You Can’t Fire Cannons At The Internet

The cooperation of US internet providers implemented a key cyber-defense doctrine of the United States — Information Sharing.  Information sharing was ordered in the President’s February 12, 2013 executive order.  The core concept of information sharing, as this graphic from US-CERT shows, is that by sharing information about cyber-threats, the threats can be quickly identified and prompt remedial action can be taken to defend against the attack.

Not surprising,  the benefits derived from the threat-intelligence sharing were short-lived — the attackers quickly shifted their attacks to new infrastructure.  “Part of the problem is we can close this door and it’s fairly easy for them to open another door,” a U.S. official told the Journal.

Data sharing identifies what has happened.  Writing in Informationweek Security,  Mathew J. Schwartz  concluded:

[S]uch information is typically gleaned by doing a forensic analysis of a captured C&C server, cataloging the IP addresses it’s contacted, then identifying which ones trace to U.S. businesses and government agencies. With that information in hand, the FBI can alert affected organizations and agencies, who can then undertake a forensic investigation and try to identify what information attackers got their hands on.

In cyberwar, the enemy is everyone and no one, everywhere and nowhere at the same time.  Strategies that assume the adversary is operating from fixed installations which can be neutralized will, as this recent episode demonstrates, fail. Matthew Miller, Jon Brickey and Gregory Conti, cyberwarfare researchers at the United States Military Academy, writing in the Small Wars Journal, observed:

Networks aren’t physical battlefields.  Attacks can transit the globe at near the speed of light.  Battles can be won or lost in milliseconds.  In this virtual world, distance approaches zero. Enemies can teleport, appearing from numerous locations around the globe in the blink of an eye. Cyberspace is a man-made domain, it is constantly shifting as new nodes are added and others disappear. Grid squares can move (by changing a network address) or lie (spoofing a network address)… A cyberspace attacker may instantly appear in a brigade operations center in Afghanistan or a game console in New Jersey.  Deception is easy on the Internet. Identities can be spoofed or stolen. Age, date of birth, gender, appearance, and marital status are all malleable. Adversaries can operate invisibly or leave little trace behind by cleaning logs.  Attackers may disappear and reappear instantly on the other side of the world, by simply changing network connections or paths.. History itself may even be rewritten by altering system log files or other data. The nature of the Internet allows many people to share the same identity (by sharing the same authentication credentials) and one person to appear as many (by creating numerous user accounts).

Or, as Brigadier General Mark Kimmitt observed, “I’m an artillery officer, and I can’t fire cannons at the internet.”

The Chinese attacked using spearphishing. We know a lot about spearphishing attacks.  We know that information sharing doesn’t work because the information that is shared is obsolete.  We know that the attackers masquarade as trusted senders.  That masquerade can be unmasked using  SP Guard from Iconix. Using SP Guard, IT can determine a list of trusted senders and provide this information to staff in a simple and highly effective manner.

You can contact us at 408-727-6342,ext 3 or use our online contact form.