La guerra cibernetica

[Andrea75]

Cyberwar or not, are we ready for extreme scenarios?

 

Fundamentally we should ask ourselves two questions:

- Do we have the technologies to stop propagating any threat within our IT systems?

- Can we continue operate without Internet access, at least for a period of time?

 

China international law and cyberspace

Modificato 9 Ottobre 2012 da Andrea75

[Andrea75]

Canada may bar China from telecoms project

 

Canada said Tuesday it had invoked a “national security exception” that could exclude China’s Huawei Technologies from a role in helping build its new super secure government network.

 

Ottawa announced the move after the US House Intelligence Committee on Monday warned in Washington that equipment supplied by two Chinese firms, Huawei Technologies and ZTE Inc., could be used for spying.

[cama81]

tra gli esperti si ipotizza il trojan perfetto , non rilevabile e non rimuovibile unica soluzione cambiare pc !!!

 

attacca la bios e da li TUTTE le periferiche del pc , impossibile ripulirlo del tutto , la paura è che i produttori cinesi possano usare mezzi simili per creare backdoor nei pc di tutto il mondo

http://www.tomshw.it/cont/news/rakshasa-e-...ni/38889/1.html

[Andrea75]

Panetta Spells Out DOD Roles in Cyberdefense

 

DOD is finalizing a comprehensive change to rules of engagement in cyberspace. “The new rules will make clear that the Department has a responsibility not only to defend DOD’s networks, but also to be prepared to defend the nation and our national interests against an attack in or through cyberspace,” he said. “These new rules will make the Department more agile and provide us with the ability to confront major threats quickly.”

 

The private sector, government, military and international partners operate in cyberspace. “We all share the responsibility to protect it,” he said. “Therefore, we are deepening cooperation with our closest allies with a goal of sharing threat information, maximizing shared capabilities, and deterring malicious activities.”

 

All U.S. leaders have discussed cyber security with foreign leaders. Panetta raised the issue with Chinese leaders during his recent trip to Beijing. “I underscored the need to increase communication and transparency so that we can avoid misunderstanding or miscalculation in cyberspace,” he said. “That is in the interest of the United States, and it is in the interest of China.”

[Andrea75]

New version of Flame virus uncovered: researchers

 

A new cyberespionage tool linked to the Flame virus has been infecting computers in Lebanon, Iran and elsewhere, security researchers said Monday.

...

the new malware "miniFlame," and said it was "a small and highly flexible malicious program designed to steal data and control infected systems during targeted cyber espionage operations." Russian-based Kaspersky said miniFlame "is based on the same architectural platform as Flame," widely reported to be part of a US-Israeli effort to slow Iran's suspected nuclear weapons drive. The smaller version "can function as its own independent cyber espionage program or as a component" inside Flame and related malware. Unlike Flame, which is designed for "massive spy operations," miniFlame is "a high precision, surgical attack tool," according to Alexander Gostev at Kaspersky Lab. "Most likely it is a targeted cyberweapon used in what can be defined as the second wave of a cyberattack."

 

New version of Flame virus uncovered

[Andrea75]

The Reality of Cyber Threats: Congress Must Act

 

Air and Space Power Journal: Warfare in the Cyber Domain

[Andrea75]

Iran Renews Internet Attacks on U.S. Banks

 

Iranian hackers renewed a campaign of cyberattacks against U.S. banks this week, targeting Capital One Financial Corp. and BB&T Corp. and openly defying U.S. warnings to halt, U.S. officials and others involved in the investigation into the attacks said.

The attacks, which disrupted the banks' websites, showed the ability of the Iranian group to sustain its cyberassault on the nation's largest banks for a fifth week, even as it announced its plans to attack in advance.

 

Canada to Beef Up Its Cyber Defenses

 

Canada said it will more than double spending on defense against cyberattacks, amid heightened global worries over cyber warfare.

Vic Toews, Canada's public-safety minister, said his department would spend an additional 155 million Canadian dollars (US$158 million) over five years on cyber security, underscoring a recent call to arms among Western allies, from the U.S. to Britain, over the threat. The new Canadian commitment is on top of C$90 million already allocated for cyber security over the same period.

[Andrea75]

U.S. Cyber Experts: Deterrence Not Enough

 

The U.S. Defense Department’s new cyber defense mantra — deterrence — is poised to help prevent attacks easily attributable to nation-states.

 

The problem? Many attacks, and frequently the most sophisticated, don’t come immediately from nation-states. Instead, they come from groups that, while state-supported, provide plausible deniability for their benefactors, experts said.

 

Defense Secretary Leon Panetta announced a new policy approach Oct. 11, a more aggressive stance in which deterrence will be used to convince bad actors to stay their hands. Panetta claimed that the U.S. can now effectively find out who is behind attacks and has developed the offensive tools to take decisive, even pre-emptive, action.

 

But while experts applauded the efforts to make cybersecurity policy a more public debate, they questioned the broad applicability of a deterrence model.

 

“One theory of deterrence is not going to be applicable to the spectrum of potential bad actors in cyberspace,” said Roger Cressey, a senior vice president at Booz Allen Hamilton.

[Andrea75]

Consolidamenti aziendali Raytheon acquires technology development firm Teligy, Inc.

 

Raytheon Company (NYSE: RTN) has acquired Teligy, Inc., a technology development company, further extending Raytheon's cybersecurity offerings in wireless communications, vulnerability analysis, reverse engineering and custom kernel software/device driver development. These critical focus areas represent top priorities of intelligence, defense and commercial organizations worldwide.

...

Teligy excels at transitioning prototype and proof of concept cyber products into deployable solutions. Coupled with Raytheon's existing expertise, Teligy enables Raytheon to cover the entire communication stack for both wired and RF technologies across all relevant platforms, and provides access to emerging markets.

[Andrea75]

In Cyberattack on Saudi Firm, U.S. Sees Iran Firing Back

 

a person with privileged access to the Saudi state-owned oil company’s computers, unleashed a computer virus to initiate what is regarded as among the most destructive acts of computer sabotage on a company to date. The virus erased data on three-quarters of Aramco’s corporate PCs — documents, spreadsheets, e-mails, files — replacing all of it with an image of a burning American flag.

 

United States intelligence officials say the attack’s real perpetrator was Iran, although they offered no specific evidence to support that claim.

[Andrea75]

Cyber Experts Engage on DARPA’s Plan X

 

Plan X, announced in May 2012, is the first DARPA program of its kind. It will attempt to create revolutionary technologies for understanding, planning and managing DoD cyber missions in real-time, large-scale and dynamic network environments. Plan X will conduct novel research on the cyber domain. The Plan X program is explicitly not funding research and development efforts in vulnerability analysis or generation of cyberweapons.

[Andrea75]

Only Global Banks Will Benefit From A Cyber-Attack On The U.S.

[Andrea75]

Cyber Defense Takes Center Stage in Nordic Cooperation

 

HELSINKI — Nordic governments have identified cyber defense as a fundamental area for urgent cooperation and the development of joint countermeasures, plans and strategies. The potential for collaboration was discussed when Nordic foreign ministers met here Oct. 31, with all countries committing to the establishment of a common capability in 2014-2015.

 

The commitment to establish a common Nordic expertise in cyber defense will involve dedicated national military cyber defense centers (CDC) working closely with the private sector to improve overall defenses against the increasing number and sophistication of attacks against vital government and military infrastructure.

 

The first step in the joint Nordic cyber defense initiative will see the formation of a connecting communications’ network linking to national cyber defense center and regulatory organizations. It is envisaged that this network can be in place within the next 12 months. The long-term plan is to broaden the cooperation project to include the Baltic states, including Estonia, which operates a NATO-standard CDC in Tallinn.

 

The need for a Nordic cyber defense capability is among the primary collaborative goals identified by Nordic Defense Cooperation (NORDEFCO), the pan-Nordic, military-run cooperation vehicle tasked with researching and formulating concrete project areas for cross-border defense initiatives among Norway, Denmark, Sweden and Finland.

[Andrea75]

Exclusive: SEC left computers vulnerable to cyber attacks - sources

 

Staffers at the U.S. Securities and Exchange Commission failed to encrypt some of their computers containing highly sensitive information from stock exchanges, leaving the data vulnerable to cyber attacks, according to people familiar with the matter.

While the computers were unprotected, there was no evidence that hacking or spying on the SEC's computers took place, these people said.

...

The revelation comes as the SEC is encouraging companies to get more serious about cyber attacks. Last year, the agency issued guidance that public companies should follow in determining when to report breaches to investors.

Cyber security has become an even more pressing issue after high-profile companies from Lockheed Martin Corp to Bank of America Corp have fallen victim to hacking in recent years.

 

 

... qualche dettaglio sui prodotti tarocchi Fake tech gear has infiltrated the U.S. government

 

 

A record number of tech products used by the U.S. military and dozens of other federal agencies are fake. That opens up a myriad of national security risks, from dud missiles to short-circuiting airplane parts to cyberespionage.

...

Suppliers with the high-risk branding are known to engage in counterfeiting, wire fraud, product tampering and a laundry list of other illicit and illegal behaviors.

Last year, 9,539 banned businesses were found to have sold technology the government. Roughly 10% of those incidents involved counterfeit parts or equipment.

...

The number of fake tech products floating around in the market quadrupled from 2009 to 2011, according to IHS -- and they're sneaking into some high-profile places

 

dunque il fenomeno è in crescita per quantità e qualità degli obiettivi. Ad esempio

 

In September 2010, the Missile Defense Agency found that the memory in a high-altitude missile's mission computer was counterfeit. Fixing the problem cost $2.7 million. Had the bomb launched, it most likely would have failed, the agency said.

 

Nel Febbraio 2008 il Dipartimento di Giustizia USA, dopo un'indagine condotta dall'FBI in collaborazione con alcune corporation, ha prodotto questo attoDepartments of Justice and Homeland Security Announce International Initiative Against Traffickers in Counterfeit Network Hardware, che punta il dito contro ... indovinate chi? La Cina:

 

Assistant Attorney General Alice S. Fisher of the Criminal Division, Assistant Director James Finch of the FBI’s Cyber Division, Assistant Secretary Julie L. Myers, U.S. Immigration and Customs Enforcement (ICE), Commissioner W. Ralph Basham, U.S. Customs and Border Protection (CBP), and Inspector Peter Goulet of the Royal Canadian Mounted Police (RCMP) today announced the results to date of an ongoing international enforcement initiative between the United States and Canada that targets the illegal distribution of counterfeit network hardware manufactured in China.

This ongoing initiative has resulted in more than 400 seizures of counterfeit Cisco network hardware and labels with an estimated retail value of more than $76 million. It is being led by ICE, CBP and the FBI working in conjunction with the Criminal Division’s Computer Crime & Intellectual Property Section, U.S. Attorney’s Offices across the country, and the RCMP.

The initiative targets the illegal importation and sale of counterfeit network hardware, in particular network routers, switches, network cards and modules manufactured by Cisco. By intercepting the counterfeit hardware at ports of entry and dismantling illegal supply chains in the U.S., the operation has achieved significant successes in protecting the public from the risk of network infrastructure failures associated with these counterfeits.

“Counterfeit network hardware entering the marketplace raises significant public safety concerns and must be stopped. This initiative shows that through collaboration among law enforcement agencies and prosecutors worldwide, we can achieve dramatic enforcement results and protect public safety,” said Assistant Attorney General Alice S. Fisher of the Criminal Division. “It is critically important that network administrators in both private sector and government perform due diligence in order to prevent counterfeit hardware from being installed on their networks.”

The FBI named its portion of this ongoing initiative Operation Cisco Raider - an international, coordinated investigation of 15 cases involving nine FBI field offices. The FBI worked closely with law enforcement partners including ICE, Defense Criminal Investigative Service, General Services Administration, Department of the Interior, Internal Revenue Service, and the RCMP. Over the last two years, Operation Cisco Raider has resulted in 36 search warrants that identified approximately 3,500 counterfeit network components with an estimated retail value of over $3.5 million, and has led to a total of ten convictions and $1.7 million in restitution.

“This operation illustrates the importance of working closely with our partners in both law enforcement and the private sector,” said FBI Assistant Director James Finch. “Cisco Systems Incorporated specifically deserves praise for their level of cooperation in this initiative. We will continue these efforts to aggressively investigate counterfeit goods in order to protect U.S. consumers and corporations.”

 

 

Il danno economico è sì rilevante (stimato in 76 milioni di USD), ma passa in secondo piano se paragonato alla "qualità" ed alla "sensibilità" dei dati e delle informazioni compromessi.

Modificato 9 Novembre 2012 da Andrea75

[Andrea75]

Lockheed says cyber attacks up sharply, suppliers targeted

 

The Pentagon's No. 1 supplier, Lockheed Martin Corp, on Monday cited dramatic growth in the number and sophistication of international cyber attacks on its networks and said it was contacting suppliers to help them shore up their security.

 

Chandra McMahon, Lockheed vice president and chief information security officer, said about 20 percent of the threats directed at Lockheed networks were considered "advanced persistent threats," prolonged and targeted attacks by a nation state or other group trying to steal data or harm operations.

 

"The number of campaigns has increased dramatically over the last several years," McMahon told a news conference. "The pace has picked up."

 

She said the tactics and techniques were becoming increasingly sophisticated, and attackers were clearly targeting Lockheed suppliers to gain access to information since the company had fortified its own networks.

[Andrea75]

Obama signs secret directive to help thwart cyberattacks

 

President Obama has signed a secret directive that effectively enables the military to act more aggressively to thwart cyber­attacks on the nation’s web of government and private computer networks.

Presidential Policy Directive 20 establishes a broad and strict set of standards to guide the operations of federal agencies in confronting threats in cyberspace, according to several U.S. officials who have seen the classified document and are not authorized to speak on the record. The president signed it in mid-October.

The new directive is the most extensive White House effort to date to wrestle with what constitutes an “offensive” and a “defensive” action in the rapidly evolving world of cyberwar and cyberterrorism, where an attack can be launched in milliseconds by unknown assailants utilizing a circuitous route. For the first time, the directive explicitly makes a distinction between network defense and cyber-operations to guide officials charged with making often-rapid decisions when confronted with threats.

The policy also lays out a process to vet any operations outside government and defense networks and ensure that U.S. citizens’ and foreign allies’ data and privacy are protected and international laws of war are followed.

“What it does, really for the first time, is it explicitly talks about how we will use cyber-

operations,” a senior administration official said. “Network defense is what you’re doing inside your own networks. . . . Cyber-operations is stuff outside that space, and recognizing that you could be doing that for what might be called defensive purposes.”

...

But cyber-operations, the officials stressed, are not an isolated tool. Rather, they are an integral part of the coordinated national security effort that includes diplomatic, economic and traditional military measures.

Offensive cyber actions, outside of war zones, would still require a higher level of scrutiny from relevant agencies and generally White House permission.

[Andrea75]

ostacoli per la legge sulla sicurezza cibernetica Political Gridlock Leaves U.S. Facing Cyber Pearl Harbor

 

There’s almost universal agreement that the U.S. faces a catastrophic threat from cyber attacks by terrorists, hackers and spies. Washington policy makers just don’t seem able to do anything about it.

Even with the consensus about vulnerabilities in U.S. networks, and with hundreds of billions of dollars at stake, Congress failed to pass cybersecurity legislation that was four years in the making and had sponsors from both parties.

...

Senate Bill

The White House focused its efforts on a gridlocked Senate rather than on the Republican-controlled House, which had passed several less ambitious cybersecurity bills.

Congressional Democrats sought to give the Department of Homeland Security ill-defined powers to set new cybersecurity standards and failed to come up with credible estimates of what those standards would cost.

Many Senate Republicans took their cues from the U.S. Chamber of Commerce and businesses that framed the debate not as a matter of national security, but rather as a battle between free enterprise and an overreaching government, according to documents and descriptions of lobbying efforts.

The Senate bill “would have created a new bureaucracy that would have slowed down the process and forced companies to focus on compliance with new government mandates that would not insure better and faster notifications of cyber threats,” Kay Bailey Hutchison of Texas, the top Republican on the Senate Commerce Committee who also is retiring, said in an e-mail.

 

... e qui un discorso fra senatori Defense Authorization bill (S. 3254)

[Andrea75]

segnalo questo paper su Federal Laws Relating to Cybersecurity: Discussion of Proposed Revisions

 

For more than a decade, various experts have expressed increasing concerns about cybersecurity, in light of the growing frequency, impact, and sophistication of attacks on information systems in the United States and abroad. Consensus has also been building that the current legislative framework for cybersecurity might need to be revised.

The complex federal role in cybersecurity involves both securing federal systems and assisting in protecting nonfederal systems. Under current law, all federal agencies have cybersecurity

responsibilities relating to their own systems, and many have sector-specific responsibilities for critical infrastructure.

More than 50 statutes address various aspects of cybersecurity either directly or indirectly, but there is no overarching framework legislation in place. While revisions to most of those laws

have been proposed over the past few years, no major cybersecurity legislation has been enacted since 2002.

Recent legislative proposals, including many bills introduced in the 111th and 112th Congresses, have focused largely on issues in 10 broad areas (see “Selected Issues Addressed in Proposed Legislation” for an overview of how current legislative proposals would address issues in several of those areas):

• national strategy and the role of government,

• reform of the Federal Information Security Management Act (FISMA),

• protection of critical infrastructure (including the electricity grid and the chemical industry),

• information sharing and cross-sector coordination,

• breaches resulting in theft or exposure of personal data such as financial information,

• cybercrime,

• privacy in the context of electronic commerce,

• international efforts,

• research and development, and

• the cybersecurity workforce.

For most of those topics, at least some of the bills addressing them have proposed changes to current laws. Several of the bills specifically focused on cybersecurity have received committee or floor action, but none have become law. In the absence of enactment of cybersecurity legislation, the White House has reportedly considered issuing an executive order, but that has been opposed by some Members of Congress.

Comprehensive legislative proposals on cybersecurity that have received considerable attention in 2012 are The Cybersecurity Act of 2012 (CSA 2012, S. 2105, reintroduced in revised form as S. 3414), recommendations from a House Republican task force, and a proposal by the Obama Administration. They differ in approach, with S. 2105 proposing the most extensive regulatory framework and organizational changes, and the task force recommendations focusing more on incentives for improving private-sector cybersecurity. An alternative to S. 2105 and S. 3414, S. 3342 (a refinement of S. 2151), does not include enhanced regulatory authority or new federal entities, but does include cybercrime provisions. S. 3414 was debated in the Senate but failed a cloture vote.

Several narrower House bills have been introduced that address some of the issues raised and recommendations made by the House task force. Four passed the House the week of April 23:

• Cybersecurity Enhancement Act of 2011 (H.R. 2096), which addresses federal cybersecurity R&D and the development of technical standards;

• Cyber Intelligence Sharing and Protection Act (H.R. 3523), which focuses on information sharing and coordination, including sharing of classified information;

• Advancing America’s Networking and Information Technology Research and Development Act of 2012 (H.R. 3834), which addresses R&D in networking and information technology, including but not limited to security; and

• Federal Information Security Amendments Act of 2012 (H.R. 4257), which addresses FISMA reform.

One was ordered reported out of the full committee but did not come to the floor:

• Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness Act of 2011 or PRECISE Act of 2011 (H.R. 3674), which addresses the role of the Department of Homeland Security in cybersecurity, including protection of federal systems, personnel, R&D, information sharing, and public/private sector collaboration in protecting critical infrastructure;

Together, those House and Senate bills address most of the issues listed above, although in different ways. All include proposed revisions to some existing laws covered in this report.

[Andrea75]

Israeli government websites under mass hacking attack

 

More than 44 million hacking attempts have been made on Israeli government web sites since Wednesday when Israel began its Gaza air strikes, the government said on Sunday.

Finance Minister Yuval Steinitz said just one hacking attempt was successful on a site he did not want to name, but it was up and running after 10 minutes of downtime.

Typically, there are a few hundred hacking attempts a day on Israeli sites, the ministry said.

Attempts on defence-related sites have been the highest, while 10 million attempts have been made on the site of Israel's president, 7 million on the Foreign Ministry and 3 million on the site of the prime minister.

A ministry spokesman said while the attacks have come from around the world, most have been from Israel and the Palestinian territories.

"The ministry's computer division will continue to block the millions of cyber attacks," Steinitz said. "We are enjoying the fruits of our investment in recent years in developing computerized defence systems."

Steinitz has instructed his ministry to operate in emergency mode to counter attempts to undermine government sites.

Both sides in the Gaza conflict, but particularly Israel, are embracing the social media as one of their tools of warfare. The Israeli Defense Force has established a presence on nearly every platform available while Palestinian militants are active on Twitter.

"The war is taking place on three fronts. The first is physical, the second is on the world of social networks and the third is cyber," said Carmela Avner, Israel's chief information officer.

[Andrea75]

Transcom Strives to Protect Networks Against Cyberthreats

 

The new Joint Cyber Center here at U.S. Transportation Command is helping protect against persistent cyberattacks while ensuring secure, uninterrupted access to the networks that underpin the command’s global mission.

Transcom gets more cyber attacks than nearly every other U.S. combatant command. The command experienced 44,551 “computer network events” during 2011 alone, and intrusion attempts are increasing, Air Force Gen. William M. Fraser III, Transcom’s commander, told Congress earlier this year.

Those breaches, if not detected and defeated, could bring the military’s global transportation and distribution enterprises to their knees.

Unlike most combatant commands that interface primarily with other secure military and government networks, Transcom relies heavily on commercial partners that deliver 70 percent of its supplies and passengers around the world, Fraser told legislators.

Ninety percent of the command’s distribution and deployment transactions are conducted in cyberspace, he said, much of it using unclassified and commercial systems lacking the safeguards provided on dot-mil and dot-gov networks.

“We are very cognizant of the fact that U.S. Transcom movements represent an Achilles’ heel for U.S. power projection en route,” said Air Force Lt. Col. Robert Hume, the Joint Cyber Center’s intelligence branch chief. “If that is where you want to disrupt what the U.S. military does, that is where you go.”

Recognizing this vulnerability, Fraser identified unfettered access to secure information networks as one of four major focus areas in the command’s recently released five-year plan.

“Every day, U.S. Transcom operates in a cyber domain that is increasingly at risk,” he noted in releasing the plan. “Cyber defense is a command imperative. We must be much more proactive in protecting our information technology infrastructure and the credibility of the information we exchange with our allies and national partners.”

The new Joint Cyber Center, established last spring, is taking the lead in this endeavor.

[Andrea75]

As cyberwarfare heats up, allies turn to U.S. companies for expertise

 

In the spring of 2010, a sheik in the government of Qatar began talks with the U.S. consulting company Booz Allen Hamilton about developing a plan to build a cyber-operations center. He feared Iran’s growing ability to attack its regional foes in cyberspace and wanted Qatar to have the means to respond.

Several months later, officials from Booz Allen and partner firms met at the company’s sprawling Tysons Corner campus to review the proposed plan. They were scheduled to take it to Doha, the capital of the wealthy Persian Gulf state.

That was when J. Michael McConnell, a senior vice president at Booz Allen and former director of national intelligence in the George W. Bush administration, learned that Qatar wanted U.S. personnel at the keyboards of its proposed cyber-center, potentially to carry out attacks on regional adversaries.

“Are we talking about actually conducting these operations?” McConnell asked, according to several people at the meeting. When someone said that was the idea, McConnell uttered two words: “Hold it.”

“We can’t have Americans at the keyboard running offensive operations,” said McConnell, a retired admiral who also ran the top-secret National Security Agency, according to those present. “It could be interpreted as an act of war.”

The Qatar incident highlights the reality of a new arms race — the worldwide push to develop offensive and defensive cyber-capabilities. Like many other countries, Qatar wanted to improve its computer defenses in the face of a growing network warfare threat. And like others, Qatar turned to the United States, where technology firms are acknowledged leaders in the field of cyberwarfare and cyberdefense.

The potential worldwide market means that U.S. companies must walk a fine line between selling their products and staying within export controls that are struggling to keep pace with the rapid technological advances in the field. Calls were made to U.S. government officials and experts in the elite world of defense consulting. It became clear to McConnell that the notion of conducting attacks was a deal-killer.

[Andrea75]

Air Force competes in second ‘Cyber Flag’

 

24th Air Force, the U.S. Air Force’s cyber component to U.S. Cyber Command, took part in the Cyber Flag 13-1 training exercise at Nellis Air Force Base, Nev. Oct. 29-Nov. 8.

USCYBERCOM designed Cyber Flag to bring together Department of Defense cyber and information technology professionals to hone their cyber skills against a realistic adversary in a tactical virtual environment.

“Our increasing dependency on reliable and efficient network connectivity and the growing threat posed by cyber adversaries highlight the importance of practicing combined operations in defense of the DOD information infrastructure,” said Capt. Christian Mapp, 24th Air Force exercise branch chief. “As the service provider for Air Force networks, 24th Air Force participation with the other service components is critical to ensuring a synchronized and coordinated approach to DOD network defense being available and capable should the need ever arise.”

Mapp said the Air Force assembled a total force team comprised of more than 70 active duty, Reserve and Air National Guard cyber warriors from across the nation.

This year’s Cyber Flag was larger than the first Cyber Flag held in 2011 on the same cyber range. This year’s exercise saw approximately 700 participants, up from last year’s 300, and doubled the network size. All participants had a specific role to play, playing the part of a U.S. team or role-playing an adversary.

“Exercises like Cyber Flag test participants’ readiness when faced with a realistic cyber event in a stressed environment against a dynamic and skilled adversary. This was not a simple ‘capture the flag’ event,” said Col. George Lamont, director of USCYBERCOM Joint Exercises and Training.

The exercise included an opposing force whose mission was to penetrate and disrupt the computer networks of the “good guys,” or Blue Force – made up of DOD cyber service components.

[Andrea75]

Cyber Security Has Great “Spin Off” Potential For Some Defense Companies

 

Even as defense budgets and even overall federal discretionary spending decline, one area that is likely to remain fairly secure or even grow in the years to come is cyber security. The reason for this is simple: the threat to federal, state and local governments, the military, critical infrastructure, private corporations and even individual Americans is growing both in quality and quantity almost daily. Secretary of Defense Leon Panetta has warned of what he termed a cyber “Pearl Harbor.” The director of the National Security Agency, General Keith Alexander, called cybercrime "the greatest transfer of wealth in history." General Alexander was speaking of the full range of cyber crime which includes not only scams and identity theft but bank fraud and, most significantly, the theft of invaluable corporate intellectual property. The recent successful hacking of the personal computer of the former Chairman of the Joint Chiefs of Staff, Admiral Michael Mullen, USN (Ret.), is a reminder of how vulnerable each of us is as individuals to the cyber threat.

As a serious cyber threat to the military and critical infrastructure and networks began to emerge in the early 2000s, the federal government, particularly the Department of Defense but also the Department of Homeland Security, turned to private companies, including many of the best names in defense, to help provide solutions. Over the years, these companies have developed impressive capabilities, including data bases, tactics, techniques and procedures, software tools, and trained personnel. These capabilities have been employed both to help defend government networks and systems and to secure the companies themselves from cyber attack.

Take Lockheed Martin as an example. The company is the largest supplier of IT services and solutions to the federal government. It also is unusual insofar as the decision was made in the 1990s not to outsource its IT systems and cyber security activities but instead to maintain, manage and secure corporate IT systems and networks. As a private company responsible to shareholders, whatever was done with respect to cyber security had to show a return on investment. What Lockheed Martin discovered was that there was a direct relationship between creating an efficient, reduced cost IT network and enhancing that system’s security. In addition, because the company chose to take on the responsibility for self-defense against cyber threats it also developed a powerful set of capabilities, including several cyber security centers staffed with a multi-disciplinary group of intelligence analysts, software programmers, systems engineers and IT service professionals as well as proprietary and customized COTS-based tools. All of these skills have proven useful in supporting government clients and can be of particular value in the commercial world which has to be sure that there is a return on investments in cyber security.

Other companies have developed similar capabilities in their efforts to provide security for their own and government IT systems. Companies such as General Dynamics, BAE Systems, Northrop Grumman and ManTech have developed a wide range of cyber security capabilities and solutions including cyber security operations centers, state-of-the-art digital forensics tools, threat visualization systems, open source network security solutions and secure data transfer capabilities, to mention just a few items. In many instances, cyber security is treated as an integral part of contracts to provide government agencies and the military with other IT and data services including cloud computing, the collection, processing, exploitation and dissemination of intelligence information and the amassing and manipulation of big data sets.

The skills and capabilities developed over years of working to build, maintain and secure both government networks as well as their own have given many of these defense companies enormous capabilities relevant to the security needs of the private sector. To the degree these companies have implemented some or many of their cyber security solutions to protect their own operations they are readily able to extend those solutions to the particular needs of specific sectors of the economy such as banking and finance, energy, health care and transportation. The explosion in the number and variety of mobile devices carries with it a demand for improved functionality and security of IT architectures and networks that are constantly expanding and changing. This will increase the demand for the kind of cyber security solutions that the smart defense companies are already developing for the military. This could be a major growth area for defense companies challenged by declining defense department budgets.

[Andrea75]

DOJ Plans To Indict State-Sponsored Cyber Attackers

 

n an intriguing push against the ever-increasing number of foreign-governments sponsored cyber attacks against U.S. companies, the U.S. Department of Justice intends to turn to its roots with an old-fashioned tactic that has worked against the mafia, drug traffickers and white collar crime: criminal prosecutions.

It is no secret that Chinese state-sponsored hackers have been running advanced persistent attacks against U.S. defense contractors in recent years — often virtually living on their computer networks. But until now, responses to cyber attacks were viewed as either a legislative challenge, an intelligence riddle for the FBI, or a potential Defense Department and National Security Agency job.

The riddle has consistently been this: If defenses aren’t working against better and better attackers, how to make the attackers pay? State Department demarches? Ineffectual. Offensive cyber retaliation? What’s the legal basis for it, and to what end?

One answer: indictments.

“I’ll give you a prediction,” said John Carlin, the principal deputy assistant Attorney General in Justice’s national security division. “Now that we are having people look at bringing one of these cases, it’s there to be brought, and you’ll see a case brought.”

The Justice Department recently stood up a little-noticed program under its National Security Division, called the National Security Cyber Specialist, or NSCS, network. It’s pronounced “niscus” and it brings the department into a relatively new arena.

Various efforts to pass cyber legislation have crashed and burned on Capitol Hill and the federal response is at best clumsy. The Department of Homeland Security technically coordinates the response to cyber attacks, working with the FBI and the Defense Department. DoD’s Cyber Command, which has the most capacity in cyber, defends military networks but can only get brought into civilian issues when it is ordered in by the executive branch.

The Justice Department initiative, Carlin said, will be multifaceted. More then 100 prosecutors are being specially trained. They’ll get more involved in each agency’s efforts.

“NSA, we have some oversight function on them but they are our client when we go in front of the foreign intelligence surveillance court,” Carlin said.

And for the FBI, he said, the DOJ will ask investigators to start looking for cases they can bring to court — something where they can finally take legal action, rather then just follow cyber leads, as they’ve been doing.

Carlin said there were a variety of potential targets to indict in these cases. The first, he said, would be the actual hackers. That certainly might have historical precedent. It could be like charging a spy caught in the U.S.

But here’s where things get interesting: Carlin said the DOJ could actually name the government behind the operation, or officials in that government.

“It could also mean prosecuting,” he said, “laying out in a prosecution document the governments, the people in the government who are doing it.”

Foreign government officials can, theoretically, be indicted, or simply named in an indictment, which itself could be punitive. Carlin points out that indicting foreign officials isn’t unheard of. In 2011 an Iranian Al Qods official was charged with conspiring to kill Saudi Arabia’s ambassador to the U.S. That doesn’t mean there’s an expectation that he’ll ever be brought to court.

But Carlin said the best possible target for a prosecution might be a case where a company that uses stolen technology could be charged.

“Whether it is a state-owned enterprise or a state-supported enterprise in China — if you can figure out and prove that they’ve committed the crime, charging the company means they can’t do business in the U.S., or in Europe,” he said. “It affects their reputation and that then causes them to recalculate: ‘Hey, is this worth it?’”

[Andrea75]

Nations prepare for cyber war http://money.cnn.com/2013/01/07/technology/security/cyber-war/index.html

 

 

 

Security analysts are predicting that 2013 is when nation-sponsored cyberwarfare goes mainstream -- and some think such attacks will lead to actual deaths.

In 2012, large-scale cyberattacks targeted at the Iranian government were uncovered, and in return, Iran is believed to have launched massive attacks aimed at U.S. banks and Saudi oil companies. At least 12 of the world's 15 largest military powers are currently building cyberwarfare programs, according to James Lewis, a cybersecurity expert at the Center for Strategic and International Studies.

So a cyber Cold War is already in progress. But some security companies believe that battle will become even more heated this year.

"Nation states and armies will be more frequent actors and victims of cyberthreats," a team of researchers at McAfee Labs, an Intel (INTC, Fortune 500) subsidiary, wrote in a recent report.

Michael Sutton, head of security research at cloud security company Zscaler, said he expects governments to spend furiously on building up their cyber arsenals. Some may even outsource attacks to online hackers.

The Obama administration and many in Congress have been more vocal about how an enemy nation or a terrorist cell could target the country's critical infrastructure in a cyberattack. Banks, stock exchanges, nuclear power plants and water purification systems are particularly vulnerable, according to numerous assessments delivered to Congress last year.

But after legislation aimed at preventing such attacks stalled in Congress last year, some experts believe this will be the year when cyberattacks turn deadly.

"Nation-state attackers will target critical infrastructure networks such as power grids at unprecedented scale in 2013," predicted Chiranjeev Bordoloi, CEO of security company Top Patch. "These types of attacks could grow more sophisticated, and the slippery slope could lead to the loss of human life."

Security firm IID also predicted that cyberattacks will lead to the loss of life this year.

But others say that such event is unlikely. Our most potent online foes, Russia and China, haven't shown an interest in infrastructure attacks. Those that would pursue them -- Iran is often mentioned -- haven't yet proven capable of pulling off something on that scale.

Verizon (VZ, Fortune 500), which runs an extensive cybersecurity business, is in the doubters' camp.

"Many security experts are using anecdote and opinion for their predictions, whereas Verizon's researchers are applying empirical evidence," said Wade Baker, head of Verizon's security division. "First and foremost, we don't believe there will be an all-out cyber war, although it's possible."

The U.S. has already put would-be attackers on notice. Defense Secretary Leon Panetta said recently that the United States reserves the right to use military force against a nation that launches a cyberattack on the country.

Even if hackers aren't capable of killing with a cyberattack, there is no doubt that they've become more destructive.

The August attack on oil company Saudi Aramco, for instance, crashed 30,000 computers. One month later, a series of attacks brought down the websites of several of the largest U.S. banks. It was the largest "denial of service" attack ever recorded, by a significant margin.

Those kinds of attacks will grow "exponentially" in 2013, McAfee predicts.

"Recently, we have seen several attacks in which the only goal was to cause as much damage as possible; we expect this malicious behavior to grow in 2013," the McAfee researchers wrote. "The worrying fact is that companies appear to be rather vulnerable to such attacks."

But there may be some good news on the cybersecurity front. Hacktivist group Anonymous is starting to fade.

The leaderless collective's attacks have gained less attention lately, and many proposed operations have failed. That's because companies are beefing up their defenses against Anonymous' main weapon, the denial of service attack.

"Anonymous' level of technical sophistication has stagnated and its tactics are better understood by its potential victims," McAfee said in a recent research report. "While hacktivist attacks won't end in 2013, if ever, they are expected to decline in number. Sympathizers of Anonymous are suffering."