My Blog on Dark Reading

I recently started blogging for Dark Reading, I will still be blogging here, but what I write there is for Dark Reading alone.

I noticed that because I didn't write for a while, my writing became rather poor (in my taste). I constantly move between between official and personal language, and find it more difficult to write short, and to the point. But I'm getting there.

So far I posted two blogs:
German Intelligence Caught Red-Handed In Computer Spying, Analysis

According to German Web site Der Spiegel, the German foreign intelligence agency BND has supposedly been spying on computer systems around the world in the past couple of years.

Everyone does it. Why not governments?

Authoritatively, Who Was Behind The Estonian Attacks?

In the past couple of weeks the press has been humoring a couple of rumors about who was behind the 2007 cyberattacks against Estonia [PDF]. During these attacks, Estonia's infrastructure, which relies heavily on the Internet, nearly collapsed.

This is not the first time such baseless attributions were made.

I was in Estonia when the attacks occurred. I wrote the post-mortem analysis and recommendations for the Estonian CERT, and I am going to authoritatively show you why these claims are baseless. I will list these accusations and responsibility claims, and show you why they should be ridiculed.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Estonian Cyber Security Strategy document -- now available online

The Estonian cyber security strategy document is now available online. I must say once again the concept of a national cyber security stance is quite interesting.

Those who wish to download the document:
http://www.mod.gov.ee/?op=body&id=518

My contact there specified she'd be happy to answer any questions. To avoid spam of her inbox, email me for her address.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Estonian Cyber Security Strategy document, translated and public

The Estonians have a public version of their cyber security strategy translated into English (currently available offline only). The concept of a national strategy for cyber security is one which I am particularly fond of (also see previous post, An Account of the Estonian Internet War).

The following is the Summary section from the document which might be of interest (Estonian Cyber Security Strategy — Cyber Security Strategy Committee, Ministry of Defence, ESTONIA, Tallinn 2008):

* * *

The asymmetrical threat posed by cyber attacks and the inherent vulnerabilities of cyberspace constitute a serious security risk confronting all nations. For this reason, the cyber threats need to be addressed at the global level. Given the gravity of the threat and of the interests at stake, it is imperative that the comprehensive use of information technology solutions be supported by a high level of security measures and be embedded also in a broad and sophisticated cyber security culture.

It is an essential precondition for the securing of cyberspace that every operator of a computer, computer network or information system realises the personal responsibility of using the data and instruments of communication at his or her disposal in a purposeful and appropriate manner.

Estonia's cyber security strategy seeks primarily to reduce the inherent vulnerabilities of cyberspace in the nation as a whole. This will be accomplished through the implementation of national action plans and through active international co-operation, and so will support the enhancement of cyber security in other countries as well.

In advance of our strategic objectives on cyber security, the following policy fronts have been identified:

• application of a graduated system of security measures in Estonia;
• development of Estonia's expertise in and high awareness of information security to the highest standard of excellence;
• development of an appropriate regulatory and legal framework to support the secure and seamless operability of information systems;
• promoting international co-operation aimed at strengthening global cyber security.

Policies for enhancing cyber security

1. The development and large-scale implementation of a system of security measures

The dependence of the daily functioning of society on IT solutions makes the development of adequate security measures an urgent need. Every information system owner must acknowledge the risks related to the disturbance of the service he or she provides. Up-to-date and economically expedient security measures must therefore be developed and implemented. The key objectives in developing and implementing a system of security measures are as follows:

• to bolster requirements for the security of critical infrastructures in order to increase its resistance, and that of related services, against threats in cyberspace; to tighten the security goals of the information systems and services provided by the critical infrastructure;
• to strengthen the physical and logical infrastructure of the Internet. The security of the Internet is vital to ensuring cyber security, since most of cyberspace is Internet-based. The main priorities in this respect are: strengthening the infrastructure of the Internet, including domain name servers (DNS); improving the automated restriction of Internet service users according to the nature of their traffic, and increasing the widespread use of means of authentication;
• to enhance the security of the control systems of Estonia's critical infrastructure,
• to improve on an incessant basis the capacity to meet the emergence of newer and technologically more advanced assault methods;
• to enhance inter-agency co-operation and co-ordination in ensuring cyber security and to continue public and private sector co-operation in protecting the critical information infrastructure.

2. Increasing competence in cyber security

In order to achieve the necessary competence in the field of cyber security, the following objectives have been established for training and research:

• to provide high quality and accessible information security-related training in order to achieve competence in both the public and private sectors; to this end, to establish common requirements for IT staff competence in information security and to set up a system for in-service training and evaluation;
• to intensify research and development in cyber security so as to ensure national defence in that field; to enhance international research co-operation; and to ensure competence in providing high-level training;
• to ensure readiness in managing cyber security crises in both the public and private sectors;
• to develop expertise in cyber security based on innovative research and development.

3. Improvement of the legal framework for supporting cyber security

The development of domestic and international legislation in the field of cyber security is aimed at:

• aligning Estonia's legal framework with the objectives and requirements of the Cyber Security Strategy;
• developing legislation on protection of the critical information infrastructure;
• participating in international law-making in the field of cyber security and taking steps internationally to introduce and promote legislative solutions developed in Estonia.

4. Bolstering international co-operation

In terms of developing international co-operation in ensuring cyber security, the Strategy aims at:

• achieving worldwide moral condemnation of cyber attacks given their negative effects on people's lives and the functioning of society, while recognising that meeting the cyber threats should not serve as a pretext for undermining human rights and democratic freedoms;
• promoting countries' adopting of international conventions regulating cyber crime and cyber attacks, and making the content of such conventions known to the international public;
• participating in the development and implementation of international cyber security policies and the shaping of the global cyber culture;
• developing co-operative networks in the field of cyber security and improving the functioning of such networks.

5. Raising awareness on cyber security

Raising public awareness on the nature and urgency of the cyber threats might be achieved by:

• presenting Estonia's expertise and experience in the area of cyber security at both the domestic and international level, and supporting co-operative networks;
• raising awareness of information security among all computer users with particular focus on individual users and SMEs by informing the public about threats existing in the cyberspace and improving knowledge on the safe use of computers;
• co-ordinating the distribution of information on cyber threats and organising the awareness campaigns in co-operation with the private sector.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

ISOI 5, Tallinn, Estonia - Summary!

ISOI stands for Internet Security Operations and Intelligence. It is a professional conference, but with a very casual atmosphere. It brings together individuals who work daily to secure the Internet and respond to global security incidents, mostly as volunteers. They are often employed in government, law enforcement, ISPs and Telcos, anti virus, security industry and academia.

We often invite some policy makers as well, but they are there to learn rather than participate.

The conference is run under the Chatham house rules, with the added caveat of having to seek permission from the presenter before mentioning in public what was talked about.

When Hillar Aarelaid first approached me about hosting ISOI in Estonia, my first reaction was: 'cool'. My second was: 'ahhh'. After all, while going to Europe is something we wanted to do for a long time now... who would go as far as Estonia? I said 'go for it', and the rest is history.

How do the rednecks say: 'Boy!' I am happy I took the chance. I forgot the venue factor. You can judge how many people will attend the Virus Bulletin conference by, for example, if there was a conference there before, and how good of a vacation spot it is. Dublin was a huge hit, as was New Zealand. Get my drift?

Within two days of announcing ISOI 5, we had 50 Americans who RSVP'd as attending. We had two Europeans. Mind-boggling.

As the conference approached, more Americans RSVP'd and we found it amazing we had barely the same number of Europeans. We later found out that there were five other conferences before or immediately after ours, not to mention one in Sweden on the very same dates. The scale was then tipped and we ended up with lotsa Europeans, but the lesson about what vacation venues mean to Americans was learned.

Randy Vaughn once again came to the rescue with preparing the online schedule, and Hillar along with the rest of the Estonian CERT made our stay amazing, and ran one hell of a conference.

Conference highlights
1. Estonian girls. Enough said.
2. No tax on alcohol. Enough said.
3. No sleep in between conference days. 'So say we all!' :)

Two evenings before ISOI, before the local Estonian CERT conference, we all went out to an Irish pub, called St. Patrick's of all things. Hillar picked up the tab.

The evening before ISOI we all went out to a local place across from the Viru hotel, where after drinking profusely for hours and eating dinner, the bill was only 200 Euros or so (I just got diet coke, shame on me).

Chad from Sunbelt simply picked it up instead of gathering money, saying it costs less than dinner in Vegas--he is a great guy. Danny McPherson from Arbor picked up what was ordered later, which couldn't have possibly been more than 50 Euros--Danny is one of the more fun guys around. Lots of thanks to them both. Alcohol is really cheap over there. Think the night ended there? Think again.... but let's talk about the conference now.

While ISOI is centered around the trusted and vetted communities of folks who spend time protecting the Internet against evil cyber criminals (ooh), one highlight of the conference for me was a lecture named The Limits of 'permitted self-help' in Internet Security and Intelligence by Alana Maurushat, an Academic from Australia.

She opened the discussion of how far can "vigilante" groups (I hate that term, especially when it is wrong) go, what is legal and what isn't. Needless to say, while she was interesting, her initiation into our group was by fire. Several of us, while appreciative, were "active particpants".

She started by showing pirates on the screen, followed by an entire room yelling "Argh!!!". Good start.
The interesting discussion aside, she had to keep saying "permitted self help". I kept wanting to ask "right or left hand?" but eventually ended up using Aussie terminology (as she is from Australia, after all), saying "so, what are these wankers all about?"

Eventually I just said she must stop implying we all masturbate for a living, but it was a good time and a great discussion. She had a cold, and it was her birthday. Trial by fire, indeed. I hope she comes back, she added quite a bit to the mix.

Rick Wesson showed a map of abuse on the Internet inspired by an xkcd comic, and many other presentations filled the day, which unfortunately I barely had time to listen to. While Hillar was amazing and ran most of the conference, being the organizer keeps you busy. The rest of the presentations I can't really talk about without seeking permission (see first paragraph about Chatham house rules and caveat), so...

At the end of the first day we gathered some of the defenders of the Internet "war" of last year on a panel to answer questions. Estonians are very shy, so moderation was problematic, but it ended up being pretty interesting.

In the evening everyone went to a local restaurant/bar with local Estonian food, for the official "reception". Microsoft, Hansapank and SEB picked up the bill for the food, and Norman volunteered to pick up the drinks tab. I asked them to cover 1000 Euros, and after the first evening we never believed they would pay more than 500, given the low prices. It ended up being 1200 Euros. Unbelievable, but some of us can drink! Thanks Norman!

The second day had many neat presentations, but the second half of it was filled with presentation after presentation on the cyber conflict in Georgia last month, and one presentation on RBN by Jart Armin.

As a surprise (for me as well), Hillar flew in last second a system administrator from one of Georgia's banks to discuss how things went from her perspective. She gave a very good presentation, but the surprise he intended for me was ruined. Hillar was somewhat annoyed when I came to him with her business card. How did I find out, you ask?

"Hello, who are you? :)"
"I am Masha, I am lecturing tomorrow"
"No you are not, and I should know.. this is my conference"

I ended up giving her my copy of "Stranger in a Strange Land" by Robert A. Heinlein, which she earned (but left me book-less for the flight back home).

The rest is history. :)

Quite a surprise from Hillar!

The last evening of ISOI is when people often go off with friends to eat dinner. The Viru hotel bar seems to have become the main gathering point from which people went in groups, came back and left again. I sat back with my laptop, staring out the window as Estonian girls passed continually, while trying to hold up my end of several conversations.

It was a very good ISOI, and a very fun one, as well. Next one is around February, in Dallas TX. After that we will have one in Norway.

Special thanks once again go to the Estonian CERT: Toomas (who helped organize), Tarmo (who operated everything), Aivar (who regardless of anything, I am just happy was there), Kathrine (who made sure we all had food, and took care of us) and of course, Hillar!

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

House Armed Services Committee discussion on EMP

A friend of mine recently brought to my attention the 2008 report of the Commission to Assess the Threat to the United States From Electromagnetic Pulses (EMP) Attack. That report
is dated April 2008, but the US House Armed Services Committee held hearings on that report July 10th, 2008.

The 2008 report (208 pages/7MB+) is available from
http://www.empcommission.org/reports.php
A video copy of the House Hearings in Windows Media format is available from
http://armedservices.house.gov/hearing_information.shtml

I listened to it once, and then a second time to get the quotes I wanted. Especially interesting to those of us who study affecting change and existential risks.

Event mentioned:
August 13 2003--Power transmission line got hot, sagged down, touched a tree and shorted the ground. Next hour 2000 megawatts of generating capacity were looking for a route to get to the northern US. Whole North-East was blacked out.

Nice buzzword/terminology:
Graceful degradation

Facts and "realistic" assessments mixed in, shared:
1, Estimation of approximately 90% death toll is possible "within parameters"
2. Estimation of a year and a half to order replacement equipment to key systems, from abroad
3. Tested, estimation of 10% of cars to stop working, most (not all) to restart regularly
4. Launch over Caspian sea and tests of Shahab 3 to detonate in orbit show EMP intentions, no others come to mind
5. Explicit Iranian doctrine including EMP
6. It doesn't take advanced or large-yiled nuclear weapons
7. China and Russia have been developing such EMP devices, as opposed to their Cold War strategies
8. With a Scud B you could cover one of the coasts
9. Estimated we'd have three days supply of food

Mentioning of (not explored further):
"Intelligence interdiction and deterrence"
"Deter, dissuade, and if necessary intercept"

My favorite quotes:

"This report presents the results of the commission's assessment of an EMP attack to our critical national infrastructures sometimes referred to as civilian infrastructures, but since they are as important to our military capabilities and our national security as they are to our civilian economy and citizenship we chose to call it critical national infrastructures." -- Dr. William R. Graham, Chair, Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack before the House Armed Services Committee hearing on EMP, July 10, 2008.

The subject of critical infrastructure is dear to my heart, and I've challenged its definition in the past year, following the "Estonian war" incident.

"EMP is one of a small number of threats that can hold our society at risk of catastrophic consequences. A well coordinated and wide-spread cyber attack is another potential example." -- Dr. William R. Graham, Chair, Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack before the House Armed Services Committee hearing on EMP, July 10, 2008.

Dr. Graham putting cyber attacks right beside the nuclear (EMP) strategic threat.

"Our vulnerability is increasing daily as our use and dependence on electronics and automated systems continues to grow." -- Dr. William R. Graham, Chair, Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack before the House Armed Services Committee hearing on EMP, July 10, 2008.

Although mentioned in relevance to EMP, it reflects well the vulnerability advanced countries face in a connected world, as I discuss in my Georgetown Journal of International Affairs article about the "Estonian war" [PDF].

"The impact of EMP is asymmetric in relation to potential adversaries who are not as dependent on modern electronics as we are." -- Dr. William R. Graham, Chair, Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack before the House Armed Services Committee hearing on EMP, July 10, 2008.

They can get us, we can't necessarily get them. Georgia is equivalent to "them" here, in being less reliant on the Internet and thus suffering mostly a PR and PR communication blow in the recent cyber attacks incident in Georgia.

"The current vulnerability of our critical infrastructures can both invite and reward attack if not corrected." -- Dr. William R. Graham, Chair, Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack before the House Armed Services Committee hearing on EMP, July 10, 2008.

Being vulnerable, not working on a correction and then, not only doesn't deter an attack, but invites it. Assuming the other side isn't aware of this vulnerability in this case is false, and yet statements have been made discussing it is a mistake.

When writing the post-mortem analysis for the Estonian CERT, I wanted to avoid a certain issue as it places a target on the backs of the local banks. The Estonian mentality of "if you write about it, we can fix it" truly surprised me.

It is a culture which has secrets and a place for security agencies, but puts full disclosure as part of its ideology.

"It's unlikely my home will burn but I would not sleep well if I did not have an insurance policy. I don't hire somebody to stand there watching for a fire to yell fire! fire! but i do have an insurance policy. That's what I'd like my nation to have for EMP protection." -- Rep. Roscoe Bartlett, House Armed Services Committee hearing on EMP, July 10, 2008.

You can't always protect against everything, but you can plan for most of it.

[Answering on if EMP is the most asymmetric attack possible] "One as I mentioned was a cyber attack, possibly a very wide-spread and contagious biological attacks, but this is one of a very small set and very asymmetric." -- Dr. William R. Graham, Chair, Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack before the House Armed Services Committee hearing on EMP, July 10, 2008.

Dr. Graham putting cyber attacks right beside the nuclear (EMP), and the biological, strategic threats.

When asked: "Why is there so little interest in the part of our leadership to do something about it? Is it just too hard they just don't want to face it?" -- Asked by Rep. Roscoe Bartlett, Dr. William R. Graham answered:

"It might be better to ask a sociologist than an engineer and physicist that question, but it falls into the category of a problem which hasn't happened yet. Certainly our ability to predict very unusual and significant events whether it's Pearl Harbor, the start of the Korean war, 9/11 and whatever, we have, to paraphrase Winston Churchill "much to be humble about" in our ability to predict these events before they happen. Of course once they happen then there tends to be massive response, but somehow it's just not within our character and our society to look for these events before they occur." -- Dr. William R. Graham, Chair, Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack before the House Armed Services Committee hearing on EMP, July 10, 2008.

This brings to mind one of my favorite quotes:
"My biggest obstacle is people's unrealistic belief that if a given disaster hasn't happened yet, it won't ever happen."
--Scott Borg, director and chief economist, U.S. Cyber Consequences Unit

Humans are reactive beings, and we kill fires. In fact, most human endeavor is so busy with current and "interrupting" events as to think or follow-through on long-term strategy.

Before a disaster occurs, you're crying wolf. After it does you're one hair on the back of one sheep asking for calm in a huge panicky herd.

Convincing people a threat is real, isn't easy either. Those who do believe you, may want live examples (show me a PowerPoint presentation of a live exploit!), or may have an interest in how this may impact them, their budget, and their work-load.

"This may be the all-time asymmetric threat but it is also the all-time esoteric threat" - Rep. John Spratt, House Armed Services Committee hearing on EMP, July 10, 2008.

Yeah, it's huge in being scary and potential impact, but how likely is it compared to everything else? Can we afford to ignore it even so?

"Affordability is like beauty, it tends to be in the eye of the beholder" -- Dr. William R. Graham, Chair, Commission to Assess the Threat to the United States from Electromagnetic Pulse (EMP) Attack before the House Armed Services Committee hearing on EMP, July 10, 2008.

Beautiful analogy.

"If you are preparing for something like this in advance, say years ahead, you're now a patriot, you're stimulating the economy, but if you do it hours before it happens, now you're a hoarder [and] you're doing exactly the same thing and timing is critical." -- Rep. Roscoe Bartlett, House Armed Services Committee hearing on EMP, July 10, 2008.

Brilliant summary of existential risks, as viewed by the public and by decision makers.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron