Executives Discussed Security Breaches, Attacks During APT Summit

Behind closed doors, more than 100 senior executives talked freely about the difficulties in defending against APTs and regulatory changes they wanted to see.

In a closed-door summit on advanced persistent threats, CISOs, CIOs and CEOs revealed that their organizations had been breached at least once by sophisticated attackers intent on stealing sensitive information. Several admitted they wouldn't be able to tell if they had been attacked.

More than 100 C-level executives from major organizations attended the Summit on Advanced Persistent Threats in Washington, D.C., last July and candidly discussed what they were doing about cyber-security and targeted attacks, Eddie Schwartz, chief security of RSA Security, EMC's security division, told eWEEK. On Sept. 13, trade group TechAmerica and RSA released key findings summarizing the discussion between forum attendees. An in-depth report is expected in October.

Schwartz said he was surprised at how pervasive APT activity is. "Literally everyone had something to say," he said, noting that many of the executives discussed incidents they had not yet disclosed publicly even though customers may be affected.

"The frequency and volume of attacks have reached pandemic levels," Schwartz said.

Security professionals from government agencies and the private sector acknowledged that they must assume they are already compromised, Schwartz said. Organizations have to plan and act as though they already have a breach, and act accordingly to minimize the time the attackers are in the network undetected and to limit damage.

The perimeter defense, of trying to block all incoming threats, doesn't work when there are so many ways for attackers to get in, Schwartz said. Instead, an organization has to ensure the "crown jewels" are protected at all times, especially since attackers are now targeting "people" with spear phishing attacks instead of breaking into systems.

Schwartz knows what being in a "state of compromise" feels like. In March, RSA disclosed that unknown attackers had breached its systems and stolen sensitive information relating to its SecurID two-factor authentication technology. The information was later used to launch follow-up attacks on several defense contractors in May.

RSA talked about what had happened with the breach and also "listened to everyone else talk," Schwartz said, adding that being able to hear what other executives were doing and experiencing gave attendees some ideas on what to implement in their organization.

There was a significant "level of shared concerns" among the attendees, which was a clear indicator that these kinds of attacks, while not new, are more pervasive than originally perceived, Schwartz said. More organizations are experiencing attacks, and there is a "growing willingness" to talk about it, he added.

The bad guys are better at information sharing and much faster at analyzing data, Phil Bond, CEO of TechAmerica, told eWEEK. In contrast, companies have a hard time sharing information or discussing incidents with the larger community. In many cases, organizations may be held liable for information shared with third parties because it would violate privacy regulations, even if it were for security purposes, Bond said. There needs to be some tweaks in policy to make it easier for companies to share information with the security community and with the government.

Attendees also acknowledged that cyber-incidents shouldn't just be handled by the security team, but need to be embedded in the organization's overall strategy. Just as the executives plan for natural disasters and sudden downturns in the stock market, cyber-attacks need to be treated as a disaster and all major divisions need to be included in the preparation for defense and incident response, Schwartz said.

Organizations have all conducted some form of employee training or awareness programs, but the traditional programs are generally perceived as being a waste of money, according to Schwartz. Employees do not see the relevance of the training, and the programs do "not make them want to follow the rules," Schwartz added.

Some organizations are taking "forward-leaning approaches" to training, such as running scenario-based "war-games" style of training, where users are actually compromised and then called in to face the consequences, Schwartz said. The employees are shown exactly how a specific action, such as opening an unknown file, results in specific amount of money lost, employees laid off or even someone injured, he added.