DISC InfoSec blog

The UK’s 2010 National Security Strategy identified cyberattacks as one of the four highest-priority risks faced by the UK. President Obama has declared cybersecurity as one of the most serious economic and national security challenges the US faces as a nation.

There is an Advanced Persistent Threat (APT) posed by organised crime and state level entities, targeting large multi-national corporations and foreign governments. Organisations of all sizes can suffer collateral damage. China has been regularly identified in the press as a major player in modern cyberwar activities but, until now, little has been written to describe the depth and severity of this threat.

21st Century Chinese Cyberwarfare, from IT Governance Publishing, is a comprehensive and in-depth review of the Chinese role in cyberwarfare. Drawing on a combination of cultural, historical, business, linguistic and personal experience, the book attempts to explain China to the uninitiated. It describes how the combination of Chinese Communism and the unique cultural and linguistic heritage of the People’s Republic of China are driving Chinese cyber activity.

The author, Lieutenant Colonel (Ret’d) William Hagestad II, is an internationally recognised subject matter expert on the Chinese People’s Liberation Army and Government Information Warfare. He advises international intelligence organisations and multi-national commercial enterprises with regard to their internal IT security governance and external security policies, making him the ideal person to write this book.

21st Century Chinese Cyberwarfare is the first book to gather the salient information regarding the use of cyberwarfare doctrine by the People’s Republic of China, highlighting the increasing threat it imposes to the western world and the fact that Chinese cyberwarfare is a clear and present danger that can no longer be ignored. The book should be read by many, from individuals through to governmental departments, with everyone finding benefit in it.

William Hagestad II adds, “My intent with this book was to introduce my readers to the Chinese culture, history and language through the lens of the People’s Liberation Army (PLA) information security & cyber warfare initiatives as a basis for economic, political and military hegemony by the Chinese Communist Party.”

Alan Calder, CEO of IT Governance comments, “This book provides a fascinating and comprehensive study of the evolution and current nature of the Chinese approach to war ‘by other means’, conducted in what the Chinese see as the fifth sphere of war: cyberspace. ‘Know your enemy’ is a good starting point for any defence strategist and this book is an outstanding contribution to a better understanding of cyber security challenges that should be read by information security professionals the world over.”

21st Century Chinese Cyberwarfare can be purchased in local currency from the ITG website

Related story

NATO Drafting Cyber Warfare International Law Manual

By SEN. KAY BAILEY HUTCHISON, SEN. CHUCK GRASSLEY, SEN. SAXBY CHAMBLISS and SEN. LISA MURKOWSKI @ POLITICO

The Senate is about to consider cybersecurity legislation. Ensuring the integrity and safety of our nation’s critical infrastructure is a bipartisan issue that Congress and President Barack Obama must work together to tackle.

There is a right way and a wrong way to address cybersecurity. The right way is for the government and private sector to work together to solve problems, help the free flow of information between network managers and encourage investment and innovation in cybersecurity. The wrong way is new, heavy-handed, costly regulation and further expansion of government bureaucracy that will slow our nation’s response to cyberthreats and increase vulnerabilities.

First, the government must do a better job of protecting its own systems. These networks contain some of our most sensitive data and control some of our most important facilities. To improve network security, there are two areas in which Congress could legislate immediately.

The first is reforming the Federal Information Security Management Act. This law, crafted to improve the security of government information systems, is a decade old and should be updated with a real-time monitoring system.

The second critical component is leveraging our key federal research institutions — including national laboratories, the National Science Foundation and the Defense Advanced Research Projects Agency — to maintain U.S. global leadership in cybersecurity innovation. By developing leading-edge cybersecurity technologies, the United States can stay one step ahead of cyberthreats, whether from hackers, terrorists or nation-states.

Though improving the security of government systems is a crucial first step, it is not enough. The federal government does not own the overwhelming majority of the infrastructure that could be the target of cyberthreats.

For example, more than 1,800 entities own or operate components of our nation’s electrical grid. To secure critical infrastructure, we should focus on strengthening our existing oversight frameworks instead of creating duplicative regulatory regimes that give additional agencies, such as the Department of Homeland Security, broad new authorities to regulate.

In fighting cyberthreats, forewarned is forearmed. The single most effective way of advancing cybersecurity is sharing cyberthreat information between the government and industry, as well as within the private sector. Yet this collaborative relationship is undermined by our laws and policies — which put the government and private entities at a severe disadvantage in proactively identifying and countering cyberthreats.

The government often collects valuable information about potential threats that can and should be shared with private entities — without compromising national security. Companies should be free from legal barriers and constraints that prevent or deter them from voluntarily sharing cyberthreat information with their peers or with the government.

As a government, we should work with the private sector to help them respond to cyberthreats. Not punish them for being victims of cyberattacks or for working with others to prevent future attacks.

In addition, our nation’s criminal laws must be updated to account for the growing number of cybercrimes. We support legislation to clarify and expand the Computer Fraud and Abuse Act — including increasing existing penalties, defining new offenses and clarifying the scope of current criminal conduct.

These changes will ensure that our criminal laws keep pace with the ever-evolving threats posed by cybercriminals.

This approach should lead to significant strengthening of our nation’s cybersecurity and quickly gain bipartisan support in Congress. Unfortunately, the administration’s proposal would create new, massive and ill-defined regulatory burdens — forcing many private companies that work with digital networks to be regulated by DHS.

Such broad new regulatory powers will, in turn, require a dramatic and costly expansion of the federal bureaucracy and its regulatory reach. This expansion will not help secure America’s networks and will harm both innovation in cybersecurity and our nation’s already suffering economy.

Now is not the time to increase the size and cost of the federal bureaucracy. We need to focus instead on reforming existing federal government entities, streamlining and targeting regulatory efforts, looking for efficiencies and strengthening our nation’s capacity to deal with cyberattacks.

The administration’s proposal is ultimately a costly and heavy-handed regulatory approach. It will not work and it won’t pass Congress. We hope the president will work with us on a more collaborative approach between government and business to effectively address the critical issue of cybersecurity.

2011 will be remembered as the year of the hacker. Large, well know brands were targeted like never before causing a media frenzy and major concern for consumers around the world.
Make your New Years-Resolution to tackle Cybersecurity. Get a head-start. Buy this book and let the master strategists show you how to fight the information war!

Tis the season to be jolly,
Put an eBook in your trolley,
In the warm without a brolly,
Don’t miss out – you could be sorry!”

Assessing Information Security: Strategies, Tactics, Logic and Framework
by Andrew Vladimirov, Konstantin Gavrilenko and Andriej Michajlowski.

RRP: $69.99

Price: $49.95
You Save: $20.04

History has taught us: never underestimate the amount of money, time, and effort someone will expend to thwart a security system. It’s always better to assume the worst. Assume your adversaries are better than they are. Assume science and technology will soon be able to do things they cannot yet. Give yourself a margin for error. Give yourself more security than you need today. When the unexpected happens, you’ll be glad you did. – Bruce Schneier

Realise the benefits of Internet technologies, while ensuring your company is protected from the associated risks.

If you want to make the Internet work for your business, you need to take the right precautions – Buy this book today!

Realize the benefits of Internet technologies, while ensuring your company is protected from the associated risks!

An effective risk management strategy is vital to your company s survival
Internet technologies have revolutionized the way that business is conducted. However, these innovations expose your business to various risks. Inadequate security can lead to the theft of customer data and, in the event of technological failure or a cyberattack, your business could lose its ability to function altogether. An effective risk management strategy is, therefore, vital to your company s survival.

Understand the origins of cyber risks and develop suitable strategies for their management
Cyber Risks for Business Professionals: A Management Guide is a general guide to the origins of cyber risks and to developing suitable strategies for their management. It provides a breakdown of the main risks involved and shows you how to manage them. Covering the relevant legislation on information security and data protection, the author combines his legal expertise with a solid, practical grasp of the latest developments in IT to offer a comprehensive overview of a highly complex subject.

Expert guidance examining the operational and technological risks
Drawing on interviews with experts from Clifford Chance, Capgemini and Morgan Stanley amongst others, the book examines the operational and technological risks alongside the legal and compliance issues. This book will be invaluable to lawyers and accountants, as well as to company directors and business professionals.

Secretary of Defense William S Cohen on the 3 Main Threats Facing the United States, secretary Cohen emphasis cyber threat is the most dangerous out of three. Click the link above to watch his video on three main threats.

Famous quotes from Secretary Cohen:
While we are not and cannot become the world’s policeman, neither can we become a prisoner of world events, isolated and tucked safely away in a continental cocoon.

There is no foolproof security that we can provide. But to say that we can’t protect against everything doesn’t mean that we shouldn’t protect against those that can cause us catastrophic harm.

For while the threat of nuclear holocaust has been significantly reduced, the world remains a very unsettled and dangerous place.

Terrorism is escalating to the point that Americans soon may have to choose between civil liberties and more intrusive means of protection.

We will not win the war on terror through military action. The sharing of information and intelligence will be vital to protecting our country.

The more reliant we become upon computers and information systems, the more vulnerable we become to cyber-terrorists who will conceive unlimited ways to cripple our infrastructure, our power grids, our banking systems, our financial markets, our space based communications systems.

Related books by Secretary of Defense William S Cohen

Presentation Abstract:by Anthony M. Freed

“The explosive growth of Internet and IP-enabled devices is reshaping communication, collaboration and commerce opportunities for individuals and organizations around the world. At the same time, miscreants are abusing the Internet’s open and any-to-any communication architecture for malicious purposes, leaving many users at risk and the future of a secure Internet as an aspiration rather than a reality.”

“The current cybersecurity model is reactive, disconnected and unable to keep pace with the seismic explosion in malware. Providing protection to a heterogeneous world of connected devices requires a new approach to security.”

“McAfee CTO George Kurtz will show that incremental improvements can’t bridge the opportunity gap and explain the required paradigm shift of driving security down the stack.”

Hacker Halted: McAfee’s George Kurtz Discusses the War on Security

Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition by George Kurtz

Richard Clarke the former Cybersecurity Czar for President George W. Bush and a noted expert on cyber war and counter-terrorism, in which Clarke identifies China’s government and its industries as a major source of the cyber security hacking and espionage that is taking place in 2011. In addition to discussing China’s cyber activity on the video, Clarke outlines four main buckets of cyber attacks today, and why many people consider 2011 the “Year of the Hack.”

The Clarke video was put together and released in October 2011 to coincide with the Eighth Annual National Cyber Security Awareness Month, which is sponsored by the Department of Homeland Security in cooperation with the National Cyber Security Alliance (NCSA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC).

Cyber War: The Next Threat to National Security and What to Do About It

Per Greg Wilshusen (GOA Information Security Director) vulnerabilities exist in all 24 federal agencies and 11 out of 24 federal agencies have significant deficiencies. There has been a 650% increase in the incidents. Take a listen to the video to know more about the details of these vulnerabilities and more importantly the plans to mitigate these risks especially 11 agencies that have significant risks.

On The Communicators, Greg Wilshusen, director of the Government Accountability Office’s (GAO) Information Security department, will discuss a report the GAO released this month that said 24 federal agencies’ computer systems are at risk of security breaches.

UK Foreign Secretary Hague: Britain willing to strike 1st to defend itself against a cyberattack from enemy state

@FoxNews
LONDON – Britain is prepared to strike first to defend itself against a cyber attack from an enemy state, Foreign Secretary William Hague said Tuesday.

His warning was the first clear signal that the UK has developed new weapons for the online battlefield.

Hague told The Sun that the globe was in the grip of a new and financially-crippling “arms race in cyberspace.”

He said he could not guarantee that Britain would be able to repel a major cyber assault on the nation’s essential infrastructure — including water works, power plants and the air traffic control system.

But he said, “We will defend ourselves in every way we can, not only to deflect but to prevent attacks that we know are taking place.”

Hague gave no clues on the makeup of Britain’s new electronic arsenal, saying, “The rest of the world will have to guess.”

The British government is pouring an extra £650 million ($1 billion) into developing deterrents to hostile viruses, which are being produced almost constantly.

“We are trying to prevent an arms race in cyber space,” Hague said. “Given that the Internet changes every day, and billions more people will have access to it over the coming years, the potential for that arms race to grow and go out of control is enormous.”

He added, “There is no 100 percent defense against this, just as there isn’t against any other form of attack. We have to defend critical national infrastructure. We have to defend national security. We have to defend our entire commercial and economic system.”

Hague spoke ahead of a cyberspace conference. Senior officials from more than 60 nations and bosses of online giants will meet in London next month to discuss the cyber menace and draw up an “international rule book” on how best to fight it.

Our assessment is that cyberattacks will be a significant component of future conflicts. Over thirty countries are creating cyber units in their militaries. It is unrealistic to believe that each one will limit its capabilities to defense. Moreover, the centrality of information technology to the U.S. military and society virtually guarantees that future adversaries will target it.

to read more on The Pentagon’s cyberstrategy, one year later

Cyber-Conflict and Global Politics

Cyberpower and National Security (National Defense University)

Homeland Security: A Complete Guide to Understanding, Preventing, and Surviving Terrorism

The Cyber Security Evaluation Tool (CSET) is a Department of Homeland Security (DHS) product that assists organizations in protecting their key national cyber assets. It was developed under the direction of the DHS National Cyber Security Division (NCSD) by cybersecurity experts and with assistance from the National Institute of Standards and Technology. This tool provides users with a systematic and repeatable approach for assessing the security posture of their cyber systems and networks. It includes both high-level and detailed questions related to all industrial control and IT systems. The tool is available for download, and the program also offers training and support at no cost to organizations engaged in administering networks that control facilities identified as being crucial to both the nation’s economy and national security.

CSET is a desktop software tool that guides users through a step-by-step process to assess their control system and information technology network security practices against recognized industry standards. The output from CSET is a prioritized list of recommendations for improving the cybersecurity posture of the organization’s enterprise and industrial control cyber systems. The tool derives the recommendations from a database of cybersecurity standards, guidelines, and practices. Each recommendation is linked to a set of actions that can be applied to enhance cybersecurity controls.

CSET has been designed for easy installation and use on a stand-alone laptop or workstation. It incorporates a variety of available standards from organizations such as National Institute of Standards and Technology (NIST), North American Electric Reliability Corporation (NERC), International Organization for Standardization (ISO), U.S. Department of Defense (DoD), and others. When the tool user selects one or more of the standards, CSET will open a set of questions to be answered. The answers to these questions will be compared against a selected security assurance level, and a detailed report will be generated to show areas for potential improvement. CSET provides an excellent means to perform a self-assessment of the security posture of your control system environment.

Key Benefits

•CSET contributes to an organization’s risk management and decision-making process
•Raises awareness and facilitates discussion on cybersecurity within the organization
•Highlights vulnerabilities in the organization’s systems and provides recommendations on ways to address the vulnerability
•Identifies areas of strength and best practices being followed in the organization
•Provides a method to systematically compare and monitor improvement in the cyber systems
•Provides a common industry-wide tool for assessing cyber systems

Download CSET
[Source]

By Ellen Messmer

Network World – The biggest business challenge today, in the minds of many information security officers, is the stealthy online infiltration by attackers to steal valuable proprietary information. The reality, they say, is that these so-called “advanced persistent threats” are so rampant and unrelenting they are forcing IT to rethink network security.

“Tackling advanced persistent threats means giving up the idea that it’s possible to protect everything. This is no longer realistic,” states the Security for Business Innovation Council, the group of 16 security leaders from companies that include eBay, Coca-Cola Company, SAP, FedEx Corp., Johnson & Johnson and Northrop Grumman. The council today published a report — “When Advanced Persistent Threats Go Mainstream” — outlining the problems and challenges facing large organizations.

These advanced persistent threat (APT) infiltrations can emanate from nation-states and their hired-hand attackers as well as industrial competitors, or organized crime and “hactivists” like Anonymous. The term APT is thought to have originated within the U.S. military, primarily the Air Force, which used the phrase as shorthand to describe cyberattacks that seemed to originate from somewhere in mainland China.

The overall sense, according to the report, is that an APT is a “cyberattack that is highly targeted, thoroughly researched, amply funded, and tailored to a particular organization — employing multiple vectors and using ‘low and slow’ techniques to evade detection.”

This stealthy attack infiltration to steal important data has become widespread, with several companies and government agencies disclosing they’ve been targets, including Google, EMC’s security division RSA, Epsilon, Citigroup, The Washington Post and the Department of Energy research labs Oak Ridge National Laboratory and Pacific Northwest National Lab.

Timothy McKnight, chief information security officer at Northrop Grumman, who is a member of Security for Business Innovation Council, recently discussed how the aerospace and defense firm virtually every day has to defend itself against what it believes are a dozen separate groups of attackers trying to get into its network to steal sensitive data.

In the council report the 16 information security officers are advising security teams to work closely with their business managers to identity the “crown jewels” of the organization and protect these “core assets,” while “also moving away from a perimeter-centric view.”

“Focusing on fortifying the perimeter is a losing battle,” their report bluntly states. “Today’s organizations are inherently porous. Change the perspective to protecting data throughout the lifecycle across the enterprise and the entire supply chain.” And the report adds: “The definition of successful defense has to change from ‘keeping attacks out’ to ‘sometimes attackers are going to get in; detect them as early as possible and minimize the damage.’ Assume that your organization might already be compromised and go from there.”

To read the remaining article Advanced persistent threats force IT to rethink security priorities