Network Critical - The Window to your Network

Something Needs to Change


Before I weigh in with my two cents worth, I’d like to share a personal experience. Way back in spring 2006, I was awarded a contract to assist the Department of Transportation as they worked to submit the required systems Certification and Accreditation to OMB.

It was a tall order, but nonetheless I looked forward to the assignment; I assumed the only downside would be the pages of Government paperwork that I was required to submit before I could even step inside DoT headquarters. In order to obtain my ID badge, I had to provide personal details not just about myself, but my family and friends as well.

Fast forward to summer 2015, when OPM notified me that their database had been compromised; as many as 21.5 million individual records had been stolen and there was a “strong possibility” that the personal data included in my DoT paperwork was amongst them. Now it’s fair to say that this ‘strong possibility’ wasn’t an absolute certainty. But given that my family and close friends information was stolen as well as my own, let’s just say that I wasn’t very open to considering the ‘possibility’ that my data had been untouched. Would you have been?

Sure, I’ve since been offered a prepaid subscription to an identity theft monitoring program, but let’s be candid. That’s the virtual equivalent of deciding to install smoke detectors in your home, after it’s been burned to the ground. Taking steps to protect the people you’re responsible for, only after they’ve been compromised, means you’ve failed. It’s that simple.

I’ve since heard that OPM has introduced two-factor authentication as a common working practice since the incident. But given that’s a feature found on most iPhones, why did it take so long for a Government department to implement it as a basic security measure?

No matter where you stand politically, no one can deny that we share a mutual concern; virtual criminals are becoming increasingly sophisticated by the day, so a level paranoia comes with the territory in the Public Sector. What continues to alarm me is that we’re all seem to be victims waiting for the next headline to hit. We are so preoccupied with fixing the destruction caused by the last attack we didn’t see coming, that we don’t have time to be proactive about preventing the next one.

There tends to be a reliance on assumptions and ‘what we know’. But given the increasingly unpredictable and unparalleled nature of these attacks, is what we know good enough anymore?

With far more exciting targets such as the NSA and the Pentagon, I for one would’ve completely dismissed anyone who predicted the possibility that a Government agency such as the OPM would be targeted, and I’m willing to bet I’m not the only one.

Back in 2011, Iran admitted to overriding and taking control of a US drone and amazingly, the story once reported seems to have disappeared from our minds. Clearly, the political and military consequences were discussed but surely there should be more time committed to asking “if a drone can be hacked, what else can?”

We need to consider the far-fetched, worst-case scenario given our current climate. If a drone can be overridden, who can absolutely guarantee the same wouldn’t happen to a plane with a pilot onboard? Is a commercial air traffic control tower just as at risk of being compromised as the OPM? Are similar, low visibility departments at risk, like the Department of Veteran Affairs?

More recently the Chinese military unveiled their latest fighter aircraft the Chengdu-J20. The aircraft bears a striking resemblance to our F-22 advanced fighter. Anyone who has seen the J-20 can’t dismiss the fact that somehow the Chinese were able to hack into either a DoD or subcontractor network and steal proprietary specifications and designs for the F-22. Fortunately stealing the designs appears to be a simpler task than duplicating the sophisticated technology that provides the F-22 pilot the ability to see and fire upon enemy aircraft even if the enemy is behind them.

Fighting fires once the damage has been done is an all too common practice. But as for best practice? That comes with discussion, sharing our experiences and bouncing ideas off each other - and I’m not referring just to our world and industry leaders.

It’s time we took a more proactive role in actually preventing the constant threat of cyber criminals that we face daily, instead of simply waiting for the latest breach to make the news, and reacting to it.

For an industry that operates in the background to ensure our information is protected, we’re being caught in the headlines way too often, and for the wrong reasons.

Sometimes it’s on a global scale, sometimes it’s personal. But one things for certain, something needs to change.

Last week I created a LinkedIn closed group to bring together informed, like-minded people who want to take a different, more proactive approach to combatting cyber security.

The group isn’t designed to be a passive, voyeuristic forum. Its purpose is for those that want to come to the table with strong ideas, share best practice in a trusted environment and are ready to hit the issues head-on together.

That way, we have a fighting chance of preventing more disastrous headlines.

You can join ‘The Cyber Security Forum’ here.

Posted: 01/03/2017 03:38:45 by Network Critical with 0 comments

The New Battlefield: Cyber Space

Cyber warfare is real. It is happening now. In fact, while you are reading this blog, government and corporate cyber resources are under attack around the globe. Here are a few recent examples:

Department of the Navy - Hacked through contractors emails. 134,000 sailors have had their personal information and social security numbers stolen. This information will likely be sold for the purpose of identity theft. This is not just stealing information to make credit cards and buy stuff on a fictitious account. This hack is more. This is cyber warfare. This hack is compromising the families and distracting the focus of service men and women in the Navy.
National Security Agency - Hacked by the Shadow Brokers. This group actually hacked a hacking group within the NSA called the Equation Group. According to Kaspersky Labs, the code that was leaked by Shadow Brokers is used by Equation Group for its own hacking and decryption operations. This is real spy vs spy stuff but it is all done behind the cyber curtain. Today it is code vs code.

People’s Liberation Army Unit 61398 is a division of the Chinese military that is dedicated to hacking corporations and governments around the world. A report by computer security firm Mandiant provided detail on this organization and, after many diplomatic denials, the Chinese government actually confirmed the existence of the group.
The CIA and FBI have confirmed that Russian hacking groups have been very active in trying to influence the outcome of the 2016 United States election. Congressional investigations are being organized to gather more detail on the scope and influence of these efforts.

Following is a quote from former US President Obama on the subject: “America’s economic prosperity, national security, and our individual liberties depend on our commitment to securing cyberspace and maintaining an open, interoperable, secure, and reliable Internet. Our critical infrastructure continues to be at risk from threats in cyberspace, and our economy is harmed by the theft of our intellectual property.”

Cyber warfare is our biggest threat today. It is more effective than blowing up buildings and roads. It is more effective than killing and capturing opposing forces. It is the warfare of the 21st century. It is warfare that captures minds and hearts, not just bodies. The new bombs are fake news, leaked emails and violent propaganda. The United States spends hundreds of billions of dollars on new fighter jets, bombs and automatic weapons. Yet, the Marine Corps database, managed on contract with HP, was not secured. This is what allowed SQL injection breach to the Marine Corps Intranet by the Navy hackers noted above.

The latest budget proposal from Obama significantly increases the federal spend on cyber security to $14 Billion. While this is good news, the United States cyber security spend is still a tiny fraction of the overall military budget of almost $600 Billion. Imagine the future potential if the military budget included $2 Billion dollars of scholarships to West Point and Annapolis for promising students to study cyber security and cyber warfare. Imagine the potential of funding $1 Billion in research into cyber warfare initiatives. These should be the budget priorities of the future.

For the time being, however, it is also important to recognize and act on the urgent need for vigilant management of network security profiles, continuous training, and permanent monitoring and management with tools that are available now.

Tapping links and utilizing Firewalls, Intrusion Prevention Systems (IPS), Data Loss Prevention (DLP) and other threat landscape reduction tools are a promising start to deterrence of debilitating breaches from foreign governments as well as domestic hackers. Packet Brokers are capable of providing simplified connection of multiple security tools. These devices allow mapping of data flows to specific tools and provide fail-safe protection to the network in case one of the security tools goes off line. Further, tools may be connected redundantly for maximum security without compromising network availability.

Cyber warfare is the new battlefield. It is quiet but effective. It is hidden from public view but very much a public threat. We have some good tools to fight it now but must up our game for the future. Military investment must maintain our traditional fighting forces but must also support a rapid transition to fighting a new type of war.


Posted: 21/02/2017 16:54:58 by Network Critical with 0 comments