Risk
5/3/2011
09:47 AM
50%
50%

FBI Defends Cyber Investigation Capabilities

Exclusive: An FBI official argues that an audit finding insufficient national cybersecurity investigation skills doesn't reflect current expertise and results.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
The FBI's field offices lack the skills and expertise that they require for investigating national cybersecurity intrusions, with many field offices facing a shortage of forensic investigators and intelligence analysts, as well as tactical intelligence for guiding investigations.

Those are some of the top-level findings from a Department of Justice Office of the Inspector General audit of the FBI's computer intrusion investigation capabilities, released last week.

The audit, started in 2008 as an assessment of the FBI's computer intrusion investigation capabilities, grew to encompass the bureau's ability to investigate national security computer intrusions by the audit's completion in 2010. The audit also assessed the effectiveness of the FBI-led, multi-agency task force known as the National Cyber Investigative Joint Task Force (NCIJTF). Created in 2008 when President Obama established the Comprehensive National Cybersecurity Initiative, the task force's job is to coordinate intelligence and investigations into national cybersecurity intrusions across 18 intelligence and law enforcement agencies. For the report, auditors interviewed personnel at FBI headquarters, in 10 field offices, and at the NCIJTF.

According to the audit, 36% of FBI of cyber agents thought they lacked the necessary IT expertise for handling national security intrusions, and five out of 36 agents interviewed told the auditor that they didn't think they were skilled enough to investigate national security intrusions. In addition, the audit found that sharing intelligence information between agencies could be challenging, with the reasons for withholding information not always being clear to all participants. Finally, it questioned the FBI's approach to rotating cyber personnel to new offices every three years.

But in an exclusive interview, Steven Chabinsky, deputy assistant director of the FBI's cyber division, largely disputed those findings. On the skills front, for example, he said the audit paints an out-of-date picture of the bureau's cyber-investigation capabilities and results. "We have a very limited sample size of data that's years old, that's going down to the individual level of five agents, that ignores the fact that these agents were in training, and that these agents work in an environment that's conducive to success," he said in a telephone interview.

The FBI has been heavily adjusting its approach to cyber investigations over the past few years. In particular, the bureau has created a cyber-focused training program that mixes real-world experience with classroom learning. "Some of these situations you'll never be able to learn in a classroom, because some of our adversaries are using zero-day exploits which by definition you've never seen before," said Chabinsky. Agents are also part of a squad of experienced personnel, and backed by FBI agents with extremely specialized knowledge who are part of a cyber-action team that can quickly deploy to assist with investigations onsite.

Hence, instead of focusing on the subjective opinions of interviewed agents who were in the process of being trained, Chabinsky said that observers should examine the FBI's results, which he said the report largely ignores. "Case success is relegated to a footnote that said there have been some successes which are beyond the classification level of the report," he said.

Praise For The FBI's Cyber Unit

The FBI's cyber unit and the NCIJTF have received praise for their results, notably from the Office of the Directorate of National Intelligence (ODNI), which oversees the NCIJTF and evaluates its performance on a quarterly basis. In August 2009, the ODNI praised the task force for having been "the driving force behind the transformation of cyber threats from a fragmented and reactive individual agency response, to a unified and highly successful proactive national effort that established itself as a national center of excellence."

Industry experts have also lauded the NCIJTF. "It is the best interagency cooperation program anywhere in cybersecurity--with every key agency actually helping on real cases, hunting down the attackers," said Alan Paller, director of research for information security training company SANS, in an email interview. "They are also effective in finding evidence of actual attacks and warning corporations and agencies that those organizations have been penetrated and data has been stolen. Along with the [National Security Agency vulnerability analysis and operations group], it is the best cybersecurity program we have."

If there's a shortcoming of the NCIJTF--or the FBI's cyber unit--it's that "they have too many cases for the number of people they have, but that brings us around to the problem of skills," said Paller. "The colleges are graduating people who can talk about security, but have no forensics or intrusion detection or exploit skills."

What will help, he said, are internal agency training programs, as well as outreach efforts, such as the U.S. Cyber Challenge--championed by Shawn Henry, executive assistant director of the FBI's criminal, cyber, response and services branch, said Paller--which focuses on fostering high-schoolers' and college students' interest and expertise in information security.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?