If the growth of Facebook and the emergence of the Apple iPad were the most widely reported tech stories in 2010, the emergence of Cyber Warfare that targets governments and enterprises is the most under reported one, with far greater consequences. In fact 2010, could be viewed as the year that Cyber Warfare emerged as a true weapon. Below I outline six steps to take to protect your enterprise.
It is now very clear that certain governments are using Cyber warfare to attack adversaries, including private/public companies. Some key things that occurred in 2010:
1. Facebook and other consumer social sites played a role in the Great Hack of Google and 34 other firms. However, it is worse than that. Thousands of firms may have been breached according to Kevin Mandia, CEO of security firm Mandiant.
2. Redirection of US Internet Traffic by China on April 8, 2010 and the attack of at least 5 other firms.
3. Confirmation by the US Federal Government that attacks against Google and other enterprises were ordered by Chinese Government officials (via CNBC).
A key conclusion from an earlier post: these new modes of attack, known as Advanced Persistent Threats, are far too sophisticated to stop with software and firewalls. The best known method to protect your corporate assets (source code and intellectual property) is to isolate key corporate systems from the normal corporate network. In other words, you need two networks.
What does all of this really mean? Well, for starters, it is a new era of electronic warfare and this time it is information that is the currency that is being fought over. There stakes are very high: the future of countries and the future economic well being of both the country and the companies that operate in those countries.
Why? Well, the military and technology firms are linked together in interesting ways, as this article (based on research by Rand Corp) demonstrates. Companies have become fronts for governments and military organizations. Some may say that this is not new, but the scale of what is going on now has not been seen in the past.
For enterprises, all of the investment in products that represent the future could be wasted if those secrets are stolen. Cisco learned this a few years back when some of its code was stolen by Huawei Technologies Inc. The lawyer who represented Cisco, G. Hopkins Guy, won an injunction against Huawei and was widely recognized for his ground breaking work that resulted in a worldwide injunction against Huawei.
What does this all mean to you and your enterprise? For starters consider doing this:
1. . Develop a comprehensive strategy to combat cyber warfare and make sure it includes a training program (cyber war gaming) for executives, not just IT staff.
2. Take the steps to isolate your corporate systems. No matter what you hear from major analyst firms or anyone else, physical separation of information on computers (e.g. a separate network) is the only sure way to stop intrusion right now. Look at models that the military has used (classified vs unclassified systems). This also has major implications for desktop/pc access.
3. Shield key data centers/systems from wireless access and wireless monitoring. For those with remote sites (e.g. retail branches), don't over look these sites as methods of access. If you have any doubts about this action, you need to read The Great Cyber Heist (courtesy of the NY Times).
4. Re-evaluate all browser and operating system security at an architectural level. Evaluate roadmaps from all providers and make the tough, but correct decisions on what platforms you will invest in going forward. Blindly following the incumbent provider may not be the answer that solves your issues.
5. Intrusion from the inside is also a growing issue. Compartmentalizing information so that no one person has access to everything is key, as is a practice of not keeping all source code in one location or on one physical server.
6. Block Facebook. As popular as it is, Facebook isn't secure and it isn't good for your corporate security. Run Facebook in conjunction with certain web browsers and you have the perfect system for intrusion. Many governments and enterprises block access to Facebook and now you know why. This won't be a popular decision, but it is the right one.
So, in 2011, expect to keep hearing more about Facebook and its growing valuation. 2011 may also be called the year of the Tablet (the rise of Android based Tablets). That is all well and good, but the number one issue your enterprise or government needs to prepare for is cyber warfare. 2011 is the time to get prepared for the attacks that are yet to come.....Happy New Year.
No comments:
Post a Comment