CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for AdamElkus

AdamElkus

Anonymous, Surfaces, and Gaps

The 1980s Marine Corps doctrine of Maneuver Warfare (MW) heavily focused on the concept of “surfaces and gaps.” Marines, which largely defined themselves with frontal tactical and operational attacks against fortified sites in World War II maritime campaigns, would aim to move through existing weaknesses in the enemy’s line in future campaigns rather than creating them.  Whatever the merits or demerits of MW, the concept has utility for explaining the nature of cyber threats that exist for most companies and organizations rather than exotic foreign cyberwar specialists or apocalyptic infrastructure-crashing attacks.

The Department of Homeland Security is warning that Anonymous is going to take to infrastructure attacks, and elements from the groups themselves are threatening to black out the Internet to protest copyright measures. While these may cause massive press attention (to the consternation of resident CTOVision hacker Bryan Halfpap), here’s a more realistic look at what Anonymous is actually doing:

Anonymous, a group not known for discipline, is giving itself a weekly deadline, a new attack every Friday. Following the Tuesday compromise of the website of tear gas maker Combined Systems, Inc., the Antisec wing of Anonymous struck a Federal Trade Commission webserver which hosts three FTC websites, business.ftc.gov, consumer.gov and ncpw.gov, the National Consumer Protection Week partnership website. …“We are already sitting on dozens of unreleased targets,” said an Antisec anon, who went on to describe an inventory of already compromised servers that could fill five months or more of #FFF releases. “Yes, each and every Friday we will be launching attacks… with the specific purpose of wiping as many corrupt corporate and government systems off our internet,” the anon continued.

Politically motivated hackers are, after all, looking to make political points. Most Internet users–including, government and private sector organizations–are not conversant in basic security procedures. Why go for spectacular attacks when there is simply so much low-hanging fruit lying around for doxing, defacing, and shutdowns? Or, to return to the metaphor at the beginning, why attack the fortress when one can move through the gaps in the wall? The hacks themselves admittedly are very basic stuff:

Anons claiming responsibility for the attack spoke to Wired.com in an online chat just as it happened, freely admitting that there was nothing technically remarkable in this hack. As one remarked, “own & rm and move on.” (rm being a unix command to delete data.)

As I wrote on the STRATFOR hack, despite the company’s tangential relationship to the actual Bradley Manning case, it got hacked anyway simply because it was a target of opportunity. There’s really a simple (conceptually) answer to the problem: harden the targets rather than buy into the threat of attacks–such as the laughable idea of crashing the Internet–that are more media trolling than anything else.

For more on this topic see our reporting on National Security and Technology and at:

Hadoop and Business Intelligence

Like my colleague Alex Olesker, I too attended Cloudera Day 2012.  While there were many panels of interest, perhaps one of the most important was Amr Awadallah‘s talk about big data applications to business intelligence. Many CTOVision readers with backgrounds in the intelligence community may think of corporate espionage when the phrase “business intelligence” is uttered, but I assure you that this is definitely not the case. Business intelligence is different from competitive intelligence, which is primarily based on open-source analysis of competitors and markets. Rather, business intelligence is quantitative analysis of internal data using advanced analytics techniques.

As we’ve noted before on CTOLabs, business intelligence is a changing field that is increasingly awash in information. Analysts face three core problems:

  • More information – Critical information now comes from new sources, such as online customer reviews and Facebook updates.
  • More change – The pace of competition, changes in customer preferences and organizational changes are all accelerating.
  • More questions – More people are asking new questions, such as: Why did that happen?How do these trends relate?

Adding to the analytical difficulties is the fact that complex and unstructured data, as opposed to relational data, is exploding. The question increasingly becomes–how do you manage the data and categorize it?

Awadallah talked about the unfavorable use/price dimension involved in archiving data. Once you’ve archived it, you’ve more or less lost it because it becomes too expensive to retrieve on demand. The solution? A combined computer/storage layer with Hadoop applications. Awadallah discussed opportunities to employ HDFS and MapReduce in business analytics. Hadoop offers three “core values”: scalability to grow nodes, flexibility in data storage and analysis, and data longevity. No transformation–implied under the previous model–is necessary, as data can start flowing any time with Hadoop applications. Awadallah contrasted what he called the slow “Data Council” model with a new forward-thinking approach he dubbed “Data Scientist” built on Hadoop products. Hadoop can grow too without requiring developers to re-architect their applications and algorithms. Both structured and raw data can be logged from multiple applications, and Hadoop offers centralized logging across all execution platforms.

All of these approaches, Awadallah argued, offered a much better RoB (Return on Byte) for business intelligence analysts looking to use big data to optimize their enterprise.

APT: Useful or Buzzword?

The term Advanced Persistent Threat (APT) is often regarded somewhat suspiciously by security professionals, seeing as it how it can be a buzzword that obscures actual analysis of the dynamics of cyber attacks or a diplomatic fiction because it’s not polite to openly accuse the Chinese and Russians of stealing from us. But recently, I’ve seen some analysis that points to some use for the concept (see, for example, Tom Parker on APT here)

Matthew J. Schwartz has an interesting column in Information Week where he lays out the pros and cons of the APT concept:

“As long as your business’ security was relatively better than most other businesses’ security, attackers–in their search for credit card numbers or customer data–would opt for the easy target. But with an APT, attackers have already selected your organization for attack, meaning that your information security program needs to be extremely good to stop any related attack attempts from succeeding.”

Is the term overused? Yes, Schwartz points out. But there is a qualitative difference emerging between attackers who are taking a path of least resistance and those using sophisticated attack techniques to enter the systems of targeted organizations. Moreover, while non-APTs use cruder methods to probe for weak points, APTs use social engineering and use either direct intelligence techniques (or civilian analogues) to directly target vulnerable employees and organizational knowledge gaps. As much as APTs are a marketing term, they are indeed more advanced than the average spammer (although perhaps the spammer is just as persistent) and certainly pose a threat.

This is not to say that APTs are shadowy figures using voodoo spells to trick employees or plying computer engineers with beautiful women out of a Bond movie. In a previous column on the RSA hack, Schwartz delves into precisely just how simple it can be to “hack the human:”

In the case of the breach of RSA, for example, attackers socially engineered using a relatively unsophisticated technique: they sent an email with the subject line “2011 Recruitment Plan” to two small groups of RSA employees. One of the employees retrieved the email from their junk mailbox and opened the spreadsheet, which was really a piece of malware designed to provide the attacker with a direct connection into RSA’s network. From there, the attacker was able to harvest the user’s credentials and ultimately access sensitive information relating to RSA’s two-factor SecurID system.

There’s no hard-and-fast solution, and to some extent even the most paranoid security policies are not going to deal with three cardinal facts: employees make mistakes, adversaries are intelligent and persistent, and most information systems are constructed with ease of use rather than security in mind. That’s why recognizing the APT also should mean, as Alex Olesker has often said, assuming that breaches will occur and focusing on how to mitigate the consequences.

For more see:

From Networks to Swarms

CTOs , CIOs, and technology reporters are very familiar with the idea of the network. Think of networks and tech and the terms network-centric warfare, netwar, social networks, the wealth of networks, and a host of other terms and ideas immediately roll off the tongue. The network is the defining metaphor of the information age. But while the network is important, so is the swarm. Swarming in warfare has been fairly well analyzed by David Ronfeldt and John Arquilla. However, the kind of swarming I’m going to talk about is a different sort, not performed by human agents but by automated and autonomous agents.

In the context of automated and autonomous weapons, swarming is an emerging operational pattern. Dispersed large and small unmanned aerial vehicles of the future, networked together, may swarm together–each node playing a small role in a larger reconaissance and attack pattern. Other potential swarms include clouds of autonomous small munitions, shortening the sensor/shooter gap by eliminating the difference between the two. Botnets and worms also swarm too. Botnets provide sheer mass for brute force attacks, whereas worms autonomously propagate themselves and evolve in response to security measures.  While swarming by munitions and drones is still in the concept stage, botnets and worms are already doing so.

Perhaps the primary difference between the kind of swarms described by Ronfeldt and Arquilla and non-human agents is that human swarming has always been a metaphor rather than a direct replication of swarming in nature. Swarming on the battlefield is a nonlinear attack dynamic, which while reminiscent of a insect swarm is not identical to it. Animal swarms are built on spontaneous collaboration and distributed intelligence of a kind that is simply difficult to replicate in a human setting. Until now. While Mongol battleswarms and the tactical dynamics of WTO protestors have come close to the pattern, viruses and collaborative sensors and weapons are going to produce activity that is actually replicative of animal patterns.

We’re already well familiar with the dynamics of swarming in cybersecurity–both the human variety (self-governing networks like Anonymous) and the autonomous weapon (viruses) . In the decades ahead, we may see swarms very much like the worms we combat take the field in the world’s conflict zones.

Track these and other related concepts at the CTOvisionCyberwarPage.

Enterprise Security: STRATFOR and Activist Hackers

While popular attention in cyber issues often focuses on the exotic APTs, enterprise security is being rocked by an unpleasant truth. Activist hackers have become a major problem, and not just for obvious targets such as the Church of Scientology or the United States government.

Political risk company STRATFOR was recently hacked by elements of Anonymous as part of the AntiSec campaign. The reason why STRATFOR was targeted?

[The attack] appeared to be inspired by anger at the imprisonment of Bradley Manning, the US Army private who is accused of leaking hundreds of thousands of US government files to WikiLeaks. An online statement from the group said the attack would stop if Manning was given “a holiday feast … at a fancy restaurant of his choosing.”

However, STRATFOR is not related at all to the Manning case. The Texas-based firm carries out political risk analysis for corporate and government clients. Attacking STRATFOR to protest Manning’s imprisonment makes as little sense as hacking an ESPN sports show if you’re unhappy about the NBA lockout. STRATFOR, like all consulting firms, makes money by providing analytical products to clients. While other incidents, such as the attacks on HBGary, have more of a logical motivation behind them, the STRATFOR hacks simply seem bizarre.

The logic of the attack, however, is irrelevant. A large amount of emails, credit card information, and phone numbers have been lifted. What this attack should tell us is that enterprise security is not a niche concern anymore. Your company may be at best tangentially related to the object of an activist hacker’s ire, but he or she will target you anyway. Like OpCartel, the STRATFOR hack seems to also have been very controversial within the Anon ecosystem. But, of course, it takes only one.

There isn’t really a major takeaway in terms of the technical aspect of security–enterprise security matters, as people have said repeatedly. But the politics behind the hack–and what it means for the enterprise–are the issue here.

Related articles

When Chuck Norris Gets Cloud-Mobile

At first glance, cloud computing may seem to be distinct from the austere world of special operations forces (SOF). But Special Operations Technology‘s Eric Marks has a very interesting piece on how SOF can use the cloud to gain the tactical advantage.

Some highlights:

  • Cloud to the edge tactical mobile computing, which would feature the re-engineering of mission threads and processes so they could be executed by mobile devices. “This could include controlling a UAV via a smartphone, or having map, radio, and GPS capabilities all in one small pocket-sized device.” Hear that, al-Qaeda? These dudes might be flying a drone with an iPhone! Of course, this makes me feel bad since all I do with my iPhone is browse icanhazcheezburger.com.
  • Mobile analytics could enable big data analysis of semi and unstructured data from sensors throughout the battlespace for rapid analysis of threat information. Given DARPA‘s interest in progressively more advanced sensors–particularly in urban settings–big data is likely to be of interest to tactical military users.
  • Mobile infrastructure in many civilian cloud products emphasizes the ability to make small devices mobile units of infrastructure that could be potentially deployed into austere environments for SOF. “Adding cloud computing functionality to these portable data centers simply means that more consumers can access the cloud resources when they need them, and therefore support more computing needs with fewer physical resource.”
  • Last, but not least, the tactical app store. While you have Angry Birds, SOF could use a set of applications to mission-tailor to wildly differing environments. This is a growth area not just for SOF, but for the whole military.

Marks concludes by pointing out that ad-hoc grids could provide computing power on the go for SOF users.”If a grid of linked computers can discover one another, connect, pool their resources, and allow sharing of computation to address spikes in demand for computational capacity in tactical situations.” Of course, bandwidth requirements, latency, and intermittent connections will pose problems for realizing this vision. But that wouldn’t stop Chuck Norris, and it ultimately isn’t likely to be much of an obstacle for the joint special operations community’s agile technologists.

Related articles

Tech of #OccupyWallStreet

A social movement with a hashtag in its name is obviously heavily reliant on technology. Here are a few technologies and approaches that Occupy Wall Street used to expand rapidly.

  • Mesh networks: localized Internets, set up for rapid and secure internal communication.
  • The People’s Skype, a distributed voice and voting system that enables the peculiar General Assembly voting system to function by linking different voice accounts to a general PA system.
  • The Occupy Network, a Facebook app that allows a user to see every Occupy Wall Street and affiliate-related page, which users are involved, and live feeds from affiliated users.
  • Apps that send text messages out to preset lists of friends as the user is about to be arrested, which might explain the movement’s very rapid communication tactical loops.
  • “Go” and “Vibe” iPhone apps, which allow allow anonymous users to stream and post media in real time and locate tagged posts on a GPS map.

Understanding OWS’ usage of tech, however, goes beyond specific technologies. Alexis Madrigal and Conor Friedersdorf of The Atlantic also wrote very interesting and perceptive posts about Occupy Wall Street’s broader tech philosophy. Friedersdorf had a short post about how the movement’s decentralization enabled rapid response–a suggestion he made about specific demands for the protestors ended up being reproduced word-for-word on a protester’s sign. Madrigal wrote about how the movement‘s specific philosophy and operating methods mirrored Twitter’s use of APIs to let app developers create software.

To some extent, the tactical and operational dynamics of OWS can also be explained by John Arquilla and David Ronfeldt’s literature. Their path-breaking 1994 study of the Zapatista movement in Mexico is recommended for any student of information technology and social movements. John Robb and Shlok Vaidya were also ahead in looking at tactical and operational dynamics of OWS and tech.

Rise of the Narcohackers

Here at CTOVision, we often write quite a bit about the problems of the insider threat, social engineering, and other threats to the enterprise. Amidst the seemingly endless array of security problems a given CTO faces (from overly generous Nigerians to Visitors from the Land of the Panda cough cough APTs), it’s easy to forget that the bad guys have security issues too.

Control of information is a key element in the Mexican cartel war. Slip up, and you might end up on YouTube sans head. Additionally cartels, like any other organization, seek to aggressively shape the narrative of the environment they operate in. So they’ve killed and kidnapped journalists, pushing the news conversation out to blogs and social networks. Some of the rawest information on the drug war comes from sites like Blog Del Narco.

To make matters worse for the cartels, outsider groups such as Anonymous have entered into the drug war, threatening to use their hacking skills to expose cartel members, corrupt Mexican politicians, and bandits. Now you might not exactly picture a Zeta commando to be the most adept with computers, but cartels have been using social networks for a while, as Robert Bunker relates:

[Cartels] utilize new forms of media and merge them with ghastly images of ‘on camera’ torture and killing. YouTube and other social media platforms were then utilized from about 2005-2006 on as a conduit for the transmission of this information. The disruptive effects on Mexican society are readily apparent and have resulted in an assault on the bonds and relationships that hold that nation together—the relations between the people, the government, and law enforcement/the military are becoming increasingly frayed.

Cartels have responded to the social network threat by using their own form of social engineering. While they have mainly employed traditional information-gathering skills, STRATFOR reports that the cartels may be hiring information security professionals of their own to find and kill the bloggers and cyber-activists arrayed against them. Given the resources available to cartels and their already impressive ability to co-opt elite talent (the Zetas themselves are former Mexican commandos)  it would not be particularly surprising if they have an organic cyber counterintelligence capability or are in the process of acquiring one. As one panelist mentioned during the FedCyber Government-Industry Cybersecurity conference, the rise of the mercenary and professional hacker classes is one of the characteristics of the new cyber threat environment.

Cartels are already tracking down and killing Mexican bloggers–or anyone who posts about them on social networks. In turn, however, cartels and the politicians they back are also vulnerable to leaks and social engineering–especially when carried out by those too far away for them to physically harm. It’s all about the OPSEC!

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]