4 ms·

I haven't read the report yet, but it's on my list. That said, our (USA) national interests are at stake here. So far, we've left it up to the individual comm

by Nrsolis 14y ago

I haven't read the report yet, but it's on my list. That said, our (USA) national interests are at stake here. So far, we've left it up to the individual commercial parties to police and defend their own networks and that isn't working as well as we would like. I know that there was once a trial balloon floated to get the NSA to help commercial interests properly detect and defend their IT infrastructure. IIRC, the privacy interests considered that a bigger risk than the Chinese. I'm not sure that isn't a bit myopic. When a company like RSA gets hacked, you need to think about the guy with a gun banging at your door, not the boogeyman under the bed.

diminoten 14y ago
This is the real conversation we need to be having; why are companies having to go toe-to-toe with nations, without the backing or support of their own government?
- ComputerGuru 14y ago
  The unfortunate answer is quite simple: because we don't trust our own government. And with (some) good reason.
- betterunix 14y ago
  What makes you think companies are not receiving help from the government? https://en.wikipedia.org/wiki/ECHELON#Controversy https://en.wikipedia.org/wiki/ECHELON#Controversy
- GHFigs 14y ago
  One reason that conversation has been hard to have to date is that a bill like this: http://en.wikipedia.org/wiki/Protecting_Cyberspace_as_a_National_Asset_Act http://en.wikipedia.org/wiki/Protecting_Cyberspace_as_a_Nati..., gets reported in the press like this: http://en.wikipedia.org/wiki/Internet_kill_switch http://en.wikipedia.org/wiki/Internet_kill_switch
  - snowwrestler 14y ago
    Exactly. And CISPA gets marketed as "SOPA warmed over" by activists eager to build their email lists.
- snowwrestler 14y ago
  U.S. companies do receive significant support from their government, typically in the form of FBI support for the investigation and mitigation of intrusions. The really sophisticated stuff is on the military side, which is a black box. But who is to say that the NSA or DOD is not actively engaged in trying to analyze or degrade the capabilities of Chinese APTs? It's possible someone in the NSA is reading the Mandiant report right now thinking "not bad, they got almost half of what we know." The recent Obama executive order should help get more of such info into the hands of companies.
  - greedo 14y ago
    From what I've heard, the US govt has basically decided that the best defense is a good offense. You don't hear of any of their successes because a) the US doesn't want to let it out, and b) the Chinese aren't especially fond of losing face.
- rayiner 14y ago
  Because contemporary net/tech culture believes in an extremist version of "those who would trade liberty for security deserve neither" philosophy. Inside the tech community, reasonable proposals are shouted down as the first step on the slippery slope to big brother. Outside the tech community, nobody really cares because they don't intuitively understand the need for network security in the way they might understand the need for border or airport security.
- joequant 14y ago
  Which government? If you are a software company and you let it be known that you actively cooperate with the NSA and CIA, I doubt you'll be doing much business in China. I doubt France is going to let you in, either. Outside of a few industries, the business losses from actively cooperating with a national government are going to be much larger than any losses due to hacking.
- jstalin 14y ago
  This assumes that the government is better at it than private industry.
trotsky 14y ago
The biggest problem with the NSA proposal was that it was dishonest. Industry has been asking them for threat alerts based on tier 1 network surveillance for some time, but the NSA (dba Cyber Command) has continually questioned whether they were chartered to share that information. As a response they offered to share data only with organizations that would place NSA instrumentation inside their private networks, which is what raised the privacy concerns. Simply put, defense is hard. That's the main reason you've seen all of the national intelligence organizations playing hot potato with the issue. Hopefully this will be changing a bit for the better based on the executive order Obama signed recently that directs DHS, NSA and the FBI to expand their programs that share active threat information with private companies.
- Nrsolis 14y ago
  I hear you and I don't want to underestimate or diminish the concerns that private companies have. That said, the threat vectors for APTs aren't always solely network-based. IIRC, the behavior of the APT that struck RSA was fairly targeted and changed behavior once inside the network. It isn't unreasonable to think that the NSA would want to talk about putting sensors inside a private network where they could detect "successful" penetrations. Again, we have every right to be wary of letting the (government) camel nose in the tent. I'm just saying that if you don't kinda sorta trust your government to help you fight a serious foreign power with nearly unlimited resources, you might need to reconsider your position. The threat from China is real and ongoing versus the theoretical threat from the US Government.
  - joequant 14y ago
    One problem is that multinational corporations are multinational with significant operations inside of China. I doubt that the NSA is going to be of much help in helping a US company secure its networks inside of China, and if that company has large numbers of Chinese employees in China, there are security issues with having US intelligence companies sharing sensitive US intelligence. For example, the NYTimes has a bureau in Shanghai, and if they use a private contractor to help strengthen their networks, then I don't think that the Chinese government would be cancelling visas. If the NYTimes brought in the NSA, then I give the Chinese government five minutes before all of the visa get cancelled and the journalists get expelled.

by Nrsolis 14y ago

diminoten 14y ago

This is the real conversation we need to be having; why are companies having to go toe-to-toe with nations, without the backing or support of their own government?

ComputerGuru 14y ago
The unfortunate answer is quite simple: because we don't trust our own government. And with (some) good reason.
betterunix 14y ago
What makes you think companies are not receiving help from the government? https://en.wikipedia.org/wiki/ECHELON#Controversy https://en.wikipedia.org/wiki/ECHELON#Controversy
GHFigs 14y ago
One reason that conversation has been hard to have to date is that a bill like this: http://en.wikipedia.org/wiki/Protecting_Cyberspace_as_a_National_Asset_Act http://en.wikipedia.org/wiki/Protecting_Cyberspace_as_a_Nati..., gets reported in the press like this: http://en.wikipedia.org/wiki/Internet_kill_switch http://en.wikipedia.org/wiki/Internet_kill_switch
- snowwrestler 14y ago
  Exactly. And CISPA gets marketed as "SOPA warmed over" by activists eager to build their email lists.
snowwrestler 14y ago
U.S. companies do receive significant support from their government, typically in the form of FBI support for the investigation and mitigation of intrusions. The really sophisticated stuff is on the military side, which is a black box. But who is to say that the NSA or DOD is not actively engaged in trying to analyze or degrade the capabilities of Chinese APTs? It's possible someone in the NSA is reading the Mandiant report right now thinking "not bad, they got almost half of what we know." The recent Obama executive order should help get more of such info into the hands of companies.
- greedo 14y ago
  From what I've heard, the US govt has basically decided that the best defense is a good offense. You don't hear of any of their successes because a) the US doesn't want to let it out, and b) the Chinese aren't especially fond of losing face.
rayiner 14y ago
Because contemporary net/tech culture believes in an extremist version of "those who would trade liberty for security deserve neither" philosophy. Inside the tech community, reasonable proposals are shouted down as the first step on the slippery slope to big brother. Outside the tech community, nobody really cares because they don't intuitively understand the need for network security in the way they might understand the need for border or airport security.
joequant 14y ago
Which government? If you are a software company and you let it be known that you actively cooperate with the NSA and CIA, I doubt you'll be doing much business in China. I doubt France is going to let you in, either. Outside of a few industries, the business losses from actively cooperating with a national government are going to be much larger than any losses due to hacking.
jstalin 14y ago
This assumes that the government is better at it than private industry.

trotsky 14y ago

The biggest problem with the NSA proposal was that it was dishonest. Industry has been asking them for threat alerts based on tier 1 network surveillance for some time, but the NSA (dba Cyber Command) has continually questioned whether they were chartered to share that information. As a response they offered to share data only with organizations that would place NSA instrumentation inside their private networks, which is what raised the privacy concerns. Simply put, defense is hard. That's the main reason you've seen all of the national intelligence organizations playing hot potato with the issue. Hopefully this will be changing a bit for the better based on the executive order Obama signed recently that directs DHS, NSA and the FBI to expand their programs that share active threat information with private companies.

Nrsolis 14y ago
I hear you and I don't want to underestimate or diminish the concerns that private companies have. That said, the threat vectors for APTs aren't always solely network-based. IIRC, the behavior of the APT that struck RSA was fairly targeted and changed behavior once inside the network. It isn't unreasonable to think that the NSA would want to talk about putting sensors inside a private network where they could detect "successful" penetrations. Again, we have every right to be wary of letting the (government) camel nose in the tent. I'm just saying that if you don't kinda sorta trust your government to help you fight a serious foreign power with nearly unlimited resources, you might need to reconsider your position. The threat from China is real and ongoing versus the theoretical threat from the US Government.
- joequant 14y ago
  One problem is that multinational corporations are multinational with significant operations inside of China. I doubt that the NSA is going to be of much help in helping a US company secure its networks inside of China, and if that company has large numbers of Chinese employees in China, there are security issues with having US intelligence companies sharing sensitive US intelligence. For example, the NYTimes has a bureau in Shanghai, and if they use a private contractor to help strengthen their networks, then I don't think that the Chinese government would be cancelling visas. If the NYTimes brought in the NSA, then I give the Chinese government five minutes before all of the visa get cancelled and the journalists get expelled.