Unconstrained by Actual Facts

Unconstrained by Actual Facts

Over the past couple of years the conversation of CyberSecurity has exploded from a term we’ve used as practitioners to one that is top of mind of most people in the U.S.  The media frenzy, initiated by the Snowden event, has created a multi-year news cycle that continues to today.  As a result we have a lot of commentators on the threats, compromises, budgets, skills, etc that are devoid of actual facts.  I’ve taken some time to try and apply some data to this overall “Threat” landscape that is talked about for so long.  While this is clearly not "scientific" and open to debate, I feel it does bring some data to the conversation as opposed to the faceless statements that echo in industry.  So much in fact, that a resonating chamber effect is starting to take hold well outside of practitioners since the media has focused.

Read More

OMG! Governments are Spying!

There has been a lot of media about the recent report to Congress on Foreign Economic Collection and Industrial Espionage.  It states that there is a huge level of espionage being done by foreign governments on corporations in the U.S. for intellectual property.  There are a couple of things that bother me about this. 

  • Spying and/or industrial espionage is nothing new.  It' been going on for hundreds of years and the introduction of the Internet hasn't changed anything other than the ease in which it can occur.
  • These electronic attacks have been going on for over 10 years and now we see a report?  Those of us who actually practice security have been dealing with it for a long time and trying to combat the issue in a mature and risk mitigation based manner.
  • The report focuses on key areas of data such as defense, energy and others.  It should be scoped as such in the beginning to not be inflamitory as it is. 
  • The recommendations at the end of the report should be a lot better.  If they really wanted to drive solutioning to the problem it would have really suggested using an industry mature framework (COBIT / ISO) to do it.  This only highlights how far behind they are in understanding the problem.

As I've written before, the problem isn't knowing attribution, threat vectors or anything else.  It has everything to do with getting corporate behavior to agree that this is a problem for it.  That doesn't mean that all companies will agree that this is a concern and nor should they.  It's the discussion that's important for practitioners to drive and have a healthy dialogue about it.

Yet, this report goes for the fear sell instead of actual data and diagnosis.  This is the same for certain vendors in their "Marketing Reports".  All fear with no data to substantiate it and no solutioning to solve it.  In addition, the media picks up on "China does most of the attacks" and reprints because it's catchy.  Congrats ONCIX on getting media attention, however, you're ruining all of our chances in fixing it.

FBI is now Spoofing Cell Towers

I usually don't read a lot of attack threads but this one is interesting.  It appears the FBI is now in the business of spoofing cell towers in order to track and log users.  Kim Zetter reported about this in Wired's "Threat Level".  To be honest I'm a bit shocked and nervous that this is being done.  Not only will it capture the individual in question but everyone else in the area that gets bumped to it.  In addition, the FBI doesn't feel they should need a warrant in order to do it.  That's the problem.  Where monitoring activities like this are needed to catch the "bad guys", they should always be done with appropriate oversite and justification.  Without a warrant it leaves it open to abuse.

Evidently, UK has been doing this for a while as well as the Guardian reports.

Trade Wars and 2011-2012 Crime Trends

The Carnegie Endownment published an interview with Michael Peltis about the future of China and the 2011-2012 global economic future.  I have a tendancy to agree with him that China will go through some tough changes in the late 2011 and 2012.  Since they are a huge part of BRIC (Brazil, Russia, India and China) and global growth at this point, it will have some interesting knock on effects.

For the most part he says that 2011 will continue as is.  However, 2012 will have China starting to slow dramatically, in growth.  I feel that this will have a dramatic affect as the rest of the world is still recovering from the recession and it will be a good 7+ years for them to get out of it. 

If China slows, I would expect commodety prices to drop since they are consuming the vast majority of them.  This should slow down the U.S. theft of copper and other metals in homes, etc.  It was reported that the increase in copper thefts from houses and other facilities started when copper hit $2.5.  I would expect that this to come back and drop the crime wave that has occured.

On the other hand we should see a dramatic increase in localized e-crime.  As we saw in the U.S., the recessions drives a significantly higher corruption index.  Less jobs + high costs = lower moral standards = thefts.  With e-crime already being a significant problem in Asia I can see it increasing once the bubble pops if it were.

In the end, let's enjoy the 2011 year as 2012 looks to have a dramatic increase in e-crime for consumers and corporations due to the revisitation of global economic growth stagnation.  Since this stagnation is predicted to last 5+ years from that point (2012-2017) we have some work ahead of ourselves.