Previous page: What happened in Estonia
How real is the threat of politically motivated attacks?
It's out there, but the attacks are very few and far between.
Are politically motivated attacks on the rise?
With the amount of attention that the Estonian attacks are getting, they could potentially [be on the rise.] Some other political entities may want to try to mirror these attacks to see if they can get the same notoriety that the Estonian attack achieved.
Are there specific industries that should worry about politically motivated attacks?
The nation should be consciously aware of what happened in Estonia. We need to make sure our networks are secure and make sure that they are where we need them to be and that we have instant response. When the attack occurs is not the time to find out who you need to be calling and making friends with. You have to have plans in place, and you need to have exercised those plans.
Does the U.S. CERT have plans for future cybersecurity exercises?
The U.S. CERT will be working with the Defense Department later this fall in an exercise called Zenith. In March 2008, the Department of Homeland Security and U.S. CERT will take part in Cyberstorm II, which is a national-level exercise that includes our international counterparts and includes many representatives of the critical infrastructure across the U.S., several state governments and international governments. We will have lots of critical infrastructure involved, but I'm not prepared to say which ones at this point.
What more should the U.S. be doing to get ready for politically motivated attacks?
Network operators need to take another look at their systems as political targets. There may be individuals out there or groups that don't agree with a company's motives or what they're doing. They need to have around the clock, seven days a week, operational teams monitoring their networks. They need to have network cognizance. They need to know what their infrastructure is and be able to monitor it. There are a lot of large corporations out there that may not know exactly what their networks [are]. They need to train and educate their workforce about cybersecurity.
What should U.S. CIOs be doing to defend against cyberwar or other politically motivated attacks?
It gets back to making sure they have policies in place, plans in place and that they are empowering their information security officers to be able to defend their networks. They need to ensure that their workforce is educated to know that something is not right and that they know who to call.
What do you see as the top three threats for U.S. network operators and what should be done about them?
I wouldn't say that political attacks would be among the top threats from our standpoint.
We're seeing a lot of socially engineered attacks, such as phishing. When things come into your e-mail in-box, you shouldn't assume that the links are truly from your bank. Identity theft is definitely on the rise.
The Internet has come a long way from where it was 10 years ago. It used to be that attacks were designed to take down networks. Now the bad guys have found a way to make a profit. They don't want the Internet to be taken down.
Network operators are going to be seeing activity against their firewalls and their networks, and they need to make sure they are cognizant that is happening. If an attack occurs, can you identify what is critical on your network and what the impact will be if it is taken away as a resource?
It all comes down to training and educating your people. You need to ensure your technical people have standard operating procedures, plans and policies in place to deal with attacks and insider threats. It really comes down to making sure you have policies in place that are enforceable and that you have plans in place to deal with something as it arises.
What do you think will happen next in the area of cyberwar or hactivism?
I don't know. It will happen again, but I don't necessarily know if it's going to be [an attack as occurred in Estonia.] We're sort of in uncharted territory. You don't know what is going to upset an individual or a group to see if later they will launch a cyberattack.
Will politically motivated attacks be more frequent?
There is the potential for it to be more frequent based on the attention brought to what happened in Estonia.
Related content:
Estonia's unsolved zombie insurgence
Cyber attack prompts U.S. to send team to Estonia
Cyber-crime protection pushes new precedents for privacy
Pentagon report claims China ready to launch cyber attack
The European advantage
icon.
