Risk
7/27/2012
01:36 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Strike Back At Hackers? Get A Lawyer

Don't risk legal troubles. Get advice before taking the offensive against cybercriminals, military security expert says at Black Hat.

As security pros in business and government shore up their cyber defenses and contemplate striking back at hackers, they may find themselves on uncertain legal ground. To avoid costly mistakes, it's important to get legal advice before taking action.

That was the message from Robert Clark, an operations lawyer with the U.S. Army Cyber Command, in an address titled "Legal Aspects of Cyberspace Operations," on Thursday at the Black Hat conference in Las Vegas.

"Get a good lawyer. Get them involved early and often. They can be a valued team member," Clark said in an interview with InformationWeek after his presentation.

A key theme at Black Hat was the trend toward incorporating an offensive component into cybersecurity strategies, what Clark referred to as "hack back." But the use of security "beacons," disinformation, and other offensive techniques may have legal implications, he said. Clark said he was speaking in his personal capacity as a legal expert and not as a government official.

[ Consider these 5 Black Hat Security Lessons For CIOs. ]

The role of the lawyer is to ask detailed questions about what steps security teams want to take "so the people who make the decision are fully informed of the risks," Clark said.

Earlier in the week at Black Hat, former FBI cybersecurity expert Shawn Henry, now president of CrowdStrike Services, said proactive cybersecurity strategies include creating a "hostile environment" for would-be hackers and even causing them "pain." He pointed to the use of corrupt packets and disinformation as potential ways of doing that.

Clark said there's a "large area to be explored" when it comes to new techniques for defending an organization's information and IT assets. The Computer Fraud and Abuse Act of 1986, which specifies a range of computer-access offenses, sets legal parameters that continue to apply. "No lawyer's going to say, 'violate the law,'" said Clark.

Operations lawyers can and should help IT security teams finds ways to accomplish their objectives within the boundaries of the law. "No lawyer should say, 'you can't do that,'" said Clark. "They should say, 'if we do it this way,'" then the strategy is legally viable.

Computer security basics continue to be important. Clark said operations lawyers must assess the steps taken prior to engaging in more proactive defenses, such as "air gapping" sensitive information, so that it's harder to access electronically, and encrypting data at rest.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
7/27/2012 | 7:23:14 PM
re: Strike Back At Hackers? Get A Lawyer
A great piece of advice, always get a legal opinion if what you are doing is questionable. I am sure hack back started because some companies IT department got back at some one who penetrated their system. I like the idea giving them a taste of their own medicine. Also it does have the potential to get nasty fats if both parties involved are trying to one up the other. On the part of the business that would be very unprofessional to get in a shouting match. The professional way would be to seek the advice of a lawyer so that you know exactly what your limitations are as a business. I can also see some good in this; say someone penetrates your companies system and the IT department does not find out about it till after the fact. Hacking back could actually entice the hacker to return and therefore giving the company the second chance at identifying the infiltrator. Has anyoneG«÷s company actually done a hack back and had positive legal results form it?

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4793
Published: 2014-12-27
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.

CVE-2013-5958
Published: 2014-12-27
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a si...

CVE-2013-6041
Published: 2014-12-27
index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in a SOFTCookies sid cookie within a login action.

CVE-2013-6043
Published: 2014-12-27
The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of requests.

CVE-2013-6227
Published: 2014-12-27
Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5.0.4 allows remote attackers to execute arbitrary code by uploading an executable file, and then accessing this file at a location specified by the format param...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.