Transcript of a podcast in conjunction with The Open Group Conference in San Francisco on how foreign governments and criminal gangs are colluding to attack governments and businesses for profit and power.Listen to the podcast. Find it on iTunes/iPod. Download the transcript. Sponsor: The Open Group.
Register for The Open Group Conference
Jan. 30 - Feb. 3 in San Francisco.
Dana Gardner: Hello, and welcome to a special
BriefingsDirect thought leadership interview series coming to you in conjunction with the upcoming
The Open Group Conference this January in San
Francisco. I'm
Dana Gardner, Principal Analyst at
Interarbor Solutions, your host throughout these discussions.
The conference will focus on how IT and
enterprise architecture support enterprise
transformation. Speakers in conference events will also explore the latest in
service oriented architecture (SOA),
cloud computing, and
security.
We’re here now with one of the main speakers,
Joseph Menn, Cyber Security Correspondent for the
Financial Times and author of
Fatal System Error: The Hunt for the New Crime Lords Who are Bringing Down the Internet.Joe has covered security since 1999 for both the Financial Times and then before that, for the
Los Angeles Times.
Fatal System Error is his third book, he also wrote
All the Rave: The Rise and Fall of Shawn Fanning's Napster.As a lead-in to his Open Group presentation, entitled "What You're Up Against: Mobsters, Nation-States, and Blurry Lines," Joe and I are now going to explore the current
cyber-crime landscape, the underground cyber-gang movement, and the motive behind governments collaborating with organized crime in cyber space. [Disclosure: The Open Group is a sponsor of
BriefingsDirect podcasts.]
Gardner: It seems to me that there has been conventional wisdom about cyber crime and security that if there wasn’t much profit then there was self-regulation in place, and the cost of cyber crime would outweigh the payoffs, and it stayed manageable.
Has that changed? Have we entered a new period where just balancing risks and costs isn't a sufficient bulwark against burgeoning crime and risk?
Menn: I'm not sure that that was ever true, not after cyber crime metastasized beginning in 2003, when the bad-guy
spammers in Russia wanted more
IP addresses to send mail from after
the
blacklisting got effective. But, it's increasingly less true than it ever was.
Maybe you can make your enterprise a little trickier to get into than the other guy’s enterprise, but crime pays very, very well, and in the big picture, their ecosystem is better than ours. They do capitalism better than we do. They specialize to a great extent. They reinvest in
R&D.
On our end, on the good guys’ side, it's hard if you're a
chief information security officer (CISO) or a
chief security officer (CSO) to convince the top brass to pay more. You don’t really know what's working and what isn't. You don’t know if you've really been had by something that we call
advanced persistent threat (APT). Even the top security minds in the country can't be sure whether they’ve been had or not. So it's hard to know what to spend on.
More efficient
The other side doesn’t have that problem. They’re getting more efficient in the same way that
they used to lead technical innovation. They're leading economic innovation. The
freemium model is best evidenced by crimeware kits like
ZeuS, where you can get versions that are pretty effective and will help you steal a bunch of money for free. Then if you like that, you have the add-on to pay extra for -- the latest and greatest that are sure to get through the
antivirus systems.
Gardner: When you say "they," who you are really talking about?
Menn: They, the bad guys? It's largely Eastern European organized crime. In some countries, they can be caught. In other countries they can't be caught, and there really isn't any point in trying.
It's a geopolitical issue, which is something that is not widely understood, because in general, officials don’t talk about it. Working on my book, and in reporting for the newspapers, I've met really good cyber investigators for the
Secret Service and the
FBI, but I’ve yet to meet one that thinks he's going to get promoted for calling a press conference and announcing that they can’t catch anyone.
So the
State Department, meanwhile, keeps hoping that the other side is going to turn a new leaf, but they’ve been hoping that for 10 or more years, and it hasn’t happened. So it's incumbent upon the rest of us to call a spade a spade here.
What's really going on is that Russian intelligence and, depending on who is in office at a given time, Ukrainian authorities, are knowingly protecting some of the worst and most effective cyber criminals on the planet.
Gardner: And what would be their motivation? In heaven’s name, why would a sovereign power or an agency therein want to protect cyber criminals?
The same resources, human and technical, that are used to rob us blind are also being used in what is fairly called cyber war.
Menn: As a starting point, the level of garden-variety corruption over there is absolutely mind-blowing. More than 50 percent of Russian citizens responding to the
survey say that they had paid a bribe to somebody in the past 12 months. But it's gone well beyond that.
The same resources, human and technical, that are used to rob us blind are also being used in what is fairly called
cyber war. The same criminal networks that are after our bank accounts were, for example, used in
denial-of-service (DOS) attacks on
Georgia and
Estonian websites belonging to government, major media, and Estonia banks.
It's the same guy, and it's a "look-the-other-way" thing. You can do whatever crime you want, and when we call upon you to serve Mother Russia, you will do so. And that has accelerated. Just in the past couple of weeks, with the
disputed elections in Russia, you've seen mass
DOS attacks against opposition websites, mainstream media websites, and live journals. It's a pretty handy tool to have at your disposal. I provide all the evidence that would be needed to convince the reasonable people
in my book.
Gardner: In your book you use the terms "bringing down the Internet." I suppose another conventional thought around security is that there is a sort of mutual assured destruction effect where bringing down the Internet would hurt everyone. Is that not the case? Are they really just looking for people’s credit card numbers and petty crime, or is this really a threat to the integrity of the Internet in general?
Menn: Well integrity is the keyword there. No, I don’t think anybody is about to stop us all from the privilege of watching
skateboarding dogs on
YouTube. What I mean by that is the higher trust in the Internet in the way it's come to be used, not the way it was designed, but the way it is used now for
online banking,
ecommerce, and for increasingly storing corporate -- and heaven help us, government secrets -- in the cloud. That is in very, very great trouble.
Not a prayerI don’t think that now you can even trust transactions not to be monitored and pilfered. The latest, greatest versions of ZeuS gets past multi-factor authentication and are not detected by any antivirus that’s out there. So consumers don’t have a prayer, in the words of
Art Coviello, CEO of
RSA, and corporations aren’t doing much better.
So the way the Internet is being used now is in very, very grave trouble and not reliable. That’s what I mean by it. If they turned all the
botnets in the world on a given target, that target is gone. For multiple
root servers and
DNS, they could do some serious damage. I don’t know if they could stop the whole thing, but you're right, they don’t want to kill the golden goose. I don’t see a motivation for that.
Gardner: I guess if we look at organized crime in historical context, we found that there is a lot of innovation over the decades, over the generations, about how to shake people down, create rackets,
protection scams, and so forth. Is that playing out on the Internet as well? Is there some continuity around what organized crime tends to do in the physical world to what they're now attempting to do in the virtual world?
Menn: Sure. The mob does well in any place where there is a market for something, and there isn’t an effective regulatory framework that sustains it --
prohibition back in the day, prostitution, gambling, and that sort of thing. One of the things that’s interesting about the core narrative in my book is that prostitution doesn’t travel very well. Liquor is pretty well legal in most of the countries, but gambling travels very well.
So the traditional
Five Families,
Gambino-type mobs gravitated toward
Internet gambling, and they run some very large enterprises that are offshore. And if you don't pay off, then yeah, somebody actually shows up and breaks your legs.
Old school.
The mob does well in any place where there is a market for something, and there isn’t an effective regulatory framework that sustains it.
The Russian and Ukrainian gangs went to extortion as an early model, and ironically, some of the first websites that they extorted with the threat were the offshore gambling firms. They were cash rich, they had pretty weak infrastructure, and they were wary about going to the FBI. They started by attacking those sites in 2003-04 and then they moved on to more garden-variety companies. Some of them paid off and some said, "This is going to look little awkward in our
SEC filings" and they didn’t pay off.
There are some people who say organized crime and the Internet don't really mix and don't know how it happened. I've just told you how it happened in the US. Overseas it's not like the mob had a meeting one day and said, "Bob, I think, this Internet thing shows promise. I want you to open a cyber division for it."
The way things work in Russia is that even legitimate businesses have a local patron mobster that they pay tribute to. It's not so much because he is going to shut them down, but because you want one guy to deal with all the other people that are going to shake you down -- other mobsters and cops who are on the take.
Once the cyber gang got big enough, sooner or later, they also wanted the protection of traditional organized crime, because those people had better connections inside the intelligence agencies and the police force and could get them protection. That's the way it worked. It was sort of an organic alliance, rather than "Let’s develop this promising area."
Gardner: Just as in past eras with the need for protection, these cyber criminals look for a safe haven and perhaps pay off people, whether it's physical or virtual, to protect their environment, and then perhaps there is some added collusion along the way.
Have we moved now beyond this "let's just get safe and payoff some people for protection," or is there a two-way street where these cyber criminals are being contracted by some state agencies. How does this further collusion come about?
Proving their worthMenn: Exactly. That is what happens. Initially it was garden-variety payoffs and protection. Then, around 2007, with
the attack on Estonia, these guys started proving their worth to the
Kremlin, and others saw that with the attacks that ran through their system.
This has continued to evolve very rapidly. Now the DOS attacks are routinely used as the tool for political repression all around the world --Vietnam, Iran and everywhere you’ll see critics that are silenced from DOS attacks. In most cases, it's not the spy agencies or whoever themselves, but it's their contract agents. They just go to their friends in the similar gangs and say, "Hey do this." What's interesting is that they are both in this gray area now, both Russia and China, which we haven't talked about as much.
In China, hacking really started out as an expression of patriotism. Some of the biggest attacks,
Code Red being one of them, were against targets in countries that were perceived to have slighted China or had run into some sort of territorial flap with China, and, lo and behold, they got hacked.
In the past several years, with this sort of patriotic hacking, the anti-defense establishment hacking in the West that we are reading a lot about finally, those same guys have gone off and decided to enrich themselves as well. There were actually disputes in some of the major Chinese hacking groups. Some people said it was unethical to just go after money, and some of these early groups split over that.
In Russia, it went the other way. It started out with just a bunch of greedy criminals, and then they said, "Hey -- we can do even better and be protected. You have better protection if you do some hacking for the motherland." In China, it's the other way. They started out hacking for the motherland, and then added, "Hey -- we can get rich while serving our country."
It is much, much worse than anybody realizes. The US counterintelligence a few weeks ago finally put out a report saying that Russia and China are deliberately stealing our intellectual property.
So they're both sort of in the same place, and unfortunately it makes it pretty close to impossible for law enforcement in [the U.S.] to do anything about it, because it gets into political protection. What you really need is White House-level dealing with this stuff. If President Obama is going to talk to his opposite numbers about Chinese currency, Russian support of something we don’t like, or oil policy, this has got to be right up there too -- or nothing is going to happen at all.
Gardner: What about the pure capitalism side, stealing
intellectual property (IP) and taking over products in markets with the aid of these nefarious means? A lot of companies won't want to share details about this, but how big a deal is this now for enterprises and commercial organizations?
Menn: It is much, much worse than anybody realizes. The U.S. counterintelligence a few weeks ago finally
put out a report saying that Russia and China are deliberately stealing our IP, the IP of our companies. That's an open secret. It's been happening for years. You're right. The man in the street doesn’t realize this, because companies aren’t used to fessing up. Therefore, there is little outrage and little pressure for retaliation or diplomatic engagement on these issues.
I'm cautiously optimistic that that is going to change a little bit. This year the Securities and Exchange Commission (SEC) gave very detailed guidance about when you have to disclose when you’ve been hacked. If there is a material impact to your company, you have to disclose it here and there, even if it's unknown.
Register for The Open Group Conference
Jan. 30 - Feb. 3 in San Francisco.
Can't be boilerplateIf it might have, or is reasonably likely to have, a material impact, you have to spell it out. And it can't be boiler plate. It can't just be, "We are an Internet retailer and therefore we are target of hackers and therefore people’s credit cards might get out." No, without divulging what your weaknesses are you have to say, "We have detected hacks in the past and we don’t know but our source code might be gone."
You have to be a little more explicit, and so far, it's basically Google that has
really spelled out how badly they got hit. We're going to see a lot more companies say that, and I think that will help wake up Congress and the general public.
Gardner: So the old adage of shining light on this probably is in the best interest of everyone. Is the message then keeping this quiet isn’t necessarily the right way to go?
Menn: Not only is it not the right way to go, but it's safer to come out of the woods and fess up now. The stigma is almost gone. If you really
blow the PR like Sony, then you're going to suffer some, but I haven’t heard a lot of people say, "Boy, Google is run by a bunch of stupid idiots. They got hacked by the Chinese."
It's the definition of an
asymmetrical fight here. There is no company that's going to stand up against the might of the Chinese military, and nobody is going to fault them for getting nailed. Where we should fault them is for covering it up.
Not only is it not the right way to go, but it's safer to come out of the woods and fess up now. The stigma is almost gone.
I think you should give the American people some credit. They realize that you're not the bad guy, if you get nailed. As I said, nobody thinks that Google has a bunch of stupid engineers. It is somewhere between extremely difficult to impossible to ward off against "
zero-days" and the dedicated teams working on social engineering, because the
TCP/IP is
fundamentally broken and it ain't your fault.
Gardner: Let's say that I'm a leadership individual at a corporation, a
Global 500 organization, and I am wondering to what extent this is a risk. Is this something that’s going to be an acceptable cost of doing business? Is this just something I have to deal with when I go to different markets around the world, or is this an existential threat?
We're still seeing record profits by many companies. Google is certainly not hurting. This hasn’t necessarily attacked their bottom line in the same way it attacked their firewall. How serious is this? How serious should it be considered?
Menn: It's an existential threat not only to your company, but to our country and to our way of life. It is that bad. One of the problems is that in the U.S., executives tend to think a quarter or two ahead. If your source code gets stolen, your blueprints get taken, nobody might know that for a few years, and heck, by then you're retired.
With the new SEC guidelines and some national plans in the U.K. and in the U.S., that’s not going to cut it anymore. Executives will be held accountable. This is some pretty drastic stuff. The things that you should be thinking about, if you’re in an IT-based business, include figuring out the absolutely critical crown jewel one, two, or three percent of your stuff, and keeping it off network machines.
Short-term priceYes, that is a current cost to doing things that might well make you less efficient and that’s a short-term price you have to pay to ensure long-term survival. You have to do that, and there are some creative things that could be done.
For example, say you've got a blueprint for the next widget that is absolutely going to smoke the competition, and it has got to be on a computer that other people can access for some reason. I would make 100 different similar blueprints of the next generation widget, and only a handful of people you trust know which is the right one, and all the others are hooey.
Therefore, if everything gets stolen, they're going to waste a lot of cycles building the wrong widget. That’s the sort of strategic spy-type thinking that I think garden-variety CEOs have got to start engaging it.
Gardner: That’s interesting. So we have to think differently, don’t we?
Menn: Basically, regular companies have to start thinking like banks, and banks have to start thinking like intelligence agencies. Everybody has to level up here.
Gardner: What do the intelligence agencies have to start thinking about?
Menn: The discussions that are going on now obviously include greatly increased monitoring, pushing responsibility for seeing suspicious stuff down to private enterprise, and obviously greater information sharing between private enterprise, and government officials.
But, there's some pretty outlandish stuff that’s getting kicked around, including looking the other way if you, as a company, sniff something out in another country and decide to take retaliatory action on your own.
But, there's some pretty outlandish stuff that’s getting kicked around, including looking the other way if you, as a company, sniff something out in another country and decide to take retaliatory action on your own. There’s some pretty sea-change stuff that’s going on.
Gardner: So that would be playing offense as well as defense?
Menn: In the
Defense Authorization Act that just passed, for the first time, Congress officially blesses offensive cyber-warfare, which is something we’ve already been doing, just quietly.
We’re entering some pretty new areas here, and one of the things that’s going on is that the cyber warfare stuff, which is happening, is basically run by intelligence folks, rather by a bunch of lawyers worrying about collateral damage and the like, and there's almost no oversight because intelligence agencies in general get low oversight.
We’re probably also buying a whole bunch of cyber stuff, which is a waste. I mean, they're going to be equivalent of $500 toilet seats, and we’re not going to know about it, because this stuff doesn’t get disclosed.
Gardner: I know that we could go on to this separate subject for hours, but just very briefly how about the area of governance? We know who's in charge when it comes to interstate commerce. We know who is in charge when it comes to managing the monetary system and protecting against counterfeit bills.
Do we really have anyone who is officially in charge of protecting, let's say, in this case, U.S. companies from outside cyber warfare? Is there a defense, legal, or other framework under which the responsibility for protection falls?
It's a messMenn: The short answer is it's a mess. The
Department of Homeland Security (DHS) is officially in charge of protecting the civilian-owned stuff with the assistance of the
Department of Defense (DoD) and the
National Security Agency (NSA). The bottom line is that this makes it very tricky, because there's different frameworks involved.
For example, the FBI gets called in to investigate a hack and they discover it's criminal gang X, but that criminal gang may have been motivated to steal defense secrets more than the money. Then, they're supposed to kick it over to the intelligence community, but it's the same people. So we're a lot more handcuffed in all this than our adversaries are.
Gardner: So it's hard to say whose jurisdiction it is, under what circumstances, for how long, and then who gets the ultimate blame if things go right or wrong? I guess criminals would love to see that, right?
Menn: Yup.
Gardner: Okay, we have to wrap up. It's a very fascinating subject obviously. Just quickly looking to the future, we have some major trends. We have an increased movement toward mobility. People using public networks through their mobile carriers increasingly for work and more business-sensitive activities.
We have the drive toward
cloud computing. We’ll be putting more of your assets, data, processes, perhaps even IP in a third-party
data center, known as a cloud. We’re also seeing the movement toward outsourcing more IT and outsourcing applications in a
software-as-a-service (SaaS) field.
The inroads of social networking into the workplace are bad from a security point of view. Perhaps worse is the consumerization of IT, the bring-your-own-device trend, which isn't going to go away.
Are these good, bad, indifferent? How does this set of big shifts in IT impact this whole cyber security issue?
Menn: Well, there are some that are clearly dangerous, and there are some things that are a mixed bag. Certainly, the inroads of social networking into the workplace are bad from a security point of view. Perhaps worse is the
consumerization of IT, the
bring-your-own-device trend, which isn't going to go away. That’s bad, although there are obviously mitigating things you can do.
The cloud itself is a mixed bag. Certainly, in theory, it could be made more secure than what you have on premise. If you’re turning it over to the very best of the very best, they can do a lot more things than you can in terms of protecting it, particularly if you’re a smaller business.
If you look to the large-scale banks and people with health records and that sort of thing that really have to be ultra-secure, they're not going to do this yet, because the procedures are not really set up to their specs yet. That may likely come in the future. But, cloud security, in my opinion, is not there yet. So that’s a mixed blessing.
Gardner: Before we close out, it sounds as if it's important for companies to educate themselves on what the real threats are, consider what to do if they are a victim, try to figure out who are their friends in government, and in the third-party private security organizations. Anything else that you think is important, Joe, in terms of getting started in moving toward both defense and offense in anticipating that these issues as you say are potentially existential?
Radical stepsMenn: As I said, you need to think strategically about this, and that includes some pretty radical steps. There are those who say there are two types of companies out there -- those that have been hacked and those that don’t know that they’ve been hacked.
Everybody needs to take a look at this stuff beyond their immediate corporate needs and think about where we’re heading as a society. And to the extent that people are already expert in the stuff or can become expert in this stuff, they need to share that knowledge, and that will often mean, saying "Yes, we got hacked" publicly, but it also means educating those around them about the severity of the threat.
One of the reasons I wrote my book, and spent years doing it, is not because I felt that I could tell every senior executive what they needed to do. I wanted to educate a broader audience, because there are some pretty smart people, even in Washington, who have known about this for years and have been unable to do anything about it. We haven't really passed anything that's substantial in terms of legislation.
As a matter of political philosophy, I feel that if enough people on the street realize what's going on, then quite often leaders will get in front of them and at least attempt to do the right thing. Senior executives should be thinking about educating their customers, their peers, the general public, and Washington to make sure that the stuff that passes isn't as bad as it might otherwise be.
If enough people on the street realize what's going on, then quite often leaders will get in front of them and at least attempt to do the right thing.
Gardner: Very good. We have been talking with Joseph Menn, Cyber Security Correspondent for the Financial Times and author of
Fatal System Error: The Hunt for the New Crime Lords Who are Bringing Down the Internet.As a lead-up to his Open Group presentation on, "What You're Up Against: Mobsters, Nation-States and Blurry Lines," Joe and I have been exploring the current cyber crime landscape, what can be done to better understand the threat and perhaps begin to work against it.
This special BriefingsDirect discussion comes to you in conjunction with
The Open Group Conference from Jan. 30 to Feb. 3 in San Francisco. You'll hear there more from Joe and many other global leaders on the ways that IT and enterprise architecture support enterprise transformation.
So thanks to you Joe Menn for a very fascinating discussion, and I look forward to your presentation in San Francisco. I also encourage our readers and listeners to
attend the conference to learn more. Thanks, Joe.
Menn: Thanks very much.
Gardner: This is Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator through these thought leader interviews. Thanks again for listening, and come back next time.
Listen to the podcast. Find it on iTunes/iPod. Download the transcript. Sponsor: The Open Group.
Transcript of a podcast in conjunction with The Open Group Conference in San Francisco on how foreign governments and criminal gangs are colluding to attack governments and businesses for profit and power. Copyright Interarbor Solutions, LLC, 2005-2012. All rights reserved.
Register for The Open Group Conference
Jan. 30 - Feb. 3 in San Francisco.
You may also be interested in:
Group IT organization TUI InfoTec has come to grips with managing IT operations better, especially in mixed environments like hybrid clouds.
European leading company in travel and tourism. They're very large in Germany, in the UK, and also in other European countries. They’re not presently doing a lot of business in the US.
which is virtualized, and we're currently planning to go further -- to 80 percent virtualization in the total landscape. That's our current state, and we’ve driven more and more to a virtualized infrastructure for all the mission-critical systems.
