Recent News articles detailing the NSA surveillance monitoring has shown to extend to other countries and that of their high-level officials. A more recent article states the following:
“The U.S. monitored the phone conversations of 35 world leaders, according to a National Security Agency document provided by its former contractor, Edward Snowden, according to The Guardian newspaper.”
Although most people cannot communicate using secure phone calls, it does raise the importance that the data be what is secured, not just the mode of transport. A phone call or even Internet usage should not be considered secure. There are numerous hops and intermediary systems that connect the signal being used. Each of those points of connection are a potential point of surveillance. Add the additional discoveries regarding ATT, Verizon, and other carriers, the expectation of privacy should no longer be expected.
This means that only the data, if encrypted or secured, provides the potential expectation of privacy. Insuring securing data at rest and during transport is critical to insure privacy. It may take more time and resources, but in an age of “continuous monitoring” of everything, it is the best way to provide the assurance most people and businesses desire.
GCN published an article on June 3, 2013 regarding the possible data breach of Customs and Border Protection (CBP) systems operated by third-parties for clearances. The information used to obtain clearances is not only personal identifiable information (PII), but also re-tells the past ten or more years of history of an individual. So the potential compromise of this information is a serious issue.
Now add the recent scandals regarding surveillance by the NSA and other government agencies adds to the concern. This is more than a privacy issue, but one of the capability to maintain data secure. DHS is meant to provide the “cybersecurity” component of the government in conjunction with the DoD, but if DHS and the DoD have issues with maintaining the security of their respective systems, what will the potential breach be with the new surveillance information. While granted, the information of the phone calls from the various telecoms is currently not maintaining the call content itself, the associated metadata could expose even greater risk to individuals than is being expressed. Most phones maintain GPS and cell tower information with a call. Add the additional cell phone number and owner information, it is now possible to track the patterns of the individual in addition to the various calls.
While the potential privacy issues around surveillance has its place, the ability for the government to protect the data is also equally important.
There has been a lot of news recently about the potential for the coming Cyber Pearl Harbor. A cyber attack that would mirror the devastation that hit the naval base in Pearl Harbor during the beginning of WWII. According to an article in CSO Magazine on October 18, 2012, the United States is concerned of a coming cyber attack. The concept of comparing the attack to Pearl Harbor has been around for several years. It wasn’t until a recent a speech by U.S. Secretary of Defense Leon Penetta in New York that this has become more of a topic.
The article states the following:
The results of cyberttacks by a hostile nation-state on critical infrastructure like transportation, water supply or the electric grid “could be a cyber Pearl Harbor — an attack that would cause physical destruction and the loss of life,” Panetta said. “In fact, it would paralyze and shock the nation and create a new, profound sense of vulnerability.”
Panetta also invoked the image of a cyberattack on the level of 9/11. “Before September 11, 2001, the warning signs were there. We weren’t organized. We weren’t ready and we suffered terribly for that lack of attention. We cannot let that happen again. This is a pre-9/11 moment,” he said.
In a follow-up article in CSO Magazine November 7th, the opposing viewpoint was brought forth. Many in the security industry feel that the concept and description of a Cyber Pearl Harbor is nothing more than hot air. Experts including Bruce Schneier have chimed in. Bruce has reduced the extent to which he believes the concept to be exaggerated but according to he article:
Critics argue argue that not only is the threat of a catastrophic cyberattack greatly exaggerated, but that the best way to guard against the multiple risks they agree exist is not with better firewalls or offensive strikes against potential attacks, but to “build security in” to the control systems that run the nation’s critical infrastructure.
Bruce Schneier, author, Chief Technology Security Officer at BT and frequently described as a security “guru,” has not backed off of his contention made at a debate two years ago that the cyber war threat “has been greatly exaggerated.” He said that while a major attack would be disruptive, it would not even be close to an existential threat to the U.S.
“This [damage] is at the margins,” he said, adding that even using the term “war” is just a, “neat way of phrasing it to get people’s attention. The threats and vulnerabilities are real, but they are not war threats.”
The reality is that it is probably somewhere in the middle of the two viewpoints. It can be likened to the Y2K issue a little over a decade ago. The world was going to come to an end and the dark ages would re-emerge. The reality was that preparation help minimize what little impact there may have been. Security is a risk decision, but most risk decisions are defensive in nature. The other decision of a preemptive cyber capability is another aspect of the decision-making that needs to be addressed. Should the U.S. begin cyber strikes on perceived threats? What is the impact of doing this on the long-term? The world has already seen a small view of what can be done with Stuxtnet and will these type of state-sponsored cyber attacks the new nuclear deterrent…that is yet to be seen.
Regardless of the direction that gets taken, business needs to look at potential cyber attacks/hacks as a real potential threat and determine what risk is willing to be accepted and what will need to be mitigated. Whether the issue is the size of a country or your home computer, measure twice, cut once is still the best direction.
Many may have heard of the ongoing dispute between England and the United States about the pending extradition of British hacker Gary McKinnon. Well the wait is over, the British Home Secretary Theresa May in an announcement yesterday before Parliament stated that she would block the extradition of Gary McKinnon. She based her decision on the several medical examinations and his Asperger’s Syndrome diagnosis. He has been charged by the United Stated for hacking into highly classified Pentagon computer systems, for what McKinnon alleges in search of proof of extraterrestrial evidence. USAToday.com has a good article on the coverage.
According to the article:
Officials in Washington expressed disappointment at the outcome, and State Department spokeswoman Victoria Nuland said the decision meant McKinnon would not “face long overdue justice in the United States.”
British prosecutors will now decide if he should face charges in the U.K.
There has also been discussion that England will also renegotiate the extradition treaty to make it harder for British citizens to be extradited to the United States.
In an article in Dark Reading, they discuss a recent study that shows the costs of cybercrime are reduced through intelligence, which included monitoring. The study by the Ponemon Institute was a survey tallying the cost of cybercrime. The study surveyed 56 companies and these companies lost on average, $8.9 million due to cyberattacks each year. Based on the survey, companies that detected attacks slowly incurred greater costs. In the 2012 survey, that is to say the companies needed 24 days, on average, to resolve a cyberattack, which in turn created a hefty bill of more than $590,000 per incident — 42 percent more than the previous year.
While many businesses see information technology and especially information security as a cost center, there has always been a hard sell when it comes to proving or showing that the security controls, including network and security monitoring, help in saving money. Most of this is because of the usual hefty price tag that occurs with the implementation and ongoing maintenance of these systems.
According to the article and study:
“Some organizations seem to experience a lower cost, but not a zero cost, if they do certain things,” says Larry Ponemon, chairman and founder of the survey firm. Security intelligence “is really important and helpful — not only in the detection of the cybercrime — but in the containment and ultimately remediation of the crime.”
Companies that had deployed security information and event management systems or intrusion detection systems had, on average, $1.7 million less in cybercrime costs, according to the Ponemon survey. Companies that had implemented access and identity management tools saved $1.6 million, and the deployment of tools to help with governance, regulation, and compliance trimmed $1.5 million.
It is easy to understand that technologies for monitoring and gaining intelligence on threats, “security intelligence” within the report, correlated the most with a reduction in cybercrime costs. As mentioned above, while the costs were not reduced to zero, the reduction provides a good basis for the implementation or continuation of these functions within business.
An article in the Wall Street Journal Blog discusses 20 ways that an individual is under surveillance during the normal day-to-day hustle and bussle. When looking at the article, most people will not realize the extent to which they are monitored and the economics around it.
Whether it is the GPS device in the car, the street cameras, or facebook, the ability to monitor and track an individual is becoming more common. In addition, it is a major money maker for those doing the tracking…