NSA Says Federal Cyber Strategy Needs More NSA More Often, And On The Information Sharing Ground Floor

from the cyber-me-once,-shame-on-me... dept

The NSA doesn't like the fact that it didn't get a big enough slice of the tax-dollar-grabbing cyber pie. After much discussion about which agencies would oversee what aspects of the US government's cyberwar defense systems, the NSA -- despite all of its computing power and hoarded exploits -- ended up with the unenviable task of protecting the home turf rather than engaging in more offensive maneuvers.

Currently, the NSA has responsibility for protecting U.S. government IT systems that carry classified or sensitive data — like the Department of Defense’ massive intranet known as NIPRNet.

It's a clear case of cyber envy. The DHS gets all the good stuff, including a first look at any juicy data turned over to it from the government's one-way "information sharing" program.

But the security of most civilian federal IT systems — and the private sector networks that support the functioning of vital industries like banks and telecoms — are the responsibility of DHS’ Office of Cybersecurity and Communication…

The DHS is supposed to vet and minimize this information before passing it along to federal cybersecurity partners like the NSA. The NSA, however, isn't used to seeing unminimized data. Nor is it content to hang out underneath the DHS's cybertable and wait for it to toss it a bone. So, it's proposing a revamping of the federal government's cyber strategies so that they align more closely with what the NSA apparently feels should have been done in the first place.

“I’m now firmly convinced that we need to rethink how we do cyber defense as a nation, possibly even going so far as that we unite pieces of those three organizations into one organization that does it on behalf of the whole government,” said Curtis Dukes, the NSA’s deputy national manager for national security systems.

Yeah! That's how a partnership is supposed to work: the NSA seated in the same room with the DHS and law enforcement agencies, with everyone comparing the size of their information silos. Excellent. Dukes says he might be a "bit biased" in placing the NSA on equal footing with domestic security and law enforcement agencies, but cyber lives are at stake, dammit!

Dukes said the “bad news” was, with every cyber intrusion becoming a potential crime scene, meaning the FBI had to be involved, and with the DHS in charge, “as we orchestrate across those three department and agencies what we find is that we’re suboptimal and by the time we actually respond to an intrusion, it takes hours to days and by then in cyber time, the adversary has already met their objective.”

Figuring out under whose authorities an incident response should be run meant giving the enemy a head start, he said. “By the time we fill out the paperwork that would allow NSA to provide assistance, it’s typically days to a week before we can actually respond,” he added.

Wonderful. Exigent circumstances but for domestic snooping.

The NSA wants first access to private sector communications and data because the current method takes too long to get the data into the NSA's hands. That's the pitch. Never mind the fact that the NSA is supposed to be an intelligence service tasked with collecting FOREIGN communications and data. Never mind the fact that the agency exploited post-9/11 terrorism fears to become a domestic surveillance agency that turned the Third Party Doctrine into a loophole to be exploited in bulk. Never mind that it simply makes more sense to route domestic security-related data to the the domestic agencies (DHS, FBI, etc.) for several reasons, not the least of which are (at least) two Constitutional amendments (First, Fourth).

But there you have it: the NSA is lobbying for first peek at shared data from US companies, and it's claiming its only interest is better cybersecurity. And it's making this pitch while glossing over the fact that it is not -- and never has been -- a domestic law enforcement agency. Somehow, it still feels it's entitled to act like one and engage in even more domestic snooping.

Filed Under: cybersecurity, dhs, doj, fbi, nsa, surveillance

NBC Happily Parrots The CIA's Case For Escalating Cyber War With Russia

from the putting-out-fires-by-burning-the-house-down dept

As we've been noting there have been growing calls for the Obama Administration to publicly scold Russia for hacking the DNC, and to dole out some kind of righteous punishment for this unseemly behavior. Calls on this front have ranged from launching larger cyber offensives or even a brick and mortar military response. We've noted repeatedly how this is stupid for a multitude of reasons, since hacking "proof" is (if the hacker's any good) impossible to come by, with false-flag operations consistently common.

Despite the obvious dangers of escalation, the U.S. press seems pretty intent on helping the intelligence community justify doing exactly that. Countless outlets are breathlessly passing along the idea that we simply must "retaliate" for Russia's behavior, willfully ignoring that the United States wrote the book on nation state hacking and lacks the moral high ground to lecture anyone on cybersecurity. As Snowden and other whistleblowers should have made abundantly clear by now, we've been hacking allies, fiddling in Democratic elections, creating indiscriminately dangerous malware and worse for decades.

Led by our bad example, we've cultivated a global environment in which nation state operators hack one another every second of every day to keep pace with the United States. As such, the idea that the United States is an innocent daisy nobly defending its untarnished honor from uncivilized international ruffians is absurdly, indisputably false, yet this concept sits at 90% of the reporting on this subject. Case in point: eager to get the escalation ball rolling, the CIA last week used NBC to make the case for a renewed cyber-warfare campaign against Russia in the coming months:

According to the full NBC report, the CIA is cooking up a rotating platter of different proposals, most of which involve launching similar hack and leak campaigns intended to embarrass Putin and company:

"The Obama administration is contemplating an unprecedented cyber covert action against Russia in retaliation for alleged Russian interference in the American presidential election, U.S. intelligence officials told NBC News. Current and former officials with direct knowledge of the situation say the CIA has been asked to deliver options to the White House for a wide-ranging "clandestine" cyber operation designed to harass and "embarrass" the Kremlin leadership."

Again though, if you understand that the NSA and its army of private contractors are covertly probing and attacking countless nations day in and day out (allies and enemies alike), the very idea that we'd announce this single counterattack via god-damned NBC should strike you as transparently theatrical and a bit silly. And as some pointed out, the wording of the story seems to strongly suggest we've already obtained plenty of documents that could prove embarrassing to Russia:Like most news coverage of the Russian hacks, our own responsibility for global cyber war escalation is left entirely unmentioned by a media that fancies itself a truth teller, yet somehow still can't escape the grip of fevered nationalism when covering militarism and cyber warfare. And you'll note the only hesitation from most of the government sources quoted in the article is that our "retaliation" won't be vicious enough:

Sean Kanuck, who was until this spring the senior U.S. intelligence official responsible for analyzing Russian cyber capabilities, said not mounting a response would carry a cost. "If you publicly accuse someone," he said, "and don't follow it up with a responsive action, that may weaken the credible threat of your response capability." President Obama will ultimately have to decide whether he will authorize a CIA operation. Officials told NBC News that for now there are divisions at the top of the administration about whether to proceed.

Good. There should be "divisions." Escalating our cyber-offensive "strategies" resulted in the conundrum we're currently enjoying. And escalation here could prove notably fatal to many given our ongoing proxy war with Russia in Syria. But it's abundantly clear the CIA wants the green light and is getting some resistance from the current administration, encouraging NBC to suggest that escalation could protect the sanctity of the November elections:

"The CIA's cyber operation is being prepared by a team within the CIA's Center for Cyber Intelligence, documents indicate. According to officials, the team has a staff of hundreds and a budget in the hundreds of millions, they say. The covert action plan is designed to protect the U.S. election system and insure that Russian hackers can't interfere with the November vote, officials say. Another goal is to send a message to Russia that it has crossed a line, officials say."

Again though, there is no "line," and any ethical or legal lines that do exist, we obliterated years ago. We've hacked nations aggressively for decades, and are now fanning our collective faces in indignation at the idea that anybody would dare hack us back. We've contributed to escalating cyber-security tensions by being among the most badly behaved nations on Earth, consistently using the resulting threat escalation to justify our ongoing war on encryption, bloated security contractor budgets, and domestic surveillance expansion. It's a vicious, expensive ouroboros of dysfunction.

We've tried escalation as the aggressor, and it consistently makes things collectively, internationally worse, and certainly doesn't stop us from being the targets of these kinds of attacks. That's why we've noted repeatedly that the smart play here is to focus on defense, instead of letting Putin (and our own security contractors and intelligence community) goad us into more idiotic behavior than ever before.

Filed Under: cia, cybersecurity, cyberwar, escalation, russia

Obama Promises 'Proportional' Response To Russian Hacking, Ignores That We Started The Fight

from the bogus-moral-high-ground dept

We've noted several times how launching cyberwar (or real war) on Russia over the recent spike in hack attacks is a notably idiotic idea. One, the United States effectively wrote the book on hacking other countries causing all manner of harm (hello, Stuxnet), making the narrative that we're somehow defending our honor from shady international operatives foundationally incorrect. And two, any hacker worth his or her salt either doesn't leave footprints advertising their presence, or may conduct false flag operations raising the risk of attacking the wrong party.

After significant pressure from intelligence industry saber rattlers and the cybersecurity firms that profit from cyber-hysteria, President Obama this week proudly proclaimed that the U.S. government would be launching a "proportional" response to Russia's recent slate of hacking attacks:

"We obviously will ensure that a U.S. response is proportional. It is unlikely that our response would be announced in advanced. It’s certainly possible that the president could choose response options that we never announce," Earnest told reporters aboard Air Force One. "The president has talked before about the significant capabilities that the U.S. government has to both defend our systems in the United States but also carry out offensive operations in other countries," he added. "There are a range of responses that are available to the president and he will consider a response that’s proportional."

Again though, the very idea that the United States would be "responding" is fundamentally incorrect. We've been engaged in nation state hacking and election fiddling for decades, happily hacking the planet for almost as long as the internet has existed. We use submarines as underwater hacking platforms, the U.S. government and its laundry list of contractors routinely hacking and fiddling with international elections and destroying reputations when and if it's convenient to our global business interests. Our behavior in 1970s South America giving tech support to Operation Condor is the dictionary definition of villainy.

Yet somehow, once countries began hacking us back, we responded with indignant and hypocritical pouting and hand-wringing. But the reality is we are not some unique, special snowflake on the moral high ground in this equation: we've historically been the bully, and nationalism all too often blinds us to this fact. Long a nation driven to war by the weakest of supporting evidence, hacking presents those in power with a wonderful, nebulous new enemy, useful in justifying awful legislation, increased domestic surveillance authority, and any other bad idea that can be shoe-horned into the "because... cybersecurity" narrative.

And as we're witnessing in great detail, hacking has played a starring role in this nightmarish election, with Donald Trump giving every indication he intends to only ramp up nation state hacking as a core tenet of his idiocracy, and Hillary Clinton lumping Russia, hackers, and WikiLeaks into one giant, amorphous and villainous amoeba to help distract us from what leaked information might actually say about the sorry state of the republic.

We're wandering into extremely dangerous territory here. As we saw with Stuxnet's impact on companies like Chevron, the United States' hacking behavior has had very real, negative repercussions for innocent third parties around the globe. Operating from the belief that we're somehow nobly defending ourselves is a falsehood the media consistently perpetuates, making this kind of dangerous digital saber rattling easier than ever for those in power. The U.S. press and public can no longer afford to be so viciously naive as 2016 stumbles drunkenly to its welcome conclusion and hacking becomes the bogeyman du jour for the next administration.

Filed Under: cybersecurity, escalation, hacking, obama, russia, white house

DHS Inspector General Says Office Has No Idea How New Cybersecurity Act Is Supposed To Be Implemented

from the OIG-to-Congress:-you-made-this-mess,-now-fix-it dept

The reanimated CISA, redubbed The Cybersecurity Act (a.k.a., OmniCISA) and hurried through the legislative process by stapling its 2000 pages to the back of a "must-pass" budget bill, is still in the processes of implementation. Not much is known about what the law is intended to do on the granular level, other than open up private companies to government surveillance so the USA can beat back "the cyber."

Surveillance aficionados were quick to lean on private companies to start sharing information, but the government needs to be taught new tricks as well. There's plenty of info siloing at the federal level, which keeps the DHS, FBI, and others involved in the cyberwar from effectively communicating, much less sharing anything interesting they might have had forwarded to them by the private sector.

The federal government has been less than successful in securing its own information -- something CISA was also supposed to fix. The DHS's Inspector General has performed a follow-up investigation on the department's implementation of CISA's requirements. For the most part, things seem to be moving forward, albeit in a vague, undefined direction.

The OIG notes that the DHS has put together policies and procedures and, amazingly, actually implemented some of them. Better still, it has moved many critical account holders to multi-factor authorization. Unfortunately, the DHS still has a number of standalone systems that can't handle multi-factor authorization, which will make them more vulnerable to being breached.

That's pretty much the end of the good news. There are still holes in the DHS's data systems at a very critical juncture. From the report [PDF]:

Although the Department has established software inventory policies, not all DHS components used data exfiltration protection capabilities to support data loss prevention, forensics and visibility, and digital rights management. Further, the Department had not developed policies and procedures to ensure that contractors implement data protection solutions.

Then there's this part of the report, which shows that no one truly understands the 2000-page law -- not even the DHS's first level of oversight, which can't even tell what the agency is supposed to be doing to comply with the new law. (h/t Eric Geller)

DHS and its Components can benefit from additional data protection capabilities and policy to help ensure sensitive PII and classified information are secure from unauthorized access, use, and disclosure. We are submitting this report for informational purposes to the appropriate Congressional oversight committees, as required by the Act. Due to a lack of specific criteria, this report contains no recommendations.

This explains why the report is so short: the OIG doesn't have anything to work with. Two thousand pages and yet the Cybersecurity Act's demands and goals remain so vague that all the Inspector General can do is take a cursory look at the DHS's security protocols and see if they've improved. Beyond that, the DHS and its Inspector General have no specifics to guide them and no firm goals to reach. So, the Inspector General's office is doing the only thing it can do: kick the problem over to the legislators who created it.

This is already quite the problem considering the DHS is flying blind with achieving its internal directives. What makes matters worse is the DHS is a clearinghouse for the information and data obtained from private companies -- like ISP monitoring of user activity for "cybersecurity purposes" -- and is in charge of determining whether or not any personally-identifiable information needs to "scrubbed" before it is passed on to other government agencies.

If it doesn't have enough guidance to determine what direction it should be going in securing its own systems, it presumably has far less when it comes to the handling of private sector information. Those privacy protections were stripped during CISA's swift push through Congress and replaced with a DOJ judgment call on whether or not the DHS has performed an adequate scrub before handing over data to the FBI, NSA, et al. "Lack of specific criteria" pretty much defines the government's approach to domestic surveillance -- which is enabled by this law: grab it all now; figure it out later.

Filed Under: cisa, cispa, cybersecurity, cybersecurity act, dhs

US Gov't Officially Accuses Russia Of Hacking... Question Is What Happens Next

from the this-is-unlikely-to-end-well dept

It's been quite a crazy Friday, and in the midst of it all, the US government finally came out with an official accusation that Russia is behind various hack attacks concerning the US election:

The U.S. Intelligence Community (USIC) is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations. The recent disclosures of alleged hacked e-mails on sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent with the methods and motivations of Russian-directed efforts. These thefts and disclosures are intended to interfere with the US election process. Such activity is not new to Moscow—the Russians have used similar tactics and techniques across Europe and Eurasia, for example, to influence public opinion there. We believe, based on the scope and sensitivity of these efforts, that only Russia's senior-most officials could have authorized these activities.

The same report says that they don't (yet) have enough information to also accuse Russia of the recent hacks on state election computers:

Some states have also recently seen scanning and probing of their election-related systems, which in most cases originated from servers operated by a Russian company. However, we are not now in a position to attribute this activity to the Russian Government.

But they also stick with the party line that actually hacking the election would be difficult:

The USIC and the Department of Homeland Security (DHS) assess that it would be extremely difficult for someone, including a nation-state actor, to alter actual ballot counts or election results by cyber attack or intrusion. This assessment is based on the decentralized nature of our election system in this country and the number of protections state and local election officials have in place. States ensure that voting machines are not connected to the Internet, and there are numerous checks and balances as well as extensive oversight at multiple levels built into our election process.

Of course, people have been pointing the finger at Russia over these hacks for a while, and according to various reports there's been widespread debate within the Obama administration about making a public accusation. There are two main issues here:

1. Attribution for computer attacks is really really difficult. No one knows for sure, and there are ways to spoof where attacks come from. There does appear to be quite a lot of evidence pointing back at Russia for these hacks, so it does seem like a safe bet. But that doesn't mean it's definitely them. It would be nice if people gave actual confidence values when they make statements like these, but no one in politics ever does that these days.
2. The much bigger question is what comes next. There are political benefits and costs to naming Russia. But the big thing here is that by naming Russia, it gives the US government more leeway to do something in response. And, as we warned many months ago, this is a horrifically bad idea. It will only escalate matters and make things worse overall.

As I noted just the other day, cybersecurity should be a defensive game. Going offensive is really, really dangerous, because things will get worse, and we really don't know what the capabilities of the other side(s) truly are. Focus on protecting critical infrastructure, not on some meaingless symbolic strike back.

But, of course, in this day and age, people seem to feel that every action requires some sort of reaction, and in a computer security realm, that's just stupid. But it seems to be where we're inevitably heading. The cybersecurity firms will get wonderfully rich off of this. But almost everyone will be less safe as a result.

Filed Under: cybersecurity, cyberwar, dhs, hacking, nsa, russia

Trump Joins Clinton In Pushing For Cyberwar

from the well,-that's-just-great dept

We've noted a few times in the past our serious concerns about Hillary Clinton's hawkish and tone deaf views on cybersecurity, in which she wants the US to go on the offensive on cyberattacking, even being willing to respond to attacks with real world military responses. She seems to ignore the fact that the US has a history of being some of the most aggressive players on offense on such things (Stuxnet, anyone?), and doesn't seem to recognize how escalating such situations may not end well at all.

Of course, her opponent, Donald Trump has been totally incomprehensible on cybersecurity during the course of his campaign. There was his first attempt to respond to questions about cybersecurity in which it's not clear he understood the question, and started talking about nuclear weapons instead. Or the time he took a question on cybersecurity and answered by talking about the latest CNN poll. Or, of course, who can forget his debate performance on the topic, where his key insights were that his 10 year old was good with computers and a 400 lb. hacker may be responsible for the DNC hacks.

It appears that the Trump campaign finally decided that maybe Trump should say something marginally coherent on the subject, and sent him out earlier this week with a prepared teleprompter speech, which Trump actually managed to get through without going too far off script. And... it's basically the same kind of bullshit as Clinton -- pushing for more aggressive and offensive cyberattacks.

“I will also ask my secretary of Defense and joint chiefs to present recommendations for strengthening and augmenting our Cyber Command,” Trump said of his cybersecurity plan. “As a deterrent against attacks on our critical resources, the United States must possess, and has to, the unquestioned capacity to launch crippling cyber counterattacks, and I mean crippling. Crippling. This is the warfare of the future. America’s dominance in this area must be unquestioned, and today it’s totally questioned.”

There was also the kind of hilarious claim that the government has not made cybersecurity issues a priority, which is laughable if you've been paying attention to, well, anything in the "cybersecurity" policy space over the past few years. You could say that their priorities within that realm are screwed up. Or that the government seems to mainly use "cybersecurity" as a cloak to hide NSA surveillance efforts. But to argue that it's not been a priority is clearly false.

And, really, having our own side launching "crippling" cyberattacks (as with Clinton's plan) doesn't seem like the most effective plan. These kinds of things only escalate. Being an aggressor here seems particularly shortsighted. Taking out, say, China's internet, may show strength, but for what purpose? Will it really stop Chinese computer attacks on US infrastructure? Doubtful. Cybersecurity is mostly a defensive game, and it should remain that way. Encrypt everything possible. Disconnect critical infrastructure from the wider network wherever possible, and do everything to stop attackers from getting in, taking down, or mucking with systems.

This hawkish talk about offensive attacks in response to inbound online attacks is probably poll-tested to sound good as "being tough," but it's really stupid actual policy.

Filed Under: computer security, cyberattack, cybersecurity, cyberwar, donald trump, hillary clinton, offensive

Trump Offers More Insight On His Cybersecurity Plans: 10-Year-Old Relatives Vs. 400-lb Bedroom Dwellers

from the every-debate-response-basically-a-banned-forum-user's-posts dept

Smile, constituents: this man may become president.

Look at the mess that we're in. Look at the mess that we're in. As far as the cyber, I agree to parts of what secretary Clinton said, we should be better than anybody else, and perhaps we're not. I don't know if we know it was Russia who broke into the DNC.

She's saying Russia, Russia, Russia. Maybe it was. It could also be China, it could be someone sitting on their bed that weighs 400 pounds...

Look, anyone who refers to cybersecurity or cyberwarfare as "the cyber" is probably better off not discussing this. But Donald Trump, in last night's debate, felt compelled to further prove why he's in no position to be offering guidance on technological issues. And anyone who feels compelled to portray hackers as 400-lb bedroom dwellers probably shouldn't be opening their mouth in public at all.

With this mindset, discussions about what "the Google" and "the Facebook" are doing about trimming back ISIS's social media presence can't be far behind. Trump did note that ISIS is "beating us at our game" when it comes to utilizing social media. Fair enough.

But Trump's cybersecurity "plan" isn't actually a plan. What there is of it has to be compiled from a string of random, semi-related sentences. Apparently, the next cyberwar will pit tweens against 400-lb Russians...

I have a son. He's 10 years old. He has computers. He is so good with these computers, it's unbelievable. The security aspect of cyber is very, very tough. And maybe it's hardly do-able. But I will say, we are not doing the job we should be doing, but that's true throughout our whole governmental society. We have so many things that we have to do better, Lester and certainly cyber is one of them.

The problem isn't so much that Trump plainly has no idea what he's talking about or even the coherency to bluff his way through it. No one expects presidential candidates to be experts on every possible issue that might come up. But this has been the government's primary focus in recent years, and multiple high-profile hackings have only intensified that.

The problem is that Trump clearly has no interest in discussing these issues with those who can offer coherent, possibly-useful cybersecurity strategies. The more he speaks, the more he exposes his ignorance. Ignorance isn't unfixable. But Trump has done nothing over the past several months to close these (often significant) gaps in his knowledge. That's the scariest aspect of his presidential run -- the unwillingness to handle the boring but essential work of creating a platform composed of something more than half-formed thoughts and severely misguided jingoism that blames the rest of the world for somehow making America a worse country.

The mitigating factors are these:

Hillary Clinton's response may have been more coherent but hers suggests we should probably engage in more actual war than cyberwar to handle ISIS -- something's that gone oh so well for the past couple of decades. And she was ready to declare cyberwar on Russia after the DNC hacking, an idea that's not only stupid (seeing as the entity behind the hacking is still unknown) but an indication she'd be willing to wield government power to avenge embarassment.

Trump's power in office is likely to be far less than he obviously envisions it. Trump may be a rather extreme form of populist but those popular votes will be about as useful as Facebook likes when it comes to attempts to push his agenda past far more level-headed advisors and legislators.

Either way, voters are faced with choosing between the devil they sort of know and the devil other devils have been distancing themselves from for several weeks. In both cases, we're going to end up with a president who doesn't have the technical knowledge to deal with today's realities.

Filed Under: cybersecurity, debate, donald trump, election, hillary clinton, politics

DHS Offers Its Unsolicited 'Help' In Securing The Internet Of Things

from the STANDING-BY-TO-TAKE-CREDIT-FOR-ACTIONS-OF-OTHERS dept

It's generally agreed that the state of security for the Internet of Things runs from "abysmal" to "compromised during unboxing." The government -- despite no one asking it to -- is offering to help out… somehow. DHS Assistant Secretary for Cyber Policy Robert Silvers spoke at the Internet of Things forum, offering up a pile of words that indicates Silvers is pretty cool with the "cyber" part of his title... but not all that strong on the "policy" part.

The industry, according to Silvers, is demanding that IoT security is tackled "from a DHS perspective," meaning a focus on public safety. And then he damned other government departments' efforts with faint praise.

"This is complex stuff, but it's not going to be regulatory or over prescriptive, it's not even going to be highly technical," he argued. "What we're going to be doing is drawing on the best approaches, pulling them together and elevating them to get the public's attention."

Shorter DHS: we're going to take what the private sector and other government agencies have accomplished, print it out on a few pages of DHS letterhead, and call it good. All Silvers is promising is the DHS's insertion into a crowded marketplace of vague ideas, many of them coming from other government agencies.

Even better, Silvers claimed the DHS's intrusion into this overcrowded space won't be "regulatory." This statement arrived shortly before Silvers suggested regulation was on its way.

“We have a small and closing window of time to take decisive and effective action,” Silvers said, “the challenge of addressing IoT security is outweighed only by the greater challenge of patching, or building on the security of already deployed systems. While some of this may sound like common sense, it’s an undeniable fact that some companies are not being held accountable,” Silvers said.

"Companies not being held accountable" sounds like the sort of thing the government would feel compelled to fix with regulation. As Kieran McCarthy of The Register points out, the DHS seems mostly concerned with ensuring it's cut in on the cybersecurity action.

The DHS's current plan seems to be little more than shoving their foot in the door: Silvers could not give a timetable for the principles, or even a consultation plan. He didn't highlight specific areas of concern, or point to the direction the DHS is expected to take.

Perpetually-increasing budgets are on the line here. Every agency wants a piece of the "cyber" pie, whether on the offensive or defensive side. The DHS is no different, even though its track record on cybersecurity is mostly terrible. (Its track record on "homeland" security isn't that fantastic either…) Its Election Cybersecurity task force is composed of state politicians, rather than security experts. And the Government Accountability Office has previously noted the DHS has no plans in place to protect government buildings from cyberattacks on access and control points -- despite having had nearly 15 years to do so.

In front of a group of professionals actually putting together best practices for the Internet of Things, the DHS has announced its willingness to coattail-ride its way into the cybersecurity future -- one promising to be full of government intrusion and steady paychecks. And, like others in the government who feel the government should do nothing more than make demands of the private sector, Silvers encouraged the forum attendees to "nerd harder." Or, at least, faster.

Silvers issued a call of action to attendees, urging them to “accelerate everything” they’re working on and tackle issues that pop up in cybersecurity in real time.

Thanks, bossman. There's nothing security professionals like more than being told how to do their jobs by government agencies without coherent future plans or the ability to secure anything more than a pension.

Filed Under: cybersecurity, dhs, iot, security

If Someone Is Testing Ways To Take Down The Internet, Perhaps It's Time To Build A Stronger Internet

from the let's-get-it-done dept

There's been a lot of buzz over respected computer security expert Bruce Schneier recently talking about how someone, or some organization, or (most likely) some state actor, is running a series of tests that appear to be probing for ways to take down the entire internet. Basically, a bunch of critical infrastructure providers have noticed some interesting attacks on their systems that look like they're probing to determine defenses.

Recently, some of the major companies that provide the basic infrastructure that makes the Internet work have seen an increase in DDoS attacks against them. Moreover, they have seen a certain profile of attacks. These attacks are significantly larger than the ones they're used to seeing. They last longer. They're more sophisticated. And they look like probing. One week, the attack would start at a particular level of attack and slowly ramp up before stopping. The next week, it would start at that higher point and continue. And so on, along those lines, as if the attacker were looking for the exact point of failure.

The attacks are also configured in such a way as to see what the company's total defenses are. There are many different ways to launch a DDoS attacks. The more attack vectors you employ simultaneously, the more different defenses the defender has to counter with. These companies are seeing more attacks using three or four different vectors. This means that the companies have to use everything they've got to defend themselves. They can't hold anything back. They're forced to demonstrate their defense capabilities for the attacker.

This article is getting a collective "oh, shit, that's bad" kind of reaction from many online -- and that's about right. But, shouldn't it also be something of a call to action to build a better system? In many ways, it's still incredible that the internet actually works. There are still elements that feel held together by duct tape and handshake agreements. And while it's been surprisingly resilient, that doesn't mean that it needs to remain that way.

Schneier notes that there's "nothing, really" that can be done about these tests -- and that's true in the short term. But it seems, to me, like it should be setting off alarm bells for people to rethink how the internet is built -- and to make things even more distributed and less subject to attacks on "critical infrastructure." People talk about how the internet was originally supposed to be designed to withstand a nuclear attack and keep working. But, the reality has always been that there are a few choke points. Seems like now would be a good time to start fixing things so that the choke points are no longer so critical.

Filed Under: attack, bruce schneier, cybersecurity, internet, vulnerabilities

Pressure Mounts to Punish Russia For Hacking Without Evidence And Before Investigations Are Concluded

from the evidence-is-for-sissies dept

While it's certainly possible Russia has been busy using hackers to meddle in (or at least stoke the idiot pyres burning beneath) the U.S. elections, we've noted how actual evidence of this is hard to come by. At the moment, most of this evidence consists of either comments by anonymous government officials, or murky proclamations from security firms that have everything to gain financially from stoking cybersecurity tensions. Of course, transparent evidence is hard to come by when talking about hackers capable of false flag operations while obfuscating their footprints completely.

Granted that hasn't stopped people from demanding a cyber or real world attack on Russia, both idiotic ideas for what should be obvious reasons. But with no hard evidence forthcoming, those looking for perceived justice are apparently getting a little punchy. The Washington Post notes that the government continues to conduct an investigation into the DNC hacks, but the whole "obtaining actual evidence before doing anything stupid" thing is clearly frustrating the 1980's action movie sect of the intelligence community:

"The White House’s and some Cabinet officials’ insistence on awaiting the probe’s results has frustrated some officials at the FBI, the Justice Department and within the intelligence community, who favor holding Moscow accountable. The White House’s continued requests for more evidence, said one official, is “to delay — purposely delay” a public attribution."

Again, it's not like you're going to find a goddamned memo linking Russia to the DNC hacks, and any hacker worth his or her salt isn't going to leave evidence of the hack or their ties to a nation state. There's also the ongoing reality that the leading country when it comes to nation state hacking has generally been the United States, making any vocal moral repudiation kind of laughable. Still, that doesn't seem to be stopping folks like Senator Ben Sasse, who insists that we should just skip the whole actual evidence thing and proceed to lambasting Russia for doing what the United States has done for decades:

"Sen. Ben Sasse (R-Neb.), a member of the Homeland Security committee, said President Obama should publicly name Russia and do so before the November election. A failure to do so will only encourage further cyber intrusions and meddling in the U.S. election, he said.

“If the Obama administration has a reason for not clearly attributing these hacks to Russia, it contradicts their own cyber strategy,” Sasse said. “If they’re silent because it would invite response, that suggests that we’re operating from a position of weakness — in other words, we know that we need to aggressively deter cyberattacks, but we are too vulnerable to do it. Neither scenario is reassuring."

But again, what good is publicly shaming Russia for hacking when you've spent decades doing the same thing -- or worse? The only net outcome is you wind up looking like a giant, blithering hypocrite to the global community. The entire article stumbles on like this, quoting various officials on and off the record demanding we do everything from impose sanctions to start leaking Putin's dirty laundry:

"The National Security Agency, for instance, could disrupt a Russian computer system in a way that leaves no doubt who did it and that warns the Russians “to knock it off,” one former intelligence official said. Or the CIA could leak documents that are embarrassing in some way to Russian President Vladi­mir Putin."

Attack! Attack! Who needs evidence? Who needs the moral high ground? Generally, the press-driven public dialogue on cybersecurity and intelligence is so far from what's actually happening in the wild (as intelligence whistleblowers illustrate every few years) that one really should treat press reports on the subject as creative fiction. Combine that with the way nationalism leads to hypocrisy and the fact that most of these "former intelligence officials" don't even know what a gigabyte is, and you've got a recipe for keystone-cops-esque high comedy.

Again, none of this is to suggest that Russia isn't hacking the United States. But to ignore that all nation states are hacking each other all the time is myopic, and suggesting the DNC attack constitutes some rare breach of international ethics is hysterically naive given what we know about the States' own hacking attacks. The real danger here remains the threat of false flag hacking attacks and misinformation campaigns designed to prompt countries to dramatic action without substantive proof. The smarter path is to focus this energy on securing, upgrading and patching government systems to protect against intrusion, even though that's certainly a lot less fun than starting a new world war just because you think hard evidence is for sissies.

Filed Under: cybersecurity, dod, doj, hacking, politics, response, russia, us government