Welcome!

Government Cloud Authors: Liz McMillan, Elizabeth White, Chris Kocher, Ed Featherston, XebiaLabs Blog

Related Topics: Cloud Security, Government Cloud

Cloud Security: Blog Post

Burning Down the House for Fun and Profit

The Pros and Cons of Naming and Shaming

In October of 1962, during the buildup to the Cuban Missile Crisis, a debate between Adlai Stevenson and Valerian Alexandrovich Zorin at the United Nations Security Council, revealed how far the U.S. was willing to go to produce evidence that the Soviet Union was indeed stockpiling tactical nuclear weapons and ballistic missiles in North America. The Soviets, reluctance to be truthful "in the court of world opinion", forced the hand of the U.S. to produce the very intelligence that the Soviets' claimed the U.S. did not have. Once the overhead photos of the missiles were shared publicly, the Soviets immediately countered that the imagery was fake. We knew the truth then and we know it today, the Soviets had been caught in their lie.

What we saw this week was very similar to what we saw in 1962.  What is most interesting in this case is that the bombshell was not dropped in a stuffy chamber full of wrinkly policy makers, nor was it used by the administration to draw a hard line under Executive Order 13636 that President Obama signed last week. No, the story was brought to light by a single, private sector entity using unclassified information that was publicly available for anyone to put together. By doing so, a precedent has been set. Finally, the veil has been lifted. Now, the public was able take a glimpse at an unseen threat that many within the security industry have been following closely for nearly a decade.  A complex, intangible idea has a face, or rather a building, attached to it.

So what does this mean? Is this good, bad or somewhere in the middle?

Operational Caveat:
Since 13 February, Cyber Squared's ThreatConnect.com has detected an unknown security research group, (believed to be Mandiant) sink-holing known "Comment Group" command and control infrastructure to a variety of named Virtual Private Servers (VPS) ahead of their 19 February report release. All "Comment Group" infrastructure has been freely available to vetted ThreatConnect users since November 2012.

The Pros:
Unfortunately, there are no lanes in the road that point out clear-cut standards by which organizations can measure if they are responsibly or irresponsibly disclosing cyber threat information. While not everyone supports public disclosures of this nature, we can look at both sides of what has occurred and find the benefits and cost of this massive disclosure.

PRO1: Finally an organization has developed a public attribution picture, publicly naming and shaming China for behavior that many have observed internationally for over a decade.

PRO2: A precedent has now been set for the entire security community; there are many others who have chosen to hold off on disclosing details of attacks or operationalizing infrastructure take downs out of concerns with tipping the threat actors and forcing them to change their TTPs and operational security. Now a green-light has been given to disclose similar details and to unilaterally act to take down large chunks of malicious infrastructure associated with APT's.

PRO3: The United States Government (USG) appears to have handed over the issue of Chinese cyber espionage to commercial industry. Some may argue that this level of disclosure should only be part of an official USG response. However, allowing industries to self-regulate and establish norms of internet behavior may serve as a more efficient way to manage threats of this nature.

PRO4: This now gives the security industry something to measure against.  Not only can the industry observe and measure how "Comment Group" will respond to the disclosure, but also their reactions to sweeping sinkhole operations in addition to target reacquisition efforts.  The industry can also pay attention to general responses from other Chinese APT groups.

PRO5: A disclosure at this level raises the issue of nation state sponsored or sanctioned cyber espionage to a larger audience, keeping the issue in the spotlight and increasing overall global awareness of the threat posed by Chinese cyber espionage.

The Cons:
On the flipside, despite the new opportunities that this may present the industry, there are untold numbers of secondary effects that could come to light because of this disclosure.

CON1: The USG appears to be sidestepping a strategic national policy issue by allowing a commercial entity to assume all of the risk by acting as the mouthpiece that may influence U.S.-China relations. If the USG is to send a message, it needs to send it unequivocally with no appearance of a puppet.

CON2: This may increase the precedent for foreign governments or non-U.S. companies that wish to embarrass the U.S. or western allies by attributing details of other sophisticated threats to western powers.

CON3: "Comment Group", while quite effective, could be considered "low hanging fruit".  There were many "eyes on" from across the global security community which were actively monitoring the threat. Many organizations that had adequate visibility of "Comment Group" infrastructure, capabilities and operations now find themselves exposed to the unknown.  Assuming a Chinese military intelligence unit isn't just going to give up and go home, everyone is now equally vulnerable to whatever they use next.

CON4: A single Chinese APT group out of an average of approximately 20 APT groups would only address 5% of the overall problem. By disclosing details of just one threat group, the effect to Chinese cyber espionage operations would be minimal.

CON5: A detailed disclosure at this level reveals a laundry list of specific items that the Chinese can now use as lessons learned to improve upon overall tradecraft. This increases the probability of Chinese counter intelligence operations, operations security, oversight and an overall process improvement which will diminish the security industries ability to effectively combat the threat of Chinese APT's in the future.

Conclusion
Only time will tell if the gains outweigh any losses associated with the disclosure.  Despite growing evidence that this is the work of the Chinese, the official response has been no different than what we have seen before.  A poor embassy spokesperson, followed by spokespeople for the Ministry of Foreign Affairs and Defense, are forced to respond with the standard canned and reflexive denial stating that accusing China without evidence is "irresponsible" and "unprofessional" or that China is ultimately the victim and would never do such a thing. What this spokespersons probably doesn't understand, through the layers of party bureaucracy, is how "irresponsible" and "unprofessional" the Chinese Computer Network Exploitation (CNE) machine actually is. If this is the case, it highlights how intentionally deceptive the PRC is or that the left hand has no idea what the right hand is doing in the shadows.

Ultimately, what is truly "irresponsible" and "unprofessional" is targeting the same individual four times a day through emails written in broken English with an attached implant embedded in a self extracting archive. For those who bear the scars of APT attacks or organizations who specialize in protecting customers from such threats, it becomes quite clear, the Chinese, in their hunger to support their modernization and economic rise, have compromised themselves before a global economy.

More Stories By Rich Barger

Rich is the Chief Intelligence Officer for Cyber Squared and the ThreatConnect Intelligence Research Team (TCIRT) Director.

@ThingsExpo Stories
If you’re responsible for an application that depends on the data or functionality of various IoT endpoints – either sensors or devices – your brand reputation depends on the security, reliability, and compliance of its many integrated parts. If your application fails to deliver the expected business results, your customers and partners won't care if that failure stems from the code you developed or from a component that you integrated. What can you do to ensure that the endpoints work as expect...
SYS-CON Events announced today that ReadyTalk, a leading provider of online conferencing and webinar services, has been named Vendor Presentation Sponsor at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. ReadyTalk delivers audio and web conferencing services that inspire collaboration and enable the Future of Work for today’s increasingly digital and mobile workforce. By combining intuitive, innovative tec...
Just over a week ago I received a long and loud sustained applause for a presentation I delivered at this year’s Cloud Expo in Santa Clara. I was extremely pleased with the turnout and had some very good conversations with many of the attendees. Over the next few days I had many more meaningful conversations and was not only happy with the results but also learned a few new things. Here is everything I learned in those three days distilled into three short points.
WebRTC adoption has generated a wave of creative uses of communications and collaboration through websites, sales apps, customer care and business applications. As WebRTC has become more mainstream it has evolved to use cases beyond the original peer-to-peer case, which has led to a repeating requirement for interoperability with existing infrastructures. In his session at @ThingsExpo, Graham Holt, Executive Vice President of Daitan Group, will cover implementation examples that have enabled ea...
There is growing need for data-driven applications and the need for digital platforms to build these apps. In his session at 19th Cloud Expo, Muddu Sudhakar, VP and GM of Security & IoT at Splunk, will cover different PaaS solutions and Big Data platforms that are available to build applications. In addition, AI and machine learning are creating new requirements that developers need in the building of next-gen apps. The next-generation digital platforms have some of the past platform needs a...
Fifty billion connected devices and still no winning protocols standards. HTTP, WebSockets, MQTT, and CoAP seem to be leading in the IoT protocol race at the moment but many more protocols are getting introduced on a regular basis. Each protocol has its pros and cons depending on the nature of the communications. Does there really need to be only one protocol to rule them all? Of course not. In his session at @ThingsExpo, Chris Matthieu, co-founder and CTO of Octoblu, walk you through how Oct...
Smart Cities are here to stay, but for their promise to be delivered, the data they produce must not be put in new siloes. In his session at @ThingsExpo, Mathias Herberts, Co-founder and CTO of Cityzen Data, will deep dive into best practices that will ensure a successful smart city journey.
Businesses are struggling to manage the information flow and interactions between all of these new devices and things jumping on their network, and the apps and IT systems they control. The data businesses gather is only helpful if they can do something with it. In his session at @ThingsExpo, Chris Witeck, Principal Technology Strategist at Citrix, will discuss how different the impact of IoT will be for large businesses, expanding how IoT will allow large organizations to make their legacy ap...
Adobe is changing the world though digital experiences. Adobe helps customers develop and deliver high-impact experiences that differentiate brands, build loyalty, and drive revenue across every screen, including smartphones, computers, tablets and TVs. Adobe content solutions are used daily by millions of companies worldwide-from publishers and broadcasters, to enterprises, marketing agencies and household-name brands. Building on its established design leadership, Adobe enables customers not o...
SYS-CON Events announced today that Numerex Corp, a leading provider of managed enterprise solutions enabling the Internet of Things (IoT), will exhibit at the 19th International Cloud Expo | @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Numerex Corp. (NASDAQ:NMRX) is a leading provider of managed enterprise solutions enabling the Internet of Things (IoT). The Company's solutions produce new revenue streams or create operating...
24Notion is full-service global creative digital marketing, technology and lifestyle agency that combines strategic ideas with customized tactical execution. With a broad understand of the art of traditional marketing, new media, communications and social influence, 24Notion uniquely understands how to connect your brand strategy with the right consumer. 24Notion ranked #12 on Corporate Social Responsibility - Book of List.
Major trends and emerging technologies – from virtual reality and IoT, to Big Data and algorithms – are helping organizations innovate in the digital era. However, to create real business value, IT must think beyond the ‘what’ of digital transformation to the ‘how’ to harness emerging trends, innovation and disruption. Architecture is the key that underpins and ties all these efforts together. In the digital age, it’s important to invest in architecture, extend the enterprise footprint to the cl...
Why do your mobile transformations need to happen today? Mobile is the strategy that enterprise transformation centers on to drive customer engagement. In his general session at @ThingsExpo, Roger Woods, Director, Mobile Product & Strategy – Adobe Marketing Cloud, covered key IoT and mobile trends that are forcing mobile transformation, key components of a solid mobile strategy and explored how brands are effectively driving mobile change throughout the enterprise.
As ridesharing competitors and enhanced services increase, notable changes are occurring in the transportation model. Despite the cost-effective means and flexibility of ridesharing, both drivers and users will need to be aware of the connected environment and how it will impact the ridesharing experience. In his session at @ThingsExpo, Timothy Evavold, Executive Director Automotive at Covisint, will discuss key challenges and solutions to powering a ride sharing and/or multimodal model in the a...
In his general session at 18th Cloud Expo, Lee Atchison, Principal Cloud Architect and Advocate at New Relic, discussed cloud as a ‘better data center’ and how it adds new capacity (faster) and improves application availability (redundancy). The cloud is a ‘Dynamic Tool for Dynamic Apps’ and resource allocation is an integral part of your application architecture, so use only the resources you need and allocate /de-allocate resources on the fly.
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lea...
SYS-CON Events announced today that Roundee / LinearHub will exhibit at the WebRTC Summit at @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. LinearHub provides Roundee Service, a smart platform for enterprise video conferencing with enhanced features such as automatic recording and transcription service. Slack users can integrate Roundee to their team via Slack’s App Directory, and '/roundee' command lets your video conference ...
Web Real-Time Communication APIs have quickly revolutionized what browsers are capable of. In addition to video and audio streams, we can now bi-directionally send arbitrary data over WebRTC's PeerConnection Data Channels. With the advent of Progressive Web Apps and new hardware APIs such as WebBluetooh and WebUSB, we can finally enable users to stitch together the Internet of Things directly from their browsers while communicating privately and securely in a decentralized way.
"My role is working with customers, helping them go through this digital transformation. I spend a lot of time talking to banks, big industries, manufacturers working through how they are integrating and transforming their IT platforms and moving them forward," explained William Morrish, General Manager Product Sales at Interoute, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...