Cyberthreats Grow More Ominous: Former NSA Chief

Microsofts Craig Mundie, former NSA and CIA chief Gen. Michael Hayden and other experts say cybersecurity attacks are getting more dangerous.

The nature of cybersecurity attacks is becoming more dangerous and the threats on business and government more disturbing, a group of IT and cybersecurity experts said at a Cybersecurity Summit, held by the
Washington Post
Oct. 3.
I think that people need to understand that in the last 12 months theres been a qualitative change, said Craig Mundie, senior adviser to the CEO at Microsoft. The threats are moving to destructive attacks. Unlike conventional weapons, every time someone shoots one of these weapons, the bad guys get to watch it, then clone it.
Gen. Michael Hayden, former director of both the National Security Agency and the CIA, told attendees that U.S. computer networks -- not just government systems, but corporate systems and ordinary citizens computers -- face layers of threats. While concerns about systematic penetration by nation states such as China, India and Russia are well recognized, that threat primarily is of intellectual property theft.
We steal stuff, I admit that, he said of U.S. intelligence community efforts, but we do it to protect citizens, not to get rich.
[ For more info on protecting your systems, see
Dont Let Spooks Get Your Cloud Data
. ]
More concerning are the emerging threats that want to damage systems, such as the cyber attack against the Saudi Arabian national gas company
Aramco
. Hayden pointed out that about 35,000 hard drives were wiped clean in that attack.
The emerging new groups of attackers act on a wide range of motives. They are just mad, mad at the world. Blessedly, they are the least capable right now, Hayden said, but they may acquire capabilities comparable to nation states and criminals.
Ellen Richey, chief enterprise risk officer for Visa, the global credit card company, said her industry loses about $10 billion every year to theft and fraud. While the industry actively works to strengthen its security measures, law enforcement around the world has not adapted to the new Internet environment.
We know who some of these big players are, and they are specifically attacking American and western European companies, Richey said. If someone came and bombed my data center, I presume the government would protect me, but if an enemy country sent hackers to attack me, the company is on its own.
The rules of cyber warfare are evolving slowly as governments and companies around the world work to address these threats, but the concept of self-defense does not apply.
Its illegal to chase bad guys up the wire, even if you have the capability to do so -- its illegal to shoot back, Mundie said. There is no self-defense argument a company can make. These legal limits, and other constraints, make for uneasy relations between government agencies tasked with cybersecurity and the industries that get targeted by hackers.
For instance, Howard Schmidt, former White House cybersecurity coordinator, said, If you go to small co-ops that provide electric power ... the government almost becomes an enemy because these utilities have done a lot and theyre not being recognized. There is a maturity model for the energy sector ... but to constantly say the private sector has failed, makes it very difficult to have a dialogue.
Rather than simply lamenting the state of affairs, the panelists suggested repeatedly that good computer hygiene -- firewalls, prompt software upgrades and patch management, two-factor identification, limiting administrative permissions, and other fundamentals of cybersecurity -- would address 80% of the threats faced by computer users and networks, whether in the public or private sector. This would allow cyber resources to be dedicated to the all-important 20% of threats, from new zero-day exploits to threats against critical infrastructure such as the electrical grid.
To that end, Jane Lute, former deputy secretary at the Department of Homeland Security and now president and CEO of the Council on Cyber Security, said her organization is going to convene the first meeting of law enforcement officials from around the world to discuss cybersecurity and threats.
Can we prioritize cyber intrusions ... as a diplomatic priority? she said. Quite frankly, the business sector has been slow off the mark. They need to be incentivized. Good business practice isnt an incentive, the protection of peoples privacy isnt an incentive.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Cyberthreats Grow More Ominous: Former NSA Chief