Defenses Havent Changed

 

While many things have changed in the post-9/11 world, defenses against cyber-terrorism haven't. Many organizations are still relying on the same defenses developed in the mid-to-late 1990s, said Anup Ghosh, founder and chief scientist of Invincea. "We are defending against 21st century attacks with 20th century technology," he said.

The Defense Department and the Defense Advanced Research Projects Agency's (DARPA) focus on fighting terrorism inhibited innovation in information security, according to Ghosh. Foreign cyber-attackers began penetrating U.S. networks, but instead of publicizing evolving threats and tactics, the government classified the details.

"The market hasn't innovated with the adversary because it hasn't been privy to the exploits or advances in technology," he said. The security industry is still largely reactive as it focuses on defenses that look for known signatures and patterns of attack when it needs new techniques to defend against cutting-edge cyber-attacks, he added.

A few years ago, attacking critical infrastructure was just another "movie idea"-something no one thought would really happen-but last year's Stuxnet Trojan attack was a "wake-up call," F-Secure's Hypponen said. Until Stuxnet was discovered, no one realized these kinds of infrastructure attacks were already happening.

"Look at Die Hard," said Hypponen. As everything has become connected to the Internet and computers have become more ubiquitous, the film's plot has become reality, he said.

But the security situation isn't completely bleak. We have made some progress, especially in the areas of information sharing and interagency cooperation.

The private sector has done a good job communicating with the government about protecting the critical infrastructure, Todd Davis, CEO of LifeLock, told eWEEK at a training summit for law enforcement officials at the New York Stock Exchange. The goal was to bring together "front-line" law enforcement and specialized agencies to share information on what techniques criminals are using and what tools are available for the good guys.

The Defense Industrial Base Cyber Pilot is an example of how industry is working with the Department of Defense to share classified and sensitive data about cyber-attacks. The data collected in a three-month pilot program with 20 companies helped stop "hundreds of attempted intrusions" by identifying malware signatures, said Deputy Defense Secretary William Lynn. The pilot will be expanded to the rest of the industry and key areas of critical infrastructure.

"We are in a so much better space than we used to be," LifeLock's Davis said, adding that now is "one of the best times for collaboration."

In addition, advances in technology have made it much easier and faster for law enforcement and business to identify potential problems. Organizations can deploy forensics and monitoring tools to detect anomalous activity in near-real-time, while police officers have access to more information about drivers during routine traffic stops, Davis said.

The goal of these efforts? To use technology to help stop cyber-attacks.