CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

Home » Verisign

Verisign

Nation-Blanking DDoS Attacks Launched By Individuals Now Proven Able To Take Entire Nation’s Off The Net

We live in times of extreme technological hooliganism, where small groups or even individuals can cause asymmetric damage from a distance. This was proven several times over the last few months, most famously in the 21 October attacks against Dyn that impacted many of Dyn’s clients, including Amazon, Twitter, Reddit, Airbnb, New York times, Spotfiy, Netflix and many others sites.

Conversations with researchers throughout the community and analysis of motives of recent large attacks like that one lead us to conclude that these large attacks are not the result of nation states attacking our infrastructure. This is very likely one or maybe two individuals causing this havoc.

That point should make you think of two things:

  1. If lone actors could do this, consider what many lone actors could do acting individually or collectively
  2. If lone actors could do this, consider what a nation could do

Other interesting thoughts arise when the size of the attacks are considered. According to the Verisign DDoS Trends Report for 2Q2016, peak attack volume for DDoS Attacks was coming in 256 Gigabits per second (Gbps). The big attacks in October were over 1 Tbps, a big leap, and predictions that soon botnets capable of 14 Tbps in size may be conducted very soon.

Very few businesses and very few ISP’s can withstand an attack of 1 Tbps. That size attack can threaten entire segments of the economy and even nations. And with even larger capabilities coming, Nation-blinding attacks can be expected.

Today saw proof that at least one nation-blinding attack has been tested. A new botnet began targeting Liberia in west Africa 2 and 3 Nov. The attack was brief, leading some researchers to conclude it was a test. Many of us believe this too was the act of a small group, not another nation. Someone is doing this for kicks.

Clearly the ability to conduct these attacks is growing. I estimate capacity for this attack will grow by an order of magnitude over the next 30 days.  Imagine what size attacks will be possible in just 30 days. Imagine Venezuela, Colombia and Ecuador all being taken offline at the same time. Or you pick the other countries that get hit. Or imagine the companies that make up your supply chain being hit hard. This could have an impact on you.

Or imagine eBay, Amazon and Walmart being taken out before people get a chance to order holiday gifts.  Or imagine the Post Office, FedEx and UPS being taken out for days or weeks. What would that do to your personal and/or business life.

Worse yet, imagine financial clearing houses being disrupted, slowing financial settlements.

The 9/11 attacks were failures of imagination. Lets not repeat that mistake in not thinking through the impact of nation-blanking attacks. Lets imagine the damage and then find better ways of taking collective action to mitigate them.

What can be done to prevent this attack or mitigate the impact of similar attacks when they occur? We provide our thoughts here, segmented into recommendations for Home Users, Business Users and Local, State, Federal Governments.  And we are updating all that guidance now to underscore, you have to find backup ways to communicate and we recommend doing so asap.

 

 

 

What Local, State, Federal Governments Should Do To Mitigate DDoS Threats

Governments have special roles in helping prevent DDoS attacks. Governments at Local, State and Federal Levels have massive infrastructures that should be protected to help prevent DDoS on others and they have important citizen-facing missions that need protection themselves. Governments can also help us all take collective action.

We have all been tracking the the threats of DDoS evolve to the point where we all need to take collective action to prevent attack. This post provides some of our suggestions on what governments can do in this regard:

  • Legislatures should consider how to encourage network operators to operate in secure ways. One concept would be to grade network providers like healthcare providers are graded and do so in a way that provides the public with results.
  • Law enforcement should avail themselves of the powerful research tools used in the cybersecurity community. One critical source is Passive Total. This comprehensive data collection makes it easy to search, correlate and analyze adversary infrastructures. Network defenders can use this to take defensive action, but law enforcement can use it to take legal action and help shut down the bad actors.
  • Local law enforcement is a tremendous resource for scaling information to every citizen. Local law enforcement should continue to evolve to helping citizens prevent and deter crime by helping inform the public on cyber threats through all available media channels (to be effective at this, law enforcement should study the cyber threat as well).
  • Governments and agencies at Local, State and Federal levels should all ensure DNS firewalls are in place. We recommend Verisign’s DNS Firewall. It provides cloud-based network security based on is built on Verisign’s global recursive DNS platform.
  • Ensure your workforce is tracking the cyber threat by signing up for the OODA Daily Pulse.  This will provide strategic warning of threats and info on mitigation strategies.
  • Government employee training is also key. One way to raise awareness is through our book, The Cyber Threat. This succinct overview articulates the threat in ways that inform and lead to collective action.

We also provide insights and tips aimed at the Businesses and for Home Users. Please review and help get those tips into the right hands.

What Business Users Should Do To Mitigate DDoS Threats

Businesses have long known of the threats of DDoS to their operation, and the security community has been watching this threat evolve to the point where we all need to take collective action to prevent attack.

  • Businesses of every size need to know what devices you have and what you have them for. This gets hard but must be done if you are to optimize your IT. If you don’t understand what you have got you will never be able to keep systems patched and will have a hard time changing default passwords.
  • We are strong believers in using software defined perimeter approaches to understand who is who and what is what and only allowing authorized actions in your network.
  • Use a DNS firewall to reduce two major issues: 1) users visiting sites known to have malicious code that threatens your enterprise and 2) malicious code inside your enterprise that seeks to beacon out to its controller. We recommend Verisign’s DNS Firewall. It provides cloud-based network security based on is built on Verisign’s global recursive DNS platform.
  • Managed DNS is important as well. Make sure your provider of managed DNS services has a track record of reliability.
  • Also ensure your networking team understands the details of BCP38 on Network Ingress Filtering. This will defeat DDoS attacks that employ IP source address spoofing.
  • Ensure your workforce is tracking the cyber threat by signing up for the OODA Daily Pulse.  This will provide strategic warning of threats and info on mitigation strategies.
  • Your network defenders should avail themselves of the powerful research tools of Passive Total. This will help keep them aware of threats in ways that will help them adjust defenses. A key benefit is tracking risks that exist totally out of your control.
  • Consider training your extended team on the cyber threat. One way to raise awareness is through our book, The Cyber Threat. This succinct overview articulates the threat in ways that inform and lead to collective action.
  • Have a backup communications plan. If your network is down and that same network carries all your data, video and voice, how will you get the word out to employees, suppliers, customers?

We also provide insights and tips aimed at the Home User and for Governments at Local, State and Federal levels. Please review and help get those tips into the right hands.

Moving Toward a Framework for Resilient Cybersecurity: Expanding to a Hybrid Security Architecture

This post was sponsored by Verisign.

Hybrid architectures are a reality in today’s complex enterprise environments. The pervasiveness, affordability, and flexibility of cloud infrastructure and services are driving organizations to choose a mixture of on premise, private, and public cloud computing capabilities to meet their needs. So far we have laid out a roadmap for the development of a framework for resilient cybersecurity that includes threat intelligence, tool selection, and incident response. However, we haven’t covered the role that cloud computing can play in enhancing this framework.

Just as organizations look to enhance their capabilities by implementing cloud-based services, the same approach can be applied to extend the capabilities of an organization’s cybersecurity framework. According to the team at Verisign Security Services (see Framework for Resilient Cybersecurity), “For certain types of business needs (resiliency, availability, etc.) cloud-based security services often offer more enhanced capabilities, the ability to scale (worldwide points-of-presence and increased capacity to handle large attacks), and greater expertise and global intelligence than a single enterprise can provide on its own—at lower cost and quicker time to deployment.”

 

In essence, organizations can leverage the resilience, scalability, and increased capacity of cloud-based security services as a force multiplier to increase the efficiency and effectiveness of its internal cybersecurity capabilities. Additionally, through the use of standards based APIs, it is possible to aggregate data and correlate events across on premise and cloud-based systems to enrich the visibility into user behavior and enable quicker detection and response activities.

Enterprises are continually evolving to meet the unique and ever changing demands of the organizations they support. Likewise, the threat landscape is constantly growing and changing to take advantage of new, zero day vulnerabilities. As enterprises continue to evolve, the cybersecurity perimeter becomes harder to define and the attack surface increases, making it difficult for organizations to keep pace with the threats. To combat this, enterprises should consider a shift toward a flexible framework that empowers resilient cybersecurity capabilities reaching beyond on premise systems and into the cloud.

To learn more about each of the recommendations presented in this blog series, read Verisign’s paper entitled, “Framework for Resilient Cybersecurity”.

Also see:

Moving Toward a Framework for Resilient Cybersecurity: Evaluating the Threat Landscape

CTOvision researches the technology landscape looking for firms with significant potential for helping enterprises address their greatest mission needs and dominate in the marketplace.

We categorize our reports into sections on:

Artificial Intelligence Companies | Big Data Companies | Business Intelligence Companies | Cybersecurity Companies | Cloud Computing Companies | Collaborative Tool Companies | Infrastructure Companies | IoT Companies | Mobile Companies | Robotics Companies | Services Companies | Tech Titans | VC, PE and Finance Companies

This content requires a login to read. If you are a CTOvision Pro member, please make sure you are logged in.

If you are not yet a member, please try our free trial!

Here is more info:

CTOvision Pro is our subscription only research and analysis service. This service leverages our proven ability to spot, analyze and accelerate disruptive technologies to provide mission impacting, actionable information.

We deliver actionable insights that will make direct contributions to your success. Subscribing gives you a leg up over your competition by making sure you are always aware of what is possible in enterprise IT.

CTOvision Pro members receive:

  • Exclusive content
  • A special newsletter with insights and summaries of our latest reports
  • Access to our “Ask the CTO” feature
  • In depth analysis on enterprise IT
  • Overviews on and projections/assessments on the future of IT
  • Special reports on Big Data, Cloud Computing, Cyber Security
  • Special reporting on Federal IT

Our high value reports will help you know the difference between leading edge and bleeding edge and fantasy. Know which technology is about to disrupt the market and beat out existing programs and projects. And be the first to find out which company holds the greatest potential of helping you succeed in your enterprise mission and business pursuits.

Start Your Free Trial of CTOvision Pro

The Need for a Framework for Resilient Cybersecurity

This content requires a login to read. If you are a CTOvision Pro member, please make sure you are logged in.

If you are not yet a member, please try our free trial! Here is more info:

CTOvision Pro is our subscription only research and analysis service. This service leverages our proven ability to spot, analyze and accelerate disruptive technologies to provide mission impacting, actionable information.

We deliver actionable insights that will make direct contributions to your success. Subscribing gives you a leg up over your competition by making sure you are always aware of what is possible in enterprise IT.

CTOvision Pro members receive:

  • Exclusive content
  • A special newsletter with insights and summaries of our latest reports
  • Access to our “Ask the CTO” feature
  • In depth analysis on enterprise IT
  • Overviews on and projections/assessments on the future of IT
  • Special reports on Big Data, Cloud Computing, Cyber Security
  • Special reporting on Federal IT

Our high value reports will help you know the difference between leading edge and bleeding edge and fantasy. Know which technology is about to disrupt the market and beat out existing programs and projects. And be the first to find out which company holds the greatest potential of helping you succeed in your enterprise mission and business pursuits.

Start Your Free Seven Day Trial of CTOvision Pro

History of Cyber Intelligence Discussion

Following the Atlantic Council Cyber Statecraft Initiative’s excellent panel on “Lessons From Our Cyber Past,” the panelists and attendees engaged in an insightful discussion on history, technology, intelligence, and cyber. The discussion was moderated by CTOvision editor and Crucial Point LLC CTO Bob Gourley, who also has extensive cyber intelligence experience as the former Defense Intelligence Agency CTO and Director of Intelligence (J2) of Joint Task Force Computer Network Defense (JTF-CND). The panel was filled with a diverse group of cyber and intelligence veterans with unique perspectives. The panel consisted of Rear Admiral Samuel J. Cox, Director of Intelligence (J2) for US Cyber Command, Matt Devost, President and CEO of FusionX with decades of experience as an intelligence and security entrepreneur, Jason Healey, Director of the Cyber Statecraft Initiative and former Director for Cyber Infrastructure Protection at the White House, and Sean Kanuck, National Intelligence Officer for Cyber Issues.

Gourley began with his own question for the panelists. Can we meaningfully explore the history of cyber in an unclassified way? Jay Healey, who is currently the lead investigator for the Cyber Conflict Studies Association’s cyber history book, thought you could. Right now so much information comes from the private sector, and hence is unclassified. Today’s model of cyber information sharing relies on the private sector to provide the intelligence, as it is typically their networks and infrastructure that comes under attack. In the theoretical division of labor, it is then the government’s role to solve the problem, but in practice, it has always been the network owners and private companies that take action, suggesting that the relationship should be reversed. As it stands, classified information isn’t terribly important as it stays within the government anyway. Devost added that while classified information is valuable and government agencies should be studying that history themselves, we can still form a cogent story without it for the private sector. Sean Kanuck noted that the unclassified parts of the story are typically the most important. More critical for the full story is including two kinds of cyber analysis that work best together: the forensic, which is done both by government and industry, and the analytic, which can determine why the attack occurred and is performed by the intelligence community but also by business intelligence. RADM Cox answered that while the classified aspects of history are required to get the full picture, the account without them can still be a useful and accurate one.

The first comment from the audience was that when we study history to understand cyber, we should go back even further, which led to a discussion of valuable historical works that can inform intelligence. Some suggested reading from audience members and panelists included Machiavelli, Alvin and Heidi Toffler’s War and Anti-War, the 1999 Chinese PLA manual Unrestricted Warfare, international law and humanitarian law textbooks, and The Victorian Internet, which explores the first cyber attacks and cyber espionage using telegraphs.

An audience member then asked whether CYBERCOM has the necessary authority to use its tools. Currently, the administration says that war powers don’t apply to cyber as we are not actually sending troops into hostilities. While this is far from a new concern, there is still work to be done on this subject so that decisions about authorization can be made at a rapid pace.

Another audience member asked for declassified examples of cyber intelligence victories and failures. Devost was able to come up with several private sector wins from his time as a consultant such as with iDefense, which got an early warning of an incoming cyber attack and sent it out to its customers. Jay applauded the question, as he thought we needed to hear more about “cyber Midways,” where intelligence turned the tide, not just “cyber Pearl Harbors.” Among his wins, Jay recounted his time with Goldman Sachs where, knowing that physical protests beget cyber attacks, he predicted a string of attacks on banks after a 2002 “Day of Action.” As an example of a loss, he mentioned the attacks against Estonia, which were a surprise despite ample warning and physical protest. Jay noted that most major attacks can be predicted like Estonia, with a cyber component on top of physical upheaval, rather than by PhD’s examining 1’s and 0’s. Sean answered that every time the government finds a threat through all-source intelligence and warns the private sector, that’s a win for intelligence, but a failure was insufficient work on education and awareness, allowing for rampant phishing and unpatched vulnerabilities. Sam Cox added the Defense Industrial Base pilot, where the government shares cyber threat data with a select group of contractors, to the list of intelligence successes.

The next question was on the roles of human and technical intelligence for cyber. Sean Kanuck pointed out that cyber is adapting to Big Data and TECHINT now relies not just on data but meta-data, and meta-meta-data. Jay said that the best source for intelligence on cyber attacks is the foreign press, as it allows you to see who’s angry, who’s making threats, and who’s getting ready to do something.  Matt Devost mentioned tremendous recent gains in TECHINT but reminded the audience that they don’t diminish human intelligence and human analysis. Because the opponent isn’t a 1 or a 0, intent matters. Bob added that the two work best together, and noted that we’ve also been known to turn foreign assets as a source of HUMINT.

Lastly, an audience member asked if openly discussing cyber attacks and espionage by China and Russia has made a difference. Bob used the historical analogy of the Soviet Military Power declassified periodical that was put out to deal with the open secret that the Soviet Union had nuclear weapons. We need a similar declassified information source that we can give to the press that explains what the threat is, who is behind it, and what we need to know. Jay Healey pointed out that with China, our conflict isn’t spy versus spy as with the KGB. Rather, it’s non-state groups, and more of a crime than a counterintelligence issue. Matt pointed out that now, with the perpetrators of attacks against the U.S. out in the open, the next step is establishing norms and a common understanding that such behavior is not ok.

The panelists concluded the event with some final thoughts. RADM Cox noted that the “global cyber arms race” was greatly exaggerated, as actors with the capability to develop sophisticated malware have already been doing so. He also warned of applying the term “cyber attack” sloppily, as most so-called attacks are exploitation and espionage. Sean Kanuck called for a broad societal discussion of cyber that involved physical, technical, legal, and other aspects. Matt Devost added that the study of cyber was multidisciplinary, and required thinking not only of the future but also the far future. Bob Gourley closed the event with hopes that the new crop of policymakers will be better informed about cyber history and that, as intelligence is about the threat, cyber intelligence must be about penetrating the threat and getting that information out to the decision makers.

My Opinion: NYT wants cyber security to be a divisive issue.

I just read an article that seems designed to keep spreading FUD (Fear, Uncertainty, Doubt) about the US government and the NSA.   The article is titled “Control of Cybersecurity Becomes Divisive Issue “.  It starts with an assertion stated as if it were a fact that says “The National Security Agency has been campaigning to lead the government’s rapidly growing cybersecurity programs”.

I bump into all sorts of people in the beltway, and there is a huge amount of buzz regarding cyber.  There is also a huge amount of pontification and rumor and hype, and I think Risen and Lichtblau have fallen for some of that.

I guess I should not be so hard on Risen and Lichtblau.  They are writing about stuff they have no real experience in (other than as writers) and their sources probably have their own biases or in some cases probably have no access to what is really going on.

Maybe I should just repeat something that all of us citizens should already know.  Don’t believe everything you read.

If I were writing the article, I think I would have started it out by saying “The National Security Agency has impressive security expertise and a long history of doing the right thing.  Their sensitive mission is conducted with great care and extensive oversight and they have great processes in place to continually improve what they do. They save lives and protect our privacy and do so with great honor.”  I would also have, as Risen and Lichtblau did, quoted my old friend Dale Meyerrose who said “They are probably the premier cybersecurity, cyberorganization in the world.”

There are plenty of other quotes by friends in that article.  All seem to agree that NSA should not be in total command of all aspects of cybersecurity.  OK, there are many many options on how the nation can do this.  But I really think it was wrong to start off the article with the assertion that the NSA is campaigning for anything.

The NSA has great capabilities that the nation will almost certainly take advantage of as we enhance our cyber security.  That doesn’t mean they are lobbying to be in command of everything.  If they were placed in total command then the country would place the right amount of checks and balances to ensure it worked well, and I would be totally fine with that.  If they are not in command then the country should place the right amount of coordination mechanisms in place to ensure the mission is served well, and I would be totaly fine with that.

What I would not be fine with is if we keep kicking the can down the road and keep a model where we are slow to react and cannot mount as vigorous of a defense as we should.

A hypothetical question to ask ourselves:  Which path would the Russian Business Network, a criminal group described by Verisign as “the baddest of the bad”, want us to take? They would probably want to see us fiddle around for as long as possible without taking clear action.  As for me, I want clear, decisive action that moves us forward.  And I don’t see anything coming from NYT that will help us embark on that path.

Related Reading

Would you like the truth about the NSA? Watch this one minute video

NSA and 60 Minutes: If You Want To Know The Culture of NSA This May Be Your Best Source

National Security and Technology

More Content

Cyber War

Optimizing Corporate Intelligence with OODA Loop

This post is part of our Intelligent Enterprise series, which providing insights aimed at corporate strategists seeking competitive advantage through better and more accurate decision-making. The first post provided foundational insights into A Practitioner’s View of Corporate Intelligence. This one dives into actionable recommendation on ways to optimize a corporate intelligence effort. It is based on a career serving large scale analytical efforts in the US Intelligence Community and in applying principles of intelligence in corporate America.

SciFi

Science Fiction Gadgets You Can Get Today

Technology is advancing pretty fast, at times influenced by the exciting world of Science Fiction. This video captures 10 of the tech developments first seen in SciFi that are available now. A key point of this, if you want to know what is in our future, watch more SciFi!  

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]