Risk
7/27/2012
01:36 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Strike Back At Hackers? Get A Lawyer

Don't risk legal troubles. Get advice before taking the offensive against cybercriminals, military security expert says at Black Hat.

As security pros in business and government shore up their cyber defenses and contemplate striking back at hackers, they may find themselves on uncertain legal ground. To avoid costly mistakes, it's important to get legal advice before taking action.

That was the message from Robert Clark, an operations lawyer with the U.S. Army Cyber Command, in an address titled "Legal Aspects of Cyberspace Operations," on Thursday at the Black Hat conference in Las Vegas.

"Get a good lawyer. Get them involved early and often. They can be a valued team member," Clark said in an interview with InformationWeek after his presentation.

A key theme at Black Hat was the trend toward incorporating an offensive component into cybersecurity strategies, what Clark referred to as "hack back." But the use of security "beacons," disinformation, and other offensive techniques may have legal implications, he said. Clark said he was speaking in his personal capacity as a legal expert and not as a government official.

[ Consider these 5 Black Hat Security Lessons For CIOs. ]

The role of the lawyer is to ask detailed questions about what steps security teams want to take "so the people who make the decision are fully informed of the risks," Clark said.

Earlier in the week at Black Hat, former FBI cybersecurity expert Shawn Henry, now president of CrowdStrike Services, said proactive cybersecurity strategies include creating a "hostile environment" for would-be hackers and even causing them "pain." He pointed to the use of corrupt packets and disinformation as potential ways of doing that.

Clark said there's a "large area to be explored" when it comes to new techniques for defending an organization's information and IT assets. The Computer Fraud and Abuse Act of 1986, which specifies a range of computer-access offenses, sets legal parameters that continue to apply. "No lawyer's going to say, 'violate the law,'" said Clark.

Operations lawyers can and should help IT security teams finds ways to accomplish their objectives within the boundaries of the law. "No lawyer should say, 'you can't do that,'" said Clark. "They should say, 'if we do it this way,'" then the strategy is legally viable.

Computer security basics continue to be important. Clark said operations lawyers must assess the steps taken prior to engaging in more proactive defenses, such as "air gapping" sensitive information, so that it's harder to access electronically, and encrypting data at rest.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
7/27/2012 | 7:23:14 PM
re: Strike Back At Hackers? Get A Lawyer
A great piece of advice, always get a legal opinion if what you are doing is questionable. I am sure hack back started because some companies IT department got back at some one who penetrated their system. I like the idea giving them a taste of their own medicine. Also it does have the potential to get nasty fats if both parties involved are trying to one up the other. On the part of the business that would be very unprofessional to get in a shouting match. The professional way would be to seek the advice of a lawyer so that you know exactly what your limitations are as a business. I can also see some good in this; say someone penetrates your companies system and the IT department does not find out about it till after the fact. Hacking back could actually entice the hacker to return and therefore giving the company the second chance at identifying the infiltrator. Has anyoneG«÷s company actually done a hack back and had positive legal results form it?

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1701
Published: 2015-04-21
Unspecified vulnerability in Microsoft Windows before 8 allows local users to gain privileges via unknown vectors, as exploited in the wild in April 2015.

CVE-2015-2041
Published: 2015-04-21
net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.

CVE-2015-2042
Published: 2015-04-21
net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.

CVE-2015-0702
Published: 2015-04-20
Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to execute arbitrary code by using the languageShortName parameter to upload a file that provides shell access, aka Bug ID CSCus95712.

CVE-2015-0703
Published: 2015-04-20
Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.