Feeds

Foreign intelligence agencies are biggest online threat, ex-Fed warns

Pot, meet the kettle of color – allegedly

Using blade systems to cut costs and sharpen efficiencies

Black Hat 2012 Former FBI executive assistant director Shawn Henry has warned that the biggest threat online comes not from terrorists or hackers, but from foreign intelligence organizations looking to steal intellectual property.

"The threat from computer attack is the most significant threat we face as a society, other than a weapon of mass destruction," he said in his opening keynote at the Black Hat 2012 conference in Las Vegas. "Everything we do – R&D, intellectual property, and corporate strategies – is stored or transmitted electronically. The DNA of companies is available to bad guys."

Henry said that the FBI had seen cases where a company had lost a billion dollars of intellectual property in a weekend. Other companies were facing a stacked deck in trade negotiations, he said, because all too often their opposite numbers know what their negotiating positions will be.

Some might say this is a case of the pot calling the kettle black. It has been over a decade since the first complaints from the EU that the ECHELON eavesdropping system was being used to spy on competitors of US corporations – but when El Reg raised this, Henry denied that the US had ever carried out such spying.

Shawn Henry

Spies like us play nice, Henry asserts

This may be true now, but it was not always so, said Marcus Ranum, a Black Hat alumnus and faculty member of the Institute for Applied Network Security.

"Our entire industrial revolution was based on stolen European technology," said Ranum. "We're complaining now we are on top, but it's buyer's remorse. There are a lot of corporations who exposed far too much information online, and rather than fixing the problem, let's blame the Chinese."

The answer to the cybersecurity conundrum, Ranum opined, was to get a lot more proactive against threats by sharing information between the government and the private sector. There are a number of bills being considered by Congress to make this easier, and he acknowledged that in the past this had been too much of a one way street, with the government taking in information but not sharing it.

A proactive response doesn't mean the NSA hacking the hackers, he said, but instead taking an attitude to building defensive systems so that if and when a breach occurs, the attackers either don't get the information they are after, or they get wrong information.

"There's denial and deception, corrupt packets and misinformation, so that when you sit down at negotiation they have the wrong answers to the test," Henry explained. "You can cause them pain if they've spent four months and two zero-day attacks to get on there and then find they have the wrong missile and it doesn't even work."

Rather than basing CSO and CIO bonuses on stopping breaches in the network, companies should aim to find out about a breach quickly after they happen, he said. A secure perimeter is impossible; instead, we need to work on mitigation, and that would take the active support of Black Hat delegates.

While the industry has woken up to this threat in the last few years, there were still not enough people taking it seriously, Henry said, adding that it will take a serious physical attack launched online to put it to the top of the agenda. The intelligence community had heard of Osama bin Laden for years, but it wasn't until the world watched the planes hitting the buildings that the threat was taken seriously. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.