{"id":336579,"date":"2017-03-23T18:30:03","date_gmt":"2017-03-23T10:30:03","guid":{"rendered":"http:\/\/techcrunch.com\/?p=1467924"},"modified":"2017-03-23T18:30:03","modified_gmt":"2017-03-23T10:30:03","slug":"lessons-learned-from-the-russian-hacking-scandal-and-our-cyber-election","status":"publish","type":"post","link":"https:\/\/people.utm.my\/asmawisham\/lessons-learned-from-the-russian-hacking-scandal-and-our-cyber-election\/","title":{"rendered":"Lessons learned from the Russian hacking scandal and our \u201ccyber\u201d election"},"content":{"rendered":"

<\/p>\n

\n
\n

Joel Wallenstrom<\/span> Contributor<\/span><\/p>\n<\/p><\/div>\n

Joel Wallenstrom<\/a> is president and chief executive of Wickr<\/a>, a secure communications company. Before Wickr, Joel co-founded iSEC Partners, one of the world’s leading information security research teams, later acquired by NCC Group<\/a>, and served as Director for Strategic Alliances at @stake, one of the very first computer security companies in the industry.<\/p>\n<\/div>\n

Information security \u2014 or what is commonly referred to as \u2018cyber\u2019<\/em>\u00a0\u2014 has dominated the narrative in this week\u2019s hearings on Capitol Hill about the Russian interference in the 2016 elections. Despite the political noise, a fact-based public debate on how to deal with strategic and targeted attacks is what\u2019s needed now to develop better defenses for all \u2013 businesses or government organizations.<\/p>\n

There is a universal agreement that a highly-motivated and unapologetic entity has conducted an advanced and persistent campaign to disrupt, undermine and gain power over its strategic adversary. The questions become \u2013 what have we learned from the 2016 campaign and how are we going to adapt to prevent similar cyber campaigns in the future?<\/p>\n

Convenience vs. Security<\/h2>\n

The alleged attempt by Russia to influence the outcome of the US elections is today\u2019s news. Yet this has not been and will not be the last time such operations have been conducted by nation-states, including our own. From the<\/p>\n

From the Titan Rain<\/a> in the early 2000s, Operation Aurora<\/a>\/Hydraq<\/a> in 2009-2011 to\u00a0Red October<\/a>, Eurograbber<\/a> and the infamous Sony intrusion<\/a>, to name just a few, we see that well-funded global technology providers may still bend under the pressure of the advanced and persistent intrusion ran by highly-skilled cyber teams. In every circumstance, the pattern is: break in, harvest information and use it to gain influence.<\/p>\n

If recent history is any lesson, the 2016 election has shown that complexity is often the primary source of weakness.\u00a0 Take the 2016 election campaign -\u2013 years-worth of private, high-value conversations were extracted from an unauthorized communication system and later strategically exposed to the public for a larger political effect. It is unlikely that any decisions to retain high-target sensitive information were made because sanctioned technologies were too simple and convenient.<\/p>\n

Why do we still hope to teach end users to use complex products in the name of security? Do we, for example, rely on employees to never take a picture of a whiteboard or to ensure their phone settings are such that the picture is not stored in the cloud? Do we train our teams to make sure all IP is permanently deleted when it is no longer useful? Do we provide corporate phones that won\u2019t talk to the internet and expect people not to use their personal devices? Or do we realize that they will default to the convenience of their own machines and provide them an easy-to-use application that auto-deletes proprietary information?<\/p>\n

Offering our public officials and business leaders a simple system built to encourage collaboration while proactively deleting sensitive data could very well have made a significant difference in the many intrusion incidents we witnessed in 2016. We all need to come to grips with the fact that imposing complexity on end users will only further enable advanced and persistent adversaries.<\/p>\n

\"\"<\/p>\n

Combatting Persistent Adversaries<\/h2>\n

Many of us who worked in security during the Aurora incident response remember that it was an event that made the term \u201cAPT\u201d or advanced persistent threat ubiquitous. Perhaps the most disappointing byproduct of Aurora was the sales frenzy it triggered in the infosec industry. Armies of \u2018sportcoats\u2019 were unleashed to sell products that protected your everything<\/em> from \u2018APTs\u2019. The current discussion of the \u2018Russian Threat\u2019 has created a similar irrational demand for security silver bullets.<\/p>\n

There is nothing wrong with developing defensive technologies, nor do I suggest that investments in layered security strategies are inappropriate. But we must face that existing security tech is often mere cyber<\/em> speed bumps while the operating expense of protecting digital assets is fast outgrowing the value of what we attempt to secure.<\/p>\n

Although there is no silver bullet solution and security remains incredibly hard, enabling organizations to protect less is a first step in the right direction. Default ephemerality minimizes the window of opportunity for attackers. It robs advanced adversaries of persistence while offering an efficient and predictable framework for keeping proprietary information private.<\/p>\n

No matter how robust and layered your end-point defense is, if important communications are stored, they are vulnerable<\/a> to anyone with enough resources and persistence. That applies to policy-makers, corporations, critical infrastructure, and any organization working with information of value. The result is expensive and mostly ineffective attempts to protect communications we don\u2019t benefit from storing.<\/p>\n

And while there is no compelling enough reason for retention of real-time communications in the face of security risks, we do it out of habit anyway. Because storage is free, just as are convenient services if only we allow the providers to access and hold on to our information.<\/p>\n

\"\"<\/p>\n

What\u2019s at Stake?<\/h2>\n

Interestingly, in the 1990s, when cyber security was not much of a concept, Dan Geer<\/a> foresaw that storage will be near free and, therefore, unreasonably costly in the future. At the time, not all appreciated the vision that storing everything would make the task of securing data nearly impossible and extremely expensive. Now there is almost a universal acceptance that we are simply storing too much.<\/p>\n

As technology evolves, so do the capabilities<\/a> of adversaries working to exploit not only the security flaws in common technology but the human nature of those with access to sensitive information. Things get even messier when an adversary begins to push the boundaries<\/a>, exploiting the very strength of the system it seeks to compromise \u2013 free press, transparency, strong judiciary, and law enforcement.<\/p>\n

If before we used to fear the simple hacking of the election box, now it is clear that there are multiple ways to disrupt and destabilize one\u2019s political system. Several European nations are in the midst<\/a> of their election campaigns. They too are facing foreign influence. Understanding how to adapt to increasingly sophisticated and unconventional tactics is all the more critical in minimizing the impact of the next generation of attacks built on the 2016 Russian playbook<\/a> by other state and non-state attackers.<\/p>\n

\"\"<\/p>\n

Progress Will Be Made in the Middle<\/h2>\n

So where do we go from here? Trust and understanding between the government and the industry is key to improving our readiness against foreign or domestic adversaries. Although it is understandable for law enforcement and intelligence to want more<\/a> and easier access<\/a> to information, including the ability to bypass encryption, it is counterproductive given the existing threats, including to the government\u2019s own communications. Yet it is equally understandable that the private sector will not grant such easy access and should not be relied upon to do so.<\/p>\n

We should perhaps face the fact that law enforcement will vilify encryption in the name of public safety, and privacy advocates will vilify surveillance techniques in the name of free speech and democracy. We should also expect to see more irresponsible reporting of leaked information and, as a result, silly and defensive posturing by companies suggesting that they have defeated the intelligence communities.<\/p>\n

While extreme positions are important, progress will be made in the middle. That is why some of us will work fervently to create products that enable private communications while others will be equally persistent in finding ways to gain unauthorized access to that same user content.<\/p>\n

We can be certain that our adversaries continue to improve and build on their<\/em> lessons learned from the 2016 elections, spinning off new hybrid attacks across global information networks. In turn, if we fight the instinct to continue hoarding sensitive communications and accept our own inability to access ephemeral conversations, we will extend this same limitation to our adversaries, eliminating the one weakness that proved most critical in disrupting ourbusinesses<\/a> and political system in 2016.<\/p>\n

Featured Image: Charles Mann<\/a>\/Getty Images<\/small><\/p>\n","protected":false},"excerpt":{"rendered":"

\"\" Information security — or what is commonly referred to as ‘cyber’ — has dominated the narrative in this week’s hearings on Capitol Hill about the Russian interference in the 2016 elections. Read More<\/a><\/p>\n

\n<\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a>\n<\/div>\n

\"\"\/ <\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-336579","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/336579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=336579"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/336579\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=336579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=336579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=336579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}