Risk
10/11/2013
10:21 AM
50%
50%

Cyberthreats Grow More Ominous: Former NSA Chief

Microsoft's Craig Mundie, former NSA and CIA chief Gen. Michael Hayden and other experts say cybersecurity attacks are getting more dangerous.

The nature of cybersecurity attacks is becoming more dangerous and the threats on business and government more disturbing, a group of IT and cybersecurity experts said at a Cybersecurity Summit, held by the Washington Post Oct. 3.

"I think that people need to understand that in the last 12 months there's been a qualitative change," said Craig Mundie, senior adviser to the CEO at Microsoft. "The threats are moving to destructive attacks. Unlike conventional weapons, every time someone shoots one of these weapons, the bad guys get to watch it, then clone it."

Gen. Michael Hayden, former director of both the National Security Agency and the CIA, told attendees that U.S. computer networks -- not just government systems, but corporate systems and ordinary citizens' computers -- face layers of threats. While concerns about systematic penetration by nation states such as China, India and Russia are well recognized, that threat primarily is of intellectual property theft.

"We steal stuff, I admit that," he said of U.S. intelligence community efforts, "but we do it to protect citizens, not to get rich."

[ For more info on protecting your systems, see Don't Let 'Spooks' Get Your Cloud Data. ]

More concerning are the emerging threats that want to damage systems, such as the cyber attack against the Saudi Arabian national gas company Aramco. Hayden pointed out that about 35,000 hard drives were wiped clean in that attack.

The emerging new groups of attackers act on a wide range of motives. They are "just mad, mad at the world. Blessedly, they are the least capable right now," Hayden said, but "they may acquire capabilities comparable to nation states and criminals."

Ellen Richey, chief enterprise risk officer for Visa, the global credit card company, said her industry loses about $10 billion every year to theft and fraud. While the industry actively works to strengthen its security measures, law enforcement around the world has not adapted to the new Internet environment.

"We know who some of these big players are, and they are specifically attacking American and western European companies," Richey said. "If someone came and bombed my data center, I presume the government would protect me, but if an enemy country sent hackers to attack me," the company is on its own.

The rules of cyber warfare are evolving slowly as governments and companies around the world work to address these threats, but the concept of "self-defense" does not apply.

"It's illegal to chase bad guys up the wire, even if you have the capability to do so -- it's illegal to shoot back," Mundie said. There is no "self-defense" argument a company can make. These legal limits, and other constraints, make for uneasy relations between government agencies tasked with cybersecurity and the industries that get targeted by hackers.

For instance, Howard Schmidt, former White House cybersecurity coordinator, said, "If you go to small co-ops that provide electric power ... the government almost becomes an enemy because these utilities have done a lot and they're not being recognized. There is a maturity model for the energy sector ... but to constantly say 'the private sector has failed,' makes it very difficult to have a dialogue."

Rather than simply lamenting the state of affairs, the panelists suggested repeatedly that good computer hygiene -- firewalls, prompt software upgrades and patch management, two-factor identification, limiting administrative permissions, and other fundamentals of cybersecurity -- would address 80% of the threats faced by computer users and networks, whether in the public or private sector. This would allow cyber resources to be dedicated to the all-important 20% of threats, from new zero-day exploits to threats against critical infrastructure such as the electrical grid.

To that end, Jane Lute, former deputy secretary at the Department of Homeland Security and now president and CEO of the Council on Cyber Security, said her organization is going to convene the first meeting of law enforcement officials from around the world to discuss cybersecurity and threats.

"Can we prioritize cyber intrusions ... as a diplomatic priority?" she said. "Quite frankly, the business sector has been slow off the mark. They need to be incentivized. Good business practice isn't an incentive, the protection of people's privacy isn't an incentive."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Chuck Brooks
50%
50%
Chuck Brooks,
User Rank: Apprentice
10/14/2013 | 8:04:09 PM
re: Cyberthreats Grow More Ominous: Former NSA Chief
I attended the Washington Post conference (which was informative and eye opening). Patience's summary of the highlights of the conference are concise. The biggest takeaway is that cyber threats are expanding exponentially and it is very difficult to maintain a current/heightened level of security. Good computer hygiene and awareness are often overlooked and are an increasingly more important part of mitigating threats.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7830
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the mod/feedback:mapcourse cap...

CVE-2014-7831
Published: 2014-11-24
lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the get_grades web service.

CVE-2014-7832
Published: 2014-11-24
mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by vi...

CVE-2014-7833
Published: 2014-11-24
mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.

CVE-2014-7834
Published: 2014-11-24
mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the forum_get_discussions web service.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?