Welcome!

Government Cloud Authors: Liz McMillan, William Schmarzo, Sematext Blog, Kevin Jackson, SmartBear Blog

Related Topics: Cloud Security, Government Cloud

Cloud Security: Blog Post

Burning Down the House for Fun and Profit

The Pros and Cons of Naming and Shaming

In October of 1962, during the buildup to the Cuban Missile Crisis, a debate between Adlai Stevenson and Valerian Alexandrovich Zorin at the United Nations Security Council, revealed how far the U.S. was willing to go to produce evidence that the Soviet Union was indeed stockpiling tactical nuclear weapons and ballistic missiles in North America. The Soviets, reluctance to be truthful "in the court of world opinion", forced the hand of the U.S. to produce the very intelligence that the Soviets' claimed the U.S. did not have. Once the overhead photos of the missiles were shared publicly, the Soviets immediately countered that the imagery was fake. We knew the truth then and we know it today, the Soviets had been caught in their lie.

What we saw this week was very similar to what we saw in 1962.  What is most interesting in this case is that the bombshell was not dropped in a stuffy chamber full of wrinkly policy makers, nor was it used by the administration to draw a hard line under Executive Order 13636 that President Obama signed last week. No, the story was brought to light by a single, private sector entity using unclassified information that was publicly available for anyone to put together. By doing so, a precedent has been set. Finally, the veil has been lifted. Now, the public was able take a glimpse at an unseen threat that many within the security industry have been following closely for nearly a decade.  A complex, intangible idea has a face, or rather a building, attached to it.

So what does this mean? Is this good, bad or somewhere in the middle?

Operational Caveat:
Since 13 February, Cyber Squared's ThreatConnect.com has detected an unknown security research group, (believed to be Mandiant) sink-holing known "Comment Group" command and control infrastructure to a variety of named Virtual Private Servers (VPS) ahead of their 19 February report release. All "Comment Group" infrastructure has been freely available to vetted ThreatConnect users since November 2012.

The Pros:
Unfortunately, there are no lanes in the road that point out clear-cut standards by which organizations can measure if they are responsibly or irresponsibly disclosing cyber threat information. While not everyone supports public disclosures of this nature, we can look at both sides of what has occurred and find the benefits and cost of this massive disclosure.

PRO1: Finally an organization has developed a public attribution picture, publicly naming and shaming China for behavior that many have observed internationally for over a decade.

PRO2: A precedent has now been set for the entire security community; there are many others who have chosen to hold off on disclosing details of attacks or operationalizing infrastructure take downs out of concerns with tipping the threat actors and forcing them to change their TTPs and operational security. Now a green-light has been given to disclose similar details and to unilaterally act to take down large chunks of malicious infrastructure associated with APT's.

PRO3: The United States Government (USG) appears to have handed over the issue of Chinese cyber espionage to commercial industry. Some may argue that this level of disclosure should only be part of an official USG response. However, allowing industries to self-regulate and establish norms of internet behavior may serve as a more efficient way to manage threats of this nature.

PRO4: This now gives the security industry something to measure against.  Not only can the industry observe and measure how "Comment Group" will respond to the disclosure, but also their reactions to sweeping sinkhole operations in addition to target reacquisition efforts.  The industry can also pay attention to general responses from other Chinese APT groups.

PRO5: A disclosure at this level raises the issue of nation state sponsored or sanctioned cyber espionage to a larger audience, keeping the issue in the spotlight and increasing overall global awareness of the threat posed by Chinese cyber espionage.

The Cons:
On the flipside, despite the new opportunities that this may present the industry, there are untold numbers of secondary effects that could come to light because of this disclosure.

CON1: The USG appears to be sidestepping a strategic national policy issue by allowing a commercial entity to assume all of the risk by acting as the mouthpiece that may influence U.S.-China relations. If the USG is to send a message, it needs to send it unequivocally with no appearance of a puppet.

CON2: This may increase the precedent for foreign governments or non-U.S. companies that wish to embarrass the U.S. or western allies by attributing details of other sophisticated threats to western powers.

CON3: "Comment Group", while quite effective, could be considered "low hanging fruit".  There were many "eyes on" from across the global security community which were actively monitoring the threat. Many organizations that had adequate visibility of "Comment Group" infrastructure, capabilities and operations now find themselves exposed to the unknown.  Assuming a Chinese military intelligence unit isn't just going to give up and go home, everyone is now equally vulnerable to whatever they use next.

CON4: A single Chinese APT group out of an average of approximately 20 APT groups would only address 5% of the overall problem. By disclosing details of just one threat group, the effect to Chinese cyber espionage operations would be minimal.

CON5: A detailed disclosure at this level reveals a laundry list of specific items that the Chinese can now use as lessons learned to improve upon overall tradecraft. This increases the probability of Chinese counter intelligence operations, operations security, oversight and an overall process improvement which will diminish the security industries ability to effectively combat the threat of Chinese APT's in the future.

Conclusion
Only time will tell if the gains outweigh any losses associated with the disclosure.  Despite growing evidence that this is the work of the Chinese, the official response has been no different than what we have seen before.  A poor embassy spokesperson, followed by spokespeople for the Ministry of Foreign Affairs and Defense, are forced to respond with the standard canned and reflexive denial stating that accusing China without evidence is "irresponsible" and "unprofessional" or that China is ultimately the victim and would never do such a thing. What this spokespersons probably doesn't understand, through the layers of party bureaucracy, is how "irresponsible" and "unprofessional" the Chinese Computer Network Exploitation (CNE) machine actually is. If this is the case, it highlights how intentionally deceptive the PRC is or that the left hand has no idea what the right hand is doing in the shadows.

Ultimately, what is truly "irresponsible" and "unprofessional" is targeting the same individual four times a day through emails written in broken English with an attached implant embedded in a self extracting archive. For those who bear the scars of APT attacks or organizations who specialize in protecting customers from such threats, it becomes quite clear, the Chinese, in their hunger to support their modernization and economic rise, have compromised themselves before a global economy.

More Stories By Rich Barger

Rich is the Chief Intelligence Officer for Cyber Squared and the ThreatConnect Intelligence Research Team (TCIRT) Director.

@ThingsExpo Stories
Identity is in everything and customers are looking to their providers to ensure the security of their identities, transactions and data. With the increased reliance on cloud-based services, service providers must build security and trust into their offerings, adding value to customers and improving the user experience. Making identity, security and privacy easy for customers provides a unique advantage over the competition.
"We've discovered that after shows 80% if leads that people get, 80% of the conversations end up on the show floor, meaning people forget about it, people forget who they talk to, people forget that there are actual business opportunities to be had here so we try to help out and keep the conversations going," explained Jeff Mesnik, Founder and President of ContentMX, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
"There's a growing demand from users for things to be faster. When you think about all the transactions or interactions users will have with your product and everything that is between those transactions and interactions - what drives us at Catchpoint Systems is the idea to measure that and to analyze it," explained Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Systems, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York Ci...
Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with the 19th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world and ThingsExpo Silicon Valley Call for Papers is now open.
I wanted to gather all of my Internet of Things (IOT) blogs into a single blog (that I could later use with my University of San Francisco (USF) Big Data “MBA” course). However as I started to pull these blogs together, I realized that my IOT discussion lacked a vision; it lacked an end point towards which an organization could drive their IOT envisioning, proof of value, app dev, data engineering and data science efforts. And I think that the IOT end point is really quite simple…
"My role is working with customers, helping them go through this digital transformation. I spend a lot of time talking to banks, big industries, manufacturers working through how they are integrating and transforming their IT platforms and moving them forward," explained William Morrish, General Manager Product Sales at Interoute, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
You think you know what’s in your data. But do you? Most organizations are now aware of the business intelligence represented by their data. Data science stands to take this to a level you never thought of – literally. The techniques of data science, when used with the capabilities of Big Data technologies, can make connections you had not yet imagined, helping you discover new insights and ask new questions of your data. In his session at @ThingsExpo, Sarbjit Sarkaria, data science team lead ...
Extracting business value from Internet of Things (IoT) data doesn’t happen overnight. There are several requirements that must be satisfied, including IoT device enablement, data analysis, real-time detection of complex events and automated orchestration of actions. Unfortunately, too many companies fall short in achieving their business goals by implementing incomplete solutions or not focusing on tangible use cases. In his general session at @ThingsExpo, Dave McCarthy, Director of Products...
WebRTC is bringing significant change to the communications landscape that will bridge the worlds of web and telephony, making the Internet the new standard for communications. Cloud9 took the road less traveled and used WebRTC to create a downloadable enterprise-grade communications platform that is changing the communication dynamic in the financial sector. In his session at @ThingsExpo, Leo Papadopoulos, CTO of Cloud9, discussed the importance of WebRTC and how it enables companies to focus...
Verizon Communications Inc. (NYSE, Nasdaq: VZ) and Yahoo! Inc. (Nasdaq: YHOO) have entered into a definitive agreement under which Verizon will acquire Yahoo's operating business for approximately $4.83 billion in cash, subject to customary closing adjustments. Yahoo informs, connects and entertains a global audience of more than 1 billion monthly active users** -- including 600 million monthly active mobile users*** through its search, communications and digital content products. Yahoo also co...
A critical component of any IoT project is what to do with all the data being generated. This data needs to be captured, processed, structured, and stored in a way to facilitate different kinds of queries. Traditional data warehouse and analytical systems are mature technologies that can be used to handle certain kinds of queries, but they are not always well suited to many problems, particularly when there is a need for real-time insights.
Amazon has gradually rolled out parts of its IoT offerings in the last year, but these are just the tip of the iceberg. In addition to optimizing their back-end AWS offerings, Amazon is laying the ground work to be a major force in IoT – especially in the connected home and office. Amazon is extending its reach by building on its dominant Cloud IoT platform, its Dash Button strategy, recently announced Replenishment Services, the Echo/Alexa voice recognition control platform, the 6-7 strategic...
The best-practices for building IoT applications with Go Code that attendees can use to build their own IoT applications. In his session at @ThingsExpo, Indraneel Mitra, Senior Solutions Architect & Technology Evangelist at Cognizant, provided valuable information and resources for both novice and experienced developers on how to get started with IoT and Golang in a day. He also provided information on how to use Intel Arduino Kit, Go Robotics API and AWS IoT stack to build an application tha...
IoT generates lots of temporal data. But how do you unlock its value? You need to discover patterns that are repeatable in vast quantities of data, understand their meaning, and implement scalable monitoring across multiple data streams in order to monetize the discoveries and insights. Motif discovery and deep learning platforms are emerging to visualize sensor data, to search for patterns and to build application that can monitor real time streams efficiently. In his session at @ThingsExpo, ...
SYS-CON Events announced today that LeaseWeb USA, a cloud Infrastructure-as-a-Service (IaaS) provider, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. LeaseWeb is one of the world's largest hosting brands. The company helps customers define, develop and deploy IT infrastructure tailored to their exact business needs, by combining various kinds cloud solutions.
SYS-CON Events announced today that 910Telecom will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Housed in the classic Denver Gas & Electric Building, 910 15th St., 910Telecom is a carrier-neutral telecom hotel located in the heart of Denver. Adjacent to CenturyLink, AT&T, and Denver Main, 910Telecom offers connectivity to all major carriers, Internet service providers, Internet backbones and ...
Big Data, cloud, analytics, contextual information, wearable tech, sensors, mobility, and WebRTC: together, these advances have created a perfect storm of technologies that are disrupting and transforming classic communications models and ecosystems. In his session at @ThingsExpo, Erik Perotti, Senior Manager of New Ventures on Plantronics’ Innovation team, provided an overview of this technological shift, including associated business and consumer communications impacts, and opportunities it ...
SYS-CON Events announced today that Venafi, the Immune System for the Internet™ and the leading provider of Next Generation Trust Protection, will exhibit at @DevOpsSummit at 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Venafi is the Immune System for the Internet™ that protects the foundation of all cybersecurity – cryptographic keys and digital certificates – so they can’t be misused by bad guys in attacks...
It’s 2016: buildings are smart, connected and the IoT is fundamentally altering how control and operating systems work and speak to each other. Platforms across the enterprise are networked via inexpensive sensors to collect massive amounts of data for analytics, information management, and insights that can be used to continuously improve operations. In his session at @ThingsExpo, Brian Chemel, Co-Founder and CTO of Digital Lumens, will explore: The benefits sensor-networked systems bring to ...
Manufacturers are embracing the Industrial Internet the same way consumers are leveraging Fitbits – to improve overall health and wellness. Both can provide consistent measurement, visibility, and suggest performance improvements customized to help reach goals. Fitbit users can view real-time data and make adjustments to increase their activity. In his session at @ThingsExpo, Mark Bernardo Professional Services Leader, Americas, at GE Digital, discussed how leveraging the Industrial Internet a...