Can Elite Combat Teams Teach Cyber Security Teams Anything Useful?

For the last three Suits and Spooks events I've invited retired and former Navy SEALs to speak about which of their skills and training might transfer over to cyber security engineers. After all, they're both in the business of engaging adversaries albeit under very different conditions and rules of engagement, and I know that lots of security engineers are military veterans or have held civilian jobs with the DOD. So the panel's concept made a lot of sense to me. So far, though, it has met with mixed reactions among attendees for a few reasons:

• Some attendees have trouble relating to what they're hearing for a variety of different reasons
• Some are looking to apply only the tactical takedown of a target and finding a way to do something similar to a foreign hacker
• Some wonder why I only have the Navy Special Warfare guys represented (see my answer to that below)

Yesterday's panel, with the addition of an active duty operational SOFer helped me understand the problem better. Here are a few of my observations about why this process of extrapolating useful ideas from one discipline to another may be problematic:

1. SOFers have a known target to attack. It's rarely that black and white for cyber security folks.
2. SOFers have very well-defined Rules of Engagement (ROE). We have an out-dated CFAA and no clear-cut policies or understanding on where to draw the line between passive defense and active defense.
3. SOFers are elite, highly trained individuals who have overcome obstacles that would stop 99% of the rest of us because quitting is not in their DNA. In Cyber, while we have much different obstacles albeit quite difficult ones, I see more and more engineers rationalizing why they can't do something instead of working the problem in different ways until they're successful. 
4. SOFers know better than to offer excuses or rationalizations about why they can't accomplish their objective. InfoSec folks, ...? Enough said.
5. SOFers understand the importance of a team, and each man's primary concern is to keep his teammate alive. Cyber security engineers may work together but I doubt that very many believe that their primary mission is to support their colleagues by keeping them motivated, enthusiastic, and always in the fight. Correct me if I'm wrong on that.

Personally, I feel quite lucky to have been able to meet former Team guys who are now doing amazing things related to cyber security like Mike Janke and Vic Hyder who co-founded Silent Circle; David Howe at Civitas Group; and "Woody" who will soon retire after 20 yrs of service and is so eager and passionate about finding a way to embark on a new career in cyber security. 

I feel lucky because they and other Team guys who are personal friends like Rob DuBois and Thomas Dzieran have taught me the importance of (1) developing an iron-hard mental attitude to never quit in the face of difficulty; (2) not to accept or make excuses about why I can't achieve something; (3) the critical importance of building a team of like-minded people; and (4) the equally critical importance of not associating with those who dispute the validity of 1, 2, and 3. 

And please note my use of "SOFer". While my examples all come from the Navy, that's only because those are the guys I happen to know. I haven't met anyone from Delta, SAS, or any other Special Operations Forces units. However, if you come from those units or know ones who do,  please ask them if they'd be interested in participating at a future Suits and Spooks event. I'd love to include them.

Add to Cart View detail

Russian Institute Solicits Foreign Companies But Masks Ties with Russia's Defense Ministry

My company recently published a report which discovered that aerospace companies with joint ventures in Russia and China are hacked 2.4 times more often than those companies who don't. However, hacking a network is small potatoes when compared with the amount of intellectual property that is transferred in other ways.

One of the more surprising discoveries that we made while researching that report had to do with a Russian institute that was set up primarily to engage foreign companies with various types of assistance: the Research Institute of Mathematic Modeling and Intelligent Control Systems. This institute is a part of St. Petersburg State Polytechnical University's Institute of International Educational Programs. The website is in English and is not listed on SPSPU's Russian home page so it's entire focus is foreign-based. 

It conducts applied research in the following areas:

• Distributed industrial controllers networks for decentralized control of distributed objects and technological processes
• Intelligent multi-agent based control of android robots and cooperative behavior of robots network 
• Numerical modeling of external and internal flows aimed at dragand noise reduction
• Computation of vortical flows and wakes aimed at enhancement of safety in air and ground transportation 
• Numerical analysis of stress/strain distributions in the real world industrial objects, in particular for those working in the extreme conditions
• Numerical non-linear analysis of visco-elasticity, contact interaction, large deformations
• Seismic analysis, simulation of crash-tests, modeling of nucleation and propagation of damage
• Computation of cooling of electronic devices, heating and air-conditioning systems >> Development of graphic user interface to control virtual objects 
• Polygonal and NURBS-modeling

A few of the U.S. companies who work with RIMMICS include Boeing and GE. Foreign companies include EADS, Airbus, SAP, LG electronics and Bombardier. I wonder how many of those companies know that RIMMICS also provides avionics services, among others, for the Russian Ministry of Defense because it's not disclosed anywhere on the website.

More information on RIMMICS and other surprises that we've uncovered when investigating foreign vendors who service key U.S. enterprises will be disclosed at our upcoming Suits and Spooks luncheon at the Ritz Carlton Tysons Corner on Sept 10, 2013. Seats are extremely limited so register today. 

Add to Cart View detail

Open letter to President Obama on the eve of his Summit with President Xi

Dear President Obama,

I've spent the last five years working exclusively in the identification and cataloging of threat actors in cyberspace. I've participated in incident response investigations for some of the world's largest companies and have briefed both U.S. intelligence agencies and those of five foreign countries on the complexity of the cyber threat landscape as well as information warfare planning, research & development, and execution of strategy by both Russia and China. I host three highly regarded executive cyber security conferences each year, and my book Inside Cyber Warfare (in its 2nd edition) is used as a text by the U.S. Air Force Institute of Technology in its cyber warfare certification program.

While I'm enthusiastic about your upcoming meeting with President Xi on mutual cyber security concerns, I'm worried that the strong anti-China sentiment on the Hill and in print by the New York Times, Bloomberg and the Washington Post will have a polarizing effect on your talks. Much of the evidence being touted as pointing to China's acts of cyber espionage is a conflation of multi-state and non-state actors engaging with the same target companies that China is interested in. I personally know of Russian hackers who prefer to attack their targets in different countries via a compromised Chinese computer because there are so many of them and they're so easy to exploit.

While there is a propensity among government officials and infosec experts to blame China first for any attack involving U.S. intellectual property, they often do so without any hard evidence. Chinese IP addresses don't qualify as evidence anymore than U.S. IP addresses do. Open source hacker tools written by Chinese developers and posted on the Web for anyone to download and use cannot be considered evidence of Chinese government involvement. And President Xi will certainly make the same point. While there's no question that the Chinese government engages in cyber espionage, it is not the only nation that does so and it is certainly not solely responsible for the estimated $300 billion in stolen U.S. IP.

Rather than accusing China of something that cannot be proved, I believe that U.S. interests can best be served by cooperating with China on the identification and prosecution of non-state actors who operate in Chinese and U.S. IP space. Media stories and self-serving infosec reports to the contrary, not all Chinese hackers work for the PLA. There are many independent hackers in China, Ukraine, Russia, Romania, Bulgaria, Pakistan, Taiwan and other countries who make money stealing IP and selling it to whomever is willing to pay. Some of these same hackers may be involved in attacking Chinese government websites; particularly those in India, Tibet, and Taiwan. While conventional wisdom groups hackers into silos (Russians rob banks; Chinese steal IP; Iranians attack power companies), that's not a realistic nor fact-based portrayal of the international cyber threat landscape.

There are many ways that China is benefiting from U.S. technology transfer such as their successful campaign to provide monetary incentives for U.S. multinationals to open R&D labs in Shanghai and Beijing (which now number over 1200). These labs employ Chinese engineers who learn U.S. technological secrets and then leave to work for Chinese companies; taking that proprietary knowledge with them. Those same employees have trusted access on their respective corporate intranets. There's no reason for the Chinese government to execute sloppy hacking operations against a U.S. company when that company has offices in Bejing or Shanghai. Access to their IP is a given.

If you and President Xi could reach an agreement to cooperate on reducing the activities of independent  non-state actors that have attacked both the U.S. and Chinese businesses and government organizations, it would benefit the U.S. in the following ways:

1. Chinese threat data is of great interest to U.S. law enforcement organizations.
2. A reduction of non-state actors currently cluttering up the threat landscape would make it easier to identify state-run cyber espionage operations.
3. The biggest threat to both Chinese and U.S. critical infrastructure is from non-state actors and, in the future, those may include terrorist groups. 

Mr. President, in my opinion, attempting to shame or threaten China over its hacking activities when the available evidence is so easily dismissed makes the U.S. look weak and ineffective. Enlisting China as an ally to identify and interdict the activities of independent threat actors would result in a win for both nations.

I hope this open letter finds it's way to your desk and that it helps inform your strategy.

Warm Regards,

Mr. Jeffrey Carr
CEO, Taia Global, Inc.
Author, Inside Cyber Warfare
Founder, Suits and Spooks conference

Add to Cart View detail

Critique of IP Commission's Cyber Security Recommendations

The National Bureau of Asian Research published (and assisted in writing) "The IP Commission Report: The report of the Commission on the theft of American intellectual property" (.pdf). The Commission members along with its purposes are as follows:

• Dennis C. Blair (co-chair), former Director of National Intelligence and Commander in Chief of the U.S. Pacific Command 
• Jon M. Huntsman, Jr. (co-chair), former Ambassador to China, Governor of the state of Utah, and Deputy U.S. Trade Representative 
• Craig R. Barrett, former Chairman and CEO of Intel Corporation 
• Slade Gorton, former U.S. Senator from the state of Washington, Washington Attorney General, and member of the 9-11 Commission 
• William J. Lynn III, CEO of DRS Technologies and former Deputy Secretary of Defense 
• Deborah Wince-Smith, President and CEO of the Council on Competitiveness 
• Michael K. Young, President of the University of Washington and former Deputy Under Secretary of State 

The three purposes of the Commission are to:

• Document and assess the causes, scale, and other major dimensions of international intellectual property theft as they affect the United States 
• Document and assess the role of China in international intellectual property theft 
• Propose appropriate U.S. policy responses that would mitigate ongoing and future damage and obtain greater enforcement of intellectual property rights by China and other infringers 

IP and trade secret theft is a rapidly growing and very critical problem for U.S. companies. The IP Commission estimates the value of stolen IP from U.S. companies and government agencies at over $300 billion, which is about 75% of what the U.S. spends on R&D research each year.

While the report takes a deep and heavily annotated dive into the scale and scope of this problem, chapters 13 and 14 that detail the Commission's cyber security recommendations, have absolutely no footnotes whatsoever. In other words, there's no way to know who provided the commission with some very risky and questionable cyber security advice. So I called them.

I was told by the person who took my call that the cyber security experts wanted to remain anonymous, however she recommended that I speak with someone at the NBR. I sent a message via the NBR's information email account, read receipt requested, and watched it work its way up to Roy Kamphausen who confirmed that they spoke with "a wide array of cyber experts" but didn't mention any names.

Unfortunately, while much of the report is quite good, the cyber security advice ranges from problematic to potentially damaging. Here's my critique of that content. I'd be happy to debate it with anyone that the Commission spoke with.

1. No where in this report is mentioned the critical importance of first identifying a company's critical data or "crown jewels". It's a huge problem because most companies have no idea how to do this and the Commission never once mentions it.
2. Locking down a person's computer with a booby-trapped file has questionable legality but even worse, may result in the threat actor coming back to take more aggressive action against the targeted company. Remember Saudi Aramco? SA had to replace 2,000 servers thanks to a Wiper virus that only half worked due to some amateur coding mistakes. Remember HBGary Federal when its CEO threatened to "out" some members of Anonymous? There is no more HBGary Federal but Anonymous is alive and well. 
3. Recommending the passage of CISPA is both bad security advice and inserts a political agenda to an otherwise apolitical report.  
4. Threat-based deterrence is advocated for without being adequately defined. There are numerous ways that such a deterrence plan can have negative and unexpected consequences. And just like it's stupid to pick a fight with a stranger,  it's never a sound strategy to threaten an unknown adversary who can operate anonymously and holds the advantage.
5. Chapter 14 contains a back-handed recommendation to pursue three measures that constitute aggressive offensive action. The commissioners couched it in a bizarre manner by effectively saying that while we don't recommend these things at this time, if the situation doesn't improve, then they should be considered. The measures were for what's commonly called hacking-back, cutting funding to the World Health Organization, and raising tariffs on Chinese goods 150% higher than the amount of IP theft stolen by China. 

Considering how potentially bad if not operationally ludicrous some of these recommendations are, it's not surprising that none of the commission's cyber security experts wanted their names attached to the report. The topic of "active defense" or "hacking back" or "offense as defense" is an important one that needs broad discussion. In fact, I made it the focus of last February's Suits and Spooks DC conference and we'll address it again in La Jolla in two weeks. But it is rife with pitfalls and needs much more informed discussion and debate. The Commission really failed its audience in terms of the content of these last two chapters.

Add to Cart View detail

The Focus Areas of 26 Chinese State Key Labs for Information Technology Research

This image is a tag cloud representing the Information Technology focus areas of 26 Chinese State Key Labs. It represents a fraction of the data that we're mining for our Chimera network defense product.

Know The Targets

Add to Cart View detail

Boston or New York for the next Suits and Spooks?

We try to host a Suits and Spooks event in different cities (other than Washington DC which remains a constant). Our Boston attendance was quite good last year, however I've been asked several times if we'd host a Suits and Spooks in New York City. What's your preference?

Click here to take survey

Add to Cart View detail

Closing the Loop: Part of an Assumption of Breach Security Paradigm

Tim O'Reilly gave a talk recently at Stanford University on the importance for startup companies to "close the loop" with their customers. Uber was used to demonstrate the concept. Both the Uber driver and the Uber customer know a lot about each other. They can track each other's location. The customer knows what the driver looks like as well as his license plate number. They can communicate with each other prior to the vehicle arriving. There's immediate feedback required on the customer's experience with the driver. There's almost no uncertainty in the entire service chain of an Uber hire. Uber has closed the loop with its customers.

As I listened to Tim speak, I immediately related it to the uncertain world of cyber security. Think of Uber as a U.S. corporation or government agency. Think of the Uber customer as the adversary state or non-state actor who's breaking in to steal valuable data. What cyber security tools "close the loop" between the two?

If you adopt an "Assumption of Breach" paradigm, then you've accepted that attackers may already be active in your network. Any tool which provides you with information on their movements in real-time "closes the loop". Then it just becomes a question of weighing cost against effectiveness and spending your dollars wisely on those tools.

Another way to close the loop with an adversary who's targeting your company or agency is to know what they want. This article in The Telegraph describes how MI-5 has issued a warning to British universities that their research on graphene and quantum computing is being stolen by Russia and China and, eventually, informing those countries' patent development work:

Researchers have already warned that work on graphene is moving abroad, with Britain funding extra research by our own academics but seeing their 54 patents outstripped by 2,204 from China.
Overall, cyber crime costs the UK £27billion per year, official figures suggest, with universities now identified as targets.
Researchers from Manchester, for instance, including academics Andre Geim and Konstantin Novoselov who won the 2010 Nobel Prize, have been warned that their servers could be targets. Graphene is a kind of two-dimensional carbon which is one of the thinnest, lightest, strongest and most conductive materials known to man. Identified only in 2004, it is harder than diamond, just a single molecule thick and conducts electricity.
Threats are posed both by hackers infiltrating UK university computers and from the theft of data from computers used by academics travelling abroad. 

My company, Taia Global, with financial support from our angel investors, is currently in development on a product which knows what the research priorities are in potential adversary states and can predict what will be stolen from our customers; thereby closing the loop between the victim and the thief and giving the victim time to take the necessary steps to protect those targeted documents. This is particularly useful when a company has millions of files, cannot protect all of them, and doesn't have a reliable way to classify those which are of value to an adversary or competitor.

Our product development cycle is currently in early Alpha. If you'd like to receive more information about this product as we get closer to beta, please contact us.

Add to Cart View detail

Rep. Wolf's Flawed Approach to Supply Chain Security

According to this article in today's Politico, Rep. Wolf has inserted language in a budget stopgap bill that is "meant to ensure Chinese companies certify their independence from official Beijing before they can sell their goods to the Commerce Department, among others, during the life of the continuing resolution." Furthermore, it excludes "American companies who do assembling in China".

This provision is stunning in terms of its utter uselessness as a cyber security measure. The problem that Rep. Wolf should be worried about is how easy U.S. companies who have offices in China can be compromised by the Chinese government in ways that go far beyond what is normally reported on by the press.

Yet another problem is how quickly U.S. companies open R&D labs in China which result in technology transfer and a rapid escalation of China's own technological innovation. As an example, I just tried to contact two Microsoft Asia researchers (both Chinese) whose work focused on a specific type of data analytics that my company is interested in. Both researchers had recently left Microsoft and are now continuing their research at Huawei. This revolving door happens all the time and represents just one small part of the vast threat landscape for U.S. companies and by extension the U.S. government that extends far beyond a spear phishing attack and the APT kill chain.

Not only is Rep. Wolf's language utterly useless from a security perspective, it's detrimental to U.S.-China relations which, like it or not, we depend on. We have the ability to handle this problem in a much smarter, more effective way if legislators would invite a broader base of experts in to testify and give guidance on this issue rather than the same anti-China cheerleaders time and again.

Add to Cart View detail

New Direction for Taia Global

UPDATE (2/19/2013): Our press release is out with details on the start of development of our data classification engine called Chimera.
--------------------------------------------------------
For the last two years, Taia Global (my startup security consultancy) has been a services-focused business. We've been privileged to have been able to provide counsel on improving security operations center practices, identifying supply chain weaknesses and generally helping executives understand their threat landscape and how to shrink it at some very large defense, telecommunications, and entertainment companies as well as smaller sized firms.

Thanks to that diverse set of experiences, I've been able to identify a problem and a solution which is scalable and unique in the information security marketplace and have begun a second angel round to raise capital for product development.

I'm grateful to my angel investors from 2010 who have continued to support me in this latest round as well as for a new investor that has just come aboard. 2013 will be the year that Taia Global moves from being services-based to services with a product. Watch this blog and my Twitter feed for more details in the weeks and months to come.

Add to Cart View detail

Debate: "Private Companies Should Be Authorized To Take Measured Offensive Action Against Attackers"

On Feb. 8-9, 2013, up to 100 people including some of the world's leading experts in law, incident response, reverse-engineering and intelligence will meet in Washington DC to debate the topic: "Private Companies should be Authorized to take Measured Offensive Actions against Attackers". The list of speakers includes CrowdStrike's Dmitri Alperovich, Mandiant's Richard Bejtlich, Microsoft's Dave Aucsmith, Dambala Labs' Gunter Ollmann, CrySys Labs' Boldi Bencsath, ReVuln's Donato Ferrante, INTERPOL's new Digital Crime Center's director, the ITU's Marco Obiso, The Grugq, The Jester, and many more.

The Agenda of Suits and Spooks DC will feature the most intriguing panel discussions every held on the highly controversial issue of "striking back" at those responsible for cyber attacks as well as how offensive markets for malware are changing the world of vulnerability exploits. The second day will include breakout sessions as well as an afternoon debate between two teams consisting of 12 volunteers from our attendees along with time for research and strategizing over a working lunch.

Friday, February 8, 2013 - Waterview Conference Center

9:00am - Registration and Continental Breakfast

9:45am - Welcome and Briefing on the Day's Activities

10:00am - 12:00pm: Panel Discussion - Offensive Tactics and Takedowns by Security Vendors

Featuring Mr. Dmitri Alperovich (CTO and Co-Founder, Crowdstrike), Mr. Richard Bejtlich (CSO, Mandiant), Mr. David Aucsmith (Sr. Director, Microsoft Institute of Advanced Technologies for Governments), and Mr. Nick Selby (Police Officer, DFW Area Department of Public Safety; Partner, Enterprise Security at N4Struct, Inc.).

12:00pm - 1:00pm: How Duqu, Flame, Gauss, and Shamoon can be reconfigured and reused against different victims

Featuring Dr. Boldizsár “Boldi” Bencsáth (Associate Professor, Laboratory of Cryptography and Systems Security (CrySyS), Department of Telecommunications, Budapest University of Technology and Economics)

1:00pm - 1:45pm LUNCH (provided on-site)

1:45pm - 3:45pm: Panel Discussion - Finding Exploitable Loopholes in the Computer Fraud and Abuse Act and International Law for Offensive Actions in Cyberspace

Featuring Dr. Catherine Lotrionte (Director of the Institute for Law, Science + Global Security, Georgetown University),  Mr. Stewart A. Baker (Partner, Steptoe & Johnson), Mr. Frank J. Cilluffo, Director, Homeland Security Policy Institute at George Washington University, and Mr. Marco Obiso (Cybersecurity Coordinator, International Telecommunications Union (ITU)

3:45pm - 4:00pm BREAK

4:00pm-6:00pm: Panel Discussion - Offensive Markets for Vulnerability Research - Pros and Cons

Featuring Mr. Donato Ferrante (Co-Founder and Security Researcher, ReVuln), The Grugq (a security engineer who specializes in reverse-engineering and anti-forensics), Mr. Gunter Ollmann (Chief Technology Officer, Damballa Labs)

Saturday, February 9, 2013 - Waterview Conference Center

9:00am Continental Breakfast

9:30am Welcome and Briefing on the Day's Activities

9:45am - 10:45am (Classroom A): Calculating The Adversary's Return-On-Investment and How That Can Inform Defense

Featuring Mr. Josh Corman (Director of Security Intelligence, Akamai)  and Mr. David Etue (Vice President, Corporate Development Strategy at SafeNet)

9:45am - 10:45am: (Classroom B): (topic to be announced)

Featuring Mr. Spencer Wilcox (Lead Security Strategist and Special Assistant to the Vice President of Corporate and Information Security Services for Exelon Corporation)

9:45am - 10:45am: (Classroom C): Q&A with The Jester via IRC "Is Offense The Best Defense, and Who Should Conduct It?"

This will be a moderated discussion with The Jester via IRC chat. Attendees will be able to pass their questions to the moderator and The Jester will respond in real-time.

 10:45am - 12:45pm: What's the Downside of Private Sector Offensive Engagement?

Featuring Dr. Anup Ghosh (Founder and CEO at Invincea), Mr. Jeffrey Carr (Founder and CEO, Taia Global, Inc.), Mr. Gunter Ollmann (Chief Technology Officer, Damballa Labs), and Mr. Josh Corman (Director of Security Intelligence, Akamai)

12:45pm-2:00pm: Working Lunch

12 attendees will volunteer to debate the proposition (6 per team). The working lunch will be spent dividing into teams and assisting the debaters in preparing research and debate strategies.

2:00pm - 3:30pm: Debate the Proposition "Private Companies Should be Authorized to Take Measured Offensive Actions Against Attackers"

The debate will be judged by a panel of 5 of our speakers

3:30pm - Closing Remarks

The Waterview Conference Center is one of Washington D.C.'s most beautiful and exclusive facilities but it has a capacity of only 100 people so don't miss out. Register today and be a part of one of 2013's most important events.

We are also still looking for companies to join Basis Technology in sponsoring this important event. Please contact me for more information.

Add to Cart View detail

Huawei's Cavernous Cyber Security Credibility Gap

Approximately one month before Huawei officials (along with ZTE officials) are supposed to testify before the House Permanent Select Committee on Intelligence (October 2012), the company's Global Cyber Security Officer and SVP John Suffolk released a white paper entitled "Cyber Security Perspectives: 21st Century Technology and Security - a Difficult Marriage".

I've been monitoring Huawei for several years and have given dozens of briefings on the security risks associated with the company, its management and its products. I've had several Huawei employees contact me privately about issues within the company and I've spoken to at least one of their senior executives last year about my concerns. I just finished reading Mr. Suffolk's white paper, which Andy Purdy, former Director of DHS National Cyber Security Division and now Huawei's Chief Security Officer, helped write. While it covered all of the usual bases regarding Huawei's commitment to security (I'm not going to recap these - read the paper if you must know), it addressed none of the issues that underscore the opinion of myself and others that Huawei is a security threat, such as:

• Madam Sun Yafang's past employment with China's Ministry of State Security and how she helped the young company secure loans form the Chinese government.
• Claims that Huawei benefited from Nortel's IP in 2004 including duplicating its instruction manuals.
• Claims that Huawei stole source code from Cisco and its settlement of those claims in 2004.
• Lack of full disclosure regarding Huawei's obligations to the Chinese government as a national champion firm and a provider of services and products to the State including the Peoples Liberation Army. 
• Lack of full disclosure regarding how many of its executives are members of the powerful Chinese Communist Party (CCP) and therefore bound to comply with directives from the CCP. After all, the CCP plays a dominant role in China's economy.

If Huawei's white paper is an example of how Huawei intends to address the concerns of the House Intelligence Committee, it's not nearly enough - even with Andy Purdy's help.

UPDATE (06SEP12): According to Reuters, Huawei is negotiating terms for its testimony before the House Intelligence committee. The fact that they have to "negotiate terms" says a lot to me about how valid the scope and validity of the concerns that I mentioned above are, not to mention the ones that Huawei doesn't want to have discovered.

Add to Cart View detail

Learn how to Take Down a State's Power Grid, Transportation System, and Other Critical Infrastructure

President Obama wrote an Op-Ed piece for the Wall Street Journal last Friday which described a catastrophic attack against the transportation and water sectors of our nation's critical infrastructure. He then pressed for passage of comprehensive cyber security legislation. While Congress and the White House have a sense of what might occur, they don't seem to be aware of the technical vulnerabilities involved or they would know that none of the current cyber security bills pending in Congress could stop such an attack even if they were enacted into law.


Therefore I've decided to invite some of the world's leading experts in protecting critical infrastructure to present how they would mount an offensive attack against their respective industry sectors at the next Suits and Spooks anti-conference to be held October 18th, 2012 in Brookline, MA. For obvious reasons, this event will be closed to the press and none of the presentations will be made public. 


One of our speakers will be Dale Peterson, the founder of Digital Bond, Inc., a control system consulting and research firm that also hosts the most visited SCADA security site and the S4 conference. He began work on control system security in 2000 after beginning his security career as an NSA cryptanalyst. In his presentation for Suits and Spooks Boston, Dale will provide detailed scenarios on how how an adversary would take out thousands of power plants around the world or large parts of the electric transmission system. 


Another one of our speakers will be Rob DuBois, a retired U.S. Navy SEAL and current manager for Red Team operations at a U.S. defense contractor. Since the threats aren't only digital, Rob will walk the audience through how a highly trained team would mount a physical attack against a key facility.


Our keynote speaker will be Dr. David A. Bray who currently serves as Principal Strategist and Senior National Intelligence Service Executive with the National Commission for Review of Research and Development Programs of the U.S. Intelligence Community. Prior to joining ISE, Dr. Bray served as a strategist at the Institute for Defense Analyses and the Science and Technology Policy Institute. In 2009, he deployed to Afghanistan as a Special Advisor to STRATEGIC EFFECTS for NATO’s International Security Assistance Force and U.S. Forces Afghanistan, with the task of helping to “think differently” on critical strategic efforts. Dr. Bray also served as IT Chief for the Bioterrorism Preparedness and Response Program at the U.S. Centers for Disease Control and Prevention, where he led the technology aspects of the bioterrorism program’s response to 9/11, anthrax in 2001, SARS, and other outbreaks. 


This will be the fourth Suits and Spooks event since I first started holding them in September of 2011 and it may be the most critical one yet. The information that will be shared on October 18th by our speakers (a complete list is available at the website) will clearly lay out offensive options that could wreak havoc on up to six key components of critical infrastructure - water, power, transportation, communication, health care, and banking. Due to the timeliness and the importance of this topic, we're going to cap attendance at 130 instead of 100. If you'd like to be part of this history-making event, registration begins today.

Add to Cart View detail

Cyber Self Defense For Non-Geeks

"The direction of a strike depends on where your opponent stands, what he is doing at the moment, and what target on his body you want to hit. There are five sections of the body that you can attack: head, hands and arms, trunk, thighs, and lower legs. There are three components to consider before launching a strike: distance to the available targets, angle of the surface of the target, and timing of the opponent’s movement."

- Sang H. Kim, Vital Point Strikes (Turtle Press, 2008)

The best way to think about cyber security and self defense is to compare it to boxing or any martial art. Your body, like a computer network, has numerous vulnerabilities. When you find yourself being attacked, you need to position your arms and your torso in such a way that you shrink the number of vulnerabilities exposed to the attacker. This is known as “shrinking the attack surface”. Trained fighters will angle their body to present a reduced attack surface to their opponent. They’ll keep their arms up to cover everything from the bottom of their ribcage to the top of their skull because most of the lethal points of the body are in those regions. They’ll still get hit, but it probably won’t be on a vital point. Similarly, there’s no way to stop an attack against your network, but you can make sure that the attack hits only non-vital data rather than your company’s most valuable information.

The following are some basic principles for you to follow both at home and abroad to help keep your valuable data safe. They won’t be sufficient for when you’re in high-risk locales and they won’t stop a targeted attack, but they will make it much less likely that you’ll suffer a serious breach because of poor cyber security habits or an over-reliance on your antivirus or firewall application. A 64-year-old friend of mine who’s been a lifelong bodybuilder and a fighter is fond of saying “I may not be able to feed a guy his lunch any more, but I’ll definitely feed ‘em a sandwich.” That’s all we want to do with this strategy. If someone wants to attack you, we want that person to know that it’s going to cost them something—and that may be enough to get them to leave you alone and pursue weaker, less prepared prey.

Develop a healthy paranoia about everything in your Inbox or your Browser
If you receive an email from an unknown person with an attachment, don’t open it. If you recognize the name of the sender but the text in the email doesn’t sound like her, pick up the phone and call her to verify that the email is legitimate. If the email asks that you click on a link, read the link first. A lot of malicious links are designed to look like the real thing but won’t stand up to close scrutiny. Is the word spelled correctly? Does it end with a “dot com” or a “dot co”? Take a minute and check before you click.

If you’re on Twitter and receive a tweet with nothing but a shortened URL, ignore it. If you receive a Direct Message from someone you know with a shortened URL, but the message doesn’t sound like it would have come from that person, pick up the phone and make a call to verify that your friend Jody actually sent you the message “You should see what this guy is saying about you at fakeURL.com!”

Use the most secure Web browser that you can find
It doesn’t matter if you’re a Microsoft geek or Apple chic. Don’t let your loyalty to a company brand determine your online safety. Find and read independent research on which browser is the most secure and make your decision from the evidence. For example, Accuvant Labs recently published “Browser Security Comparison: A Quantitative Approach” on December 14, 2011. They examined Internet Explorer, Mozilla Firefox, and Google Chrome for security flaws and came to the conclusion that Chrome was the most secure browser. However, take your time and read the full report so that you understand what the issues are and why Accuvant made the decision that it did. Feel free to look for contrary findings as well and make an informed decision.

The only rule you need to know about passwords
There is one simple rule to remember about constructing a password: make it as long as possible—definitely longer than 10 characters. One example is to use the latitude or longitude of your favorite city. For example, Rio de Janeiro’s latitude is “Latitude:-22.9181189”. That password has 20 characters of all 4 types and it’s almost impossible to crack using any of the password cracking tools out there today. If you like that idea, visit www.findlatitudeandlongitude.com and pick your favorite destination. If you can’t memorize it, write it down and keep it in your wallet, but be sure to obfuscate it in some way that only you know. For example, just write down the number portion and obfuscate that by adding numbers to it: e.g., 22.918118904, or turn it into something that looks like a credit card number: 2291 8118 9040 5592. You’ll remember that everything from the 0 onward is extraneous but no one else will know that. Add an expiration date 01/15 and anyone who finds your little cheat sheet will automatically assume that it’s a credit card number.

It’s important to remember that no matter how complex your password is, if your computer becomes infected with a keylogger (an application that captures your keystrokes), you’re done. That’s why the above advice about browsers and email are so important.

Do preventative maintenance on your computer
Your computer is a tool just like all of your other tools, including your automobile, and as such it requires regular maintenance. Make sure that all of the applications running on your computer are up to date. One way to do that is by using a free program called Secunia Personal Software Inspector (PSI). The website address is http://secunia.com/vulnerability_scanning/personal/. Once it’s loaded on your machine, it will search for security patches for every application that you use, notify you if any are out-of-date and point you to the download site.

Avoid free Wi-Fi
One of the most popular ways for bad guys to steal your login credentials is to hang out at coffee shops, airports, and other popular locations that offer free Wi-Fi and use an application known as a “sniffer” to intercept your username and password for whatever application you’ve logged into while drinking a cup of coffee or waiting for your flight. Instead, use the mobile hotspot that comes with your smart phone or pay for a service that protects your session. Both are secure from wireless sniffers.

Don’t use USB thumb drives or other removable media
One of the worst breaches ever to occur at the U.S. Department of Defense came about because of the popularity of transmitting data from one computer to another via thumb drives. The following article was written by Deputy Defense Secretary William J. Lynn III for the magazine Foreign Affairs in the September/October 2010 issue:

"In 2008, the U.S. Department of Defense suffered a significant compromise of its classified military computer networks. It began when an infected flash drive was inserted into a U.S. military laptop at a base in the Middle East. The flash drive's malicious computer code, placed there by a foreign intelligence agency, uploaded itself onto a network run by the U.S. Central Command. That code spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead, from which data could be transferred to servers under foreign control. It was a network administrator's worst fear: a rogue program operating silently, poised to deliver operational plans into the hands of an unknown adversary."
"This previously classified incident was the most significant breach of U.S. military computers ever, and it served as an important wake-up call. The Pentagon's operation to counter the attack, known as Operation Buckshot Yankee, marked a turning point in U.S. cyberdefense strategy."

To put it simply: don’t use removable media to transfer data between computers. The only time removable media should be used is when you travel and then only to store your own critical data as an alternative to storing it on your travel laptop.

This is an excerpt from my ebook "A TRAVELER'S GUIDE TO CYBER SECURITY"

Add to Cart View detail

The Stratfor E-mail Address Scandal That Isn't

The Guardian just ran a sensational story about hundreds of British government and NATO email addresses being exposed via the Stratfor hack. The L.A. Times ran a similar story featuring other exposed email addresses from various U.S. agencies and organizations including the White House. In fact, my email was among those exposed. My response is - big deal. I publicize my email address on the Web. It's one of many that I use for different purposes. An email in and of itself means very little. An email with a ridiculously easy password could be a problem if the person was foolish enough to use that same combination on his work email address but for most people, especially those in large corporations and the U.S. Government, that's next to impossible to do because of specified password requirements and two-factor authentication. And in the case of obtaining free reports via Stratfor's marketing strategy, why bother using a strong password as long as it and its associated email address are different from ones that you use for work? In fact, programs like Anonymizer give you throw-away email addresses and passwords to use for just such an occasion.

One of the articles that I read claimed that the Stratfor breach included 3 email addresses from the White House. Well, two of those were President@whitehouse.gov and Prez@whitehouse.gov. Does anyone seriously believe that either of those are real? They're most likely the invention of someone who, like me, wanted to read one of Stratfor's "free" reports. Stratfor doesn't validate those email addresses and every time you want to download another free report you need to invent a different email address to register under. That's why Stratfor has so many email addresses in its system. People who want a freebie report are loading them up with valid and invalid email addresses like "Prez@whitehouse.gov".

So what are the repercussions to have your email address listed along with hundreds of thousands of others? Spam and spear phishing attacks are pretty much it and both of those can be easily avoided if you've paid any attention to network breaches in the past year. In the rare case that you used your work email address along with your work password, you're pretty much screwed (and deserve to be for being so carless) but by now you've changed your password anyway. The worst part of the Stratfor hack wasn't the release of those email addresses. It was Stratfor's atrocious handling of its members credit card data and the awful state of its own network security. The worst part may be yet to come, if and when Anonymous releases the contents of those emails between Stratfor analysts and their corporate and government clients. Once that happens, you'll be wishing that all you had to worry about was an exposed email address with a weak password.

Related:
An Open Letter to George Friedman and Stratfor
Was Stratfor Breached By An Insider?

Add to Cart View detail

2012: Blood in the Water

2011 was the year that our perceived security was stripped away. EMC’s RSA division was breached and soon afterward so were some of its customers. The world’s largest anti-virus companies have been taken to task for selling snake oil (also known as anti-virus) to gullible CEOs. Local police departments were unable to protect their own officers’ personal and confidential information. The FBI’s Infraguard program was repeatedly hacked. And the directors of DARPA and NSA have recently both agreed that after many years of trying they’ve failed to come up with a security model that works.

We’ll be entering 2012 more vulnerable than ever before because at least part of our security relied upon the perception by bad guys that those charged with our security, both public and private, could do the job. Well, that myth has been busted which gives rise to opportunity. Conversely, over 28 nations and counting are developing offensive cyber capabilities, and the really malicious actors of the world like drug cartels and extremist groups (both domestic and foreign) are rapidly learning what’s possible vis-a-vie attacks through cyberspace. In other words, those with the means to act are growing quickly.

Finally, the anger and frustration of the expanding Occupy movement combined with the onset of hate-fueled politics that accompanies a Presidential election year - especially against this President - will engender widespread motivation for people to take action. With means, motive, and opportunity solidly represented, I fully expect 2012 to produce one or more multi-modal cyber attacks against a U.S. target which will result in serious harm if not loss of life. By multi-modal, I mean an offensive operation where a cyber attack represents one component. Once there's blood in the water, you can expect more of the same to quickly follow.

The very worst part of this prediction is that its inevitable. CEOs typically refuse to act to protect their own companies if it cuts into profit. The U.S. government has refused to do what’s necessary to protect our nation’s critical infrastructure because it's 90% privately owned, and our laws and system of government has enabled this massive malfeasance so that everyone responsible can claim absence of malice. In the words of Upton Sinclair and the movie based upon his book Oil! - "there will be blood". It's just a matter of time.

Add to Cart View detail

Akamai: U.S. Ranks Third As World's Source Of Attack Traffic; China ranks 4th

Akamai just released its 2Q 2011 State of the Internet report. For those of you who think that China is the end-all and be-all of cyber attacks, you'll want to get a copy of this report right away. Akamai serves up to 30% of the world's Internet traffic with its Akamai Intelligent Platform; more than 604 million unique IP addresses from 238 countries and regions to be precise. In addition, Akamai runs a dark net of unadvertised honey pot systems. Since they aren't part of Akamai's production platform and aren't utilized in any way, any attempt to connect to those honeypots is interpreted as an attack. Here's the attack data from Akamai's latest report:

The geolocation of IP address isn't proof that any given nation's government is responsible for attacks emanating from servers on its soil, otherwise the Chinese government would be demanding that Secretary of State Clinton explain why the U.S. is generating so much attack traffic (instead of vice versa  which is equally wrong). What these statistics do suggest is that the U.S. government needs to start regulating the Internet Service Provider industry in this country. We have WAY too many bad ISPs operating on U.S. soil that are being used to conduct criminal acts around the world. Host Exploit's latest report shows that the U.S. hosts 5 of the 10 worst ISPs in the world, including the #1 position. 

Note that SoftLayer and The Planet are at the #11 and #12 positions. Both are located in Plano, TX whose Governor (Rick Perry) is hoping to be the Republican nominee for President. Perry has also been courting Huawei to open its North American headquarters in Texas. It seems to me like the Governor of Texas has a great opportunity to demonstrate that cybersecurity should become a priority for this country by making it a priority for the State of Texas first.

Add to Cart View detail

My Top 5 Tips for "Cyber" Startups

1. Pick a hard problem and throw yourself into solving it. In 2005 I was inspired by the InfoSec Research Council's Hard Problems List (.pdf) while I was at Microsoft even though it had little to do with my actual job there. You need to find a problem that you can get passionate about or you'll never survive the difficult road ahead of you.

2. Start a blog about the problem that you've selected. Once I found what I thought would be a solution for one of the problems on that list, I presented it to Microsoft's Greenhouse. When they rejected it, I started a blog (IntelFusion.net - no longer active) as a way of continuing my research and building a network of like-minded folks who were interested in the same sorts of things that I was.

3. Get Published. You don't have to write a book, although that's a great experience to have but you do need to create a body of work that can be reviewed and critiqued by your peers. Submitting papers for conferences is one of the best ways to do this. Go to as many conferences as a presenter as you can. That's key. Go as a presenter, not as an attendee. As a presenter, you'll get your expenses covered while meeting decision makers who may become customers, mentors, employees, or partners later on.

4. Build a Network. There's a reason why predators thrive in pack environments rather than on their own. You won't make it as a one-man show. In fact, if you've done the first three things on this list, you'll already have a collection of business cards and LinkedIn contacts for people who either want to help you or use you. You'll figure out which is which soon enough.

5. Find a Mentor. Or hopefully, more than one, to help get you past some of the hurdles you'll encounter in starting a new business. For example, I used to think that I could start a company which offered a product or service that the government needed and which no one else offered and I'd be in business! After a year of failing, it took a mentor to educate me about the fact that it takes a startup company 3 years on average to win its first government contract. I also used to think that I could go after an Army or Air Force SBIR grant and that my application would stand an equal chance at getting selected. After three rejections, it took a mentor to tell me that the Army already knows the company that it plans to award the SBIR grant to beforehand. Both of those experiences, among others, helped me understand that I don't want the government as a customer; that I should focus instead on providing a product or service needed by corporations.

These 5 things helped me leave Microsoft and start my own company (Taia Global, Inc.) with no money at the height of the financial crisis in 2009. It was and remains an arduous journey but it has been the best experience of my life and my company is doing better than ever. I'm confident that if you can find your passion in trying to solve some of the hard challenges that governments and companies face today, that you'll have the same end result that I've had - experiencing daily joy in building a company that makes a difference in peoples' lives. It doesn't get any better than that.

Add to Cart View detail

Venture Opportunities in Cybersecurity - Repairing a Broken InfoSec Model

I'm really looking forward to acting as moderator for the MIT/Stanford Venture Lab - "Cybersecurity - Protecting Against The Unseen Enemy" - to be held at Stanford University on the evening of November 15, 2011. Here's a brief description from the website:

As the cyberspace grows beyond the personal computer to mobile devices, sensors, cloud applications, networked-devices, where are the opportunities and what are the next generation of cyber security start-ups doing to protect our data and systems?  Meet the brilliant entrepreneurs ushering in a new era of digital security.  

The old model of providing cybersecurity to both corporations and governments is broken and has been for a long time. Big InfoSec is struggling to not only provide protection that works but to be agile and responsive to the critical needs of their customers who may soon find themselves having to comply with SEC regulations on reporting network breaches and the risk of those breaches occurring. There's a huge opportunity for new ventures built upon new business models and I'm hopeful that this VLab will spawn some exciting outside-the-box innovations in that area. 

Add to Cart View detail

Thoughts on the SEC's New Guidance on Reporting Cyber Risk

The new guidance by the Security and Exchange Commission (SEC)'s Division of Corporation Finance (CF) is a very well-written and welcome development in the world of corporate cyber-security. Although these are not rules nor regulations, the CF has published them to "provide guidance that assists registrants in assessing what, if any, disclosures should be provided about cybersecurity matters in light of each registrant’s specific facts and circumstances."

One of the key take-aways for me is that it's not just about reporting a breach although that's obviously a part of it. Companies also need to assess and report the risk of a breach occurring. Here's the exact language:

The federal securities laws, in part, are designed to elicit disclosure of timely, comprehensive, and accurate information about risks and events that a reasonable investor would consider important to an investment decision.[2] Although no existing disclosure requirement explicitly refers to cybersecurity risks and cyber incidents, a number of disclosure requirements may impose an obligation on registrants to disclose such risks and incidents. In addition, material information regarding cybersecurity risks and cyber incidents is required to be disclosed when necessary in order to make other required disclosures, in light of the circumstances under which they are made, not misleading.[3] Therefore, as with other operational and financial risks, registrants should review, on an ongoing basis, the adequacy of their disclosure relating to cybersecurity risks and cyber incidents.

This obviously doesn't apply to all companies; only the ones who are in high risk sectors or perhaps ones that have already been the victim of a major breach or repeated breaches (i.e., RSA, Lockheed Martin, Sony). Again quoting from the SEC document under "Risk Factors":

In determining whether risk factor disclosure is required, we expect registrants to evaluate their cybersecurity risks and take into account all available relevant information, including prior cyber incidents and the severity and frequency of those incidents. As part of this evaluation, registrants should consider the probability of cyber incidents occurring and the quantitative and qualitative magnitude of those risks, including the potential costs and other consequences resulting from misappropriation of assets or sensitive information, corruption of data or operational disruption.

The existing regulations on reporting risk are contained in Regulation S-K, Item 503 (c) "Prospectus Summary, Risk Factors, and Ratio of Earnings to Fixed Charges". Basically, you need to discuss what makes investment in the offering speculative or risky. For example:

• Your lack of an operating history;
• Your lack of profitable operations in recent periods;
• Your financial position;
• Your business or proposed business; or
• The lack of a market for your common equity securities or securities convertible into or exercisable for common equity securities.

Some of the factors spelled out in the SEC brief which could trigger the reporting of cyber risks for registrants include:

• Discussion of aspects of the registrant’s business or operations that give rise to material cybersecurity risks and the potential costs and consequences; 
• To the extent the registrant outsources functions that have material cybersecurity risks, description of those functions and how the registrant addresses those risks;
• Description of cyber incidents experienced by the registrant that are individually, or in the aggregate, material, including a description of the costs and other consequences; 
• Risks related to cyber incidents that may remain undetected for an extended period; and
• Description of relevant insurance coverage.

While there's a lot more work ahead before this guidance becomes anything more than voluntary, it's an important first step. C-suite executies who want to stay ahead of the regulatory curve should be paying attention to this announcement.

Add to Cart View detail

The U.S. State Department As Cybersecurity Innovator?

I was astounded to read Siobhan Gorman's WSJ article that the U.S. Dept of State's approach to cybersecurity (iPost) is so innovative that very well-known cybersecurity firms are requesting their source code. State is a well-known bureaucratic sinkhole but they appear to be paying attention to improving their cybersecurity issues; at least as far as known threats and vulnerabilities go. And that's the rub.

No one should be compromised through a known vulnerability, yet it happens all the time; especially SQL injection attacks (InfraGuard, INSA, Sony, etc.). So while known threats are still a problem, they shouldn't be. And iPost does nothing to protect from the real problem - customized attacks which are specifically built to compromise a targeted network. That's the real risk; not only to State but government agencies all over the world. So when John Streufert, State's CISO says something like this - "We know anywhere in the world what our risk is", then I have serious doubts about State's understanding of risk management. Risk isn't about what you know. Risk is about what you don't know. And iPost, like many other so-called cybersecurity solutions, does absolutely nothing about addressing that problem.

NOTE: You can read the GAO report on iPost here (.pdf).

Add to Cart View detail