

[ For more info on protecting your systems, see Don't Let 'Spooks' Get Your Cloud Data. ]

More concerning are the emerging threats that want to damage systems, such as the cyber attack against the Saudi Arabian national gas company Aramco. Hayden pointed out that about 35,000 hard drives were wiped clean in that attack.

The emerging new groups of attackers act on a wide range of motives. They are "just mad, mad at the world. Blessedly, they are the least capable right now," Hayden said, but "they may acquire capabilities comparable to nation states and criminals."

Ellen Richey, chief enterprise risk officer for Visa, the global credit card company, said her industry loses about $10 billion every year to theft and fraud. While the industry actively works to strengthen its security measures, law enforcement around the world has not adapted to the new Internet environment.

"We know who some of these big players are, and they are specifically attacking American and western European companies," Richey said. "If someone came and bombed my data center, I presume the government would protect me, but if an enemy country sent hackers to attack me," the company is on its own.

The rules of cyber warfare are evolving slowly as governments and companies around the world work to address these threats, but the concept of "self-defense" does not apply.

"It's illegal to chase bad guys up the wire, even if you have the capability to do so -- it's illegal to shoot back," Mundie said. There is no "self-defense" argument a company can make. These legal limits, and other constraints, make for uneasy relations between government agencies tasked with cybersecurity and the industries that get targeted by hackers.

For instance, Howard Schmidt, former White House cybersecurity coordinator, said, "If you go to small co-ops that provide electric power ... the government almost becomes an enemy because these utilities have done a lot and they're not being recognized. There is a maturity model for the energy sector ... but to constantly say 'the private sector has failed,' makes it very difficult to have a dialogue."

Rather than simply lamenting the state of affairs, the panelists suggested repeatedly that good computer hygiene -- firewalls, prompt software upgrades and patch management, two-factor identification, limiting administrative permissions, and other fundamentals of cybersecurity -- would address 80% of the threats faced by computer users and networks, whether in the public or private sector. This would allow cyber resources to be dedicated to the all-important 20% of threats, from new zero-day exploits to threats against critical infrastructure such as the electrical grid.

To that end, Jane Lute, former deputy secretary at the Department of Homeland Security and now president and CEO of the Council on Cyber Security, said her organization is going to convene the first meeting of law enforcement officials from around the world to discuss cybersecurity and threats.

"Can we prioritize cyber intrusions ... as a diplomatic priority?" she said. "Quite frankly, the business sector has been slow off the mark. They need to be incentivized. Good business practice isn't an incentive, the protection of people's privacy isn't an incentive."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Chuck Brooks
50%
50%
Chuck Brooks,
User Rank: Apprentice
10/14/2013 | 8:04:09 PM
re: Cyberthreats Grow More Ominous: Former NSA Chief
I attended the Washington Post conference (which was informative and eye opening). Patience's summary of the highlights of the conference are concise. The biggest takeaway is that cyber threats are expanding exponentially and it is very difficult to maintain a current/heightened level of security. Good computer hygiene and awareness are often overlooked and are an increasingly more important part of mitigating threats.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.