A new cyber crime study about targeted and politically inspired attacks on countries, was reported on in the NY Times today here. My first reaction was to just sort of shrug...this sort of attack has been going on for a while, last fall saw similar attacks on the White House itself, and the Obama and McCain campaigns. The actual research papers (there are two related papers, one that addresses the targeted attacks on Tibet and the Dalai Lama is here, and a much broader study is available here), have a lot of interesting details- worthwhile reading.
The Dalai Lama attacks were pretty sophisticated, and highly targeted. Attack vectors included malware via targeted e-mails to influential people in the "free tibet" movement, and keystroke loggers which would transfer files and data out via HTTP. In addition, the study found that some of the computing practices in use contributed to the breaches (users storing files and data that was deemed sensitive on local machines that were used to open e-mail, and browse the internet.)
I am encouraged though by what seems to be a more serious look at cyber security by the new US administration. Putting additional healthcare security provisions in the recovery act, to bolster security/privacy ahead of healthcare IT advances such as Electronic Health Records, and health information networks is welcome and needed.
The 90 day Hathaway cyber security review seems promising as well, as does the prospect of bringing cyber security under the direct responsibility and control of a White House official.
Obviously the stakes are pretty high, and whether the attackers are profit motivated or politically motivated, their capabilities are getting pretty scary. As the Shishir Nagaraja/Ross Anderson study points out, the typical enterprise wouldn't stand a chance against this kind of determined attack.
Jim
Jim Hietala
Jim Hietala, CISSP, GSEC, is Research Director and a
principal of Compliance Research Group,
providing research, analysis, and consulting services in the areas of
compliance, risk management, and IT security. He is also the Vice President,
Security for The Open Group, where he manages all security and risk management
programs and standards activities.
Jim has provided research and consulting services to
organizations such as SANS, The Open Group, and a number of IT security and
compliance vendors. He is a frequent speaker at industry conferences, and he
recently authored a comprehensive course on IT risk management. He participates
in the SANS Analyst/Expert program, having written several research whitepapers
and participated in several webcasts for SANS. He has also published
numerous articles on information security, risk management, and compliance
topics in publications including The ISSA Journal, Bank Accounting &
Finance, Risk Factor, SC Magazine, and others.
An industry veteran, he has held leadership roles at
ControlPath, Avail Networks, Alternative Technologies, eSoft, Qwest, Concentric
Network, and Digital Pathways. He developed and launched the industry’s first
remote access VPN service (Concentric RemoteLink) and encrypting ISDN router
(at Network Express), and launched a compliance and risk management software
start-up in the IT-GRC market.
He holds a B.S. in Marketing from Southern Illinois
University.