CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Cyber War

Cyber War

hacking-detected-shutterstock_188832089The study of cyberwar is more important now than it has ever been. Over the last 20 years we have witnessed cyberwar evolve from an obtuse but prescient concept to a theoretical possibility to a world of constant cyber attacks to today, where all war has cyber components. All war today is cyber war, and all conflict is cyber conflict.

Sign Up To Receive The CTOvision Daily

Cyberwar is a state of conflict. It is related to the technological environment and to cybersecurity, but cyber conflict comprehends those and many other topics into a greater national security construct. Today our nation faces constant adversary action and conflict in cyberspace. Meeting the challenges this adversary action causes requires an understanding of what people and companies and governments can proactively do to bring the fight to adversaries. It also involves deep understanding of adversary tactics and capabilities so we can really understand The Cyber Threat.
We track the the history of cyber conflict, the cutting edge concept being implemented in government, the technological dimensions of cyber war, and, most importantly, the key actions you should take to help protect your personal and business information in cyber conflict. We do that by capturing the thoughts of national security experts and cyber warriors with direct experience in this very serious domain. Our thought leaders take positions, but provide you with the insights you need to evaluate whether or not you support those positions. For example, see: What If This Is The Most Important Thing The Government Can Do To Enhance Our Cybersecurity? where we advocate for the intelligence community to provide compelling insights on the cyber threat to the American people. We also encourage everyone to consider that: Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases For a primer on strategic topics associated with cyberwar see: Twelve Principles of DoD Cyber Conflict

eSentire Appoints Bob Gourley To Advisory Board

Editor’s note: I am very proud to be associated with eSentire in this way. They are a tremendous firm providing businesses with cybersecurity capabilities they would not otherwise have, including an ability to tap into an always on team of experts. -bg

The following is from the press release at eSentire.

eSentire Appoints Cybersecurity Veteran Bob Gourley to its Advisory Board

Cambridge, ON – eSentire Inc., a leader in Active Threat Protection solutions and continuous managed cybersecurity services, proudly announces Bob Gourley, intelligence expert and cybersecurity author, as the newest member of its Advisory Board.

Bob Gourley began his career as a naval intelligence officer, which included operational tours in Europe and Asia. Bob was the first Director of Intelligence of the US Department of Defense’s cyber defense organization. Later in his career Bob was the CTO of the Defense Intelligence Agency (DIA).

“eSentire has developed the tools to effectively combat today’s cybercriminals, but we have to continue to adapt to be effective,” said J. Paul Haynes. “Bob understands the velocity of the cybersecurity landscape and can guide us to better serve our existing customers and connect with new ones.”

Bob’s unique vantage point has made him a sought after advisor to business executives presenting them with actionable insights into the threat landscape.

eSentire actively collaborates with cybercrime advisors to ensure it has access to the breath of expertise required to stay ahead of today’s ever-evolving cyber landscape.

Bob Gourley, based in Virginia, is a Partner at Cognitio Corporation and an author, his most recent book The Cyber Threat is available in bookstores across America and online.

For more see https://www.esentire.com

With HoloLens Microsoft Is Cool Again: Or maybe cooler than ever

hololens-1200-80I haven’t been this excited about MicroSoft in forever.

Their thought leadership, investment in R&D and incredible technical chops has turned what was recently science fiction into a deployable reality.

The innovation is called the HoloLens. Its power and potential is perhaps best seen vice described. For an overview see the video at this link:

In the three months since that video has been released Microsoft has continued to develop this capability and now have plans to role this out to the market. I can’t wait. I especially can’t wait to learn how to use the software development kit that should ship with it. This is going to be a blast.

Community Focused Creators of Value Matt Devost and Tom Parker Have Big News to Share

The highly regarded champions of cyber security Matt Devost and Tom Parker both made a very interesting Facebook posts today, reporting that Accenture has acquired the FusionX, the firm they created and nurtured into a cadre of high performance cyber practitioners making a dramatic difference for global enterprises.

From the press release:

Accenture Acquires FusionX, Further Bolstering Ability to Help Clients Assess and Respond to Advanced Cyber Threats

Accenture Acquires FusionX, Further Bolstering Ability to Help Clients Assess and Respond to Advanced Cyber Threats

NEW YORK; August 4, 2015 – Accenture (NYSE: ACN) has acquired FusionX, a Washington, DC-based cyber security company that has a fundamentally differentiated approach to cyber attack simulation, threat modeling, cyber investigations and security risk advisory services. The acquisition will further strengthen Accenture’s Security practice and help clients accurately assess their ability to protect against, detect and, where necessary, respond to sophisticated and sustained cyber attacks.

Through the acquisition, FusionX will join and augment Accenture’s growing global Security team. By combining FusionX’s expertise in identifying security vulnerabilities with Accenture’s industrialized suite of security transformation and operations offerings, the acquisition will allow clients to more effectively manage risk and improve business results.

“Even companies that have strong cyber security leadership and make wise investments can still find themselves compromised by advanced cyber threats,” said Michael Salvino, group chief executive, Accenture Operations. “FusionX gives Accenture the critical ability to prepare our clients against the most advanced cyber adversaries. Accenture will continue to expand its advanced threat capabilities to help  clients spot cyber security vulnerabilities, defend themselves against the most advanced cyber threats, and to respond to the inevitable breaches that do occur.”

“I’m incredibly proud of the team we have built at FusionX. For the last five years, we have redefined the way our clients defend themselves against advanced cyber threats,” said Matthew Devost, FusionX president and CEO. “By joining Accenture, we will be able to accelerate the expansion of our capabilities, enabling both existing FusionX and Accenture clients to continue to validate and mature their security postures, and draw from Accenture’s substantial security advisory, transformation and operations services. Our team thrives on solving our clients’ toughest security challenges and is looking forward to combining our expertise with Accenture’s security capabilities and experience.”

Founded in 2010 by security industry veterans Devost and Tom Parker, FusionX is staffed by an elite team of highly technical security experts. The company works with Fortune 100 organizations in financial services, critical infrastructure, technology, government, and manufacturing.

Terms of the transaction were not disclosed.

About Accenture
Accenture is a global management consulting, technology services and outsourcing company, with more than 336,000 people serving clients in more than 120 countries. Combining unparalleled experience, comprehensive capabilities across all industries and business functions, and extensive research on the world’s most successful companies, Accenture collaborates with clients to help them become high-performance businesses and governments. The company generated net revenues of US$30.0 billion for the fiscal year ended Aug. 31, 2014. Its home page is www.accenture.com.

OASIS Advances Automated Cyber Threat Intelligence Sharing with STIX, TAXII, CybOX

Editor’s note: We saw the press release below from OASIS and wanted to share it with you since it covers some of the most important information sharing standards in the community today, STIX, TAXII and Cybox. These standards are now being advanced through the open standards process of OASIS.
From PRweb

OASIS Advances Automated Cyber Threat Intelligence Sharing with STIX, TAXII, CybOX

Organizations from Around the World Collaborate on International Standards to Prevent and Defend Against Cyber Attack

(PRWEB) JULY 16, 2015
Three foundational cyber security specifications, STIX, TAXII, and CybOX, are now being advanced through the international open standards process at OASIS. In a transition headed by the U.S. Department of Homeland Security, a record number of organizations from around the world have come together in the new OASIS Cyber Threat Intelligence (CTI) Technical Committee to develop and promote adoption of standards that enable cyber threat intelligence to be analyzed and shared among trusted partners and communities. The work will support automated information analysis and sharing for cyber security situational awareness, real-time network defense, and sophisticated threat characterization and response.
CTI Technical Committee members include representatives of Boeing, Check Point, Cisco, Dell, EMC, eSentire, Fortinet, Fujitsu, IBM, iboss, iSIGHT Partners, NEC, New Context, Palo Alto Networks, Resilient, Securonix, Soltra, TELUS, ThreatQuotient, ThreatStream, TruSTAR, US DHS Office of Cybersecurity and Communications, US NIST, ViaSat, and others.

“Security professionals are overwhelmed and simply don’t have time for analyzing data in disparate formats. STIX, TAXII, and CybOX streamline the process, putting the focus of cyber intelligence where it belongs—on prevention, detection, and remediation,” said Jon Oltsik, Senior Principal Analyst at Enterprise Strategy Group. “Using data converted to these standard formats can help security practitioners rapidly identify and access current threats, and determine how they act, who is responsible and what course of action is needed. Threat intelligence standards are also a key building block for fulfilling the vision of ubiquitous threat intelligence sharing.”

STIX, TAXII, and CybOX can work in concert or be implemented separately. STIX (Structured Threat Information Expression) is a language for describing cyber threat information so that it can be analyzed and/or exchanged. STIX makes it possible to explicitly characterize a cyber adversary’s motivations, capabilities, and activities, and in doing so, determine how to best defend against them. TAXII (Trusted Automated Exchange of Indicator Information) defines services and message exchanges that enable organizations to share the information they choose with the partners they choose. CybOX (Cyber Observable Expression) is a language for specifying, capturing, and communicating events or stateful properties that are observable in system and network operations. Together, STIX, TAXII, and CybOX are instrumental in supporting a wide variety of applications including security event management, malware characterization, intrusion detection, incident response, and digital forensics.
“STIX, TAXII, and CybOX have reached a level of maturity where they will benefit from a more formal collaboration guided by a globally recognized standards development process that ensures transparency, international participation, stability, reciprocity, and perpetual ease of access,” said Richard Struse of the U.S. Department of Homeland Security Office of Cybersecurity and Communications, who chairs the OASIS CTI Technical Committee. “OASIS provides all of this, and is an ANSI-accredited developer of American National Standards as well as an authorized PAS Submitter to ISO. Having these certifications available to STIX, TAXII, and CybOX means they will be implementable by the broadest possible stakeholder community.”
OASIS CTI Technical Committee members have formed three Subcommittees to address the specifications individually. The CTI STIX Subcommittee is chaired by Aharon Chernin of Soltra and Sean Barnum of MITRE. The CTI TAXII Subcommittee is chaired by Bret Jordan of Blue Coat and Mark Davidson of MITRE. The CTI CybOX Subcommittee is chaired by Trey Darley of Soltra and Ivan Kirillov of MITRE
New members are encouraged to join the OASIS CTI Technical Committee and its Subcommittees at any time. Archives are accessible to both members and non-members, and OASIS invites public review and comment on the work.
Support for CT

Check Point
“Check Point believes that open standards and community sharing are vital components of a successful and effective fight against cybercrime. Our goal is to make Threat Intelligence, from a variety of sources, timely and actionable. We have been working with the STIX/TAXII community for the past three years and are adopting STIX/TAXII in our architectures. We look forward to working with the community to expand the standards to allow for significant sharing between governments, security organizations and vendors, and customers.”
–Dorit Dor, VP, products, Check Point Software Technologies

eSentire
“Real-time threat intelligence consumption will become more of a reality as these specifications are widely implemented by vendors in all parts of the security ecosystem. Our security intelligence analysts have been affiliated with and advocates of STIX, TAXII and CybOx for quite some time. The introduction of OASIS as an international standards checkpoint will undoubtedly improve threat intelligence sharing amongst partners by facilitating the exchange of computer-readable threat information.”
–David Maxwell, Director of Threat Intelligence, eSentire

Fortinet
“Information sharing is crucial to building a more secure infrastructure across the global ecosystem. Creating a common language, a methodology for how that language is communicated, rating systems, and other standards are going to be required for efficiency and clarity to combat the speed of new threat creation. STIX and TAXII in particular are important initiatives towards next generation threat intelligence. Using the same terms, data streams, and threat modeling methods will help researchers, vendors, and law enforcement alike share information back and forth to stay abreast or even ahead of threat actor groups. We are pleased to contribute to this and more through OASIS.”
–Derek Manky, Global Security Strategist, Fortinet

IBM
“IBM has long supported industry standards to solve the world’s most pressing challenges. Cybersecurity is one of the greatest challenges our modern society faces and requires a coordinated approach to succeed. Under OASIS leadership, we see an opportunity to better organize the good guys to fight cybercriminals by sharing cyber threat intelligence data in an automated and efficient data standard.”
–Peter Allor, Senior Security Strategist, IBM

iboss
“We have long been committed to any advances that can better enable the sharing of threat intelligence among security professionals. Until now, organizations have been hampered by a lack of common standards and the tendency for security information to be siloed. We strongly support this important endeavor and look forward to contributing to the standardization being led by OASIS.”
–Paul Martini, Co-founder and CEO, iboss Cybersecurity

iSIGHT Partners
“iSIGHT Partners, creator of the commercial cyber threat intelligence category, understands how security organizations can gain the advantage over adversaries by using threat intelligence across their security and risk management program. As an early contributor and enabler of STIX, we welcome the opportunity to join with OASIS to further develop CTI standards and accelerate the adoption of context rich threat intelligence.”
–Robert Huber, VP Community, iSIGHT Partners

NEC
“NEC is very pleased to be part of the CTI Technical Committee and continues to drive CTI adoption with industry partnerships to benefit customers. NEC believes that threat intelligence standards are crucial for proactively countering the cyber threat. We are excited about the formation of CTI TC and support its efforts through its contributing to and promotion of this global standard.”
–Kozo Matsuo, General Manager, Cyber Security Strategy Division, NEC Corporation

New Context
“Development of an industry-wide standards framework for cyber threat intelligence is crucial for the information security industry to be able to define and share threats. New Context is a proud sponsor of OASIS and believes strongly in open and transparent standards frameworks development. We look forward to collaborating on the next standards for STIX, CybOX and TAXII.”
–Daniel Riedel, CEO, New Context

Resilient
“As a Sponsor of the OASIS CTI Technical Committee, we are delighted to be at the forefront of advancing critically important standards like STIX, TAXII and CybOX. By creating protocols that address how to best model, analyze, and share cyber threat intelligence, we can provide greater support to overwhelmed security professionals.”
–John Bruce, CEO and co-founder, Resilient Systems

Soltra
“Soltra is proud to be a member of the OASIS CTI Technical Committee. Our threat information sharing solution, Soltra Edge, was built leveraging STIX, TAXII, and Cybox – key standards within the industry. We look forward to contributing to CTI as we continue to establish and maintain open standards, while improving cyber security capabilities and reducing workload.”
–Aharon Chernin, CTO, Soltra, a DTCC and FS-ISAC Company

TruSTAR
“We are proud to support the work OASIS is doing to advance their cybersecurity specifications and promote information sharing, a critical factor in today’s security posture. By sharing details about malicious incidents quickly, not only between the public and private sectors, but across industry lines within the private sector as well, we can work together to better defend ourselves and stay ahead of the hackers.”
— Paul Kurtz, founder and CEO, TruSTAR Technology

ViaSat
“Focusing on standardizing threat intelligence technologies to keep sensitive government and corporate information secure is paramount to the mission of OASIS and its members. At ViaSat, we take a comprehensive approach to cybersecurity, from identifying potential cyber and physical security vulnerabilities to designing and implementing a plan that leverages big data analytics, intuitive visualization and intelligent automation to keep pace with evolving threats no matter where data resides on the network or how it is accessed.”
–Jerry Goodwin, VP, Secure Network Systems, ViaSat

About OASIS:
OASIS is a non-profit, international consortium that drives the development, convergence and adoption of open standards for the global information society. OASIS promotes industry consensus and produces worldwide standards for security, privacy, cloud computing, IoT, content technologies, digital experiences, and other areas. OASIS open standards offer the potential to lower cost, stimulate innovation, grow global markets, and protect the right of free choice of technology. OASIS members broadly represent the marketplace of public and private sector technology leaders, users, and influencers. The consortium has more than 5,000 participants representing over 600 organizations and individual members in 65+ countries.

Consider This Defense Science Board Warning In Light of The OPM Hack

Now that we have all had time to digest the OPM hack (which is, to borrow a phrase from the Hitchhiker’s Guide to the Galaxy, really big… you just won’t believe how vastly hugely mindbogglingly big it is), I would like to draw your attention back to something else. The Defense Science Board Report of January 2013 on the resilience of DoD systems to cyber attack.

After reviewing all available evidence and rigorously weighing threat information, a Task Force of the Defense Science Board (DSB) concluded that:

The United States cannot be confident that our critical Information Technology (IT) systems will work under attack from a sophisticated and well-resourced opponent. 

How does that make you feel? You know yourself what adversaries are doing with well resourced attacks against the US healthcare industry where over 80 million of us have had our private information stolen. And you have read about the devastating OPM attacks that have compromised the personal information of all government employees plus the security clearance information associated with investigations and the people interviewed on investigations.  Now consider what a well resourced adversary could do to the US military when they decide to take offensive combat action against us. Well resourced adversaries could also offer these capabilities to lower tier adversaries to use against us for strategic advantage.

Read on for more about what the DSB reported as the threat to military systems.

Here are more details: 

The Defense Science Board (DSB) provides advice, assessments and reports as chartered by DoD leadership. It has studied cyber security and related topics for years and has been instrumental in providing new ideas and perspectives for action by DoD leadership.

The DSB was recently chartered to look at an interesting and somewhat intellectually stimulating topic, that of how US military systems could withstand cyber attack and remain able to execute their mission.  The chartered group, a task force on Resilient Military Systems, produced a report with a set of recommendations designed to improve DoD’s ability to accomplish its missions. The overarching strategy recommended by the DSB is one that enhanced the department’s defenses in the face of attacks, decreases the effectiveness of adversaries, increases the cost to adversaries, and deters the most significant adversaries by ensuring the US maintains the ability to deliver desired mission capabilities in the face of catastrophic cyber attack.

The task force also identified a framework to implement metrics collection systems and then develop appropriate performance metrics that can be used to shape DoD’s investment decisions. The report approved by DSB chairman Paul Kaminsky is at http://www.acq.osd.mil/dsb/reports2010s.htm. It is also available at: Resilient Military Systems and the Advanced Cyber Threat.

Here is more from the forwarding letter to the report:

The final report of the DSB Task Force on Resilient Military Systems is attached. This report is based on the perspective of 24 Task Force members who received more than 50 briefings from practitioners and senior officials throughout the Department of Defense (DoD), Intelligence Community (IC), commercial sector, academia, national laboratories, and policymakers. This Task Force was asked to review and make recommendations to improve the resilience of DoD systems to cyber attacks, and to develop a set of metrics that the Department could use to track progress and shape investment priorities.

After conducting an 18-month study, this Task Force concluded that the cyber threat is serious and that the United States cannot be confident that our critical Information Technology (IT) systems will work under attack from a sophisticated and well-resourced opponent utilizing cyber capabilities in combination with all of their military and intelligence capabilities (a “full spectrum” adversary). While this is also true for others (e.g. Allies, rivals, and public/private networks), this Task Force strongly believes the DoD needs to take the lead and build an effective response to measurably increase confidence in the IT systems we depend on (public and private) and at the same time decrease a would-be attacker’s confidence in the effectiveness of their capabilities to compromise DoD systems. This conclusion was developed upon several factors, including the success adversaries have had penetrating our networks; the relative ease that our Red Teams have in disrupting, or completely beating, our forces in exercises using exploits available on the Internet; and the weak cyber hygiene position of DoD networks and systems. The Task Force believes that the recommendations of this report create the basis for a strategy to address this broad and pervasive threat.

Nearly every conceivable component within DoD is networked. These networked systems and components are inextricably linked to the Department’s ability to project military force and the associated mission assurance. Yet, DoD’s networks are built on inherently insecure architectures that are composed of, and increasingly using, foreign parts. While DoD takes great care to secure the use and operation of the “hardware” of its weapon systems, the same level of resource and attention is not spent on the complex network of information technology (IT) systems that are used to support and operate those weapons or critical IT capabilities embedded within them.

DoD’s dependence on this vulnerable technology is a magnet to U.S. opponents. In fact, DoD and its contractor base have already sustained staggering losses of system design information incorporating decades of combat knowledge and experience that provide adversaries insight to technical designs and system use. Despite numerous DoD actions, efforts are fragmented, and the Department is not currently prepared to mitigate the threat.

That forwarding letter was signed by the task force co-chairs, Mr. Lewis Von Thaer and Mr. James R. Gosler, two of the most professional, well thought out leaders I have ever worked with.

Please dive deep into the full document now. You will find some information you already know, but I promise some surprises as well. Find more at http://www.acq.osd.mil/dsb/reports2010s.htm

 

 

Recorded Future Provides Awareness Into Issue of Government Credentials On The Open Web

RF-desktopRecorded Future provides real time threat intelligence to cyber defenders as well as business executives seeking insights to inform decisions. They leverage a patented Web Intelligence Engine over with billions of indexed facts (and more added daily) to analyze the open web to provide insights.

One category of the many sites they ingest is paste sites. These sites are web applications designed to allow users to store and share plain text. They are regularly used to hold and share small working documents by programmers/developers/systems administrators as well as academics and students. In practice, paste sites are also used as a dumping ground for stolen credentials. By applying algorithms over paste sites as well as over 650,000 other sources on the web, Recorded Future can provide enterprises with early warning that credentials have been compromised.

In a report titled “Government Credentials on the Open Web” Recorded Future provides insights and analysis showing 47 US government agencies across 89 unique domains have credentials leaked and made available to potential adversaries. Analysis and additional reporting by the government indicates that many of these agencies do not require multi-factor authentication, meaning lost credentials are a particularly risky threat in those cases.

We downloaded and reviewed the report and then sought to replicate the analysis and learn more by direct use of the Recorded Future application.

We began our evaluation by doing very simple queries of all paste type sites based on government email domains (for example, opm.gov). Starting with simple searches was a great way to generate foundational context. Immediately the visualizations of Recorded Future provided not just results on opm.gov domains but context around related data in the records. For example, a dump to paste sites from Dec 2013 which held opm.gov credentials also held credentials for 8 additional federal entities plus many of their key contractors and Recorded Future summarized the significance of that visually. It also provides a link to the data that was in the paste.

When miscreants steal or break passwords and paste them online it is an immediate threat and with this tool we can see it happening in very plain ways. We can also see the horrid state of user passwords.  Here are a few that stood out:  monkey, Marlene, brianna, turtles, dallaskid, redskins, buffy123, turkey.  These are all horrible passwords!

I also conducted analysis around other domains, including organizations where I have worked in the past and those of many friends and associates. In almost every case there was information that would be of some use to adversaries who might use the information in phishing attacks and in some cases there was clear indication that passwords had been compromised.

Any organization that has leaked credentials is at increased risk, so using this method is a great way to inform defenders of the nature of threats and to take action to mitigate threats.

This same method can be used to look for indications of other types of leaked information, including supplier lists, contract data, customer lists, intellectual property, business strategies and other information meant to be protected. Which leads to the bottom line conclusion: Organizations should use the automation of Recorded Future to enhance situational awareness and drive continued action to improve security and reduce risks.

For more see: “Government Credentials on the Open Web”

Related Posts:

The Use of Recorded Future for Cyber Security Professionals(Opens in a new browser tab)

An Introduction to Recorded Future: An ability to leverage the predictive power of the web(Opens in a new browser tab)

The Insider Threat Worst-Case Scenario(Opens in a new browser tab)

FBI Provides An Update On #SonyHack Investigation Including Some Tech Details On Attribution

 

List of Cyber Threat “Wake-Up Calls” Growing: Policy makers have been hitting the snooze button since 1970

The list below is an update to our reference of “Cyber Security Wake-Up Calls.”  What does it take to be on the list? Generally each of the events below was so significant policy makers were loudly proclaiming to all who would listen that they were a wake-up call. This means there are reflections in public policy documents, speeches and the press that cite leaders using the phrase.

The list below is not all cyber incidents. And the list does not capture the full lessons or nuances of the event. But it should make a clear point: there is something about human nature that causes people to forget the cyber threat. We call this situation Cyber Threat Amnesia.

I believe there are cures for Cyber Threat Amnesia, and I think those cures might come with education, training and awareness (helping address Cyber Threat Amnesia is a key reason we wrote The Cyber Threat). Unfortunately recent events like the deep penetration of U.S. government systems and theft of records on almost every government employee make it clear that more needs to be done in raising awareness in the minds of senior executives.

For now, resolve yourself to this observable fact: Our history indicates cyber security events frequently cause action and remediation and get widespread attention. But soon after the attempt to remediate, organizations collectively forget about the threat.

Here is an updated list of major events. This is not all major events, just those widely reported to be “wake-up calls” for the nation.

Cyber Threat Wake Up Calls

  • 1970 and 1971 – The Defense Science Board publishes what will be known as the “Ware Report” highlighting the potential dangers to department information in the coming age of connected computing. This report was widely seen as a “wake-up call” for computer security and caused changes at institutions like the National Security Agency to enhance the departments security posture.
  • Nov 1988 – The Morris Worm was released and propagated throughout internetworked systems including those of the federal government. This “wake-up call” resulted in establishment of computer response organizations throughout DoD and also resulted in increased funding for computer security research being provided to academic organizations and institutions. The CERT/CC at Carnegie Mellon University was funded.
  • 1995 – The President’s Commission on Critical Infrastructure Protection (PCCIP) was widely regarded as a “wake-up call” for the entire federal government and since it was extensively coordinated with industry and academia was also seen as a way forward in cybersecurity for the entire nation.
  • 1997 – Deputy Secretary of Defense John Hamre was quoted as saying “Solar Sunrise was a wake-up call for DoD.” This activity resulted in increased funding to cyber defense organizations and the creation of a new joint activity called DoD’s “Joint Task Force Computer Network Defense” or JTF-CND (Bob Gourley was first Director of Intelligence (J2) there).
  • 1998 Assistant Secretary of Defense Art Money was quoted as saying “Moonlight Maze was a wake-up call for DoD.”  This activity resulted in enhanced counterintelligence resources and more information sharing across the DoD law enforcement and counterintelligence.
  • 2009 Director of National Intelligence Admiral Blair testified that “Buckshot Yankee was a wake-up call” for the government. This activity resulted in more awareness and more funding for cyber security throughout the federal government.
  • 2010 Deputy Secretary of Defense Lynn writes that “Google’s Aurora attacks were a wake-up call for us all.”  This wake-up call resulted in stronger, deeper coordination across the federal space and underscored need for a DoD strategy.
  • 2011 Deputy Assistant Secretary of Defense Bob Butler says “Wikileaks was a wake-up call for DoD.”   This wake-up call resulted in significant activities and planning across the federal space aimed at enhancing security of information from disclosure.
  • 2012 Sep, In one of the most destructive attacks against computers noted against any company to date, Saudi state-owned oil company ARAMCO had data destroyed on over 3/4 of their companies computers. The NY Times reports this as a “wake-up call” and attributes intelligence officials (including General Alexander) with that assessment.
  • 2012 Oct, South Carolina Gov Nikki Haley announced a massive hack into state websites. The Gov offered the excuse that these attacks are increasingly common. Reporters suggested this be her “wake-up call”.
  • 2012 Oct, Secretary of Defense Panetta issues what he said is a “clarion call” for American’s to “wake up” to the growing cyber threat.
  • 2012 Nov, Former Director of National Intelligence McConnell provides “wake-up call” warning of a potential 9/11 type attack via cyber.
  • 2012 Sep, Department of Energy issues a report on internal cybersecurity practices. This report by their internal inspector general was reportedly seen as a “wake-up call” for the agency’s cyber security group.
  • 2013 Jan, New York Times acknowledges hacks into its papers by Chinese sources. This was widely reported as a “wake-up call” for security experts in media.
  • 2013 Jan, Twitter was hit by a major hack in what security experts called a “wake-up call” for the ecommerce and social media community.
  • 2013 Jan, Attacks on US banks called a “wake-up call” for the industry by cyber security professionals.
  • 2013 Feb, Anonymous attacks against Federal Reserve investigated by FBI. Compromise, called a “wake-up call” compromised data from the Fed’s Emergency Communications System.
  • 2013 Feb, Chairman of the House Intelligence Committee expressed confidence that the hackers recently targeting newspapers and other companies would soon “wake-up” Washington on cybersecurity.
  • 2013 Feb, Mandiant releases a report exposing one of China’s Cyber Espionage Groups. This report, widely considered one of the best articulations of the threat, resulted in significant positive awareness on the seriousness of the threat and was widely called a wake-up call. We believe this is one of the best pieces of cybersecurity research ever produced by an independent company, and we know it is making positive, virtuous change. We hope this goes a long way to really being the wake-up call we all need.
  • 2013 July, Snowden insider attacks declared a “wake-up call” in Bloomberg report.
  • 2013 Nov, Australian newspaper cites Melissa Hathaway stating “We haven’t had our big wake-up call yet and I’m hoping that we’ll address the problems before we have a wake-up call.”
  • 2014 May, When Target CEO Steinhafel was forced out of his position for the late 2013 attacks this was called a wake-up call for CEOs.
  • 2014 Oct, Attacks against JP Morgan and loss of 76 million records called a wake-up call for the industry
  • 2014 Dec, Sony hacks called a “wake-up call” for industry by Fortune and US leaders.
  • 2015 Feb, Anthem attack and loss of 80 million records called a “wake-up call to step up cybersecurity”
  • 2015 Feb, National Association of Attorneys General declares attacks against state governments a “wake-up call”
  • 2015 May, IRS breach and loss of taxpayer personal info called “the latest cyber wake-up call”
  • 2015 May, The VC investment and tech communities should especially take note to the “huge wake-up call” issued by Mary Meeker in her annual Internet Trends report.
  • 2015 June, OPM loss of 4 million records of government employees results in latest wake up call. In a statement which stretched the truth further than saying this was a “wake-up call” OPM director Archuleta said that “Protecting our Federal employee data from malicious cyber incidents is of the highest priority at OPM.”

Of course the reason to publish this list is not to make fun of people for using the term “wake up call.”  The reason to publish the list is to get your brain deeper into the game. Maybe there is something you can do to prevent Cyber Threat Amnesia.  Maybe you can suggest action to current community or government or business leaders? Or maybe you can find ways to educate policy makers or Congress or the American public? Or maybe you have other ideas for stopping this madness of forgetting about the threat.

We certainly want to do our part. We will keep writing about cyber issues here. And we will continue to publish items for awareness in our OODA Daily Pulse.

Let us know if there is more you think we can do to strategically raise awareness of this threat.  We are open to all ideas.

For more see:

For more on these topics see the CTOvision Guide to National Security Technology and

Airbus confirms software errors/configuration brought down A400M transport plane

airbus_a440mThe Register is reporting that badly configured software, installed incorrectly, is responsible for the crash of an Airbus A400M transport plane. Engine control software, installed wrong, was to blame.

The A400M crashed just after takeoff on its first real production test flight, 9 May near Seville’s San Pablo Airport, killing four.

For the initial report on the software  see: The Register.

For more background on the crash see: Wikipedia.

For more see:

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]