Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/8/2013
03:01 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Managing The Legal Risks Of Active Defense

Legal considerations must come to bear in risk management calculations made with regard to implementing active defense measures with IT security practices

As increasingly more organizations deliberate adding active defense strategies to their IT security practices, they'll need to consider the risk management baggage that accompanies these aggressive maneuvers. One of the top risk considerations to factor into a decision about active defense activities should be legal concerns, according to a cyber law expert who last week at Black Hat outlined the legal ramifications of a number of common active defense scenarios.

Among the highlights, Robert Clark, distinguished professor of law for the Cyber Operations Center for Cyber Security Studies at the US Naval Academy, recommended that enterprises bear in mind two important points. First, that the right to protect property is not unlimited—in the physical world, for example, one can't kill someone who has stolen their stuff. And, second, that if IT risk managers are contemplating going down the path of active defense they should be involving their attorneys early and often in the decision-making process.

Click here for more of Dark Reading's Black Hat articles.

"If you're going to do this, you're going to need a great team of lawyers, or at least one really great lawyer, to handle this for you," said Clark, who said he was speaking in a personal capacity as a cybersecurity law expert. "Explain the technology to them at a third-grade level so that they can turn to senior leaders or judge and jury to explain it at a first-grade level."

Clark detailed some of the legal aspects of common active defense situations, including the legal pitfalls of seeding networks with deceptive information or decoy honeypots. For example, if an organization sets up fake internal documents with no intent for them to be made public but they are nevertheless stolen and sent to the media these seemingly legitimate documents could be confused as public disclosure to the Securities and Exchange Comission (SEC).

"If I'm the SEC and I see the documents coming out there, I can tell you, I'm going to be knocking at your door. And your shareholders are going to be knocking at your door as you're sitting there trying to explain it is part of a deception plan," he said. "That's why you have to get your SEC lawyers involved when you're having this discussion of what you want to do."

Even more common, though, are the situations Clark went over with regard to recovery of stolen intellectual property or other sensitive data when an organization can locate where the data is housed outside of the network. Every scenario is different, but he advised his audience that the law will likely look more favorably if the organization has done everything it can on the prevention side before it takes an intrusive measure against an antagonist.

"The law favors prevention over post-trespass recovery," he said. Also, the courts are likely to consider whether an organization is supposed to be where it is from a permissions standpoint, using the real-world analogy of sitting in a bar frequented by a competitor's executives versus using a hidden microphone in a private office.

So, there would be a lot more grey area to work around if an organization erased data from an anonymous FTP server with open privileges than if they escalated privileges or broke into an attacker's private machine. Meanwhile if an innocent and unknowing third party's machine is being used to host data, the organization would likely have no legal standing to simply go in and act , but they could ask permission to delete the data. However, even situations like the first one with the anonymous FTP server could have the potential to land an organization in hot water with the Department of Justice (DOJ) for Computer Abuse and Fraud Act violations. According to Clark, organizations that don't like it shouldn't blame the DOJ.

"I'll tell you something. When you're talking about recovery operations, I really do believe that this is a no-win situation," Clark says. "Don't blame doj for anything. Blame congress. If you've got a problem with something, you need to talk to congress about changing the law. You elected them, they work for you, that's what needs to be changed."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
IoT Vulnerability Disclosure Platform Launched
Dark Reading Staff 10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27673
PUBLISHED: 2020-10-22
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.
CVE-2020-27674
PUBLISHED: 2020-10-22
An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.
CVE-2020-27675
PUBLISHED: 2020-10-22
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash vi...
CVE-2020-3996
PUBLISHED: 2020-10-22
Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in information leakage to unauthorized users.
CVE-2020-15680
PUBLISHED: 2020-10-22
If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to successfully probe whether an external protocol handler was registered. This vulnerabil...