Tag Archives: Attorneys

Security

Update: Putting and End to the End of Active Defense

Leave a comment

I recently read an article, “Putting an end to “strike back” / “active defense” debate, and another it linked to, “Managing The Legal Risks Of Active Defense,” wherein my friend Bob Clark was quoted.  Here is my response: 

Why in the world would we end the debate?  Security sucks and the bad guys have a huge advantage.  Our hands are tied.  Any debate that moves the discussion forward is a good thing. 

In the first article a guy calling himself Jericho chastises those who advocate Active Defense.  He equates it to strike back and hack back.  I have to say, I agree with two of his points; many companies are now trying to capitalize on this new term, yes new term, by offering what they call active defense or hack back tools.  In many cases this advertising is deceptive since the tools merely offer the same old software defenses under a new name.  I also agree that if your defenses don’t meet the basic standard, Active Defense is not an option.

I disagree with is his characterization of Active Defense.  I wish people would stop equating it to hack back.  Hack back is the last 1% of Active Defense.  See my definition here: http://www.titaninfosecuritygroup.com/_m1698/blog/Active-Defense-definition. 

It is a method for companies who find themselves persistently attacked to collect the intelligence needed to evaluate the attacks, develop courses of action or options, and then enable the leadership to make well-informed decisions to move forward in an effort to protect the company.

On a spectrum the options could be anywhere from do nothing or the other extreme of hack back to either find the attackers or disrupt or deny the server(s) being used to launch the attacks. The intelligence collected will allow company leadership to make decisions at pre-determined checkpoints based on risk, liability and legal issues.

The initial decision whether to simply proceed with incident response versus Active Defense is based on determining whether the attack is a one-time incident or persistent, and how much money is being lost since. Active Defense will require the company to bring in a team of experts to accomplish the various tasks: intel collection, malware analysis, tool/technique development, evaluating legal, risk and liability issues, and therefore the cost involved must be weighed against the damage to the company or loss due to the attacks.

Also, I disagree with the many people who write in opposition to Active Defense and make broad statements about how it is illegal without defining Active Defense or detailing what they believe to be illegal or why.  If you’re not an attorney stop saying it is illegal because the legality of Active Defense is not black and white. 

Jericho’s assertions strike me as hypocritical by jumping on the bandwagon of the Active Defense flurry, making broad assertions and offering NO solutions.  If defense is so easy then provide the solution, a solution that hasn’t been tried and one that will work and not subverted by hackers within a few months.  Second, see my friend Davi’s response, here: “Putting and End to the End of Active Defense”.  Good luck.

As for the article in which my friend Bob is quoted, I agree with Bob, for the most part.  You need a team of experts who know what they are doing, to include one or more attorneys who know what he/she is doing, but more than just an attorney you believe you can explain the technology to. 

This is not the kind of stuff you can just brush up on over the weekend.  This takes years of experience to understand the technology, apply the law and foresee the results or consequences.  Don’t believe it?  Ask your lawyer if he/she would be willing to put their law license on the line and provide advice in cyber security, hack back, the CFAA, ECPA, trace back, open-source collection, etc. 

What I disagree with is his comment that this is a no-win situation.  If you are a company owner and losing a lot of money or intellectual property, have tried everything else, and the attacks continue, you have a fiduciary responsibility to do something and self-defense may be your only option. 

Now, this does not mean jumping right to hack back.  My definition for Active Defense and what it entails is at the link above.  What it does mean is following a process, similar to incident response on steroids, and as the company leadership making critical decisions to protect the company.  In the end it may mean taking actions in self-defense and blocking or disrupting a CnC server or deleting your IP on a compromised server.  These options though are merely that, options in a process that requires a lot of Intel, thought and decision-making.

So, keep the debate going and don’t dismiss Active Defense as a no-win situation or illegal activity.

Security

Active Defense/Hack Back and “Complete Ignorance”

Leave a comment

I recently read a post about “Active Defense” or as some call it, hack back. I won’t reveal the author or the title so as not to disparage anyone. Certainly this topic is very sexy right now and many like to write about it, but most of articles I have seen constitute fear mongering with comments not based in fact or even sound theory, but ignorance of the topic, the laws, and the technology and appear to be an attempt to sensationalize the topic.

Yes, there is a problem. Yes, companies are suffering. Some of the companies have a legitimate complaint. They have done all they can and the government has tied their hands by saying things like, “if you hack back you are no different than the hackers.” A lot of companies, though, have no right to complain because their security really sucks, is like Swiss cheese and they are not willing to spend the money to fix it.

The blog I read recently quoted a former DoJ attorney who stated that it is illegal to go outside of your network and hack back at your attacker. In the next paragraph the writer quotes a so-called security expert who says his company has the capability to determine who attackers are and collect intelligence on them, and this is not illegal but good practice. The expert provides the usual, “do not try this at home,” warning. I will leave it to you to decide whether this warning is good advice or simply self-serving.

So here’s my problem: These quotes claim on one hand it is illegal to attack your attacker but on the other hand not to take the steps necessary to determine who your attacker is? If determining who attackers are was really that easy and clearly lawful everyone would be doing it. Most would admit the greatest challenge with cyber crime is determining who the attacker is, e.g. Attribution. One of the great claims by those who believe “Active Defense” is illegal and immoral is that attribution is extremely difficult and if you can’t determine attribution then you may be, “attacking an innocent victim.”

As a side note to the above comment, and as I have said in previous blogs, if someone has been compromised and their server is being used to attack my company, that person is NOT innocent. A victim like me, yes, but innocent, no. If I have to disrupt his server to protect my company then so be it. Chances are that server owner does not want the other hundreds or thousands of companies who are victims of his server attacks to know that he is the patsy attacking them due to his crappy security

So, I would kindly ask those who like to write about “Active Defense” to please do some research, think the process through, stop confusing the issue and stop writing fear mongering comments like, “you might start a war with China.”

Security

Active Defense: Attribution is just not that important

1 Comment

Imagine owning a company and realizing you have been hacked and the hackers are disrupting operations or stealing trade secrets, intellectual property, private information, or even money.  As best as you can determine this did not just happen but has been going on for a while.  You hired a company to do an incident response, clean up, patch the holes and get you back up and running.  They may or may not have claimed to have secured your network, but state in no uncertain terms that any action beyond what they have done would be illegal.  Within months you notice the same activity.  So, you call the company again.  More money, more time, and more meetings about how much is being lost.  Do you call law enforcement?  Do you continue with the cyber security company and keep paying them?  Do you have a data breach notice responsibility to shareholders, the board, and customers/clients? 

What you need is a clear and concise plan of action to follow in these situations.

When lecturing on “Active Defense” I often hear comments like, “hack back is illegal,” “without attribution you might hurt an innocent bystander,” or my favorite, “you might start a war with China.”  So what is “Active Defense”?  Many people equate it to hack back.  My definition of “Active Defense” is “a clear and concise process or plan for addressing a compromise to the security of your network and/or the loss or theft of data.”  The process begins with an incident response and could ultimately end with hack back.  It includes a series of predetermined check points requiring leadership/CEO involvement in making various decisions.  One of the first decisions is whether, based on the information available and/or gathered, the attack is a one-time occurrence or an ongoing intrusion/breach.  If it is determined to be a one-time occurrence the decision is easy, initiate an incident response plan, clean up, patch holes, and provide notifications required by law.  If the attack appears to be ongoing some of the follow-up on decisions may include: what end-state the company is seeking (find the hacker and prosecute, block the attack, get data back, etc.); what intelligence/information should be gathered; what tools/techniques should be developed and/or used and how; as information is gathered and options presented, which should be considered and pursued; and many more, most of which are all dependent on the facts, information available, best interests of the company, the fiduciary responsibility, etc.  At each stage and as each decision is made risk, liability and legal issues are discussed, evaluated, and factored into the decision process

Okay, so why is attribution not that important? 

Certainly, being able to identify your attacker makes life much easier for you and your company.  Even if you can’t identify the attacker, being able to identify who owns the server being used to attack you makes life simpler.  You can simply call the owner of the company whose server has been compromised and is attacking your network and work together to block the hacker.  If, for some reason, the owner of the compromised server will not work with you then you can proceed as if he is the hacker.  You might contact law enforcement or if for some reason that decision has been ruled out or, law enforcement for some reason is not able to assist, then you might decide to take action to block the attacks.  At this point the leverage you can garner against the server owner is pretty great.  Chances are his server is not only being used to attack you but many other companies as well.  The server owner will likely not want all of the other companies to know his compromised server is responsible for their pain, assuming they are aware of it.  When this fact is revealed to him he may suddenly be more than ready to negotiate and assist

In many cases though, you will not be able to determine the identity and/or whereabouts of the server owner. 

In that case, if you strike back and inspect the server attacking you, have you lashed out at an innocent bystander?  Many people claim just that.  I would argue this person is a victim like you, but innocent bystander, not even close.  Consider the 2006 movie “Firewall” with Harrison Ford.  His wife and daughter were kidnapped and the kidnappers, using this leverage, forced him to hack into a bank he was hired to protect and steal millions of dollars for them.  Now, granted, I like Harrison Ford, but, if he is stealing my money he’s not an innocent bystander.  He is a victim, but, if it is me or him, choices must be made.  Equally, if it is my company losing thousands or millions of dollars, then attacking the server being used to attack me seems like a pretty good option and it is “game on!”  This is where, depending on how you accomplish blocking the attack against your network, self-defense becomes a factor and part of the decision-making process.  I will leave self-defense for the next installment in this series of blogs entries.