For years, organizations were instructed to diligently protect their perimeter from attackers, but this approach no longer works.
Bill Dean
Sword & Shield Director of Computer Forensics and Security Assessments Bill Dean says that after many high-profile breaches, most organizations are likely already breached and must make the effort to detect the threats that are already inside.
He will present information on these advanced threats at the Middle Tennessee Cyber Summit on Wednesday, May 8 from 2:30 to 3:30 p.m. The event, held at the Middle Tennessee State University (MTSU) campus May 7-8, will address criminal, intelligence, disruptive, and information cyber threats and is scheduled to include presentations from U.S. Department of Homeland Security, the Tennessee Department of Safety and Homeland Security, the FBI, the United States Secret Service, and private sector cyber security organizations.
Online registration is closed, but walk-up registration will be available at 7.30 a.m.
Assume the Enemy is Already on Your Network and Look for Them
Bill Dean
With little modification to their malicious code, Chinese hackers are back in business and U.S. companies need to assume this code is already on their IT networks.
As the information security industry is well aware, the cyber security company, Mandiant, published a paper in February detailing cyber-espionage involving the compromise and intellectual property theft of hundreds of U.S.-based companies.
Not only did the report disclose the origin of the attacks as originating from China, but actually pinpointed the Peoples Liberation Army (PLA), in detail, as the culprit. The Chinese government, with very careful wording, disputed these accusations.
Is there additional information supporting these claims of Chinese cyber-espionage on U.S. companies? As an organization that provides incident response services, our answer is, “Yes.”
When the Mandiant report was published on the heels of President Barack Obama’s executive order for “Improving Critical infrastructure Cybersecurity”,” incident responders applauded the disclosure of what was common knowledge in the incident response community.
This report brought to light to what incident response organizations have been reporting to their clients for years: China is infiltrating your computer networks for long durations of time and obtaining your valued intellectual property. The report also did a great job of simplifying the situation for the needed executive understanding from a business impact perspective.
Once the admiration of the needed disclosure was realized, the incident response community then became somewhat concerned. Over time, incident response organizations had developed successful tools and techniques for identifying this specific threat for our clients. Now that the adversary has been “ousted”, will they raise their game and change their methods making the identification more difficult?
Read More »