Category Archives: White House

Cyber Pearl Harbor or Just Cyber Space…

There has been a lot of news recently about the potential for the coming Cyber Pearl Harbor. A cyber attack that would mirror the devastation that hit the naval base in Pearl Harbor during the beginning of WWII. According to an article in CSO Magazine on October 18, 2012, the United States is concerned of a coming cyber attack. The concept of comparing the attack to Pearl Harbor has been around for several years. It wasn’t until a recent a speech by U.S. Secretary of Defense Leon Penetta in New York that this has become more of a topic.

The article states the following:

The results of cyberttacks by a hostile nation-state on critical infrastructure like transportation, water supply or the electric grid “could be a cyber Pearl Harbor — an attack that would cause physical destruction and the loss of life,” Panetta said. “In fact, it would paralyze and shock the nation and create a new, profound sense of vulnerability.”

Panetta also invoked the image of a cyberattack on the level of 9/11. “Before September 11, 2001, the warning signs were there. We weren’t organized. We weren’t ready and we suffered terribly for that lack of attention. We cannot let that happen again. This is a pre-9/11 moment,” he said.

In a follow-up article in CSO Magazine November 7th, the opposing viewpoint was brought forth. Many in the security industry feel that the concept and description of a Cyber Pearl Harbor is nothing more than hot air. Experts including Bruce Schneier have chimed in. Bruce has reduced the extent to which he believes the concept to be exaggerated but according to he article:

Critics argue argue that not only is the threat of a catastrophic cyberattack greatly exaggerated, but that the best way to guard against the multiple risks they agree exist is not with better firewalls or offensive strikes against potential attacks, but to “build security in” to the control systems that run the nation’s critical infrastructure.

Bruce Schneier, author, Chief Technology Security Officer at BT and frequently described as a security “guru,” has not backed off of his contention made at a debate two years ago that the cyber war threat “has been greatly exaggerated.” He said that while a major attack would be disruptive, it would not even be close to an existential threat to the U.S.

“This [damage] is at the margins,” he said, adding that even using the term “war” is just a, “neat way of phrasing it to get people’s attention. The threats and vulnerabilities are real, but they are not war threats.”

The reality is that it is probably somewhere in the middle of the two viewpoints. It can be likened to the Y2K issue a little over a decade ago. The world was going to come to an end and the dark ages would re-emerge. The reality was that preparation help minimize what little impact there may have been. Security is a risk decision, but most risk decisions are defensive in nature. The other decision of a preemptive cyber capability is another aspect of the decision-making that needs to be addressed. Should the U.S. begin cyber strikes on perceived threats? What is the impact of doing this on the long-term? The world has already seen a small view of what can be done with Stuxtnet and will these type of state-sponsored cyber attacks the new nuclear deterrent…that is yet to be seen.

Regardless of the direction that gets taken, business needs to look at potential cyber attacks/hacks as a real potential threat and determine what risk is willing to be accepted and what will need to be mitigated. Whether the issue is the size of a country or your home computer, measure twice, cut once is still the best direction.

Tagged , , , , , , , , , , , , , , ,

More on Cyber Security Executive Order…

Dark Reading published an article on October 9 about the pending Executive Order on cyber security and what it will mean to an enterprise. As mentioned in a previous post, the executive order is the Obama administration’s response to the fact that Congress did not pass cybersecurity legislation, specifically the Cybersecurity Act of 2012.

Now while the Executive Order would be focused on national critical infrastructure, the article brings up some good points about what impacts and insights this could have on a business. The article noted that the Executive Order would not deal with one of the key points of the act, the sharing of information between government agencies. According to the article:

The issuance of an executive order would not address one of the key elements of the Cybersecurity Act of 2012 – information sharing between the private sector and government. According to former NSA Deputy Training Director Cedric Leighton, information-sharing has to span both sharing between the government and private sector as well as between entities in the private sector itself.

A key point about what businesses are looking for is stated in the article…more specifically three key items:

Rather than checklists, organizations are looking for three distinct things: the current state of a threat, what others are doing about security, and what are the guiding principles that should be considered when developing a security program and strategy, Granado argues. Protecting intellectual property means complicating the process of acquiring inappropriate access, detecting threats and neutralizing threats before they expand, he says.

As noted in the article, a purely defensive “knee-jerk” mentality is not enough and a pro-active stance is needed to effectively secure the information assets of the business and in turn improve the overall risk posture. The idea that the minimum is enough is not enough, that will leave business always behind a curve.

Tagged , , , , , , , , , , , , ,

US Cybersecurity Debate Begins… Again…

Do you ever get the feeling that at some point in the morning you should be hearing the Sonny and Cher tune “i’ve Got You Babe” and that you are in Ground hog Day. That we are reliving the same thing over and over again. Well we are again…

We all probably remember the heated debate around the Cybersecurity Act of 2012. Whether political or a security practitioner, everyone had an opinion on one side or another. Well, we will soon begin the debate again, but this tim it will not be in response to a Congressional proposal, but rather an Executive Order (EO). Friday a leaked draft of the EO posted to the techdirt.com website.

According to the proposed draft, the EO is meant to revise the federal architecture for enhanced protection of the critical infrastructure and information sharing or “information exchange framework.” The EO also places the Department of Homeland Security (DHS) as an oversight role for making and implementing the changes. What is not completely understood is the full nature of what is considered “critical infrastructure” and how commercial business will act with regards to another set of US regulatory impacts to their bottom line.

Many in the political scene and in the security industry have been vocal about the need for a defined framework beyond/improving the existing FISMA regulations adhered to by federal agencies. However, there are not as many that would agree that DHS is the federal entity to oversee the implementation. There is even more of a divide when you start discussing how this framework should be applied to private industry.

A recent SC Magazine article quoted concerns from several Republicans about the current EO based on a letter written by John Brennan, the national security advisor to the president. According to the article:

A letter released on Friday written by John Brennan, national security adviser to the president, written to Sen. Jay Rockefeller, chairman of the Senate Commerce Committee, confirms that the White House is working on the order.

“Following congressional inaction, the president is determined to use existing executive branch authorities to protect our nation against cyber threats,” Brennan wrote.

In a recent sponsored Washington Post editorial, Senators John McCain (R-Ariz.), Kay Bailey Hutchinson (R-Texas), and Saxby Chambliss (R-Ga.) blasted the idea of an executive order.

“Unilateral action in the form of government mandates on the private sector creates an adversarial relationship instead of a cooperative one,” the senators wrote.

This is interesting the impact this will have with regards to the impending elections and how security community at large will view this potential mandate. This will definitely (re)develop in the coming weeks…and remember “its going to be a cold one out there…”

 

Tagged , , , , , ,
%d bloggers like this: