Security Journal on Ulitzer
Thanks to tough economic times and a generous dollop of fear-mongering from the media and opportunistic profiteers, we've all become myopically obsessed with cyber-crime.
This is not entirely a bad thing. Unless you've been living under a rock, everyone knows that technology has created unimaginable opportunity for resourceful crooks. The pitfall is in our myopia. But we've become so obsessed with cyber-crime-a "petty" offense in the grand scheme of things-that we've overlooked the bigger picture. While monetary gains are certainly a big motivator for cybercrime, increasingly cyber-criminals are acting out of political interests. Thus, it is important for IT departments to be aware that threats can come from anywhere.
A recent article in the New York Times reminded us of a conspicuously under-reported digital security threat: cyber-terrorism. Dennis Blair, the Director of National Intelligence, made the following comment in an appearance before the U.S. Congress:
"Malicious cyberactivity is occurring on an unprecedented scale with extraordinary sophistication."
U.S. Secretary of State Hillary Clinton also recently shed light on the critical nature of this global issue when she urged NATO members to modernize and strengthen their alliance to combat cyber-terrorism.
These are important reminders that all cyber-threats are not strictly for money and are certainly not all commercial. In fact, there is good reason to believe that the largest increase in systems security vulnerabilities will occur as a result of political, not criminal, activity.
Politics in this context can be defined as the creation, distribution, and maintenance of power across some group of people. On the Web, as we have seen with the alleged Chinese attacks on Google, the struggle is over the power of information.
The point is that politically motivated attacks are fundamentally different. Governments, even small ones, have vastly more resources than your average "cyber-criminal", who may actually some script-kiddie in a basement in Wisconsin. The Google attack was on a huge scale, and also highly coordinated, and was executed with, dare I say it, "military" precision.
This new brand of digital threat takes advantage of a weakness in the hierarchy of law. Most of what we're exposed to is either civil law (like lawsuits, generally) or criminal law (the kind we need police to enforce). This new form of atatck however, runs up against international law. While I am not a lawyer, the principal issues with international law are that it is both ill-defined and expensive (or impossible) to enforce.
The threat is real, and the threat is growing. Companies, organizations and governments need to be aware of commercial AND political threats to their critical digital infrastructure.
The increased nature of the geopolitical cyber-threat says something about the current, often hysterical, narrative floating around the industry about "cyber-crime". I have to admit, "cyber-crime" is getting some traction in the media, as a cyber-crime story even appeared on NPR's Fresh Air show.
Playing on the hysteria in the media, a number of competitors in our market, the Log Management space, are shamelessly hyping the dangers of cyber-crime to degrees that border on the irresponsible. Yes, it is true that we need to be aware of hackers who want to steal our data-either for monetary or political reasons. But despite what a vendor may tell you, true systems security is reliant on people, products and processes; it's not just about one single product that will magically solve all the world's security problems.
The fact of the matter is that bad things happen. You will be hacked. You may have already been hacked and not know it. A rational organization will do three things.
First, put up the best defenses you can. Make sure that you are putting the resources you already have, such as log files, to the best possible use. Start with the basics, like log management, before moving on to supplemental technologies like SIEM. Do your research and buy the best security products that suit your needs and your budget.
Second, implement the best people-processes you can. Recent studies have shown that most data-loss or security-break incidents come from people who are or have been on the inside.
Finally, you will be hacked. Accept the fact and prepare of it. Be ready to clean up and perform forensics when you do get hacked, because one way or another, it will happen.
The number and kinds of attacks on your critical IT infrastructure are increasing. While you may see attacks from one vector decrease, the number of new attack vectors in increasing. Attention by the US Government, and the Google attack from China clearly reinforce this. We must all remain vigilant, now more than ever.
Subscribe to SOA World Magazine Email News Alerts
Subscribe via RSS
