Risk
7/27/2012
01:36 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Strike Back At Hackers? Get A Lawyer

Don't risk legal troubles. Get advice before taking the offensive against cybercriminals, military security expert says at Black Hat.

As security pros in business and government shore up their cyber defenses and contemplate striking back at hackers, they may find themselves on uncertain legal ground. To avoid costly mistakes, it's important to get legal advice before taking action.

That was the message from Robert Clark, an operations lawyer with the U.S. Army Cyber Command, in an address titled "Legal Aspects of Cyberspace Operations," on Thursday at the Black Hat conference in Las Vegas.

"Get a good lawyer. Get them involved early and often. They can be a valued team member," Clark said in an interview with InformationWeek after his presentation.

A key theme at Black Hat was the trend toward incorporating an offensive component into cybersecurity strategies, what Clark referred to as "hack back." But the use of security "beacons," disinformation, and other offensive techniques may have legal implications, he said. Clark said he was speaking in his personal capacity as a legal expert and not as a government official.

[ Consider these 5 Black Hat Security Lessons For CIOs. ]

The role of the lawyer is to ask detailed questions about what steps security teams want to take "so the people who make the decision are fully informed of the risks," Clark said.

Earlier in the week at Black Hat, former FBI cybersecurity expert Shawn Henry, now president of CrowdStrike Services, said proactive cybersecurity strategies include creating a "hostile environment" for would-be hackers and even causing them "pain." He pointed to the use of corrupt packets and disinformation as potential ways of doing that.

Clark said there's a "large area to be explored" when it comes to new techniques for defending an organization's information and IT assets. The Computer Fraud and Abuse Act of 1986, which specifies a range of computer-access offenses, sets legal parameters that continue to apply. "No lawyer's going to say, 'violate the law,'" said Clark.

Operations lawyers can and should help IT security teams finds ways to accomplish their objectives within the boundaries of the law. "No lawyer should say, 'you can't do that,'" said Clark. "They should say, 'if we do it this way,'" then the strategy is legally viable.

Computer security basics continue to be important. Clark said operations lawyers must assess the steps taken prior to engaging in more proactive defenses, such as "air gapping" sensitive information, so that it's harder to access electronically, and encrypting data at rest.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
7/27/2012 | 7:23:14 PM
re: Strike Back At Hackers? Get A Lawyer
A great piece of advice, always get a legal opinion if what you are doing is questionable. I am sure hack back started because some companies IT department got back at some one who penetrated their system. I like the idea giving them a taste of their own medicine. Also it does have the potential to get nasty fats if both parties involved are trying to one up the other. On the part of the business that would be very unprofessional to get in a shouting match. The professional way would be to seek the advice of a lawyer so that you know exactly what your limitations are as a business. I can also see some good in this; say someone penetrates your companies system and the IT department does not find out about it till after the fact. Hacking back could actually entice the hacker to return and therefore giving the company the second chance at identifying the infiltrator. Has anyoneG«÷s company actually done a hack back and had positive legal results form it?

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4907
Published: 2014-07-11
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.

CVE-2014-4908
Published: 2014-07-11
Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper hand...

CVE-2014-2963
Published: 2014-07-10
Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName, (2) _2_lastName, or (3) _2_middleName parameter.

CVE-2014-3310
Published: 2014-07-10
The File Transfer feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center does not verify that a requested file was an offered file, which allows remote attackers to read arbitrary files via a modified request, aka Bug IDs CSCup62442 and CSCup58463.

CVE-2014-3311
Published: 2014-07-10
Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.