Welcome!

Cloud Security Authors: Pat Romanski, Ambuj Kumar, Shelly Palmer, XebiaLabs Blog, Liz McMillan

Related Topics: Cloud Security, Government Cloud

Cloud Security: Blog Post

Burning Down the House for Fun and Profit

The Pros and Cons of Naming and Shaming

In October of 1962, during the buildup to the Cuban Missile Crisis, a debate between Adlai Stevenson and Valerian Alexandrovich Zorin at the United Nations Security Council, revealed how far the U.S. was willing to go to produce evidence that the Soviet Union was indeed stockpiling tactical nuclear weapons and ballistic missiles in North America. The Soviets, reluctance to be truthful "in the court of world opinion", forced the hand of the U.S. to produce the very intelligence that the Soviets' claimed the U.S. did not have. Once the overhead photos of the missiles were shared publicly, the Soviets immediately countered that the imagery was fake. We knew the truth then and we know it today, the Soviets had been caught in their lie.

What we saw this week was very similar to what we saw in 1962.  What is most interesting in this case is that the bombshell was not dropped in a stuffy chamber full of wrinkly policy makers, nor was it used by the administration to draw a hard line under Executive Order 13636 that President Obama signed last week. No, the story was brought to light by a single, private sector entity using unclassified information that was publicly available for anyone to put together. By doing so, a precedent has been set. Finally, the veil has been lifted. Now, the public was able take a glimpse at an unseen threat that many within the security industry have been following closely for nearly a decade.  A complex, intangible idea has a face, or rather a building, attached to it.

So what does this mean? Is this good, bad or somewhere in the middle?

Operational Caveat:
Since 13 February, Cyber Squared's ThreatConnect.com has detected an unknown security research group, (believed to be Mandiant) sink-holing known "Comment Group" command and control infrastructure to a variety of named Virtual Private Servers (VPS) ahead of their 19 February report release. All "Comment Group" infrastructure has been freely available to vetted ThreatConnect users since November 2012.

The Pros:
Unfortunately, there are no lanes in the road that point out clear-cut standards by which organizations can measure if they are responsibly or irresponsibly disclosing cyber threat information. While not everyone supports public disclosures of this nature, we can look at both sides of what has occurred and find the benefits and cost of this massive disclosure.

PRO1: Finally an organization has developed a public attribution picture, publicly naming and shaming China for behavior that many have observed internationally for over a decade.

PRO2: A precedent has now been set for the entire security community; there are many others who have chosen to hold off on disclosing details of attacks or operationalizing infrastructure take downs out of concerns with tipping the threat actors and forcing them to change their TTPs and operational security. Now a green-light has been given to disclose similar details and to unilaterally act to take down large chunks of malicious infrastructure associated with APT's.

PRO3: The United States Government (USG) appears to have handed over the issue of Chinese cyber espionage to commercial industry. Some may argue that this level of disclosure should only be part of an official USG response. However, allowing industries to self-regulate and establish norms of internet behavior may serve as a more efficient way to manage threats of this nature.

PRO4: This now gives the security industry something to measure against.  Not only can the industry observe and measure how "Comment Group" will respond to the disclosure, but also their reactions to sweeping sinkhole operations in addition to target reacquisition efforts.  The industry can also pay attention to general responses from other Chinese APT groups.

PRO5: A disclosure at this level raises the issue of nation state sponsored or sanctioned cyber espionage to a larger audience, keeping the issue in the spotlight and increasing overall global awareness of the threat posed by Chinese cyber espionage.

The Cons:
On the flipside, despite the new opportunities that this may present the industry, there are untold numbers of secondary effects that could come to light because of this disclosure.

CON1: The USG appears to be sidestepping a strategic national policy issue by allowing a commercial entity to assume all of the risk by acting as the mouthpiece that may influence U.S.-China relations. If the USG is to send a message, it needs to send it unequivocally with no appearance of a puppet.

CON2: This may increase the precedent for foreign governments or non-U.S. companies that wish to embarrass the U.S. or western allies by attributing details of other sophisticated threats to western powers.

CON3: "Comment Group", while quite effective, could be considered "low hanging fruit".  There were many "eyes on" from across the global security community which were actively monitoring the threat. Many organizations that had adequate visibility of "Comment Group" infrastructure, capabilities and operations now find themselves exposed to the unknown.  Assuming a Chinese military intelligence unit isn't just going to give up and go home, everyone is now equally vulnerable to whatever they use next.

CON4: A single Chinese APT group out of an average of approximately 20 APT groups would only address 5% of the overall problem. By disclosing details of just one threat group, the effect to Chinese cyber espionage operations would be minimal.

CON5: A detailed disclosure at this level reveals a laundry list of specific items that the Chinese can now use as lessons learned to improve upon overall tradecraft. This increases the probability of Chinese counter intelligence operations, operations security, oversight and an overall process improvement which will diminish the security industries ability to effectively combat the threat of Chinese APT's in the future.

Conclusion
Only time will tell if the gains outweigh any losses associated with the disclosure.  Despite growing evidence that this is the work of the Chinese, the official response has been no different than what we have seen before.  A poor embassy spokesperson, followed by spokespeople for the Ministry of Foreign Affairs and Defense, are forced to respond with the standard canned and reflexive denial stating that accusing China without evidence is "irresponsible" and "unprofessional" or that China is ultimately the victim and would never do such a thing. What this spokespersons probably doesn't understand, through the layers of party bureaucracy, is how "irresponsible" and "unprofessional" the Chinese Computer Network Exploitation (CNE) machine actually is. If this is the case, it highlights how intentionally deceptive the PRC is or that the left hand has no idea what the right hand is doing in the shadows.

Ultimately, what is truly "irresponsible" and "unprofessional" is targeting the same individual four times a day through emails written in broken English with an attached implant embedded in a self extracting archive. For those who bear the scars of APT attacks or organizations who specialize in protecting customers from such threats, it becomes quite clear, the Chinese, in their hunger to support their modernization and economic rise, have compromised themselves before a global economy.

More Stories By Rich Barger

Rich is the Chief Intelligence Officer for Cyber Squared and the ThreatConnect Intelligence Research Team (TCIRT) Director.

@ThingsExpo Stories
Join IBM November 1 at 21st Cloud Expo at the Santa Clara Convention Center in Santa Clara, CA, and learn how IBM Watson can bring cognitive services and AI to intelligent, unmanned systems. Cognitive analysis impacts today’s systems with unparalleled ability that were previously available only to manned, back-end operations. Thanks to cloud processing, IBM Watson can bring cognitive services and AI to intelligent, unmanned systems. Imagine a robot vacuum that becomes your personal assistant tha...
In his Opening Keynote at 21st Cloud Expo, John Considine, General Manager of IBM Cloud Infrastructure, will lead you through the exciting evolution of the cloud. He'll look at this major disruption from the perspective of technology, business models, and what this means for enterprises of all sizes. John Considine is General Manager of Cloud Infrastructure Services at IBM. In that role he is responsible for leading IBM’s public cloud infrastructure including strategy, development, and offering ...
In a recent survey, Sumo Logic surveyed 1,500 customers who employ cloud services such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). According to the survey, a quarter of the respondents have already deployed Docker containers and nearly as many (23 percent) are employing the AWS Lambda serverless computing framework. It’s clear: serverless is here to stay. The adoption does come with some needed changes, within both application development and operations. Tha...
SYS-CON Events announced today that Avere Systems, a leading provider of enterprise storage for the hybrid cloud, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Avere delivers a more modern architectural approach to storage that doesn't require the overprovisioning of storage capacity to achieve performance, overspending on expensive storage media for inactive data or the overbui...
Widespread fragmentation is stalling the growth of the IIoT and making it difficult for partners to work together. The number of software platforms, apps, hardware and connectivity standards is creating paralysis among businesses that are afraid of being locked into a solution. EdgeX Foundry is unifying the community around a common IoT edge framework and an ecosystem of interoperable components.
SYS-CON Events announced today that TidalScale will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. TidalScale is the leading provider of Software-Defined Servers that bring flexibility to modern data centers by right-sizing servers on the fly to fit any data set or workload. TidalScale’s award-winning inverse hypervisor technology combines multiple commodity servers (including their ass...
SYS-CON Events announced today that N3N will exhibit at SYS-CON's @ThingsExpo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. N3N’s solutions increase the effectiveness of operations and control centers, increase the value of IoT investments, and facilitate real-time operational decision making. N3N enables operations teams with a four dimensional digital “big board” that consolidates real-time live video feeds alongside IoT sensor data a...
As hybrid cloud becomes the de-facto standard mode of operation for most enterprises, new challenges arise on how to efficiently and economically share data across environments. In his session at 21st Cloud Expo, Dr. Allon Cohen, VP of Product at Elastifile, will explore new techniques and best practices that help enterprise IT benefit from the advantages of hybrid cloud environments by enabling data availability for both legacy enterprise and cloud-native mission critical applications. By rev...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend 21st Cloud Expo October 31 - November 2, 2017, at the Santa Clara Convention Center, CA, and June 12-14, 2018, at the Javits Center in New York City, NY, and learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
Join IBM November 1 at 21st Cloud Expo at the Santa Clara Convention Center in Santa Clara, CA, and learn how IBM Watson can bring cognitive services and AI to intelligent, unmanned systems. Cognitive analysis impacts today’s systems with unparalleled ability that were previously available only to manned, back-end operations. Thanks to cloud processing, IBM Watson can bring cognitive services and AI to intelligent, unmanned systems. Imagine a robot vacuum that becomes your personal assistant th...
Digital transformation is changing the face of business. The IDC predicts that enterprises will commit to a massive new scale of digital transformation, to stake out leadership positions in the "digital transformation economy." Accordingly, attendees at the upcoming Cloud Expo | @ThingsExpo at the Santa Clara Convention Center in Santa Clara, CA, Oct 31-Nov 2, will find fresh new content in a new track called Enterprise Cloud & Digital Transformation.
Most technology leaders, contemporary and from the hardware era, are reshaping their businesses to do software. They hope to capture value from emerging technologies such as IoT, SDN, and AI. Ultimately, irrespective of the vertical, it is about deriving value from independent software applications participating in an ecosystem as one comprehensive solution. In his session at @ThingsExpo, Kausik Sridhar, founder and CTO of Pulzze Systems, will discuss how given the magnitude of today's applicati...
Smart cities have the potential to change our lives at so many levels for citizens: less pollution, reduced parking obstacles, better health, education and more energy savings. Real-time data streaming and the Internet of Things (IoT) possess the power to turn this vision into a reality. However, most organizations today are building their data infrastructure to focus solely on addressing immediate business needs vs. a platform capable of quickly adapting emerging technologies to address future ...
SYS-CON Events announced today that Ryobi Systems will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Ryobi Systems Co., Ltd., as an information service company, specialized in business support for local governments and medical industry. We are challenging to achive the precision farming with AI. For more information, visit http:...
As popularity of the smart home is growing and continues to go mainstream, technological factors play a greater role. The IoT protocol houses the interoperability battery consumption, security, and configuration of a smart home device, and it can be difficult for companies to choose the right kind for their product. For both DIY and professionally installed smart homes, developers need to consider each of these elements for their product to be successful in the market and current smart homes.
SYS-CON Events announced today that Golden Gate University will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Since 1901, non-profit Golden Gate University (GGU) has been helping adults achieve their professional goals by providing high quality, practice-based undergraduate and graduate educational programs in law, taxation, business and related professions. Many of its courses are taug...
What is the best strategy for selecting the right offshore company for your business? In his session at 21st Cloud Expo, Alan Winters, U.S. Head of Business Development at MobiDev, will discuss the things to look for - positive and negative - in evaluating your options. He will also discuss how to maximize productivity with your offshore developers. Before you start your search, clearly understand your business needs and how that impacts software choices.
SYS-CON Events announced today that Avere Systems, a leading provider of hybrid cloud enablement solutions, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Avere Systems was created by file systems experts determined to reinvent storage by changing the way enterprises thought about and bought storage resources. With decades of experience behind the company’s founders, Avere got its ...
High-velocity engineering teams are applying not only continuous delivery processes, but also lessons in experimentation from established leaders like Amazon, Netflix, and Facebook. These companies have made experimentation a foundation for their release processes, allowing them to try out major feature releases and redesigns within smaller groups before making them broadly available. In his session at 21st Cloud Expo, Brian Lucas, Senior Staff Engineer at Optimizely, will discuss how by using...
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lead...