Feeds

Foreign intelligence agencies are biggest online threat, ex-Fed warns

Pot, meet the kettle of color – allegedly

High performance access to file storage

Black Hat 2012 Former FBI executive assistant director Shawn Henry has warned that the biggest threat online comes not from terrorists or hackers, but from foreign intelligence organizations looking to steal intellectual property.

"The threat from computer attack is the most significant threat we face as a society, other than a weapon of mass destruction," he said in his opening keynote at the Black Hat 2012 conference in Las Vegas. "Everything we do – R&D, intellectual property, and corporate strategies – is stored or transmitted electronically. The DNA of companies is available to bad guys."

Henry said that the FBI had seen cases where a company had lost a billion dollars of intellectual property in a weekend. Other companies were facing a stacked deck in trade negotiations, he said, because all too often their opposite numbers know what their negotiating positions will be.

Some might say this is a case of the pot calling the kettle black. It has been over a decade since the first complaints from the EU that the ECHELON eavesdropping system was being used to spy on competitors of US corporations – but when El Reg raised this, Henry denied that the US had ever carried out such spying.

Shawn Henry

Spies like us play nice, Henry asserts

This may be true now, but it was not always so, said Marcus Ranum, a Black Hat alumnus and faculty member of the Institute for Applied Network Security.

"Our entire industrial revolution was based on stolen European technology," said Ranum. "We're complaining now we are on top, but it's buyer's remorse. There are a lot of corporations who exposed far too much information online, and rather than fixing the problem, let's blame the Chinese."

The answer to the cybersecurity conundrum, Ranum opined, was to get a lot more proactive against threats by sharing information between the government and the private sector. There are a number of bills being considered by Congress to make this easier, and he acknowledged that in the past this had been too much of a one way street, with the government taking in information but not sharing it.

A proactive response doesn't mean the NSA hacking the hackers, he said, but instead taking an attitude to building defensive systems so that if and when a breach occurs, the attackers either don't get the information they are after, or they get wrong information.

"There's denial and deception, corrupt packets and misinformation, so that when you sit down at negotiation they have the wrong answers to the test," Henry explained. "You can cause them pain if they've spent four months and two zero-day attacks to get on there and then find they have the wrong missile and it doesn't even work."

Rather than basing CSO and CIO bonuses on stopping breaches in the network, companies should aim to find out about a breach quickly after they happen, he said. A secure perimeter is impossible; instead, we need to work on mitigation, and that would take the active support of Black Hat delegates.

While the industry has woken up to this threat in the last few years, there were still not enough people taking it seriously, Henry said, adding that it will take a serious physical attack launched online to put it to the top of the agenda. The intelligence community had heard of Osama bin Laden for years, but it wasn't until the world watched the planes hitting the buildings that the threat was taken seriously. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.