Foreign intelligence agencies are biggest online threat, ex-Fed warns

Black Hat 2012 Former FBI executive assistant director Shawn Henry has warned that the biggest threat online comes not from terrorists or hackers, but from foreign intelligence organizations looking to steal intellectual property.

"The threat from computer attack is the most significant threat we face as a society, other than a weapon of mass destruction," he said in his opening keynote at the Black Hat 2012 conference in Las Vegas. "Everything we do – R&D, intellectual property, and corporate strategies – is stored or transmitted electronically. The DNA of companies is available to bad guys."

Henry said that the FBI had seen cases where a company had lost a billion dollars of intellectual property in a weekend. Other companies were facing a stacked deck in trade negotiations, he said, because all too often their opposite numbers know what their negotiating positions will be.

Some might say this is a case of the pot calling the kettle black. It has been over a decade since the first complaints from the EU that the ECHELON eavesdropping system was being used to spy on competitors of US corporations – but when El Reg raised this, Henry denied that the US had ever carried out such spying.

Spies like us play nice, Henry asserts

This may be true now, but it was not always so, said Marcus Ranum, a Black Hat alumnus and faculty member of the Institute for Applied Network Security.

"Our entire industrial revolution was based on stolen European technology," said Ranum. "We're complaining now we are on top, but it's buyer's remorse. There are a lot of corporations who exposed far too much information online, and rather than fixing the problem, let's blame the Chinese."

The answer to the cybersecurity conundrum, Ranum opined, was to get a lot more proactive against threats by sharing information between the government and the private sector. There are a number of bills being considered by Congress to make this easier, and he acknowledged that in the past this had been too much of a one way street, with the government taking in information but not sharing it.

A proactive response doesn't mean the NSA hacking the hackers, he said, but instead taking an attitude to building defensive systems so that if and when a breach occurs, the attackers either don't get the information they are after, or they get wrong information.

"There's denial and deception, corrupt packets and misinformation, so that when you sit down at negotiation they have the wrong answers to the test," Henry explained. "You can cause them pain if they've spent four months and two zero-day attacks to get on there and then find they have the wrong missile and it doesn't even work."

Rather than basing CSO and CIO bonuses on stopping breaches in the network, companies should aim to find out about a breach quickly after they happen, he said. A secure perimeter is impossible; instead, we need to work on mitigation, and that would take the active support of Black Hat delegates.

While the industry has woken up to this threat in the last few years, there were still not enough people taking it seriously, Henry said, adding that it will take a serious physical attack launched online to put it to the top of the agenda. The intelligence community had heard of Osama bin Laden for years, but it wasn't until the world watched the planes hitting the buildings that the threat was taken seriously. ®