Upload
microsoft
View
148
Download
1
Tags:
Embed Size (px)
DESCRIPTION
Cyber Security Conference - Rethinking cyber-threat
Citation preview
Rethinking the Cyber Threat A Framework and Path Forward
SCOTT CHARNEY Corporate Vice President Trustworthy Computing Group Microsoft Corporation
The information contained in this document represents the current view of Microsoft Corp. on the issues discussed
as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be
interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any
information presented after the date of publication.
This white paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN
THIS DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under
copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or
transmitted in any form or by any means (electronic, mechanical, photocopying, recording or otherwise), or for any
purpose, without the express written permission of Microsoft.
Microsoft may have patents, patent applications, trademarks, copyrights or other intellectual property rights
covering subject matter in this document. Except as expressly provided in any written license agreement from
Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights or
other intellectual property.
© 2009 Microsoft Corp. All rights reserved.
Microsoft is a registered trademark of Microsoft Corp. in the United States and other countries. The names of
actual companies and products mentioned herein may be the trademarks of their respective owners.
Microsoft Corp. • One Microsoft Way • Redmond, WA 98052-6399 • USA
Contents
Introduction .................................................................................................................................................. 5
Understanding the Cyber Threat ................................................................................................................. 5
Rethinking the Cyber Threat ......................................................................................................................... 7
The Problem of Attribution ........................................................................................................................... 8
Categories of Attacks .................................................................................................................................. 10
Conclusion ................................................................................................................................................... 12
5
Introduction
For more than two decades, people have struggled to understand the cyber threat, evaluate the
risks to individuals and organizations (including nation-states), and craft appropriate responses.
Although many organizations have invested significantly in information assurance, most computer
security experts believe that a well-resourced and persistent adversary will more often than not be
successful in attacking systems, especially if raising defenses is the only response to an attack. For this
reason, increasing attention is being paid to deterring such attacks in the first instance, especially by
governments that have the power to investigate criminal activity and use a wide range of tools to
respond to other public safety and national security concerns.
Notwithstanding this emerging discussion, it appears to many people that neither governments
nor industry are well-positioned to respond to this highly complex threat and that, from a policy and
tactical perspective, there is considerable paralysis. The purpose of this document is to better explain
the cyber threat, identify the reasons why cyber attacks often confound those responsible for crafting
responses, and suggest a new framework for creating more effective cyber attack responses.
Understanding the Cyber Threat
The cyber threat is difficult to assess and mitigate for six reasons:
(1) There are many malicious actors. Low cost computer technology, widespread Internet
connectivity, and the ease of creating or obtaining malware means that almost anyone can
engage in malicious activity. Indeed, the Internet is a great place to commit crime because it
provides global connectivity, anonymity, lack of traceability, and rich targets. Malicious actors
include individuals, organized crime groups, terrorist groups, and nation-states, and actions that
might serve to deter one group may be less effective against another.
(2) There are as many motives as there are actors. These motives may relate to traditional areas
of criminal activity (for example, fraud or the distribution of child pornography), economic
espionage, military espionage, or cyber warfare.
(3) There are many different but commonly used attack vectors. Leaving aside supply chain and
insider threats, which pose their own challenges, remote attackers might take advantage of
product vulnerabilities, system misconfigurations, and social engineering. Because different
actors may use similar techniques, the nature of the attack might not yield reliable clues about
the identity of the attacker or the attacker’s motives. This fact, combined with anonymity and
lack of traceability, means that attributing attacks is very difficult, and punishment for malicious
activity is unlikely.
6
(4) The Internet is a shared and integrated domain. It is shared by citizens, businesses, and
governments in a manner that makes it difficult to segregate one group from another.
Moreover, free speech, commercial transactions, espionage activities, and cyber warfare may be
occurring in this shared and integrated domain, all at the same time and over the same
transport medium. With a limited ability to parse actors and activities, tailored responses to
specific threats are extremely hard to craft.
(5) The potential consequences of an attack are very difficult to predict. Certain nefarious
activity such as network scans or unauthorized system access may be a prelude to information
theft, a data integrity breach, or a disruption of service. Moreover, the complex
interrelationships between systems suggest that there may be unanticipated cascading effects,
some which may be more severe than even the intended effect. Finally, while some attacks may
be obvious (for example, a denial of service attack against a critical infrastructure) and generate
a quick response, other attacks may be hard to detect. Much has been written about the
exfiltration of data from sensitive systems; a more disconcerting scenario might be a critical
alteration of data. Not only can this be difficult to detect, but it may be difficult to discern when
the data was changed without authority, thus making it difficult to “roll back” to a known good
state.
(6) The worst-case scenarios are alarming. In the popular press, policy space, and think tanks,
these scenarios include disrupting critical infrastructure services, impeding key economic
functions, or imperiling public safety and national security (thus explaining oft-repeated
references to an “electronic Pearl Harbor”). The complexity of these scenarios, which results in
part from massive interconnectivity and dependencies between systems that are not always
well understood, has made it difficult to develop a consensus regarding the probable
consequences of an attack. As for our ability to recover quickly from such an attack, society’s
increasing dependence on information technology systems and the data they contain may mean
that there is no longer an existing manual process with trained people to fall back on.
In an environment where actors and motives may be unknown and in which the potential consequences
may be dire, it is easy to understand why there is great concern. But where there are so many actors
with so many motives – and these actors and their activities are commingled with innocuous and even
constitutionally protected activities – it is also easy to understand why those responsible for crafting
strategic and tactical responses get bogged down.
To complicate matters even more, society is not starting with a blank slate: there are existing
methods for dealing with bad actors, methods that have been codified in law and that do not work well
in this new environment. For example, in the United States we have a legacy of organizations that use
different authorities to address different threats to public safety and national security. To protect
citizens against crime, we hire, train and equip law enforcement personnel and, as part of an
investigation, we permit them to issue subpoenas, execute search warrants, and obtain wiretap orders
under the Electronic Communications Privacy Act (ECPA). To protect us against those who would steal
7
our military secrets or attack other vital state interests, we rely upon the intelligence community to both
collect foreign intelligence and engage in counterintelligence; as part of its work, that community may
rely upon a different set of authorities, such as National Security Letters and the Foreign Intelligence
Surveillance Act (FISA). Finally, to address the military threat posed by another nation-state, we fund a
military that relies on yet a different set of authorities in the United States code (for example, Title 50
and Title 10). Other countries have a similar separation of authorities. In short, depending upon the
category of threat, countries deploy different resources, and each resource plays by its own set of rules.
This traditional model works well when one can identify the nature of the attack; specifically,
“who” is attacking and “why.” This traditional model fails in the Information Age because when
computers are under attack, the “who” and “why” are frequently unknown. By way of example, many
years ago a Russian military plane shot down a Korean civilian jetliner. For a long time, notwithstanding
Russian claims of non-responsibility, it was widely believed that state action, or at least rogue military
action, was responsible. Why? Because civilians do not have access to fighter jets. But the notion that
only states have access to weapons of war is no longer correct, at least not if information warfare is
considered. Simply put, it is not difficult to obtain computer technology and the skills to misuse it; a
potentially powerful arsenal has been placed in the public domain. Our traditional vigilance regarding
states that support terrorism, political unrest, or are otherwise considered “rogue” (that is, “nations of
concern”) must now be supplemented by vigilance regarding “individuals of concern,” a far larger pool,
and one that is harder to identify and harder to contain. If one appreciates that an attack upon a
defense department may come not only from a foreign nation conducting information warfare, but also
from juveniles living within the victim’s country (as it did in Solar Sunrise, the case name for a cyber
attack against the U.S. Department of Defense), then one appreciates that launching a military response
might not be the right approach. In short, the world is confronted with two problems: (1) a plethora of
attacks by a diverse set of individuals with differing motives and (2) security response systems that are
contingent on knowing facts that may be unavailable.
Rethinking the Cyber Threat
In a world of such diverse threats and increasing allegations of cyber crime, economic
espionage, military espionage, and cyber warfare, it is critically important that governments and cyber
security professionals think differently about malicious cyber events and how to respond to them. The
starting point is breaking down attacks by attribution and category. With regard to “the who” (and,
inferentially perhaps, “the why”), there may be strong attribution, some probability of attribution (high
to low), or no attribution. With regard to categories, there are four: cyber crime, military espionage,
economic espionage (and other areas where nation-states are in philosophical disagreement on
normative behavior) and cyber warfare. Each level of attribution and each category of attack raises
unique issues regarding response with one exception. Defensive measures are always appropriate and
nothing prevents someone from adopting stronger security measures, such as adopting multi-factor
authentication. Strong defenses are not enough, however, as offense almost always beats defense on
the Internet. So although stronger defenses might deter some who will seek easier targets (much like
8
locking one’s door encourages a burglar to seek a less-protected house), persistent, well-funded and
motivated adversaries are not readily deterred by defenses, especially because defenses have proven
insufficient in so many cases.
The Problem of Attribution
The starting point for any new strategy must focus on attribution because, even though the
open and unauthenticated nature of the Internet makes attribution difficult, having some idea of who
the bad actor might be is certainly helpful. Today, attribution is extremely difficult for both technical and
non-technical reasons. Key data relating to source may not exist or be inaccurate, those who have
relevant data may be reluctant to share it, and even governments that want to collaborate may find it
difficult to do so because of legal constraints, especially if data must be obtained and shared across
jurisdictional boundaries. When data is shared, it may still be hard to reach consensus on what the data
means.
For example, in the recent attacks against Google, many different “theories” regarding actors
and motives were advanced. Without in any way suggesting one theory is more plausible than any
other, the recent attacks on Google led people to suggest that these attacks were the work of (1) the
Chinese Government (“Chinese Attack on Google Among the Most Sophisticated Cyberattacks Ever,
Experts Say,” POPSCI, January 15, 2010),1 (2) Chinese universities (“2 China Schools Said to be Tied to
Online Attacks,” The New York Times, February 18, 2010),2 or (3) a Chinese hacker (Steve Ragan, “Was
Operation Aurora really just a conventional attack?”, January 27, 2010).3 More recently, researchers
have expressed some confusion over whether this incident consisted of one attack or two, and have
referenced the existence of a Vietnamese Botnet.4
In light of current realities, it seems that the issue of attribution must be addressed in three
ways. First, attribution should be improved where possible. Leaving aside long-term efforts to re-
architect the Internet, it is possible to increase attribution through wider application of existing strong
authentication technologies (along with appropriate auditing), through more effective technical trace-
back mechanisms (when legally permitted), or through more streamlined international assistance (in
cases where foreign assistance is practical). For example, even today it is possible to deploy technologies
that enforce more robust authentication of hardware and people (for example, TPM to TPM-based
authentication, which is multi-factor authentication based upon the issuance of secure digital
1 http://www.popsci.com/technology/article/2010-01/chinese-cyber-attack-google-among-most-sophisticated-
ever-experts-say 2 http://www.nytimes.com/2010/02/19/technology/19china.html?partner=rss&emc=rss)
3 http://www.thetechherald.com/article.php/201004/5151/Was-Operation-Aurora-really-just-a-conventional-
attack 4 http://blog.damballa.com/?p=652
9
credentials after in-person proofing).5 The benefits of more robust attribution are that some attackers
will be deterred, some attackers will be thwarted, and some attackers may be identified. And although
more sophisticated adversaries may still be successful, the fact that some attacks have been deterred or
prevented permits organizations to refocus some of their existing security resources on more complex
and intractable threats.
Second, it will likely be important to focus on probability of accurate attribution, as opposed to
certainty of attribution. In many areas, of course, absolute certainty is seldom achievable. For this
reason, a range of different standards have developed (for example, proof beyond a reasonable doubt, a
preponderance of the evidence) and individuals and organizations often have to rely upon probabilities
when making critical decisions (such as when opting for one medical treatment over another). Of
course, the greater the certainty, the easier it may be to choose a course of action, but that does not
mean certainty is required before reasonable action can be taken.
Third, it will be necessary to decide what actions, if any, are permissible in those cases for which
the probability of accurate attribution is low for either technical or non-technical reasons. The “safe”
answer is, of course “none,” at least in terms of reducing international tension regarding unilateral
action. But the problem with that answer is it leaves too many threats unaddressed and causes victim
countries to assume too much risk to public safety and national security. If this is correct – if the status
quo is not acceptable – then a different calculus is required. One possible approach is to focus on
probability and harm, and whether that harm can be avoided through traditional mechanisms. If, for
example, (1) an attacker has successfully penetrated a critical system; (2) the attacker has the capability
of causing serious damage; and (3) timely and meaningful foreign assistance is not forthcoming,
affirmative action may be warranted even if one cannot assert, with certainty, that the attacker is
affiliated with a particular group.
This approach, of course, highlights the many challenges in this area. What is the right
“probability” threshold, what is the right tolerance for “harm,” what constitutes “timely and meaningful
assistance,” and what type of response will be viewed as proportionate? Although these are all difficult
questions, society has tackled them in other areas. For example, in the areas of nuclear proliferation,
development of weapons of mass destruction, and harboring terrorists, countries frequently determine
whether another country’s assistance is meaningful, whether negotiations represent progress or a
stalling tactic, and what repercussions might be appropriate if forward progress is not made.
To be clear, one cannot overstate the challenges in this area. While an attack on a supervisory
control and data acquisition (SCADA) system may readily suggest the potential of a dire consequence,
the impact of other attacks can be far more difficult to predict. For example, scanning a system and
accessing accounts without authority may be a prelude to information exfiltration (which is serious, but
perhaps not devastating) or the alteration of critical data that might result in serious physical injury or
death. A system scan may be the prelude to an attack on the confidentiality of data or a denial of service
5 For more on authentication, see the “Establishing End-to-End Trust” white paper at
http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/.
10
attack. Such uncertainties can cause inaction and, ultimately, countries will need to discuss what level of
risk is tolerable and when certain actions are appropriate. It must also be remembered that national
authorities have a wide range of tools at their disposal, from political demarches to economic sanctions
to cyber or kinetic counter attacks; as in the physical world, different predicates will justify different
responses. But establishing some a priori agreement between nation-states might help define
acceptable behaviors and decrease tensions when action is taken.
Categories of Attacks
Of course, in some cases attribution – or at least a high probability of accurate attribution – is
possible, even if not disclosed publicly. These attacks fall into four different categories. Once this is
understood, it becomes clear where society’s current response mechanisms could be improved, and
where new strategies must be adopted.
The first category relates to conventional cyber crimes.6 These crimes include cases in which
computers are targeted for traditional criminal purposes, such as fraud, or used as tools to commit
traditional offenses (for example, the distribution of child pornography). In this category, existing law
enforcement mechanisms generally provide the right framework for response, but much work needs to
be done to update and harmonize national legal regimes and increase dramatically the speed of law
enforcement execution. Nation-states should be encouraged to pass cyber crime legislation where it is
needed, to develop the capability and capacity to fight cyber crime, and to join international efforts (for
example, the Council of Europe Convention on Cybercrime). To the extent that other nations refuse to
help address this threat, governments should think about the mechanisms they traditionally use to
obtain greater international assistance from reluctant countries. Efforts against money laundering and
other transnational crimes can provide valuable lessons in this area.
The second category relates to military espionage cases; more specifically, the allegations that
some nation-states intrude into and exfiltrate large amounts of sensitive military data from government
agencies and/or the military industrial base. Without diminishing the seriousness of these allegations, it
is important to recognize that military espionage has been occurring from time immemorial, and that
some victims of military espionage may be engaged in such espionage activities themselves. Knowing it
is unlikely that such conduct will stop, countries should aggressively raise their cyber defenses, hone
their offensive capabilities, and use those traditional elements of national power that are typically used
to address espionage concerns.
The third category relates to economic espionage cases and other cyber events where
governments clearly have philosophical differences about what constitutes acceptable behavior. For
6 The cyber crime category is by far the broadest as it captures the largest numbers of actors (from juveniles to
repeat offenders) and the largest number of motives/actions (from tampering with one’s school grades to committing complex fraud to causing significant damage to an IT system in a non-warfare context). Clearly, international government responses will have to be flexible and proportional.
11
example, many countries believe that businesses should compete on a level playing field, and that legal
systems should protect the right of those who develop new ideas to monetize them. By contrast, other
countries believe that national security is dependent on economic security and, to achieve economic
advantage, it is the government’s role to support indigenous industries by stealing the intellectual
property created in other nations (or at least turn a blind eye when a domestic company steals
information from foreign competitors). These countries are not deterred by the fact that such an
approach is both immoral and nearsighted. It is immoral because the theft of intellectual property is,
quite simply, theft, and nearsighted because a country cannot establish a culture of innovation and
achieve true economic advantage if intellectual property rights are not respected. Where countries do
have such philosophical differences, international diplomacy should focus on establishing appropriate
international norms and codifying those norms in international agreements, as has been done in other
areas.
Another area of philosophical dispute, and one that is even more challenging than economic
espionage, relates to freedom of speech. With regard to economic espionage, the debate is a fairly
binary one: either the theft of property for national economic benefit is appropriate or it is not. By
contrast, the right of free speech rests along a continuum: some countries are more restrictive than
others. In such cases, questions may arise regarding the extent to which speech is restricted (there is, for
example, a big difference between criminalizing hate speech and criminalizing religious or political
speech) as well as whether the government that restricts speech was democratically elected (thus
indicating that any restrictions are sanctioned by the populace). To complicate matters even more,
when countries do negotiate international agreements and set normative behavior, it is common to
have a treaty provision – essentially a carve out – that reserves to governments the authority to take
those actions necessary to protect public order and national security, notwithstanding other provisions
of the treaty. Because countries will not waive this sovereign right to protect public safety – and because
limitations on speech are often justified as necessary to maintain public order – it is unlikely that
negotiations will easily yield new normative behaviors. Still, agreements on the margins may still be
achievable. For example, in an age in which user-created content is transmitted across global IT systems
and stored in a cloud, ensuring safe harbor for those whose provide the “pipes” or “cloud services”
would be warranted, particularly if they are responsive when issues of legality are raised.
The fourth category relates to cyber warfare, a particularly difficult area because, as noted
earlier, the Internet is a shared and integrated domain. In the physical world, it is easier to separate
troops from hospitals, and there are even rules of war that govern permissible responses when troops
launch attacks from hospital rooftops. The Internet does not permit such clean demarcations. But today
there is also another problem: society is redefining “warfare.” As is well known, an individual recently
attempted to bomb an airliner travelling to Detroit, Michigan. Reported evidence suggested this
individual had connections to a known terrorist group and, in the aftermath of that attempted attack,
there was a debate about whether this individual was a criminal who should be read his constitutional
rights (given his “Miranda” warnings) or an enemy combatant who belonged in military custody. Of
course, in future cases, a person sympathetic to an extremist cause might undertake to blow up a plane
without any formal connection to any organized terrorist group; the actor might simply be a
12
sympathizer who is acting alone. If this happened, a nation-state might well find itself “at war” with a
single individual. Asymmetric warfare has significant implications for cyber attacks, because the Internet
permits a potentially anonymous and untraceable individual with virtually no resources to engage a
nation-state in cyber warfare. Rules for such asymmetric cyber warfare will need to be considered.
But even if cyber warfare was restricted to nation-state activity, the risk of casualties to critical
infrastructures and non-combatant property would be significant, especially when one considers that
the unintended consequences of an attack may be hard to predict. Much has been written about this
(see, for example, the National Research Council Report, “Technology, Policy, Law, and Ethics Regarding
U.S. Acquisition and Use of Cyberattack Capabilities,”7) and it is not my intention to repeat those lengthy
dissertations here. Suffice to say, domestic views and international agreements regarding what
constitutes appropriate military activity in this shared and integrated domain will be increasingly
important as militaries around the world hone their cyber capabilities, and as Internet growth and cloud
computing makes civilians even more dependent on our IT infrastructure. Indeed, if the concern is an
electronic Pearl Harbor, perhaps part of the response is an electronic “Geneva Convention” that
protects the rights of non-combatants.
The preceding four categories are important not because they eliminate all the hard questions
(they do not), but because they do in some cases make it easier to develop preventative and reactive
strategies in cases where attribution exists. They also can help reduce the paralysis that may occur when
one attempts to design a single strategy for the myriad threats that are similar only in their use of
technology.
Conclusion
There is little doubt that the Internet, with its global connectivity, anonymity, and lack of
traceability, poses considerable challenges to those in the private and public sectors who are tasked
with protecting it. The breadth of criminal activity, the number of actors and motives, and the lack of
reliable attribution have all served to make crafting responses to attacks difficult. While there are no
easy answers, greater attribution and clearer rules for responding to both non-attributed and attributed
attacks would enable the development and implementation of better strategies and tactics for
responding to cyber threats.
If this analysis is correct, the course of future action becomes clearer:
There must be innovation related to attribution. This includes both technological innovation (to
permit sources to be found technically) and legal/diplomatic innovation (to allow the data to be
shared quickly, even across borders).
7 Available at http://www.nap.edu/catalog.php?record_id=12651.
13
To deal with cyber crime, it is important for countries to adopt national laws that protect cyber
space, build law enforcement capability and capacity, and support international efforts to fight
cybercrime.
To address economic espionage and other areas of philosophical disagreement, there must be
international discussions leading to the establishment of norms that are then enforced through
national policies and international organizations.
To address military espionage, nation states must improve the state of their own computer
security, build offensive capabilities as appropriate, and rely upon existing diplomatic and
political mechanisms to address disputes.
To address cyber warfare issues, countries must first develop domestic positions on what the
rules for this new domain should be, taking due care to recognize the shared and integrated
nature of the domain. Then there must be an international dialogue designed to create
international norms for cyber space behavior. Creating these norms will be as difficult as it
sounds, but it is still both necessary and, ultimately, unavoidable. Absent such an agreement,
unilateral and potentially unprincipled actions will lead to consequences that will be
unacceptable and regrettable.