Deconstructing The Sony Hack: What I Know From Inside The Military

The heightened tensions in cyberspace over the Sony cyberattack and the subsequent DDOS in North Korea have all network security professionals around the globe on high alert. Some sensationalists will want to equate this to the cyber equivalent of the Cuban Missile Crisis. I believe that is an overreach based on the facts that we know and my experience working in government and incident response.

Many folks are fixated on trying to figure out who is behind this attack. In my opinion, the public cannot draw any clear conclusions on the attribution of the actors behind the Sony attack based on the information that has been released to date. Connecting tradecraft and infrastructure is not enough evidence for clear attribution to North Korea. Advanced, targeted threat actors use other's infrastructure and tradecraft all the time to obfuscate their activity.

Significant (unpublished) evidence
I have to believe if the FBI and Sony are pointing the finger at North Korea, there is significant evidence not made public that allows them to draw that conclusion. The basis for my assertion relies on two observations:

First, major corporations immediately retain legal counsel upon the discovery of a major breach. Legal counsel's advice is to always limit public disclosure of information to reduce future liability. If this is the case here, it does not make Sony or their legal counsel evil. It is a fact that we must all live with considering the very litigious world of cyber security.

Second, the FBI and other government organizations likely have multiple sources of intelligence (signals intelligence and human intelligence) that they believe triangulates attribution of the actors behind this attack. Likely, these other sources of intelligence are highly classified and will never be released to the public. This classified information requires the cyber security community to take on faith that the government's attribution picture is credible when paired with these other methods of intelligence that cannot be shared.

The role of ransom
Another question everyone is asking: Is this escalation to a destructive capability going to be the norm going forward? Absolutely. This is truly the one element of the Sony story that keeps me up at night. We are seeing a trend in destructive activity on the rise.

Previously, cyberthreat actors were mainly focused on computer network exploitation for purposes of crime, fraud, or the theft of intellectual property. I observed a disturbing trend a couple of years ago with the crypto locker actors holding victims for ransom. These activities started off more as an annoyance, but have quickly escalated in the past few years to the point where major damage has been done to companies by ransom actors.

To me, the Code Spaces incident should have sent a shockwave through the security community. Ransom actors are now an existential threat to some companies. In the Code Spaces incident, the company had its hosted environment compromised and all of its customer data deleted when they could not pay the ransom. Code Spaces had to shut down their successful company as a result.

When you boil down the motive behind the Sony attack, it truly is about ransom. There has been no disclosure that the actors were seeking money, but they were definitely demanding concessions and actions by Sony which caused them to modify their business plans.

What we don't know
The other big question everyone is asking is did the US government strike back against North Korea? While I don't definitively know the answer, one thing I am positive about is that the process to approve offensive operations in cyberspace on behalf of the US government does not happen quickly. I think it is very unlikely that the US government would retaliate against North Korea for the Sony attack. I think our government's response is more likely that our intelligence organizations will increase their collection on North Korean targets, but the bar for offensive cyber operations is very high. There are other more effective levers in diplomatic and economic pressure that the US can leverage to achieve our national objectives.

Where does that leave us? My first bit of advice: Don't get caught up in the guessing game on attribution. Leave it to government organizations and the victim -- in this case, Sony -- to worry about the "who done it." In just about all cases, the government or victim organization will be unable to release all of the relevant facts around attribution. The critical task is understanding the threat data and threat actor tactics to ensure you are not vulnerable to the same attack.

It's also important to add a risk factor of sophisticated ransom actors to your math homework when you present to the board to justify additional security investments. Too much of the security industry is still focused on the data that you "have to protect" instead of protecting the entire organization. In today's cyberrisk environment, you cannot predict who the ransom actors will go after. In fact, in many cases, your organization could become a target due to some random opportunity threat actors find to gain access to your systems. The best strategy is to become a hard target by seeking out the most secure infrastructure to host your most critical data and applications.

This article is probably not going to help any of my fellow security professionals sleep better. However, I hope this discussion brings into focus some things you should be worried about in the wake of the Sony attack and helps guide you in where to invest your future security efforts.