Data Breach Report Highlights Need for Cyber Policies

By Randal S. Milch, executive vice president, Public Policy, and General Counsel of Verizon - 04/24/13 06:37 AM ET

This week Verizon released the 2013 Data Breach Investigations Report, its sixth comprehensive annual report of the state of cybersecurity.  The DBIR adds important factual information to the increasingly public debate over the consumer privacy, national security and economic issues around cyber crime and how to prevent it. 

While the 2013 DBIR confirms that cyber crime remains a grave and growing threat to our security, it also provides important lessons about protecting data and about sound public policy which will enable a more robust fight against cyber criminals.

First, the facts.  In 2012, large-scale financial online crime and state-affiliated cyber espionage dominated the security landscape.  Cyber theft of intellectual property such as classified information, trade secrets and proprietary business data is a top threat to U.S. national and economic interests, yet these state-affiliated espionage campaigns were actually less common in 2012 than “hacking,” which accounted for 52% of all 2012 data breaches. 

Hactivists – who launch cyber attacks for ideological purposes or for the pure thrill of it – seek to paralyze communications systems through Distributed Denial of Service (DDoS) attacks.  DDoS creates significant costs because they not only impair business and operations, they can slow block or dramatically limit access to websites under attack.

As in years past, the 2013 DBIR reaffirms the importance of cyber hygiene.  Seventy-six percent of network intrusions exploited weak or stolen user names or/passwords. Fully forty percent of intrusions incorporated such malware as malicious software, script, or code used to compromise information.  Rigorous password practices, controls on the use of transferable media like thumb drives and other basic protections remain the first, best protections against cyber attack. 

What do these facts say about public policy?  Two things:  cooperation and flexibility.  The vulnerability of hardware and software underscores the interdependent nature of the Internet ecosystem and the need for all technology sectors to be working closely together in defending against cyber-attacks.  Verizon has a strong record of protecting our networks and the privacy and data of our customers, and we share the industry’s commitment to ongoing efforts to further improve the effectiveness of our nation’s cyber defenses.  

While our industry successfully defeats millions of attempted cyber-attacks each day, it does so because it retains the flexibility to take quick and decisive action against these attacks. In February, the Obama Administration issued an Executive Order to promote best practices on cyber security for critical infrastructure sectors.  That Order acknowledged the need for a flexible approach driven by private-public collaboration. 

Changes in federal law would go further in advancing U.S. cybersecurity.  But it’s important to note that in addressing this increasingly important national and economic security issue, there is no single, correct solution. There are many players and many solutions, and all these players in the Internet ecosystem – service providers, communications equipment makers, software developers – need to participate in the common defense. 

Congress will also play a key role and can improve our national cybersecurity posture.  Perhaps the single most important step would be to promote the voluntary sharing of cyber threat information between and among communications companies and federal agencies.  Critical to ensuring private sector participation will be providing appropriate antitrust and liability protection.   And, of course, it is vitally important that legislation provides adequate protection for Americans’ privacy and civil liberties.  The recent overwhelming 288-127 House vote on the “Cyber Intelligence Sharing and Protection Act” clearly demonstrates that bipartisan, consensus-based cyber legislation is achievable this year.

As we continue to work to find the best solutions to ensure the best cyber security in the middle of this fast-moving technological war, we must avoid regulatory mandates that will quickly become obsolete and potentially hinder the ability of high tech companies and broadband providers to innovate and coordinate to defeat ever-evolving cyber threats.   These companies must maintain the flexibility to deploy new technologies in real-time to secure networks and to protect customers. 

Together, a strong public-private partnership will produce a safer and more secure online environment that supports America’s economic prosperity and growth.  As our data breach report recommends, there are many steps that businesses, government agencies and other organizations can take to protect themselves.   But it will take teamwork – all of us working together – to permanently secure one of the most creative – and important – inventions of our time that will only grow in importance for our future.

Randal S. Milch is executive vice president, Public Policy, and General Counsel of Verizon

View Comments

View the original article here

House cyber bill protects privacy, civil liberties while addressing threat

By Rep. Lynn Jenkins (R-Kansas) and Rep. Scott Peters (D-Calif.) - 04/18/13 05:00 PM ET

Cyber espionage and warfare pose a grave threat to our nation. Foreign countries such as China and Iran are conducting massive cyber attacks and espionage campaigns on the United States, disrupting our networks and stealing our trade secrets. In both open and classified briefings, we hear far too often about the loss of American companies’ corporate trade secrets and the jobs that go along with them. Although our nation is vulnerable to serious damage from cyber attacks, we do not have to concede this fight, nor should we wait for a crippling incident to act. It is imperative that we safeguard our networks from foreign hackers while still protecting Americans’ privacy and civil liberties.

Today the U.S. House of Representatives passed H.R. 624, the Cyber Intelligence and Sharing Act (CISPA), a bipartisan effort led by House Intelligence Committee Chairman Mike Rogers and Ranking Member Dutch Ruppersberger. It addresses these dangerous cyber threats while preserving and prioritizing both privacy and security equally.

Chairman Rogers and Ranking Member Ruppersberger made clear from when they first started drafting this bill a year and a half ago that they were open to constructive ideas to improve it. As a result, privacy groups, members of Congress, and a variety of private sector companies and organizations accepted their offer, and CISPA was amended and improved through tightening the bill’s language and definitions, adding privacy protections, and including important oversight mechanisms to ensure that the bill’s authorities are always used properly.

Before it went to the floor, the committee voted unanimously to strike the government’s national security use exception from the legislation to address the concern of privacy groups who were fearful of misuse of information under the guise of national security. There was also an amendment creating a five-year expiration of the legislation to allow for adequate review of provisions in the future. Nevertheless, some continue to misunderstand CISPA, and we urge those with remaining concerns to read this important bill carefully.

Countries such as China, Russia, and Iran have already hacked the networks of American companies holding sensitive information about American customers. Hackers working for organized crime networks in Russia and Eastern Europe are working around the clock to break into networks containing Americans’ private banking information including credit card numbers and other account information. They can steal American corporate trade secrets, such as blueprints for innovative products under development, and competitive bid information for business transactions that could create new American jobs. Hackers working for Chinese Intelligence services have infiltrated American media outlets and think tanks which publish content critical of the Chinese government to determine the identity of our reporters’ sources in order to punish and imprison them. 

As CISPA advances to the Senate, we must not let misplaced fears about the bill’s authorities prevent us from addressing the severe threat posed by advanced, foreign cyber threats.

If it becomes law, CISPA will strengthen our cybersecurity, improve our ability to defend American networks and our sensitive data, and continue to protect our privacy and civil liberties. But all of this is only possible if we successfully dispel the false rumors surrounding CISPA and educate the public about the improvements this bill has undergone since its introduction. We come from two very different political parties and disagree on many issues, but we both believe this bill is critical for our nation and hope to see is become law very soon.

Peters represents California’s 52nd Congressional District. He is a member of the House Armed Services Committee and the House Science, Space and Technology Committee.

Jenkins represents Kansas’s 2nd congressional district. She is the vice chairwoman of the House Republican Conference and a member of the House Ways and Means Committee.

View Comments

View the original article here

US must do better in preparing professionals to help fight cyber attacks

By James Gabberty, professor of information systems, Pace University, New York City - 02/15/13 04:00 PM ET

While dozens of U.S. banks are in the midst of reviewing their information security policies after falling victim to recent successful network intrusions resulting from cyber-attacks, The New York Times, The Wall Street Journal, The Washington Post and even Twitter have joined the ranks of other high-value companies to have been targeted by hackers, most notably from China and Iran. It should come as no surprise to anyone following U.S. Internet vulnerabilities that China has been named as principal culprit behind a massive, sustained cyber-espionage campaign that threatens the nation’s economic competitiveness, according to a report released today by The National Intelligence Estimate.

While U.S. officials debate over what new measures, if any, to put in place to protect our economic interests, firms - both public and private – should consider what they can do to thwart these attacks from re-occurring, or to at least minimize the collective threat they pose to American business.

The plain and simple truth of the matter is that qualified information security practitioners are few and in high demand, especially as current and planned regulatory initiatives such as Sarbanes-Oxley and Dodd-Frank further constraining their availability.

Even from the perspective of the U.S. military, information security workers represent much more than basic levers of economic growth - they are a crucial component of the nascent effort to defend the nation’s information assets and our digital infrastructure. And we are losing the battle.

Given the mutual dependency of our economic and military infrastructure on the continuous availability and flow of confidential and high integrity data, one solution to solving the perpetual network probes and vulnerability scanning challenging U.S. companies is to retrain IT workers in the short term until long-term measures are put in place to protect our information infrastructure. But how can this be accomplished? After all, it takes years of technical training to produce computer and network programmers that can assist in combatting attacks from abroad. This may be true, but it is not the only way to protect U.S. economic interests.

One proven method is to train current IT workers by the thousands with the right mix of technical and managerial know-how that can be achieved in months, not years. Fortunately, the kind of training that these workers need already exists and is available through specialized training and professional credentialing agencies that specialize in information security, strategy and governance. 

While the majority of network breaches are caused by social engineering – that is, leveraging the end user as an attack vector though which unauthorized access is gained to sensitive computing assets such as communication and database servers – some other protective measures are available now and should be implemented immediately to effectively curb future exploits that can threaten even the most protected computer enclaves.

Although social engineering points to a failure at the top of the organization to link information security with corporate strategy (as well as a lack of end user training that could effectuate a first line of defense against would-be attackers), more frequent reviews of corporate strategies needs to be done, with special attention paid to ensuring that the firm’s information security strategies are aligned with business strategies.

Furthermore, sensible sharing of current attack vectors used by untrustworthy state actors from abroad against our economic assets, as witnessed by our intelligence community, needs to take place. All too often, many U.S. businesses are simply unaware as to how to best keep their firms from falling victim to common methods used by foreign actors to steal sensitive intellectual property. Less than one year ago, for example, Dupont scientist Tse Chao pleaded guilty in federal court to stealing the color white, or more specifically, the secret recipe for the firm’s Titanium Dioxide that is used to make products white, as in paint, toothpaste, and even Oreo cookie filling! You can be sure that Dupont has revised its security strategy, but what are other firms, especially those that have not yet been victimized, doing to forestall becoming victims themselves?

Infected USB drives, for example, sprinkled in corporate parking lots and commuter trains floors is a common attack methodology used by adversaries to gain access to computer networks with miniscule effort, since the workers themselves are culpable of spotting them, picking them up, and inserting them into their computers when they arrive at work. How many of us have ‘gotten the memo’ about this simple attack technique? If nothing else, security awareness training for all computer users both inside and outside the firm is absolutely necessary and can help stop nefarious activities from succeeding.

Computer worms and scripted malware, on the other hand, don’t necessarily involve human interaction and often rely on that leveraging previously reconnoitered network servers that are misconfigured or run outdated operating systems, or even unstable software that is vulnerable to getting inside corporate networks. Locating IP addresses (the addressing scheme the Internet uses to relay information) of misconfigured devices is a trivial task, since one can simply search online search to learn how to perform ‘penetration testing’ , and since most laptop and tablet users don’t know how to configure their devices and user accounts properly before plugging into the Internet, it becomes even easier to hack into systems. Perhaps more worrisome is the trend of smartphones that connect to corporate servers; these devices have paltry security features and are increasingly being used as a gateway to internal networks by hackers. Phone hacking, as famous Hollywood types have become aware, is commonplace. [hint: turn off Bluetooth unless you are using it!]

The path to train the kind of IT worker that is urgently needed today is not found in traditional academic degree programs, but instead is found in the professional credentialing agencies that specialize in identifying and developing solutions against the kinds of attacks we are witnessing daily. Of course, the traditional academic programs of study are necessary to provide deeper insight into the IT function, but the quicker path to securing America’s national economic interests is through professional information security training and credentialing associations.

Although there are literally hundreds of information security certification programs available, several in particular provide the kind of critical training that can transform interested students into ‘cyber warriors’ to stave off most of the attacks coming out of Asia. A good idea is to spend some time reviewing which certifications are in high demand (easily obtained through trade magazines) and determining which for-profit agencies offer the biggest return on training dollar. The overall objective here, of course, is to bring about a highly skilled IT workforce that possessed, for example, a thorough understanding of proper incident handling techniques so when breaches do occur, they can quickly be identified, contained, and eradicated, not to mention the payoff that firms acquire when reviewing recent unsuccessful hacking attempts and adjusting the firm’s overall security strategy. 

Furthermore, insight into common attack methods, malware analysis capabilities, network defense-in-depth techniques, and sound information security governance and policy frameworks that can boost the defensive postures of all firms and is also a necessary component of responding to the threats from network-based attacks. We simply cannot wait for a reversal in declining enrollment trends in the computing sciences to turn the tide against IT-leveraged international corporate espionage and should be doing everything we possibly can to keep our secrets protected.

While no one doubts that corporate information security policy starts at the top, the NIEs report makes it abundantly clear that current information security policies are proving ineffective. Too much trust is placed on lower-level technicians to ward off attacks on the firm. To stay ahead of so-called ‘script kiddies’ trying to hack into a company’s network is one thing, to keep away nation states hell bent on gaining access is another. This fact, coupled with the relatively miniscule amount of proven cyber warriors available today ultimately limits the ability of most firms to simply keep up with the ever-morphing catalog of millions of computer worms and viruses that grow by the thousands each day, hence the call for more certified IT security practitioners.

To protect against the potential devastation that the nefarious activities by hackers everywhere pose to all of us, it is vital stay in lockstep with the protocols being used by the most sophisticated malware purposefully designed to evade the most cleverly configured intrusion prevention & intrusion detection systems currently used throughout U.S. companies, but we are falling short. The ugly truth is that the bad guys, whoever they are, are outperforming our ability to defend our vital infrastructure and this is one race that our society cannot afford to lose.

The threats that loom over our digital infrastructure will undoubtedly multiply, causing risk to increase to untenable levels, the levels that are often associated with calamitous security breaches. So, at least for the foreseeable future, professional certifications will help to stem the tide of ever-mounting encroachment attempts, at least until academia eventually figures out a way to speed up its sometimes outmoded approach to teaching practical ways to stay abreast of a changing technological landscape.

Gabberty is a professor of information systems at Pace University in New York City and teaches graduate-level courses in systems analysis & design, telecommunications and information security. He is an alumnus of MIT and NYU’s Polytechnic Institute and has served as an expert witness in telecommunication and information security at the federal and state levels.

View Comments

View the original article here