Hot Spots
02/06/2014
The Cyber Threat
Congress requires an annual report titled “Worldwide Threat Assessment of the U.S. Intelligence Community” that is put together these days by James R. Clapper, Director of National Intelligence. I thought I would highlight what our intel folks believe is the number one threat these days, not terrorism of the al-Qaeda variety but rather the cyber threat.
---
[From the report]
We are in a major transformation because our critical infrastructures, economy, personal lives, and even basic understanding of – and interaction with – the world are becoming more intertwined with digital technologies and the Internet. In some cases, the world is applying digital technologies faster than our ability to understand the security implications and mitigate potential risks.
State and nonstate actors increasingly exploit the Internet to achieve strategic objectives, while many governments – shaken by the role the Internet has played in political instability and regime change – seek to increase their control over content in cyberspace. The growing use of cyber capabilities to achieve strategic goals is also outpacing the development of a shared understanding of norms of behavior, increasing the chances for miscalculations and misunderstandings that could lead to unintended escalation.
Compounding these developments are uncertainty and doubt as we face new and unpredictable cyber threats. In response to the trends and events that happen in cyberspace, the choices we and other actors make in coming years will shape cyberspace for decades to come, with potentially profound implications for U.S. economic and national security.
In the United States, we define cyber threats in terms of cyber attacks and cyber espionage. A cyber attack is a non-kinetic offensive operation intended to create physical effects or to manipulate, disrupt, or delete data. It might range from a denial-of-service operation that temporarily prevents access to a website, to an attack on a power turbine that causes physical damage and an outage lasting for days. Cyber espionage refers to intrusions into networks to access sensitive diplomatic, military, or economic information.
Increasing Risk to U.S. Critical Infrastructure
We judge that there is a remote chance of a major cyber attack against U.S. critical infrastructure systems during the next two years that would result in long-term, wide-scale disruption of services, such as a regional power outage. The level of technical expertise and operational sophistication required for such an attack – including the ability to create physical damage or overcome mitigation factors like manual overrides – will be out of reach for most actors during this time frame. Advanced cyber actors – such as Russia and China – are unlikely to launch such a devastating attack against the United States outside of a military conflict or crisis that they believe threatens their vital interests.
However, isolated state or nonstate actors might deploy less sophisticated cyber attacks as a form of retaliation or provocation. These less advanced but highly motivated actors could access some poorly protected U.S. networks that control core functions, such as power generation, during the next two years, although their ability to leverage that access to cause high-impact, systemic disruptions will probably be limited. At the same time, there is a risk that unsophisticated attacks would have significant outcomes due to unexpected system configurations and mistakes, or that vulnerability at one node might spill over and contaminate other parts of a networked system.
--Within the past year, in a denial-of-service campaign against the public websites of multiple U.S. banks and stock exchanges, actors flooded servers with traffic and prevented some customers from accessing their accounts via the Internet for a limited period, although the attacks did not alter customers’ accounts or affect other financial functions.
--In an August 2012 attack against Saudi oil company Aramco, malicious actors rendered more than 30,000 computers on Aramco’s business network unusable. The attack did not impair production capabilities.....
Other Actors
We track cyber developments among nonstate actors, including terrorist groups, hacktivists, and cyber criminals. We have seen indicators that some terrorist organizations have heightened interest in developing offensive cyber capabilities, but they will probably be constrained by inherent resource and organizational limitations and competing priorities.
Hacktivists continue to target a wide range of companies and organizations in denial-of-service attacks, but we have not observed a significant change in their capabilities or intentions during the last year. Most hacktivists use short-term denial-of-service operations or expose personally identifiable information held by target companies, as forms of political protest. However, a more radical group might form to inflict more systemic impacts – such as disrupting financial networks – or accidentally trigger unintended consequences that could be misinterpreted as a state-sponsored attack.
Cybercriminals also threaten U.S. economic interests. They are selling tools, via a growing black market, that might enable access to critical infrastructure systems or get into the hands of state and nonstate actors. In addition, a handful of commercial companies sell computer intrusion kits on the open market. These hardware and software packages can give governments and cybercriminals the capability to steal, manipulate, or delete information on targeted systems. Even more companies develop and sell professional-quality technologies to support cyber operations – often branding these tools as lawful-intercept or defensive security research products. Foreign governments already use some of these tools to target U.S. systems.
Source: www.intelligence.senate.gov
Hot Spots will return in a few weeks.
Brian Trumbore
