Tag Archives: risk management

Security

Active Defense: Attribution is just not that important

1 Comment

Imagine owning a company and realizing you have been hacked and the hackers are disrupting operations or stealing trade secrets, intellectual property, private information, or even money.  As best as you can determine this did not just happen but has been going on for a while.  You hired a company to do an incident response, clean up, patch the holes and get you back up and running.  They may or may not have claimed to have secured your network, but state in no uncertain terms that any action beyond what they have done would be illegal.  Within months you notice the same activity.  So, you call the company again.  More money, more time, and more meetings about how much is being lost.  Do you call law enforcement?  Do you continue with the cyber security company and keep paying them?  Do you have a data breach notice responsibility to shareholders, the board, and customers/clients? 

What you need is a clear and concise plan of action to follow in these situations.

When lecturing on “Active Defense” I often hear comments like, “hack back is illegal,” “without attribution you might hurt an innocent bystander,” or my favorite, “you might start a war with China.”  So what is “Active Defense”?  Many people equate it to hack back.  My definition of “Active Defense” is “a clear and concise process or plan for addressing a compromise to the security of your network and/or the loss or theft of data.”  The process begins with an incident response and could ultimately end with hack back.  It includes a series of predetermined check points requiring leadership/CEO involvement in making various decisions.  One of the first decisions is whether, based on the information available and/or gathered, the attack is a one-time occurrence or an ongoing intrusion/breach.  If it is determined to be a one-time occurrence the decision is easy, initiate an incident response plan, clean up, patch holes, and provide notifications required by law.  If the attack appears to be ongoing some of the follow-up on decisions may include: what end-state the company is seeking (find the hacker and prosecute, block the attack, get data back, etc.); what intelligence/information should be gathered; what tools/techniques should be developed and/or used and how; as information is gathered and options presented, which should be considered and pursued; and many more, most of which are all dependent on the facts, information available, best interests of the company, the fiduciary responsibility, etc.  At each stage and as each decision is made risk, liability and legal issues are discussed, evaluated, and factored into the decision process

Okay, so why is attribution not that important? 

Certainly, being able to identify your attacker makes life much easier for you and your company.  Even if you can’t identify the attacker, being able to identify who owns the server being used to attack you makes life simpler.  You can simply call the owner of the company whose server has been compromised and is attacking your network and work together to block the hacker.  If, for some reason, the owner of the compromised server will not work with you then you can proceed as if he is the hacker.  You might contact law enforcement or if for some reason that decision has been ruled out or, law enforcement for some reason is not able to assist, then you might decide to take action to block the attacks.  At this point the leverage you can garner against the server owner is pretty great.  Chances are his server is not only being used to attack you but many other companies as well.  The server owner will likely not want all of the other companies to know his compromised server is responsible for their pain, assuming they are aware of it.  When this fact is revealed to him he may suddenly be more than ready to negotiate and assist

In many cases though, you will not be able to determine the identity and/or whereabouts of the server owner. 

In that case, if you strike back and inspect the server attacking you, have you lashed out at an innocent bystander?  Many people claim just that.  I would argue this person is a victim like you, but innocent bystander, not even close.  Consider the 2006 movie “Firewall” with Harrison Ford.  His wife and daughter were kidnapped and the kidnappers, using this leverage, forced him to hack into a bank he was hired to protect and steal millions of dollars for them.  Now, granted, I like Harrison Ford, but, if he is stealing my money he’s not an innocent bystander.  He is a victim, but, if it is me or him, choices must be made.  Equally, if it is my company losing thousands or millions of dollars, then attacking the server being used to attack me seems like a pretty good option and it is “game on!”  This is where, depending on how you accomplish blocking the attack against your network, self-defense becomes a factor and part of the decision-making process.  I will leave self-defense for the next installment in this series of blogs entries.

Security

Active Defense/Hack Back/Attribution – The Saga Continues

2 Comments

I have noticed, at least amongst lawyers, there does not seem to be much middle ground when it comes to “Active Defense” or hack back and the right of self-defense.  Those who comment on it either agree self-defense exists in cyberspace, with very few in this camp, or it doesn’t, which is where the majority stand.  All I ask of most is don’t simply jump to the conclusion that self-defense does not exist and “Active Defense” or hack back is illegal, but instead look at the arguments, potential fact scenarios, and definitions.

“Active Defense,” has many definitions and should not be strictly equated to hack back.  Hack back, instead may be considered a subset of “Active Defense,” which does include cyber self-defense or cyber self-help.  Whether or not a company can utilize these theories depends entirely on the given facts of a situation.  For instance, if a company has suffered a cyber attack and cannot show the attack continues or is persistent, they will not likely be able to make a case for the use of self-defense.  My draft definition of “Active Defense” (still a work in progress) is as follows: “a meticulous and escalated approach to a persistent cyber attack wherein the company leadership makes a decision whether or not to progress at pre-determined decision-points, evaluating risk, liability and legal issues.”  Each decision-point will include all of the intelligence gathered, all potential options, tools, techniques, possible scenarios, potential risks, liability, and legal issues.  Depending on the facts and the confidence of the decision-maker there can be few decision points or many.  The number of decision-points is also a factor to consider in the scenario and the actual amount of liability, if any, may depend on how meticulous and cautious the decision-maker acted.  For example, the first decision-point may be whether the attack(s) is or are persistent.  “Active Defense” is very fact dependent.

Unfortunately most jump immediately to the conclusion that Active Defense, or hack back are illegal.  In my opinion this is a very shortsighted view.  If you are a company losing a lot of money, can show you have implemented good or better security, and have taken an escalated approach collecting intel and evaluating risk, liability and legal issues along the way, then I believe you do have a right to defend yourself.  Again, it is very fact specific.  This is where most people then pull out the “attribution” card and claim you will impact an innocent bystander.

If someone drugs and hypnotizes an innocent bystander and convinces him to shoot at you, don’t you have the right to shoot back in self-defense? This is similarly fact dependent.  For instance, if you know the person is an innocent bystander you would likely try and run away and get help, maybe call the police.  You might even attempt an escalated approach causing as little harm as possible to the innocent drugged and hypnotized bystander.  In the end if it is you or him most will likely opt to save their own lives.  Now remember, self-defense applies to person or property.  So, in the end most will opt to save their own property over the property of the innocent bystander.

So, if a server is compromised and being used to attack my company, don’t I have the right to defend against that server? In this scenario I am assuming I cannot identify who owns the server.  If I could I would simply call that person or company and ask that the server be shut down or the malware removed. Also, is the owner of the compromised used to attack me truly an innocent bystander? Is there contributory negligence on the part of that server owner for not having adequate security and allowing his system to be compromised? In a perfect world you could say no, but today many if not most compromises occur because companies have not used due diligence in keeping systems patched and implementing basic security.  Enough for now, comments?

Security

Active Defense: Moving the Discussion Forward

1 Comment

Cyber-attacks against companies, organizations and governments have hit an unprecedented high. The ease with which hackers can launch multiple attacks has also increased.  Hacking has become big business with nation-states, terrorist groups, organized crime and others capitalizing on the theft of information (trade secrets, technology, intellectual property, others) and disrupting businesses they are in competition with. Are the current defenses working?  Unless you live in a shoe box you realize, especially based on daily news reports, that the cyber war appears to be one the good guys are losing.

A change is needed because the problem has gotten out of hand. Current laws hinder organizations from defending themselves while at the same time facilitating the efforts of hackers. So, rather than jumping to the conclusion that any action to defend your organization beyond the currently accepted techniques is illegal, a discussion needs to be started and moved forward about better and more effective options.  It appears it has.

In a recent Washington Post article[1] the issue of defending outside of one’s network and possibly entering the server of another, active defense, was raised.  Again the knee jerk reaction is that it’s illegal, but the conversation continued. 

“[It is] important to enable companies whose computer networks are targeted by criminals and foreign intelligence services to detect who’s penetrating their systems and to take more aggressive action to defend themselves,  said Steven Chabinsky, a 17-year FBI veteran who stepped down this month as the FBI’s top cyber lawyer.    The article continued with Stewart A. Baker, a former senior Homeland Security Department official stating, “The issue . . . is that entering another party’s server and deleting or encrypting data could, under some circumstances, violate a number of state and federal laws — including those against computer fraud or trespassing.”  “But, he said, there is a legal argument to be made that such an action is a reasonable defense of one’s property.  Though common in other contexts, that defense has yet to be tested in the cyber area in court.”

Top officials and leaders in this area predict growth as companies decide enough is enough.  “Former CIA director Michael V. Hayden has said that given the limits of the government in protecting companies in cyberspace, he expects to see the emergence of a “digital Blackwater,” or firms that hire themselves out to strike back at online intruders.”

I agree, this is exactly where we are headed and the discussion must go further.  Based on current laws, technology and state of affairs there is much more companies and organizations can do to defend themselves.  I am not advocating vigilantism, but a military-like operation that helps leaders of organizations walk through possible tools and techniques while evaluating risk, liability and legal issues every step of the way in an effort defend their most precious assets.

That is why Davi and I will be presenting at several upcoming conferences, including ISSA and RSA, a practical and legal approach to Active Defense. I look forward to seeing you there.

[1] Nakashima, Ellen, “Cybersecurity should be more active, official says,” The Washington Post – National Security (September 16, 2012)