document.write("

TaoSecurity

Some of you may remember my \"X vs China\" series of posts of 2007, where I discussed multiple high profile cases where various nations noted their disapproval of China's exploitation of their networks. (That's right, 2007 -- three years before the January festivities.) This morning I read Hostile nations trying to steal India's defence secrets, by Rajit Pandit of India's Economic Times. He writes:

Even as Chinese and Pakistani online espionage agents continue their attempts to hack into Indian computer systems, hostile intelligence agencies are also trying to steal defence secrets through use of computer storage media (CSM) devices like pen drives, removable hard disks, CDs, VCDs and the like.

The Intelligence Bureau has sounded a red alert about \"intelligence officers of a hostile country'' encouraging their \"assets'' working in Indian defence establishments to use CSM devices to pilfer classified information from computer networks...

$\"\"id=\"BLOGGER_PHOTO_ID_5514148239428168962\"$ This comes even as the Army is conducting a court of inquiry against a major posted in the strategically-located Andaman and Nicobar Command, who had stored over 2,000 classified and sensitive documents on his personal computer which was \"hacked'' from Pakistan earlier this year...

With cyber-warfare being a top military priority for China, its online espionage agents frequently break into sensitive Indian computer networks.

This story is interesting for two reasons. First, it cites an Indian example of the the risks of personnel with access to classified documents and storage media, similar to the Manning and Wikileaks cases. Second, like the recent Economist magazine discussing the relationship between China and India, it reminds me that China is not just targeting established powers. China is also targeting other rising powers. It would be interesting to research Russia v China or Brazil v China scenarios. Maybe Jeff Carr will post something? (hint)

One Page to Share with Your Management

I thought this brief question-and-answer session, Richard Clarke: Preparing For A Future Cyberwar by Kim S. Nash extracted the essence of advanced persistent threat problems and how to address them. I'd like to publish the whole article, but instead I'll highlight my favorite sections:

Nash: How can the federal government protect companies?

Clarke: Do more. As a matter of law and policy, the federal government should actively counter industrial espionage.

Most U.S. government counterintelligence operations are focused on intelligence against the government, not companies, and most of those are focused on spies. It's a very 20th-century approach.

Until someone makes law or policy changes that say the U.S. Cyber Command can defend AT&T or Bank of America, it doesn't have the legal authority to do that. I think it should. The government also has to explain the threat to corporations.

Also:

Clarke: Until CEOs and boards of directors are faced with black-and-white evidence that they have lost a terabyte of information and that this has resulted in some other company beating them to market, until they have their noses rubbed in it, they're reluctant to do anything special...

Often, the CIO really needs board-level commitment and CEO commitment, not just of resources but to policies necessary for protection. Most of the time, all people want the CIO to do is keep the network up and costs down. As a result, many CIOs have been hired for their expertise in those areas, not for expertise in figuring out how to make a resilient network that resists attack.

Finally:

Clarke: It should be the federal government's responsibility to tell companies not only when they've been attacked but when others have been, such as their competitors, so they realize this sort of thing is going on...

[S]ometimes companies don't know they've been hacked. But frequently they realize after the fact. You don't know you've lost information until a knockoff of your product or some competing products start showing up in the marketplace.

I agree with all of these sentiments.

Incidentally I started read the library copy of Cyber War but decided I needed to take notes in the margins. So, I bought a copy from Amazon.com. I plan to finish it and review it by the end of the month.

The Inside Scoop on DoD Thinking

I wanted to help put some of you in the mindset of a DoD person when reading recent news, namely Defense official discloses cyberattack and Pentagon considers preemptive strikes as part of cyber-defense strategy, both by Washington Post reporter Ellen Nakashima. I'll assume you read both articles and the references.

Deputy Defense Secretary Lynn's article (covered by the first Post story) is significant, perhaps for reasons that aren't obvious. First, when I wore the uniform, the fact that a classified system suffered a compromise was itself classified. To this day I cannot say if a classified system I used ever suffered a compromise of any kind. Readers might be kind enough to say if this policy is still in effect today. So, to publicly admit such a widespread event -- one that affected classified systems -- that is a big deal.

Second, Lynn said \"this previously classified incident was the most significant breach of U.S. military computers ever.\" That is significant. It sets a bar against which other incidents can be measured. Why was it so bad?

Adversaries have acquired thousands of files from U.S. networks and from the networks of U.S. allies and industry partners, including weapons blueprints, operational plans, and surveillance data.

That's serious, and specific.

Third, after citing Google's January admission, Lynn says:

Although the threat to intellectual property is less dramatic than the threat to critical national infrastructure, it may be the most significant cyberthreat that the United States will face over the long term.

Every year, an amount of intellectual property many times larger than all the intellectual property contained in the Library of Congress is stolen from networks maintained by U.S. businesses, universities, and government agencies.

As military strength ultimately depends on economic vitality, sustained intellectual property losses could erode both the United States' military effectiveness and its competitiveness in the global economy.

I interpret this as saying cyberwar is hurting the US specifically because non-military targets are being hit, repeatedly and persistently.

Finally, I'd like to provide a counterpoint regarding the second Post article. Other pundits are calling DoD's potential offensive strategy \"beyond stupid.\" I'd like to know what's stupid: more of the same failed vulnerability-centric policies and approaches of the last, what, 10, 15, 20 years, or taking a threat-centric approach to apply pressure on the adversary? I also wrote about this in 2007, like some other pundits. In the three years since, playing defense hasn't helped much. Expect more on offensive options in the coming years, in all sectors -- not just the military.

Review of Hacking Exposed: Wireless, 2nd Ed Posted

Amazon.com just posted my five star review of Hacking Exposed: Wireless, 2nd Ed by Johnny Cache, Joshua Wright and Vincent Liu. From the review:

I reviewed the first edition of Hacking Exposed: Wireless (HEW) in May 2007, and offered four stars. Three years later I can confidently say that Hacking Exposed: Wireless, 2nd Ed (HEW2) is a solid five star book. After reading my 2007 review, I believe the authors took my suggestions seriously, and those of other reviewers, and produced HEW2, the best book on wireless security available. If you want to understand wireless -- and not just 802.11, but also Bluetooth, ZigBee, and DECT -- HEW2 is the book for you.

I forgot to mention in my review that this new edition appears to be a substantial rewrite, not a minor editing of old chapters! I didn't do a chapter-by-chapter comparison. I did read the whole book, which the publisher provided as a review copy.

GE Looking for Business Response Team Leader

GE continues to hire security professionals to help reduce IT risk at our company. I should be posting additional jobs for my team (GE-CIRT) next month, but right now my boss (our CISO) asked me to help find a Business Response Team (BRT) Leader for our Corporate entity. Visit www.ge.com/careers and search for job 1251700 to find the role. From the summary:

The Business Response Team (BRT) Leader is responsible for working with business peers and the GE Computer Incident Response Team (GE-CIRT) to better protect GE Corporate from digital intruders. The BRT Leader limits and assesses the damage caused by digital intruders, evaluates the posture and configuration of business computers, provides direct security support to business initiatives, and works to improve the security of the business.

This role is in Connecticut in order to be close to our HQ.

Bejtlich on Silver Bullet Podcast
$\"\"id=\"BLOGGER_PHOTO_ID_5508788786647100642\"$ Gary McGraw was kind enough to interview me for his Silver Bullet Podcast. Gary is a real pro; he does his homework. After describing the interview process to my wife, she thought Gary's approach sounded like James Lipton and Inside the Actor's Studio! We talked about a lot of subjects and Gary tailored his questions to relate to my incident detection and response duties and relations to software security.

Review of Least Privilege Security Posted

Amazon.com just posted my four star review of Least Privilege Security for Windows 7, Vista and XP by Russell Smith. From the review:

Russell Smith's Least Privilege Security for Windows 7, Vista, and XP (LPS) is a helpful contribution to the toolbox of many enterprise system administrators. Numerous organizations are finally realizing that the Internet is too hostile an environment to let normal users function with elevated privileges. Although by no means a panacea for preventing intrusions, users operating with least privilege are somewhat more able to resist some attack vectors. Beyond resisting attacks, users operating with least privilege are more likely to meet organizational rules. Thanks to LPS, administrators running Windows 7, Vista, and XP can apply the author's lessons and guidance to their own environment.

Bejtlich Teaching at Black Hat Abu Dhabi 2010

The teaser page for Black Hat Abu Dhabi 2010 is now live, and I am pleased to announce that I will teach TCP/IP Weapons School 2.0 there on 8-9 November. Preregistration appears to be available. This will truly be the last edition of TWS version 2.0. I have been in contact with experts from theUnited Arab Emirates Computer Emergency Response Team (aeCERT) and I hope to have students from the region participate in my class.

For those interested in TWS 2.0 but not familiar with it, I described the class in this blog post titled Sample Lab from TCP/IP Weapons School 2.0.

I described differences between my class and SANS in this post.

I am also developing version 3.0 for Black Hat DC 2011 in January. When I have details on that class I will post them here.

Review of IT Security Metrics Posted

Amazon.com just published my five star review of IT Security Metrics by Lance Hayden. From the review:

I was not sure what to expect as I started reading IT Security Metrics (ISM). I had just discarded another new book, published in July 2010, supposedly about security metrics but really about nothing useful to anyone anchored in the operational IT world. Would ISM be another disappointment? Since Andrew Jaquith published Security Metrics in 2007, no other book had appeared to help security professionals measure their worlds. Thankfully, I can strongly recommend Lance Hayden's ISM as a very strong contributor to the discussion on security metrics. ISM's subtitle, \"A Practical Framework for Measuring Security & Protecting Data,\" really does explain the purpose and value of this great new book.

Review of Practical Lock Picking Posted

Amazon.com just posted my five star review of Practical Lock Picking by Deviant Ollam. From the review:

Practical Lock Picking (PLP) is an awesome book. I don't provide physical testing services, but as a security professional familiar with Deviant's reputation I was curious to read PLP. Not only is PLP an incredible resource, it should also serve as a model text for others who want to write a good book. First, although the book is less than 250 pages, it is very reasonably priced. Second, Deviant wastes NO space. There is no filler material, background found in other readily available texts, reprinted Web site content, etc. Third, the writing is exceptionally clear and methodical, with extreme attention to detail and a master's approach to educating the reader. Finally, the diagrams, pictures, and figures are superb. When necessary they convey the most subtle elements of lock or key design, and they are the appropriate size and clarity. Overall, this book is helpful for those wishing to pick locks AND those who want to know how to write a good book.

RSS integration by RSSinclude

");