Threat Intelligence

7/17/2018
07:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
0%
100%

White House Cybersecurity Strategy at a Crossroads

Trump administration's initial lack of a unified front in the wake of Russian election-hacking indictments worries cybersecurity experts.

Fallout from a rapid-fire series of developments surrounding the 2016 election hacking and meddling by Russia continued today as President Donald Trump attempted to walk back Monday's public dismissal of his intelligence agencies' findings pointing to Russia.

The chaos from Trump's apparent disconnect with his intelligence officials and others in the administration underscores concerns that the administration's cybersecurity strategy could be unraveling.

The latest chapter began late last Friday with the bombshell federal indictments of 12 Russian military officers for alleged hacking and leaking in an orchestrated effort to tip the scales toward Trump's presidential run by damaging Hillary Clinton's candidacy.

The detailed indictment provided names of the Russians, as well as how they led the hacks of the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and employees of Democratic presidential candidate Hillary Clinton's campaign, and waged strategic leaks online. In addition, they infiltrated the website of a state election board and pilfered information on 500,000 voters as well as breached a software supplier that verifies voter registration information.

But yesterday, after a private meeting with Russian President Vladimir Putin in Helsinki, Trump publicly disputed his own US intel agencies' findings and sided with Putin's denials. After the press conference, Trump's director of national intelligence, Daniel Coats, issued a statement standing by the US intelligence findings. 

Trump attempted a little damage control today back at the White House. But he still stopped short of fully calling out Russia as the perpetrator: Trump said it could also be someone other than Russia behind the election hacks and meddling.

"I have full, great faith in US intelligence," he said after meeting with congressional leaders. "The Russians had no impact at all on the outcome of the election. ... I accept our intelligence community's conclusion that Russia's meddling in the 2016 election took place. Could be other people also."

Trump said he misspoke at one point during the press conference with Putin. He said he actually meant to say the word "wouldn't," not "would," when he stated: "I don't see any reason why it would be Russia" behind the hacks. 

Meanwhile, Trump said the US will "aggressively repeal and repel any efforts to interfere in our elections" and that his administration has taken "strong action to secure our election systems and the process."

The Race is On
Indeed, the US Department of Homeland Security (DHS) has been reaching out to states and other related parties to offer assistance for securing their election systems. But getting all states and municipalities on board with the proper security tools and practices with the nation's disparate election and voting systems is a huge challenge.

"Elections are still very local, the federal government must still be invited to the table, and as a result we have a fractured system that is impossible to secure," says Chris Pierson, CEO of Binary Sun Cyber Risk Advisers. Pierson notes that the priority systems to secure – in tight or pivotal races, for example – will be a moving target from election to election. He says many US election systems and databases already are likely compromised.

But Ron Gula, president of Gula Tech Adventures, says it's not the voting machines he's worried about. He says there are more insidious ways nation-states like Russia could disrupt this election, such as attacking the systems that report voting results to the media. "That could tip an election" with early results that ultimately discourage turnout, he says. And campaign workers are an obvious and easy target for phishing attacks, since their organizations are typically not well-funded and less likely to be able to afford two-factor authentication and other security measures.

The Russian military hacking teams from the GRU also stole more data than they leaked in 2016, including information from the Republication National Committee (RNC) and other targets. They could use the as-yet unknown stolen information, or other hacks, to repeat their previous operation this fall and in future elections, experts say.

Tom Kellermann, chief cybersecurity officer at Carbon Black, expects more Russian cyberattacks if the fall election swings out of Trump's favor and into that of the Democrats'. "Putin will take the gloves off then," he says. "And even if [Russia] feel they are winning, they aren't going to slow their hacking."

Russia's hacking teams already have been spotted in energy networks in the US: The Trump administration in March called out Russia for targeting its power grid. 

The White House cybersecurity coordinator position, which was vacated by former head Rob Joyce in April, was quietly eliminated altogether. Politico in May reported that it had obtained an email to the White House National Security Council staff from John Bolton aide Christine Samuelian that said: "The role of cyber coordinator will end," in an effort to "streamline authority" in the NSC, which includes two senior cybersecurity directors.

Trump's cybersecurity policy hasn't evolved much, and the lack of a cybersecurity coordinator may be partly why, experts say. "I think we really need somebody in there to make sure we have the right technology and approach across all leadership in government – in Congress and major agencies," Gula says.

Kellermann says while the administration still can set cybersecurity policy without someone in that position, having a cybersecurity coordinator can help bridge the various government departments. "A problem in DC is that people don't want to listen to other departments," he says.

Meanwhile, Trump's reluctance to strongly condemn Putin and his GRU for their hacking campaign during the presidential election isn't helping demonstrate a strong cybersecurity front for the US, experts say. That could leave the US vulnerable.

But it appears the key players in the nation's cyber defense aren't getting tripped up by the political battles. According to a report in The Washington Post, Paul Nakasone, director of the NSA and head of the US CyberCommand, already has the two organizations working on fighting back against any Russian cyberattacks on the 2018 election. 

Michael Hayden, a former CIA director and NSA director, says those efforts are not sufficient to protect the US, however. "Nakasone, and the heads of the other three-letter agencies, are doing what they can in their own lanes, absent an overall approach directed by the president," he told the Post. "As good as it is, it's not good enough. This is not a narrowly defined cyberthreat. This is one of the most significant strategic national security threats facing the United States since 9/11."

Editor's Note: Home Page photo credit to Andrew Harnik/AP/Shutterstock

Related Content:

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ragediver24
86%
14%
ragediver24,
User Rank: Strategist
7/18/2018 | 11:44:23 AM
Re: Analysis
Russian Hacking has been going on since before Obama and even further. Everyone is listening to everyone elses communications. The NSA is gobbling up everything with SIGINT and OSINT and yet there's still no evidence that the Russian's meddled in the election to an extent that swayed the vote count. The DNC used poor security practices and even gave people with questionable foreign ties access and security clearance to congressional and campaign documentation, and then tried to ccover it up when it became poltically expedient to do so. Saying that there's no clear Cybersecurity plan from Trump is disingenous. Obama administration published the NICE framework as well as other Executive Orders to enhance Cybersecurity and that did little to stop Russian trollls, Bots, etc. Trump published this https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ 

Which more or less says the same thing Obama said in generic terms. The difference is in backing up actual threats with actions. Unless you sit in a SOC, NOC, NSA cell that has direct information on what threats are actually occurring on a daily basis, saying that Trump somehow gave away the keys to the kingdom is flat out false. All that aside, as a security professional, I come to your site to avoid politics, but more and more tech journalists can't help but throw in their political spin. 
zzx375
50%
50%
zzx375,
User Rank: Strategist
7/18/2018 | 10:03:12 AM
Missing something
I'm missing something in all of this brouhaha and I could be accused of having simple/slow brain:

Where is the specific list of offenses that constitutes this meddling?  If bogus information dissemination is all there is to it, then I suggest the concern might rightly have to do with a society (ours) that has the lost the ability of critical analysis.  If something doesn't read "right", if the first thought "This seems hokey" it just might be.  Hacking I get although I don't get skipping the basics to prevent (patch your servers and desktops, teach people not to click on links in emails, keep following the established approval chain despite a "hair-on-fire" phone call or email from the Big Cheese - always get confirmation).  Fear of Russian meddling might be doing more harm than good.  
jenshadus
50%
50%
jenshadus,
User Rank: Strategist
7/18/2018 | 10:01:26 AM
Re: Analysis
I was thinking the same thing.  Where is the proof?  Has anyone ever heard of the enemy within?  And who in the heck was the DEM HQ security hack?  I think they all did this to themselves in case they lost.  Who know, and the lack of direction that Mueller has been bulldogging is not reassuring.  Thanks for putting it down so well.
jenshadus
100%
0%
jenshadus,
User Rank: Strategist
7/18/2018 | 9:59:23 AM
Re: White House Cybersecurity Strategy
Thanks for mentioning this technology.  I'll have to look into it.  Sounds interesting
tcritchley07
100%
0%
tcritchley07,
User Rank: Moderator
7/18/2018 | 9:20:08 AM
White House Cybersecurity Strategy
The internet's security is irretrievably insecure. I suggest the US looks at RINA (Recursive InterNetworking Architecture). I have no personal interest in this; I just think it looks as though it should be investigated as a alternative to the current cybersecurity 'patch and pray' philosophy.
PanamaVet
80%
20%
PanamaVet,
User Rank: Apprentice
7/18/2018 | 9:12:24 AM
Analysis
The report which is the basis for the current Russian indictments identifies perpetrators not found in the current list of those indicted.

Mueller was held accountable during the previous round of Russian indictments when one defendant was represented in court and demanded that Mueller produce the evidence of a crime.  He first tried to delay and then produced data that did not contain evidence.

It appears the current list is intended to exclude any Russian who may actually show up in court demanding accountability and so it is difficult to take seriously.

In other words, the basis for this analysis of Cybersecurity performance is based on a political ploy that has already proven worthless when it comes to drawing conclusions.

The fact is that a number of state sponsored attempts including our own are working every minute of every day to gather whatever information can be produced.

In the future let's stick to that and not waste time playing politics.

 </PanamaVet>

 
Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Now about that mortgage refinance offer from Wells Fargo .....
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6970
PUBLISHED: 2018-08-13
VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bounds read vulnerability in the Message Framework library. Successfully exploiting this issue may allow a less-privileged user to leak information from a privil...
CVE-2018-14781
PUBLISHED: 2018-08-13
Medtronic MMT 508 MiniMed insulin pump, 522 / MMT - 722 Paradigm REAL-TIME, 523 / MMT - 723 Paradigm Revel, 523K / MMT - 723K Paradigm Revel, and 551 / MMT - 751 MiniMed 530G The models identified above, when paired with a remote controller and having the &quot;easy bolus&quot; and &quot;remote bolu...
CVE-2018-15123
PUBLISHED: 2018-08-13
Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker perform new attack vectors and take under control device and smart home.
CVE-2018-15124
PUBLISHED: 2018-08-13
Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extract clear text passwords and get root access on the device.
CVE-2018-15125
PUBLISHED: 2018-08-13
Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface.