Good afternoon, everyone. Thank you for the kind introduction. It’s a
pleasure to be here with you today and speak to you at the Georgetown
Cybersecurity Law Institute.
As this conference comes to a close, I’d like to take some time today to talk directly to those of you from the private sector attending this conference. I imagine you’ve learned about various manifestations of the cyber threat that our country currently faces. It takes many forms, comes from many sources, and knows no borders:
The cyber threat takes the form of Distributed Denial-of-Service (DDOS) attacks – that have interrupted or suspended the service of webservers at banks.
It takes the form of theft and general invasions of privacy by “keystroke logging.” Installing malicious code, or malware, into a computer, and tracking almost every letter, number, or character you type on your keyboard, including all of the communications you are having over the Internet.
The cyber world has been a useful tool for economic espionage and trade secret theft. Criminal organizations, or even foreign governments, without having to leave their countries or even their offices, can break into the computer system of a private company and steal innovative product designs, formulas, or trade secrets. As a result of this, the company loses the benefit of its investment of money and years of hard work, and more importantly, Americans lose their jobs.
The cyber threat also takes the form of destructive malware. This is malicious software that is capable of deleting everything on a given computer hard drive. This is not an imaginary scenario. In Saudi Arabia, an oil company called Aramco was infected with just such a virus.
Our country’s critical infrastructure is one of the most important areas requiring protection from cyber-threats. Today, most of the important critical functions in our society are run by computer systems. The power grid, hydroelectric dams, nuclear power plants, transportation systems, stock markets and communication systems are all controlled through sophisticated computer systems that allow them to be efficient, effective and coordinate with numerous other critical functions.
By now, you have also heard a lot about what the government can do to help you address cybersecurity issues. But I want to emphasize that government cannot fight the cyber threat alone. And I want to provide you with some thoughts about your role in all of this. What are the things that you can do in the areas of prevention, preparedness, and incidence response. Some of this may seem quite basic to many of you, but it doesn't hurt to hear it again. Unless we work together, we will not be able to address the cyber threat successfully.
Let’s begin with prevention. There are some key things that you and your companies should be doing to build resilience to your networks. Companies should put best practices and technologies in place. For example, each company needs a strong system of network firewalls. You, of course, need an external firewall. This will serve to protect you from the hacker trying to get inside. But that’s not enough. No matter how strong your external firewall is, the likelihood is that a hacker will inevitably break inside. So you also need internal firewalls. These should wall off different departments or divisions in your company from each other. And those areas that contain your company's most sensitive and valuable information should have particularly robust protections. This way, even if a hacker gets onto your network, he doesn’t get very far. Or, at least, he doesn’t get to your company’s most sensitive information.
Companies need to educate their employees on intrusion techniques such as spear-phishing or redirecting websites – the scams that use a combination of email and bogus websites to trick victims into clicking on website links or opening attachments. It only takes the carelessness of one employee to let a hacker into your network. So companies need to train their employees to recognize and avoid these kinds of scams.
And you need to set up a strong system for passwords. The strongest system has multiple layers, and yes, I know it is a pain, but it is so much less of a pain than losing all your data, your trade secrets, or your financial information. This may require the user not only to type in a number of different passwords, but also to send images or even to do a form of biometrics. You should consider using all of these to protect your core, most sensitive network areas.
But you can't do this alone, either. You're going to need up to date information on what cyber threats are out there and what they look like. Participating in information sharing platforms like InfraGard can help you in this regard. InfraGard is an FBI-sponsored initiative that brings together representatives from the private and public sectors to help protect our nation’s critical infrastructure from attacks by terrorists and criminals. Members have access to FBI secure communications network featuring an encrypted website, web mail, list serves, and message boards. FBI uses the InfraGard website to disseminate threat alerts and advisories. InfraGard also sends out intelligence products from the FBI and other agencies.
Beyond InfraGard, you can access other information sharing organizations like the Information Sharing and Analysis Centers – ISACs. ISACs are trusted groups established by critical infrastructure owners and operators. There are different ISACs for different sectors and areas of expertise. Members of ISACs share information with each other and maintain contacts with the government to share and receive cyber threat information. Services provided by ISACs include risk mitigation, incidence response, and information sharing. Depending on the ISAC, you may have access to a 24/7 security operations center, briefings, and white papers.
What can the Government do to help with prevention? Well, for starters, we can share actionable information with you. We have collected and shared hundreds of thousands of indicators of malicious activity with the private sector and over a hundred nations. And this is just in the past six months. These indicators include information like IP addresses associated with malicious activity.
You may have also heard about ECS — the Enhanced Cybersecurity Services program. This is a program that has been available to the U.S. defense industrial base. The Department of Homeland Security has been working with cybersecurity organizations from across the federal government to gain access to a broad range of sensitive and classified cyber threat information. DHS provides that information to qualified service providers to help them counter known malicious cyber activity.
In the Executive Order that the President announced at the State of the Union earlier this year, we committed to expanding ECS beyond the defense industrial base to cover our nation's critical infrastructure. We also committed to redoubling the effort to share malicious indicators not just with members of critical infrastructure, but with the private sector writ large.
Beyond information sharing, the President’s EO gave also the National Institutes of Standards and Technology – NIST – the responsibility, along with the private sector, to develop a framework of baseline standards for cybersecurity. The Framework’s purpose is to assist owners and operators of critical infrastructure to identify and manage risks posed from cyber threats. Once the Framework is established, DHS will establish a voluntary program to support adoption of the Framework. While the Framework is directly applicable to critical infrastructure members, there is nothing that prevents all companies from adopting the framework as part of their cyber program.
Next is preparation for an attack. Even a well-defended organization will inevitably experience a cyber incidence at some point. Therefore, your company has got to have a strong and comprehensive plan for responding to a cyber incident. Determine what kinds of filters to employ in the face of a DDOS attack, how to implement mechanisms to shut down access to important sectors of your computer systems, procedures to change passwords and access controls, and provisions to preserve all your critical data to ensure continuity of your company's operation if your data has been destroyed. And importantly, mechanisms to notify customers or employees if PII has been stolen.
I may be saying the obvious, but these procedures need to be developed before any cyber attack occurs. After an attack has started, it’s usually too late to figure what to do, or to have any hope that it will be effective. And your plan needs to be tailored to your particular company. You and the other IT professionals in your company are the only ones with the expertise and detailed familiarity with your own system to undertake the evaluation of how all your systems work together and how a hostile actor might exploit vulnerabilities. So take the time to really think about it.
Finally, think about your cyber protection program from the perspective of your shareholders. The SEC has issued specific guidance regarding disclosure obligations relating to cybersecurity risks and cyber incidents. The guidance, which was issued in 2011, makes clear that there are particular obligations that apply before, during, and after a cyber incident. But you should think about your disclosure obligations beyond just particular cyber incidents. If you had to explain to your shareholders how you are going about protecting the most valuable trade secrets of your company, or its financial information, or its critical operations, or the personally identifiable information of your customers or employees, what would you want that explanation to look like? What kind of impression would you want the investing public to have about your dedication to cyber protection.
So, your company has followed all this advice. It has put in place a resilient network, and you have set up a comprehensive plan of action for responding to cyber incidences. You have also been able to rehearse your plan repeatedly and have even exercised it in responding to small-scale cyber attacks. But the attack still comes. Unfortunately, it’s inevitable. What do you do then? I know that many companies are reluctant to let anyone know they have been the victim of a cyber attack. They don't want their shareholders or their customers to lose confidence in their systems. So they deal with it themselves, and don't tell anyone about it. But that kind of thinking leads to only one result - more attacks, on you and other companies. I want to urge you, in those situations, to notify law enforcement immediately. We have tools to help you and others who are the victims of the attack and we can use your attack information to help prevent future attacks. And, we are dedicated to maintaining the confidentiality as best we can so you don’t get victimized again through bad publicity.
Let me give you an example of how law enforcement can respond when we learn of a cyber attack.
Two years ago, hackers had infected hundreds of thousands of computers with the Coreflood virus through a botnet. As many of you may already know, a botnet is a group of hacked computers, located in homes, schools, and offices. Botnet creators secretly install special malware on those computers. Once it is installed, those computers beacon back to the botnet creator's master server and do anything the botnet owner desires. That is why these computers are commonly called “zombies.”
This was a particularly pernicious infection, in large part because the malware was continually updated to escape detection by most anti-virus tools. In this scheme, the botnet creators, through keystroke loggers, were stealing peoples’ personal and financial information. Because these criminals were overseas and could not be easily identified, arrested or prosecuted, we had to figure out a way to disrupt the network and stop the theft. We did this through a combination of civil and criminal authorities that allowed us to wrest control of the network from the criminals and shut it down.
First, because the central command computers that operated the botnet were in the United States, we sought a criminal seizure order to take control of those servers. This took the botnet control away from the criminals, and let us respond when the infected computers beaconed back asking for their next instruction.
Second, we obtained a civil injunction that authorized the investigators to beacon back to the zombies and instruct the malware to “go to sleep.”
Finally, although we had put the malware to sleep, it was still on all of the individual computers. With the malware in place the botnet creators could reconstitute the botnet fairly easily. So we went to work with antivirus companies and other industry partners to solve this problem. Software companies and Internet Service Providers offered free self-help tools and advice that enabled users to rid their computers of the malware. By combining authorities and working together with the private sector, we developed an effective solution to address this one network of malicious code.
But in this instance we were lucky. We were able to locate key components in the United States and did some creative lawyering to seize control of those servers. But that won't always be the case. Most of the law enforcement we have today was designed for the 20th century. We are, unfortunately, dealing with a 21st century problem.
So I’ve laid out some key areas involving government and private sector roles and partnerships. But don't sit back and think that's enough. We all need to do more. I referred earlier to the Executive Order that the President signed. It’s a start, but we still need congressional action in this area:
Although the federal government currently has a range of tools at its disposal, we still need to give law enforcement better ways to stop cyber crime without having to piece together ad hoc, creative solutions.
We need to facilitate the appropriate sharing of cybersecurity information like malware codes between the government and private industry so industry can protect itself.
We also need legislation to incorporate privacy and civil liberties safeguards into all aspects of cybersecurity.
We have been and should also continue to engage our Allies and partners worldwide to solidify norms of cyber behavior — to help ensure that the Internet remains open, secure, and stable. It is also crucial for us to maintain a meaningful dialogue with the world’s largest cyber actors and work together to develop an understanding of acceptable behavior in cyberspace.
But above all, we must work together — the government and the private sector — to build closer and even better partnerships. Only by doing this will be able to make the future Internet a place where we can be more confident that our businesses, our privacy, and our personal finances can operate safely. The responsibility of protecting all of this rests not only with the government, but also with, individuals, firms, and companies themselves. We know that you have been working hard to provide security for your systems. We commend you for doing so and look forward to working closely with you as we move forward in addressing and countering the cyber threat.
Thank you again giving me the opportunity to talk with you today about this important topic.
As this conference comes to a close, I’d like to take some time today to talk directly to those of you from the private sector attending this conference. I imagine you’ve learned about various manifestations of the cyber threat that our country currently faces. It takes many forms, comes from many sources, and knows no borders:
The cyber threat takes the form of Distributed Denial-of-Service (DDOS) attacks – that have interrupted or suspended the service of webservers at banks.
It takes the form of theft and general invasions of privacy by “keystroke logging.” Installing malicious code, or malware, into a computer, and tracking almost every letter, number, or character you type on your keyboard, including all of the communications you are having over the Internet.
The cyber world has been a useful tool for economic espionage and trade secret theft. Criminal organizations, or even foreign governments, without having to leave their countries or even their offices, can break into the computer system of a private company and steal innovative product designs, formulas, or trade secrets. As a result of this, the company loses the benefit of its investment of money and years of hard work, and more importantly, Americans lose their jobs.
The cyber threat also takes the form of destructive malware. This is malicious software that is capable of deleting everything on a given computer hard drive. This is not an imaginary scenario. In Saudi Arabia, an oil company called Aramco was infected with just such a virus.
Our country’s critical infrastructure is one of the most important areas requiring protection from cyber-threats. Today, most of the important critical functions in our society are run by computer systems. The power grid, hydroelectric dams, nuclear power plants, transportation systems, stock markets and communication systems are all controlled through sophisticated computer systems that allow them to be efficient, effective and coordinate with numerous other critical functions.
By now, you have also heard a lot about what the government can do to help you address cybersecurity issues. But I want to emphasize that government cannot fight the cyber threat alone. And I want to provide you with some thoughts about your role in all of this. What are the things that you can do in the areas of prevention, preparedness, and incidence response. Some of this may seem quite basic to many of you, but it doesn't hurt to hear it again. Unless we work together, we will not be able to address the cyber threat successfully.
Let’s begin with prevention. There are some key things that you and your companies should be doing to build resilience to your networks. Companies should put best practices and technologies in place. For example, each company needs a strong system of network firewalls. You, of course, need an external firewall. This will serve to protect you from the hacker trying to get inside. But that’s not enough. No matter how strong your external firewall is, the likelihood is that a hacker will inevitably break inside. So you also need internal firewalls. These should wall off different departments or divisions in your company from each other. And those areas that contain your company's most sensitive and valuable information should have particularly robust protections. This way, even if a hacker gets onto your network, he doesn’t get very far. Or, at least, he doesn’t get to your company’s most sensitive information.
Companies need to educate their employees on intrusion techniques such as spear-phishing or redirecting websites – the scams that use a combination of email and bogus websites to trick victims into clicking on website links or opening attachments. It only takes the carelessness of one employee to let a hacker into your network. So companies need to train their employees to recognize and avoid these kinds of scams.
And you need to set up a strong system for passwords. The strongest system has multiple layers, and yes, I know it is a pain, but it is so much less of a pain than losing all your data, your trade secrets, or your financial information. This may require the user not only to type in a number of different passwords, but also to send images or even to do a form of biometrics. You should consider using all of these to protect your core, most sensitive network areas.
But you can't do this alone, either. You're going to need up to date information on what cyber threats are out there and what they look like. Participating in information sharing platforms like InfraGard can help you in this regard. InfraGard is an FBI-sponsored initiative that brings together representatives from the private and public sectors to help protect our nation’s critical infrastructure from attacks by terrorists and criminals. Members have access to FBI secure communications network featuring an encrypted website, web mail, list serves, and message boards. FBI uses the InfraGard website to disseminate threat alerts and advisories. InfraGard also sends out intelligence products from the FBI and other agencies.
Beyond InfraGard, you can access other information sharing organizations like the Information Sharing and Analysis Centers – ISACs. ISACs are trusted groups established by critical infrastructure owners and operators. There are different ISACs for different sectors and areas of expertise. Members of ISACs share information with each other and maintain contacts with the government to share and receive cyber threat information. Services provided by ISACs include risk mitigation, incidence response, and information sharing. Depending on the ISAC, you may have access to a 24/7 security operations center, briefings, and white papers.
What can the Government do to help with prevention? Well, for starters, we can share actionable information with you. We have collected and shared hundreds of thousands of indicators of malicious activity with the private sector and over a hundred nations. And this is just in the past six months. These indicators include information like IP addresses associated with malicious activity.
You may have also heard about ECS — the Enhanced Cybersecurity Services program. This is a program that has been available to the U.S. defense industrial base. The Department of Homeland Security has been working with cybersecurity organizations from across the federal government to gain access to a broad range of sensitive and classified cyber threat information. DHS provides that information to qualified service providers to help them counter known malicious cyber activity.
In the Executive Order that the President announced at the State of the Union earlier this year, we committed to expanding ECS beyond the defense industrial base to cover our nation's critical infrastructure. We also committed to redoubling the effort to share malicious indicators not just with members of critical infrastructure, but with the private sector writ large.
Beyond information sharing, the President’s EO gave also the National Institutes of Standards and Technology – NIST – the responsibility, along with the private sector, to develop a framework of baseline standards for cybersecurity. The Framework’s purpose is to assist owners and operators of critical infrastructure to identify and manage risks posed from cyber threats. Once the Framework is established, DHS will establish a voluntary program to support adoption of the Framework. While the Framework is directly applicable to critical infrastructure members, there is nothing that prevents all companies from adopting the framework as part of their cyber program.
Next is preparation for an attack. Even a well-defended organization will inevitably experience a cyber incidence at some point. Therefore, your company has got to have a strong and comprehensive plan for responding to a cyber incident. Determine what kinds of filters to employ in the face of a DDOS attack, how to implement mechanisms to shut down access to important sectors of your computer systems, procedures to change passwords and access controls, and provisions to preserve all your critical data to ensure continuity of your company's operation if your data has been destroyed. And importantly, mechanisms to notify customers or employees if PII has been stolen.
I may be saying the obvious, but these procedures need to be developed before any cyber attack occurs. After an attack has started, it’s usually too late to figure what to do, or to have any hope that it will be effective. And your plan needs to be tailored to your particular company. You and the other IT professionals in your company are the only ones with the expertise and detailed familiarity with your own system to undertake the evaluation of how all your systems work together and how a hostile actor might exploit vulnerabilities. So take the time to really think about it.
Finally, think about your cyber protection program from the perspective of your shareholders. The SEC has issued specific guidance regarding disclosure obligations relating to cybersecurity risks and cyber incidents. The guidance, which was issued in 2011, makes clear that there are particular obligations that apply before, during, and after a cyber incident. But you should think about your disclosure obligations beyond just particular cyber incidents. If you had to explain to your shareholders how you are going about protecting the most valuable trade secrets of your company, or its financial information, or its critical operations, or the personally identifiable information of your customers or employees, what would you want that explanation to look like? What kind of impression would you want the investing public to have about your dedication to cyber protection.
So, your company has followed all this advice. It has put in place a resilient network, and you have set up a comprehensive plan of action for responding to cyber incidences. You have also been able to rehearse your plan repeatedly and have even exercised it in responding to small-scale cyber attacks. But the attack still comes. Unfortunately, it’s inevitable. What do you do then? I know that many companies are reluctant to let anyone know they have been the victim of a cyber attack. They don't want their shareholders or their customers to lose confidence in their systems. So they deal with it themselves, and don't tell anyone about it. But that kind of thinking leads to only one result - more attacks, on you and other companies. I want to urge you, in those situations, to notify law enforcement immediately. We have tools to help you and others who are the victims of the attack and we can use your attack information to help prevent future attacks. And, we are dedicated to maintaining the confidentiality as best we can so you don’t get victimized again through bad publicity.
Let me give you an example of how law enforcement can respond when we learn of a cyber attack.
Two years ago, hackers had infected hundreds of thousands of computers with the Coreflood virus through a botnet. As many of you may already know, a botnet is a group of hacked computers, located in homes, schools, and offices. Botnet creators secretly install special malware on those computers. Once it is installed, those computers beacon back to the botnet creator's master server and do anything the botnet owner desires. That is why these computers are commonly called “zombies.”
This was a particularly pernicious infection, in large part because the malware was continually updated to escape detection by most anti-virus tools. In this scheme, the botnet creators, through keystroke loggers, were stealing peoples’ personal and financial information. Because these criminals were overseas and could not be easily identified, arrested or prosecuted, we had to figure out a way to disrupt the network and stop the theft. We did this through a combination of civil and criminal authorities that allowed us to wrest control of the network from the criminals and shut it down.
First, because the central command computers that operated the botnet were in the United States, we sought a criminal seizure order to take control of those servers. This took the botnet control away from the criminals, and let us respond when the infected computers beaconed back asking for their next instruction.
Second, we obtained a civil injunction that authorized the investigators to beacon back to the zombies and instruct the malware to “go to sleep.”
Finally, although we had put the malware to sleep, it was still on all of the individual computers. With the malware in place the botnet creators could reconstitute the botnet fairly easily. So we went to work with antivirus companies and other industry partners to solve this problem. Software companies and Internet Service Providers offered free self-help tools and advice that enabled users to rid their computers of the malware. By combining authorities and working together with the private sector, we developed an effective solution to address this one network of malicious code.
But in this instance we were lucky. We were able to locate key components in the United States and did some creative lawyering to seize control of those servers. But that won't always be the case. Most of the law enforcement we have today was designed for the 20th century. We are, unfortunately, dealing with a 21st century problem.
So I’ve laid out some key areas involving government and private sector roles and partnerships. But don't sit back and think that's enough. We all need to do more. I referred earlier to the Executive Order that the President signed. It’s a start, but we still need congressional action in this area:
Although the federal government currently has a range of tools at its disposal, we still need to give law enforcement better ways to stop cyber crime without having to piece together ad hoc, creative solutions.
We need to facilitate the appropriate sharing of cybersecurity information like malware codes between the government and private industry so industry can protect itself.
We also need legislation to incorporate privacy and civil liberties safeguards into all aspects of cybersecurity.
We have been and should also continue to engage our Allies and partners worldwide to solidify norms of cyber behavior — to help ensure that the Internet remains open, secure, and stable. It is also crucial for us to maintain a meaningful dialogue with the world’s largest cyber actors and work together to develop an understanding of acceptable behavior in cyberspace.
But above all, we must work together — the government and the private sector — to build closer and even better partnerships. Only by doing this will be able to make the future Internet a place where we can be more confident that our businesses, our privacy, and our personal finances can operate safely. The responsibility of protecting all of this rests not only with the government, but also with, individuals, firms, and companies themselves. We know that you have been working hard to provide security for your systems. We commend you for doing so and look forward to working closely with you as we move forward in addressing and countering the cyber threat.
Thank you again giving me the opportunity to talk with you today about this important topic.
Posts
No comments:
Post a Comment