CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Junaid Islam

Junaid Islam

The Internet Has A New Problem: Repeating Random Numbers!

Digital Certificates are a foundational building block of the Internet. They are used to verify the identity of e-commerce sites, the authenticity of software and encrypt data. Not surprisingly, cyberattackers try to create fake Certificates or get the Private Keys for real ones to steal data or intercept communications. No one really worried about the Certificates themselves – until now. It seems the random numbers used to generate Certificates sometimes are the same.

To understand the problem it’s useful to take a 30 second tutorial on Digital Certificates. For those of you who might have managed to stay awake during math class you’ll remember that Asymmetric Cryptography utilizes 2 prime numbers to create a Public and Private Key for a Digital Certificate. The Public Key maps an input (that you want to keep secret) to a large number field while the Private Key reverses the transaction. The theory goes that since there’s an infinite set of prime numbers, there’s an infinite set of Public/Private key combinations. To make sure the prime numbers are different a Random Number Generator (RNG) is used. Sounds pretty secure. Infinite is a big number. What could go wrong?

Well the real world is a bit different than math class. It seems the random number generators (RNG) on computer devices really don’t generate an infinite set of primes but rather a bounded set that in turn generates a set of Public/Private Key combinations. This new analysis is a result of the dramatic cost reduction in high performance computing that now enables the simulation of a chip’s RNG function and the Certificates they generate.

From an Internet security perspective, the ability of a cyberattacker to know an organization’s Private Key has huge implications. Attackers can potentially impersonate web sites, intercept secure connections or decrypt any piece of data just by looking at the Public Key. Examples of this attack are not just seen in labs. In one case, for instance, on January 7 2019 the University of California Davis sent an advisory of all students visiting China that their “secure” What’sApp messages were being monitored.

For enterprises that rely on Digital Certificates for their security, which is nearly everyone, it’s important to deploy countermeasure to RNG-based Certificates attacks:

Upgrade Your RNG: Many PKI systems have the ability to connect to an external Random Number Generator or utilize an entropy pool to ensure randomness. If your HSM/Root CA has this capability, it is highly advisable you turn it on. Next you’ll want to purge your network of old Certificates.

Switch to a Virtual HSM: If your existing PKI can’t work with an external RNG or entropy pool then you might consider one of the many cloud-based and software-based HSM solutions. All of the newer software-based PKI solutions support external RNG or entropy inputs. If shopping around, also look for a solution that makes it easy to create and propagate new Certificates – it’ll make your life easier.

Isolate Mission Critical Apps: In addition to upgrading your Certificates another important countermeasure is isolating high value or mission critical applications from the Internet. Software Defined Perimeter (SDP) is an ideal countermeasure to Certificate attacks as no one except authorized users will even know about the application. SDP can also be used to continuously propagate new Certificates to user devices.

With RSA around the corner, security professionals have a great opportunity for FREE consulting. Ask Certificate and encryption vendors for their countermeasures to existing and emerging Certificate attacks. When visiting a cloud-based SaaS, ask them what countermeasures they have implemented to ensure their Certificates don’t get attacked. Be aware; be proactive as this threat is real.

Related Posts:

The Problem With PEAP

An Introduction to Risk Analysis

Connected Devices, Remote Security: Data Encryption and Security in the Cloud

Naturally Better Security: Leveraging the power of nature to enhance Internet security

 

AWS Snowball Edge And Hyper Converged Infrastructure Will Revolutionize Global Enterprises

The recent announcement by Amazon AWS of a portable Snowball EC2 compute platform represents a significant advance in hybrid cloud/data center computing. When combined with a Hyper Converged Infrastructure  (HCI) super computer and Zero Trust Network, enterprises across a broad range of vertical markets can transform their operational model.1st Generation Hybrid: Two-Stack Architecture

The 1st generation of hybrid cloud/data center was characterized by a two-stack design with legacy apps in the data center and new apps in AWS. Application developers loved the idea of experimenting with AWS Marketplace but the IT department didn’t like the fact that apps could not be ported back into their data center. Additionally the two-stack architecture suffered from disaster recovery and security issues if there was a cloud outage.

VMware noticed the issues IT departments were having with 1st generation hybrid environments and offered vSphere in AWS. VMware’s solution improved load balancing and disaster recovery for legacy applications but it didn’t address the problem of AWS app portability.  Thus many global-scale enterprises waited on the sidelines for something better.

2nd Generation Hybrid Infrastructure: AWS Snowball Edge + HCI Super Computer 

The recent announcement of Snowball Edge by AWS represents a significant advance in hybrid infrastructure. For the first time enterprises can run apps using AWS software logic on a “physical” EC2 instance inside their data center. When combined with a Petaflop-scale Hyper Converged Infrastructure (HCI) super computer enterprises can operate a common application environment for legacy and new AWS apps across the data center and cloud infrastructure.

Looking at the image below we have a high level architecture of a 2nd generation hybrid compute architecture. The Snowball Edge in the data center allows enterprises to run software with embedded AWS logic outside the cloud. To allow enterprises to run legacy as well as compute intensive applications like machine learning there is a high performance Hyper Converged Infrastructure (HCI) super computer paired with the Snowball Edge. In the AWS cloud we have the enterprise’s VPC as well as vSphere environment. Connecting the Data Center and AWS environments we can have any combination of broadband satellite, SDWAN or VXLAN/MLPS.

One of the challenges with such a fluid architecture is routing users to the correct Secure Enclave and blocking self-propagating malware. A SDP-based Zero Trust Network ensures that users are only connected to authorized applications irrespective of where the workload sits.  Unlike standard VPNs, SDP blocks self-propagating malware from moving thru the hybrid compute environment by locking down physical and virtual network interfaces.

Some of the new technical capabilities of a 2nd generation hybrid cloud include:

Workload optimization: While EC2 is great for the majority of workloads sometimes a super computer is better for applications needing millions I/O operations per second. A 2nd generation infrastructure allows hyper-scale computing across super computing and cloud fabric for large data set machine learning or Smart Cities IoT management applications.

Partitioned Compute: The partitioning features of Snowball Edge and a Hyper Converged Infrastructure (HCI) allow for the creation of Secure Enclaves that can only be accessed by authorized users after their compute device has been remotely attested by a Zero Trust Network.  Lateral movement within the hybrid environment is blocked using encrypted APIs.

Disaster Recovery: A pure cloud-centric enterprise is a great idea except if one loses access to the cloud or it’s down. The Snowball-HCI combination allows enterprises to have true active:active redundancy that is synchronized in real time.

Micro Data Center: One interesting aspect of the Snowball-HCI super computer combination is that you can have a two box data center! The small footprint of a Micro Data Center opens the door to edge computing in a broad range of vertical market applications where installing racks of gear is impossible.

Vertical Market Applications

In addition to improving cost structure and functionality for enterprises, 2nd generation hybrid computing holds the promise to revolutionize vertical markets:

Finance & Healthcare: Financial and medical institutions have strict requirements on encryption and access control for regulated data that make it difficult to utilize a public cloud. The 2nd generation hybrid infrastructure provides regulated entities a way to develop business logic in AWS marketplace while processing sensitive data on a Hyper Converged Infrastructure (HCI) at their data center.

Energy & Transportation: Energy and transportation companies build expensive satellite networks to backhaul telemetry to centralized data centers. 2nd generation hybrid compute can reduce the need for expensive satellite communications by processing data in Micro Data Centers. Moreover the integrated security and intelligence of a Micro Data Center edge node allows for load balancing across multiple satellite providers to improve redundancy and cost structure.

Emergency Services: A hurricane, flood or earthquake can easily destroy the communications and compute infrastructure of a whole region. The autonomous operational capabilities of a Micro Data Center combined with 4G coverage and broadband satellite allows emergency personnel to “light up” impacted areas within 48 hours of an event. Moreover the ability to ingest live video feeds from drones and helicopters and fuze them provides on-site personnel improved situational awareness.

Smart Cities: Looking to the near future, the collection and processing of IoT sensor Petabyte-scale data is the single biggest challenge to Smart Cities. The massive data that energy, transportation and environmental sensors generate will overload any compute or network infrastructure. In contrast, 2nd generation architectures provide a high performance distributed compute model where IoT sensor data is first processed at Micro Data Centers and then transferred to centralized management systems. Additionally the Secure Enclave features of 2nd generation  infrastructure can be used to remove personal identifiable information while maintaining relevant data to ensure Smart Cities don’t become a giant surveillance system.

The ability to mix and match applications in a 2nd generation hybrid infrastructure frees enterprises to provision the optimal combination for each project thereby reducing cost and improving agility.  Moreover the ability to operate in a completely disconnected autonomous mode simplifies disaster recovery.

Related topics:

 

Smart Cities Cybersecurity Challenge

Smart Cities will become a full-scale cyber war battleground unless Congress mandates cybersecurity.

The biggest danger in Smart Cities is the assumption that IoT sensors communicating over a 5G fabric to Machine Learning and Blockchain systems will be safe from cyberattacks. To the contrary Smart Cities suffer from all the cyber vulnerabilities we have today (like phishing password attacks, server exploitation and self-propagating malware (especially ransomware)) plus a new generation of attack vectors due to the hyper-connected state of everything.

State-Sponsored Infiltration: We haven’t even built our first Smart City but we’ve already had our first geo-political incident. DHS recently banned Huawei’s 5G equipment when it was discovered that the Chinese government could remotely listen to any communication in the USA. The loss of domestic American telecom manufacturing makes Smart Cities vulnerable to equipment imported from hostile states. In addition to direct infiltration, the global supply chain provides ample opportunity to modify software and slip in via domestic suppliers.

Personal Targeting: Currently there are no guidelines to limit what IoT sensors can see inside your home or on the street. Self-driving cars see and hear everything while moving (even at high speed). Facial recognition software can track you as well as determine your social connections (people you talk and who they talk to). The vast amount of personal data makes personal targeting a reality. Take for example ransom (not ransomware but real ransom) from being locked in your self-driving car or smart elevator until you make a big crypto-currency payment.

Market Theft: One of the highly promoted aspects of a Smart City is a Blockchain-based market to buy and sell items like energy. While Blockchain provides a tamper proof record of a transaction it doesn’t guarantee the input data is valid. For example, one could trick Smart air conditioners that it’s very hot and have them buy expensive power from a high priced supplier. The ability to hijack a market creates many new opportunities to steal money. Subsequently all the business logic and financial systems in a Blockchain-based market require significant protections against tampering.

The Proposal: Smart City Cybersecurity Framework

To address Smart Cities cyber risks we require a new framework to mitigate state-sponsored infiltration, protect personal privacy and enable an efficient market. However Smart Cities are so complex that the conventional compliance model isn’t going to work.  We need a new approach that defines clear roles and responsibilities for every vendor and service provider.  To start the process, it’s useful to divide a Smart City into the First Mile, Management and Market sections. We can then look at each section to explore their cybersecurity responsibilities.

First Mile: The First Mile is plagued with IoT and 5G vulnerabilities. IoT sensors are extremely vulnerable to tampering leading to DDoS and malware attacks on management systems. Additionally the lack of trusted 5G infrastructure opens the door to foreign surveillance. A solution to both problems is to build an IoT overlay network using a Zero Trust Network (ZTN). ZTN’s validate the identity and software of IoT devices before provisioning connectivity.  Moreover connectivity would not rely on the 5G network for encryption as the ZTN would utilize its own certificates to establish a mutual TLS VPN.

Privacy Gateway: The First Mile is that is where Smart City citizens are the most vulnerable to personal data mining. Subsequently a Privacy Gateway that strips away Personally Identifiable Information (PII) before data is sent to Management systems is critical. A Privacy Gateway is similar to a GDPR database except that is reads the contents of packet streams and removes facial details (from HD cameras) and human speech (from home appliances) in real time.

Management: Given the mission critical nature of guiding vehicles and power generation systems Management systems should run on a Trusted Computing platform. Software processes like machine learning and administrative control should all run in their own Secure Enclave to mitigate self-propagating malware and inside attacks.  Another issue with machine learning systems is their ability to determine data which has been purposely remove. For example traffic systems could easily determine who the owner of a vehicle is and their travel patterns even after the Privacy Gateway removed the driver’s image and license plate from the HD camera feed.  Thus all analytics will need to be stored in a separate Secure Enclave the PII stripped off (again).

Data Validation: To ensure that corrupted data does not makes its way into a Blockchain market a Data Validation Gateway is required. This would be similar to the monitoring system stock markets now use to detect unusual trading activity however their logic would have to be expanded to handle the wide array of products and services in a Smart City exchange. Thus homes with Smart Appliances that like to buy expensive services will need to have their activity monitored by a Data Validation Gateway.

Market: Bitcoin made it’s mark as an anonymous cryptocurrency. Unfortunately anonymous trading is not what we want when it comes to managing energy and transportation trading. Thus secure digital wallets with strong authentication (ideally implemented in a Trusted Computing platform) combined with authorized trading limits will be critical for efficient market operation.

Whether we utilize a framework like the one presented or develop a new one, a comprehensive cybersecurity strategy is critical. Congress must mandate a minimum cybersecurity standards for Smart Cities before large scale deployment happens.

Additional Resources:

What You Need To Know About Bitcoin: Including potential new business models to consider

OODAloop nails it again with reporting on Bitcoin price manipulation

From Crowdsourced Militias to Dread Bitcoin Pirates

Today Every Company Buys Electricity, Tomorrow Every Company Will Buy Ethereum

Smart Cities Cybersecurity Challenge

Blockchain Templates: Amazon Making Technology Mainstream

How Cryptocurrencies will go from The Technologically Savvy, into the Everyday Transactions of Consumers

What Executives Should Know About Ethereum

What Should Executives Know About How Blockchain, Smart Contracts and Cryptocurrencies Are Disrupting Business?

Cryptocurrencies and their promise for enterprise technology professionals

Chinese Intelligence Operations In America

In part 2 of our Cyberwar series we’ll take a look at how the Chinese government utilizes the US’s open business environment to stage intelligence operations on American soil.

Reconnaissance: While there has been a lot of recent press on Cambridge Analytica, the reality is there’s a giant industry that sells information on individuals who play a role in national security. Everything from the identities of active duty military personnel and defense contractors to intelligence officials is for sale. By buying data from LinkedIn, advertising firms, conference organizers and trade associations, Chinese intelligence is able to get detailed personal information on every American citizen. As Bob Gourley wrote on CTO Vision, America’s enemies don’t need to hack Equifax to get data on Americans, they can just buy it.

Engagement: Nearly everyday there is an event in Silicon Valley where developers meet to discuss topics such as cybersecurity, machine learning, block chain, high-speed wireless and a host of other new technologies. And at every event you’ll always find someone representing Chinese investors. Similar interactions occur at technical conferences, trade shows and even university campuses around the country.  Such events allow Chinese intelligence operatives to gain critical knowledge on emerging technology.

Infiltration: Once Chinese operatives have identified technology of interest they gain quick access by offering companies access to the Chinese market as well as investment funds. Unaware of the fact that they are interacting with a Chinese intelligence operative, most companies willingly disclose their trade secrets.  In some critical areas like machine learning, Chinese intelligence operatives have infiltrated almost every start up – a topic now getting attention from Committee on Foreign Investment in the United States (CFIUS).

To stop the flow of sensitive information to China will require classifying all information on individuals, companies and strategic technologies under the International Traffic in Arms Regulations (ITAR). Currently ITAR is focused on regulating the export of military technologies however Chinese intelligence operates inside America. By classifying all information under ITAR transfer of data to non-US citizens is deemed an export even if it happens in America.  Thus Chinese intelligence operatives would not be able to buy identities of government personnel nor attend cybersecurity conferences without State Department approval.

The more difficult task for the US Government will be to reverse the investments China has made in technology start ups. Currently any company that has a Chinese investment is viewed as a national security risk by the US Intelligence Community (even though they let foreign operatives into the country). The consequences of being defined a risk are very serious from no access to US Government contracts to not being able to get security clearance.

To reverse Chinese investments in strategic companies Congress would have to to pass a Bill that voids all transactions. Thus any start up that got an investment from a person who was a known by the US Intelligence Community as a foreign operative would be allowed to legally reverse the transaction and clear their name.   As start ups will not have the money to pay back Chinese investors an alternative mechanism such as a note without a date or interest rate will also have to be created.

As with all national security initiatives, shutting down Chinese intelligence operations on American soil will take many years. In the meantime the burden of protecting oneself falls upon individual citizens.

Stay up on these and other related issues at the CTOvision Cybersecurity and Cyberwar Portal.

Also see the CTOvision Guide to National Security Technology and

Track the most disruptive technologies by diving into our categorized index:

Artificial Intelligence Companies – A fast overview of Artificial Intelligence companies we believe are poised to cause the most positive disruption in the enterprise.

Big Data Companies – Reference to the greatest, most disruptive Big Data companies in the tech ecosystem.

Business Intelligence Companies – We assess these to be the Business Intelligence Companies most impactful for delivering real decision advantage.

Cybersecurity Companies – We apply our deep expertise in cybersecurity to assessing the best across multiple categories including:

Cloud Computing Companies – We include both platform and software as a service providers, capturing only the most innovative and disruptive.

Collaborative Tool Companies – These are the firms that help humans connect to humans to create, manage and lead.

Infrastructure Companies – Critical enterprise foundations for business agility.

IoT Companies – Internet of Things and Industrial Internet of Things are here. How do you manage them?

Mobile Companies – Help manage, configure, secure and optimize these very powerful capabilities.

Robotics Companies – Including innovations in Robotic Process Automation, Drones, and industrial robotics.

Services Companies – We only track a few, the ones we really know well.

Tech Titans – These are the big players. We track the tech titans closely since their capabilities change continuously.

VC, PE and Finance Companies – Keeping an eye on the investors can give indications of coming developments.

You can also use our topical pages to get up to speed quickly on the current status of the major megatrends. See our pages on Cloud Computing, Artificial Intelligence, Mobility, Big Data, Robotics, Internet of Things, Cybersecurity and Blockchain and Cryptocurrencies.

We also provide special pages focused on high interest topics, including Science Fiction, Entertainment, Cyber War, Tech Careers, Training and Education and Tech Tips.

Cyberwar Is Now A 3-Way Cage Fight

The past few weeks has seen aggressive action by the White House against Russia and China.  Cyberwar has become a 3-way cage fight.  Here’s a quick review of the fight and tactics to improve.

cyber war is a cage fight

US Strategy Not Working: Hit Me, I Can Take It

Data exfiltration by Kaspersky and Huawei have been known for years among US cybersecurity researchers. However US government took the position that they are in control and not to worry. Regrettably the US is taking action against Russia and China AFTER the terabytes of data have been stolen. Lesson: Don’t get hit.

Deploy Countermeasures To Block Attacks

Current US national security strategy is based on a peacetime compliance model not cyberwar. Multi-factor authentication to stop credential theft, application layer access to stop self-propagating malware, encrypted offline data back to stop ransomware and partitioned compute to stop lateral attacks must become national standards.

Be Careful If The Other 2 Team Against You

In a 3-way fight the worse thing that can happen is that the other two fighters gang up on you. Luckily for now that isn’t happening. Russia lost trust in China after they reverse engineered their Su-27 fighter (on top of years of other efforts like that). China in turn doesn’t care for the anti-Asian rhetoric coming out of Moscow. So for now it’s fight among 3 but we need to prepare just in case they gang up on us.

Having A Great Team Makes A Difference

While this is a 3-way fight having a great support team makes a big difference (especially if the other 2 decide to work together). The Five Eyes (FVEY) intelligence consortium (Australia, Canada, New Zealand, UK and USA) should act as a block when any of the partners are attacked. Their surveillance systems are fully integrated facilitating joint action. “Use your mobile phone to steal data from one country and we’ll ban you from all 5.”

No One Said We Can’t Add To Team America

The wild card in the global cyberwar is India. With its vast pool of software developers and access to every compute system in the planet India is a cyber superpower. Traditionally India has been non-aligned but recent tussles with China have them looking to build a military partnership with Russia. The US government should get India onto Team America before its too late.

America will win in the end.  The big issue is how many broken bones we’ll have.

Secure Enclaves: Foundation For The Cloud-Based Enterprise

This is the first in a series of blog posts examining a cloud-based enterprise. In this post we’ll introduce how a Secure Enclave can help enterprises migrate to a cloud-based model.

The two dominant themes in enterprise architecture today is the desire to save money by utilizing cloud services and threat of state-sponsored cyberattacks. The goal of a Secure Enclave is to help enterprises meet both objectives by implementing a trusted access control solution in the cloud.

All IaaS and SaaS providers utilize a shared security model in which they take responsibility for the data inside their boundary but expect the enterprise to be responsible for everything outside their perimeter. For example, enterprises are responsible for all damage due to stolen passwords or unauthorized access to compute instances. Thus the security challenge for cloud-based enterprises to how to enable perimeter security when all they have is the cloud?

A Secure Enclave utilizes a Software Defined Perimeter (SDP) security model to create a protected IaaS instance inside which role-based access control,  trust assessment, certificate management and addressing functions can be deployed. Additionally a Secure Enclave can also protect IaaS and SaaS applications from network-based cyberattacks including self-propagating malware.

Looking at the high level architecture below we see Secure Enclaves supporting trusted access control functions for IaaS and SaaS applications.

Secure Enclave Vidder Junaid Islam

 

The first task of a Secure Enclave is to implement trusted access control to IaaS and SaaS applications. Trusted access control combines role-based access control with device trust assessment. Trust assessment allows enterprises to conduct a remote posture check on user devices before granting access to cloud services. For example, enterprises can verify if a device has updated software and is running endpoint protection. If the device is acceptable then one or more SAML assertions are generated based on the role of the individual.

Secure Enclaves can also be used protect IaaS instances from network-based cyberattacks. Only authorized users and their devices are granted TCP connectivity to IaaS compute instances.  Moreover to block the new generation of self-propagating malware, only application layer connectivity is granted to authorized devices.

One of the unique features of a Secure Enclave is how it protects SaaS applications from stolen passwords. Enterprises can utilize the federation capabilities to SaaS apps to re-direct sign-in requests to their SAML IdP. However only users who have access to the protected IdP can get the SAML assertion. Thus Secure Enclaves can be used to provide transparent multi-factor authentication to SaaS.

In the next post we’ll take a deeper look at the trusted access control functions of the Secure Enclave.

Maximize The Value Of Your 2018 RSA Show Visit

Planning, deploying and operating a cybersecurity architecture is difficult because it requires understanding of different disciplines. The key to having a functional security architecture is integrating identity, access control, endpoint protection and file encryption systems together (across data center and cloud environments). The importance of getting everything right is even more critical with the growing threat of state-sponsored cyberattacks.

Fortunately the RSA show is one of the few events with technical personnel in attendance. The key to getting full value from your trip is fighting the urge to look at flashy displays and instead interacting with subject matter experts. Here is a simple 5-step process you should consider to maximize the value of your 2018 RSA show visit:

1 Know your cybersecurity priorities. The first step to a successful visit is having a clear understanding of your cybersecurity priorities. Create a list that groups priorities into compliance, transformational and countermeasure categories. Send an email to yourself so that you don’t miss any important details when talking to people.

2 Take time to talk to experts once you’ve found one. Once you’ve identified a person with the expertise you seek, share your priority list with them. Take the time to understand their approach to solving your problems. Ask to walk thru the software architecture of their solution to ensure you’ve not missed any important details.

3 How well does the product integrate with your environment. Cybersecurity products that don’t integrate with others are useless. Now that you’ve found a valuable product and a person who is knowledgeable, work out an integration strategy with the solution being offered and others in your environment.

4 What is the user experience and benefit. New cybersecurity products have to provide a tangible benefit to users or there will be resistance. Identify a win for the user to make the new product more appealing. Request a demo from the end user’s perspective and try it yourself.

5 Does the product protect against state-sponsored cyberattacks. Russian self-propagating malware and Chinese data exfiltration represent the biggest cybersecurity threat facing America today. Thus ask how their product helps your company protect against state-sponsored cyberattacks.

Even if you find only 2 or 3 subject matter experts to review your priority list, the trip will pay for itself. If you run out of time at the show offer to buy them dinner in exchange for their expertise – it’ll be way cheaper than hiring a consultant.

Related Reading

Like Kip in Napoleon Dynamite, We love Technology

How Far? The Line Between Compassionate Care and Ruthless Efficiency

Bryson Bort of Scythe Discusses IoT Vulnerabilities and Threat Trends To Date

Transition for One of The Nation’s Greatest Enterprise CTOs: Dave Mihelcic Retires From DISA

Miracle on Ice: Business, Technology and National Security Leadership Lessons from the 1980 Olympics USA Hockey Team

Happy New Year: Here Are Five Suggestions To Reduce Your Digital Risk

The First Quantum Revolution: Foundational information for the enterprise CTO

White House Takes Action Against Chinese Intellectual Property Theft

On March 21, 2018 the New York Times reported that the White House was going to take aggressive action against China for illegal trade practices as well as intellectual property theft. The administration is right to do so.

Drive thru middle America and you’ll see closed factories whose products are now manufactured in China. For the past few decades China has implemented an aggressive policy of stealing manufacturing technology and then providing zero interest loans to Chinese companies to re-create American products. The transfer of wealth to China from the United States directly due to stolen products is in the order of $Trillions. More recently Chinese companies have moved into Silicon Valley to steal technology from leading edge start-ups before they even go to market.

The Chinese government utilizes three techniques to identify and steal technology in Silicon Valley. First, Silicon Valley is famous for meet ups to discuss new technologies. Every night there’s one or more events, often at a bar or coffee shop, to discuss new ideas such as machine learning or cybersecurity. Chinese operatives are regularly seen at all these events listening to ideas as well as identifying the people behind them. Second, once “smart” people have been identified, Chinese operatives utilize email password phishing attacks to access all of their correspondence. Third, if the company is viewed as valuable, Chinese operatives will launch a direct attack on server infrastructure to take source code, product designs and marketing information including customer lists.

Irrespective of how the next few months play out with China, here are some countermeasures you should implement now to protect your intellectual property:

Multi-factor Authentication: Email phishing attacks is the most common technique used by Chinese intelligence because it works. Thus you should implement some form of multi-factor authentication to make sure email isn’t stolen.

Server Isolation: After email, direct attacks on server infrastructure is the most common technique. Subsequently all Internet-facing servers should be locked down as well as connectivity between frontend and backend servers.

Certificate-based Mutual TLS VPN: Hacking WiFi hot spots is a popular technique. Given that R&D personnel love to go to coffee shops and check email or do some coding this is a big attack vector. Thus implement a certificate-based mutual TLS VPN to ensure the connections to corporate assets cannot be hijacked.

Application Layer Access: Only allow application layer access to authorized personnel and their devices. This way if attackers are able to steal an employees credentials or install malware on their devices the ability to install code on servers or laterally move within the data center is limited.

Do not let your company’s intellectual property be used against America.

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]