Tag Archives: technology

Security

Active Defense: Attribution is just not that important

1 Comment

Imagine owning a company and realizing you have been hacked and the hackers are disrupting operations or stealing trade secrets, intellectual property, private information, or even money.  As best as you can determine this did not just happen but has been going on for a while.  You hired a company to do an incident response, clean up, patch the holes and get you back up and running.  They may or may not have claimed to have secured your network, but state in no uncertain terms that any action beyond what they have done would be illegal.  Within months you notice the same activity.  So, you call the company again.  More money, more time, and more meetings about how much is being lost.  Do you call law enforcement?  Do you continue with the cyber security company and keep paying them?  Do you have a data breach notice responsibility to shareholders, the board, and customers/clients? 

What you need is a clear and concise plan of action to follow in these situations.

When lecturing on “Active Defense” I often hear comments like, “hack back is illegal,” “without attribution you might hurt an innocent bystander,” or my favorite, “you might start a war with China.”  So what is “Active Defense”?  Many people equate it to hack back.  My definition of “Active Defense” is “a clear and concise process or plan for addressing a compromise to the security of your network and/or the loss or theft of data.”  The process begins with an incident response and could ultimately end with hack back.  It includes a series of predetermined check points requiring leadership/CEO involvement in making various decisions.  One of the first decisions is whether, based on the information available and/or gathered, the attack is a one-time occurrence or an ongoing intrusion/breach.  If it is determined to be a one-time occurrence the decision is easy, initiate an incident response plan, clean up, patch holes, and provide notifications required by law.  If the attack appears to be ongoing some of the follow-up on decisions may include: what end-state the company is seeking (find the hacker and prosecute, block the attack, get data back, etc.); what intelligence/information should be gathered; what tools/techniques should be developed and/or used and how; as information is gathered and options presented, which should be considered and pursued; and many more, most of which are all dependent on the facts, information available, best interests of the company, the fiduciary responsibility, etc.  At each stage and as each decision is made risk, liability and legal issues are discussed, evaluated, and factored into the decision process

Okay, so why is attribution not that important? 

Certainly, being able to identify your attacker makes life much easier for you and your company.  Even if you can’t identify the attacker, being able to identify who owns the server being used to attack you makes life simpler.  You can simply call the owner of the company whose server has been compromised and is attacking your network and work together to block the hacker.  If, for some reason, the owner of the compromised server will not work with you then you can proceed as if he is the hacker.  You might contact law enforcement or if for some reason that decision has been ruled out or, law enforcement for some reason is not able to assist, then you might decide to take action to block the attacks.  At this point the leverage you can garner against the server owner is pretty great.  Chances are his server is not only being used to attack you but many other companies as well.  The server owner will likely not want all of the other companies to know his compromised server is responsible for their pain, assuming they are aware of it.  When this fact is revealed to him he may suddenly be more than ready to negotiate and assist

In many cases though, you will not be able to determine the identity and/or whereabouts of the server owner. 

In that case, if you strike back and inspect the server attacking you, have you lashed out at an innocent bystander?  Many people claim just that.  I would argue this person is a victim like you, but innocent bystander, not even close.  Consider the 2006 movie “Firewall” with Harrison Ford.  His wife and daughter were kidnapped and the kidnappers, using this leverage, forced him to hack into a bank he was hired to protect and steal millions of dollars for them.  Now, granted, I like Harrison Ford, but, if he is stealing my money he’s not an innocent bystander.  He is a victim, but, if it is me or him, choices must be made.  Equally, if it is my company losing thousands or millions of dollars, then attacking the server being used to attack me seems like a pretty good option and it is “game on!”  This is where, depending on how you accomplish blocking the attack against your network, self-defense becomes a factor and part of the decision-making process.  I will leave self-defense for the next installment in this series of blogs entries.

Security

When Is Electronic Espionage an ‘Act of War?”

Leave a comment

Is the U.S. engaged in a “cyber war?” 

Until recently the identity of the perpetrators of cyber-attacks against U.S. networks, infrastructure and the military were clouded in suspicion and not spoken of out loud.  There has been much speculation about cyber war or a cyber-Pearl Harbor, but no official declaration of what constitutes cyber war or naming of names, until now. 

In March, General Keith Alexander, speaking before Congress, and in May, Secretary of Defense Leon Panetta, during an interview with ABC News, outwardly named China as the main perpetrator and identified criteria for defining cyber war.  General Alexander, the Director of NSA and CYBERCOM commander, stated, “China is stealing a ‘great deal’ of military-related intellectual property from the United States and was responsible for last year’s attacks against cyber security company RSA . . . .”[1] Secretary of Defense Panetta said, “Well, there’s no question that if a cyber attack, you know, crippled our power grid in this country, took down our financial systems, took down our government systems, that that would constitute an act of war.”[2]

Over the last year the Department of Homeland Security (DHS) has voiced their concern over the vulnerability of our critical infrastructure, oil and gas refineries, electric grids and nuclear reactors, to potential cyber-attacks. If you are not fully convinced of the threat, consider the “Shady RAT (remote access tool)” report by McAfee wherein they identify companies and governments which recently discovered that hackers have been in their networks for the last five or six years undetected.[3]

One might conclude that a clear picture is emerging, but is it? 

During the Cold War, when government secrets were stolen, it was treated as espionage or spying.  Remember all of the spies tried for espionage: Aldrich Ames, Robert Hansen, the shoot down of Gary Powers and the U2 spy plane over the USSR.  What if a nation placed “sleeper cells” in its adversary’s country ready to attack critical infrastructure if a war broke?  Would this be considered spying and part of the “cat and mouse” game or grounds for a retaliatory strike?

Does the fact that these activities can now be accomplished electronically from the safety and comfort of your own nation change the playing field?  At the time, we probably considered the flights of the U2 relatively safe since it flew above the threat zone of anti-aircraft guns.  Does stealing terabytes of military secrets or planting logic bombs in critical infrastructure (to be launched in a moments’ notice to disable the infrastructure) cross the line from espionage to war or an “act of aggression?”  

This and many similar scenarios are now the new normal and must be defined as nations and the international community grapple with technology and current and future capabilities.  Where should the line be drawn?  Do we just accept, that an adversary, via computers, can now access and potentially steal, manipulate, or destroy information and functionality, or should nations aggressively draw the line now and openly retaliate in protest?

Obviously, as Secretary of Defense Panetta stated, if you disrupt critical infrastructure, deny critical communications, or blind a military defense system, the line has likely been crossed.  Certainly defacing a website does not even come close to being an act of war or aggression.  What about stealing terabytes of military secrets to later be used to disable your adversary’s defenses?  Possibly!  For now the line will be defined by the reactions of various nations faced with cyber-attacks.  If a nation does nothing or retaliates with a similar attack, e.g. theft for theft, then a line has been drawn and a precedent set.

A similar problem is the issue regarding Iran and nuclear weapons.  Is Iran’s pursuit of nuclear weapons and statements attributed to them about annihilating Israel and the West enough provocation to take aggressive action to prevent them from obtaining a bomb?  Clearly no one wants to escalate the situation but most agree something must be done before it is too late.  Similarly, in the cyber arena, all interested parties are reacting very cautiously in their response to cyber-attacks, likely to avoid escalation and the setting of precedence. 

In the Estonian and the Georgian conflicts the reaction was to block, clean up, and speculate about who may have launched the attacks and only the media claimed cyber war.  Not until recently has one nation, e.g. the U.S., been so vocal about who is using cyber espionage and attacks to invade and plague their networks.

[1] NSA Chief: China Behind RSA Attacks, J. Nicholas Hoover, Information Week Government (Mar. 27, 2012) http://www.informationweek.com/news/government/security/232700341.

[2] Leon Panetta: A Crippling Cyber Attack Would Be ‘Act of War’, Jake Tapper, ABC News (May 27, 2012) http://abcnews.go.com/blogs/politics/2012/05/leon-panetta-a-crippling-cyber-attack-would-be-act-of-war/.

[3] McAfee: Operation Shady RAT, http://www.mcafee.com/us/resources/white-papers/wp-operation-shady-rat.pdf.

Security

Courts and Lawyers: Gauging the Level of Technical Knowledge

Leave a comment

Like many people, I make a lot of assumptions.  Lately, I have made a lot of assumptions about people’s level of knowledge when it comes to cyber security and technology.  This is likely due to my background and training.  If you work in the IT or cyber security or related areas chances are you also make a lot of these assumptions as well.

Recently I learned that the level of knowledge regarding cyber security and technology amongst the legal profession is not as high as I had assumed.  This is not a knock on my colleagues in the law profession, but my failure to avoid making assumptions.  For instance, when emails are offered into evidence their authenticity must be established, but does this include whether the email address is genuine and was not spoofed, the content is original and was not altered, the date and time was not altered, the location of where the mail was accessed if webmail; how webmail works, where the servers are located, the meta data of messages, etc.  Example: if one party offers emails to prove a point about their opponent and the offering party had not been given access to the email account, the question should be raised as to where the emails came from and whether they constitute evidence of a crime; e.g. was the email account hacked?

This is not unique to email but would apply to social media accounts as well.  Many people today do not realize how easy it is to fake, alter and manipulate Online or E-accounts.  Certainly the legal profession must be provided the training and information to know the right questions to ask regarding the authenticity of evidence.

Security

Technology and the Workplace: BYOD

3 Comments

The latest buzz word or acronym around the water cooler is BYOD or bring your own device. Use of mobile devices has sky rocketed over the last year with the iPhone, iPad, tablets, Android, etc. Everyone wants the latest and the greatest. But, who wants to carry around two devices, the company’s and your own? Even if you don’t mind carrying the extra device, how many man-hours do employers lose when employees are exploring and surfing their new mobile devices at work?

It may be better, depending on the business, to just allow employees to use their personal devices for work. This issue is similar to the controversy over whether to allow employees to use social media. On that one, cat’s out of the bag. They are. So put a policy in place to set parameters to benefit and protect the company. But BYOD, whoa, how many privacy, security and legal issues does this generate? A lot!

As an employer, what can you do? Again, put a policy in place and do it now. Don’t just throw something together piece meal as you go along, do it right.

Now, this may sound a little self-serving, but, commonsense dictates having it drafted by a lawyer who is familiar with the technology, privacy, and other issues to ensure your company is protected, and consequently so is the employee.

The policy or policies need to address questions such as can you monitor the personal device; implement encryption; require anti-virus; tracking, secure wipe; use of passwords; etc.? The answers, by the way, are yes, yes, and yes.

Best plan is to have a monitoring policy and a mobile device use policy, or BYOD policy, and give employees the option: “if you wish to use your personal device at work you must agree to the terms of the policy.” The alternative would be to use the company device, aka “the brick”, if they are not willing to accept the terms.

Bottom line: a well thought out and well drafted policy or policies are the key! Watch for the next installment of “Technology and the Workplace.”