Tag Archives: self-defense

Security

Active Defense: Is it time to test in court? Correcting the Record!

Leave a comment

by David Willson

On 16 January I did two webinars with Bright Talk.  One titled, “Active Defense: It is Legal and Will It Actually Improve your Security?,” and the other a panel entitled, “The single greatest security challenges for 2013.” 

Quick side note, due to my zeal for this topic I babbled on too long in the Active Defense webinar and ran out of time before getting to the meat of the issue.  But I am going to do another on 13 March and will manage my time better.  Anyway, Peter Judge moderated the panel for the other webinar and Active Defense was my portion. 

We had a great discussion and I would encourage you to listen if you are interested.  It can be found here: https://www.brighttalk.com/webcast/288/64057. 

On 22 January Peter wrote an article for Tech Week Europe entitled, “Its Time to Test Active Defence in Court,” found here: http://www.techweekeurope.co.uk/comment/2013-time-to-test-active-defence-in-court-105048. 

Although he got the facts correct and most of what I said in the webinar correct, the tone in which he portrays my comments I feel needs some clarifying.  This is not me trying to pull myself out of the fire, since I have not seen any feedback from his article, but simply my clarification.  So, now that I am done with my overly wordy intro, here we go.

To his first point, I agree that cyber crime victims are within their right to retaliate, but would preface this as any good attorney would with “it depends!”  It depends on the facts and circumstances.  For instance, if the attack is a one-time attack and is over, then you DO NOT have a right to retaliate. 

Similar to when someone robs your house.  If they are gone you have no right to pursue the burglar on your own.  On the other hand, if you have been attacked repeatedly and are sure it continues or will happen again you have a right to defend yourself.

Okay, next comment, “Itching to test this in court.”  Well, personally yes, but I did not say this, and other than my passion for trial work and arguing in court, no one likes to find themselves dragged into court.  But, if the situation dictates that you must do something to protect your company, you have tried all other options and are interested in moving to the next level, then you have options.

Next: “. . . instead of putting in a “huge hodgepodge of security measures” to stop any threat.”  Security is a MUST.  Anti-virus, despite what Josh Corman says, is a MUST.  Anything that can help protect your network and valuable information is a MUST.  If you are going to move into Active Defense you MUST show that you have taken the high ground, done all you can, within reason, and taken an incremental approach slowly escalating as you collect the needed intel.

Next: “Persistent attacks may be bleeding hundreds of thousands of dollars from companies, and in that situation, they should be within their rights to respond, says Willson.”  Yes, they should.  If your company is losing 50 to 100 thousand dollars a week and you have done everything else you believe possible, to include called or considered calling law enforcement, to no avail, self-defense should be an option.

In the interest of time I will make this my last point.  Peter claims that I said those whose networks have been hacked and are being used to attack others are not necessarily innocent victims.  I agree, although this sounds rather ugly. 

Let’s use a physical world example.  Let’s say a bad guy has drugged and brainwashed your neighbor to believe he is a contract killer and his mission is to kill you.  Even if you know this is fact and your neighbor is an innocent unknowing pawn, if he tries to kill you wouldn’t you defend yourself?  You would likely try to diffuse the situation with the least amount of harm to your neighbor, but in the end if it is him or you unless you have a death wish it will be him. 

Active Defense entails escalation, taking the minimal approach at first and slowly escalating with the leadership of the company, not the IT department, making informed decisions based upon risk, liability and legal issues.  The nuclear weapon of cyber is your last resort if that is what the leadership decides to do.

So, there you have it.  Obviously there are many more issues none of them black and white, and this is a very difficult problem.  If it wasn’t there wouldn’t be so much debate about it. 

One last point.  Lately I have been reading a lot of articles, especially by attorneys saying things like, “it’s illegal, don’t do it, but, we are the experts and we can help you.”  Help you do what?  If they are not willing to explore the options then there is nothing for them to do.  Also many articles lately have claimed that “attribution” is impossible.  Stop it.  If it was impossible no one would ever be arrested and prosecuted for hacking.  It is difficult, but not impossible.  So, keep an open mind, think outside the box, and have a nice day ;- ).

Security

‘Active Defense’ will Improve Cyber Security

Leave a comment

Lately I’ve seen many articles about “active defense” and “hack back.” This is good because current defenses aren’t working and being in a constant state of defensive mode is not a lot of fun.  Something needs to be done.  The problem is many of these articles take a doomsday approach to the topic. 

Comments like, “it’s illegal, you can’t do it;” “you will disrupt someone’s life support in a hospital;” “we will end up with vigilantes hacking back;”and many more, do not facilitate a discussion but appear to seek to end the debate.  Many of the naysayers claim the only solution is law enforcement and more of it.  How many more police would be enough and is this a realistic response? 

Consider this: one person can command a million bot attack from the comfort of his living room; nation-states are training their people to use cyberspace to attack, steal, disrupt; and working for organized crime and terrorist groups pays much better than working a legitimate job in many countries.  So, what will it take to raise the stakes and make hacking a more risky business?

Active defense will actually improve security for those who consider it.  However, regardless of how the debate proceeds and no matter what the perceived outcome, companies are not likely to suddenly flip a switch and begin hacking back.  There are still too many variables and unknowns involved, e.g. risks, liability and legal issues.  There will continue to be much caution and debate, primarily since the law on this topic is so unsettled and at this point it is difficult to tell from one jurisdiction to the next how this activity will be perceived.

A company with any sense of corporate responsibility will attack this problem with a very cautious approach.  For instance, if your company is persistently attacked the first question is why and how.  Is the company being targeted for a particular reason or is your security so crappy that every hacker and his brother are using you as their playground? 

If your security is good, which is relative because no matter whom you are, your security can always be improved, you will likely take an escalated approach to the problem and not jump right in to hacking back.  During this escalated approach you should be collecting the necessary intelligence to evaluate the problem. 

To use an analogy, let’s say you are in a combat zone and encounter a sniper.  In most circumstances you will not call in an airstrike on the sniper.  There are many factors to consider, like where is he, what type of collateral damage may occur, what is the least amount of effort and resources necessary to take him out, etc.?  So, when facing a cyber-attack the same considerations apply:

  • Where is the hacker coming from;
  • What is his motive and end-state;
  • Based on the Intel you have collected, what tools and techniques can you use;
  • What collateral damage may occur; and,
  • Since time and resources are money, what is the least time and resource intensive course of action you can take to resolve this issue?

Companies have too much to lose to take this lightly and jump forward without a very careful analysis.  It is this analysis that will inevitably lead to much better security and more focus on the problem.

Other questions for a company to ask are, is the attack persistent or a one-time hit and how much Intel can be collected regarding the attack: can a motive be determined, what is the source and means of the attack, potential location and/or identity of the attacker, how many hops in-between your network and the attacker, what type of servers and who owns those servers; then, what is your end-state (block attack, find hacker, prevent further disruption, retrieve intellectual property/trade secrets, etc.), and finally, what are the risks, liability, and legal issues involved? 

Any company that would attempt to hack back without ensuring that their security is good or better than average is just asking for trouble.  A lot of avenues of approach beyond the standard defenses currently employed exist for companies persistently attacked.  The fear mongering spewed in many articles over active defense and hack back will simply drive companies, which are persistently attacked and frustrated with the state of security, to go underground with their response, act in a haphazard manner, and hope they don’t get caught.

Security

Active Defense: Moving the Discussion Forward

1 Comment

Cyber-attacks against companies, organizations and governments have hit an unprecedented high. The ease with which hackers can launch multiple attacks has also increased.  Hacking has become big business with nation-states, terrorist groups, organized crime and others capitalizing on the theft of information (trade secrets, technology, intellectual property, others) and disrupting businesses they are in competition with. Are the current defenses working?  Unless you live in a shoe box you realize, especially based on daily news reports, that the cyber war appears to be one the good guys are losing.

A change is needed because the problem has gotten out of hand. Current laws hinder organizations from defending themselves while at the same time facilitating the efforts of hackers. So, rather than jumping to the conclusion that any action to defend your organization beyond the currently accepted techniques is illegal, a discussion needs to be started and moved forward about better and more effective options.  It appears it has.

In a recent Washington Post article[1] the issue of defending outside of one’s network and possibly entering the server of another, active defense, was raised.  Again the knee jerk reaction is that it’s illegal, but the conversation continued. 

“[It is] important to enable companies whose computer networks are targeted by criminals and foreign intelligence services to detect who’s penetrating their systems and to take more aggressive action to defend themselves,  said Steven Chabinsky, a 17-year FBI veteran who stepped down this month as the FBI’s top cyber lawyer.    The article continued with Stewart A. Baker, a former senior Homeland Security Department official stating, “The issue . . . is that entering another party’s server and deleting or encrypting data could, under some circumstances, violate a number of state and federal laws — including those against computer fraud or trespassing.”  “But, he said, there is a legal argument to be made that such an action is a reasonable defense of one’s property.  Though common in other contexts, that defense has yet to be tested in the cyber area in court.”

Top officials and leaders in this area predict growth as companies decide enough is enough.  “Former CIA director Michael V. Hayden has said that given the limits of the government in protecting companies in cyberspace, he expects to see the emergence of a “digital Blackwater,” or firms that hire themselves out to strike back at online intruders.”

I agree, this is exactly where we are headed and the discussion must go further.  Based on current laws, technology and state of affairs there is much more companies and organizations can do to defend themselves.  I am not advocating vigilantism, but a military-like operation that helps leaders of organizations walk through possible tools and techniques while evaluating risk, liability and legal issues every step of the way in an effort defend their most precious assets.

That is why Davi and I will be presenting at several upcoming conferences, including ISSA and RSA, a practical and legal approach to Active Defense. I look forward to seeing you there.

[1] Nakashima, Ellen, “Cybersecurity should be more active, official says,” The Washington Post – National Security (September 16, 2012)

Security

When Is Electronic Espionage an ‘Act of War?”

Leave a comment

Is the U.S. engaged in a “cyber war?” 

Until recently the identity of the perpetrators of cyber-attacks against U.S. networks, infrastructure and the military were clouded in suspicion and not spoken of out loud.  There has been much speculation about cyber war or a cyber-Pearl Harbor, but no official declaration of what constitutes cyber war or naming of names, until now. 

In March, General Keith Alexander, speaking before Congress, and in May, Secretary of Defense Leon Panetta, during an interview with ABC News, outwardly named China as the main perpetrator and identified criteria for defining cyber war.  General Alexander, the Director of NSA and CYBERCOM commander, stated, “China is stealing a ‘great deal’ of military-related intellectual property from the United States and was responsible for last year’s attacks against cyber security company RSA . . . .”[1] Secretary of Defense Panetta said, “Well, there’s no question that if a cyber attack, you know, crippled our power grid in this country, took down our financial systems, took down our government systems, that that would constitute an act of war.”[2]

Over the last year the Department of Homeland Security (DHS) has voiced their concern over the vulnerability of our critical infrastructure, oil and gas refineries, electric grids and nuclear reactors, to potential cyber-attacks. If you are not fully convinced of the threat, consider the “Shady RAT (remote access tool)” report by McAfee wherein they identify companies and governments which recently discovered that hackers have been in their networks for the last five or six years undetected.[3]

One might conclude that a clear picture is emerging, but is it? 

During the Cold War, when government secrets were stolen, it was treated as espionage or spying.  Remember all of the spies tried for espionage: Aldrich Ames, Robert Hansen, the shoot down of Gary Powers and the U2 spy plane over the USSR.  What if a nation placed “sleeper cells” in its adversary’s country ready to attack critical infrastructure if a war broke?  Would this be considered spying and part of the “cat and mouse” game or grounds for a retaliatory strike?

Does the fact that these activities can now be accomplished electronically from the safety and comfort of your own nation change the playing field?  At the time, we probably considered the flights of the U2 relatively safe since it flew above the threat zone of anti-aircraft guns.  Does stealing terabytes of military secrets or planting logic bombs in critical infrastructure (to be launched in a moments’ notice to disable the infrastructure) cross the line from espionage to war or an “act of aggression?”  

This and many similar scenarios are now the new normal and must be defined as nations and the international community grapple with technology and current and future capabilities.  Where should the line be drawn?  Do we just accept, that an adversary, via computers, can now access and potentially steal, manipulate, or destroy information and functionality, or should nations aggressively draw the line now and openly retaliate in protest?

Obviously, as Secretary of Defense Panetta stated, if you disrupt critical infrastructure, deny critical communications, or blind a military defense system, the line has likely been crossed.  Certainly defacing a website does not even come close to being an act of war or aggression.  What about stealing terabytes of military secrets to later be used to disable your adversary’s defenses?  Possibly!  For now the line will be defined by the reactions of various nations faced with cyber-attacks.  If a nation does nothing or retaliates with a similar attack, e.g. theft for theft, then a line has been drawn and a precedent set.

A similar problem is the issue regarding Iran and nuclear weapons.  Is Iran’s pursuit of nuclear weapons and statements attributed to them about annihilating Israel and the West enough provocation to take aggressive action to prevent them from obtaining a bomb?  Clearly no one wants to escalate the situation but most agree something must be done before it is too late.  Similarly, in the cyber arena, all interested parties are reacting very cautiously in their response to cyber-attacks, likely to avoid escalation and the setting of precedence. 

In the Estonian and the Georgian conflicts the reaction was to block, clean up, and speculate about who may have launched the attacks and only the media claimed cyber war.  Not until recently has one nation, e.g. the U.S., been so vocal about who is using cyber espionage and attacks to invade and plague their networks.

[1] NSA Chief: China Behind RSA Attacks, J. Nicholas Hoover, Information Week Government (Mar. 27, 2012) http://www.informationweek.com/news/government/security/232700341.

[2] Leon Panetta: A Crippling Cyber Attack Would Be ‘Act of War’, Jake Tapper, ABC News (May 27, 2012) http://abcnews.go.com/blogs/politics/2012/05/leon-panetta-a-crippling-cyber-attack-would-be-act-of-war/.

[3] McAfee: Operation Shady RAT, http://www.mcafee.com/us/resources/white-papers/wp-operation-shady-rat.pdf.