Cyber Warfare, Budget Cuts and a Shortage of Cyber Experts

Saturday, June 16, 2012

Pierluigi Paganini

03b2ceb73723f8b53cd533e4fba898ee

(Translated from the original Italian)

The Flame case has raised questions about the real cyber warfare capabilities of every country, and we have spoken of the strong commitment by the Indian and German governments, praising the US capabilities for their involvement in operations such as the "Olympic Games" project.

But what are the real cyber capabilities of the United States?

No doubt the U.S. is among the main actors of an increasingly crowded cyberspace, and they have indisputable military capabilities in the field. However, the country is still too vulnerable to potential cyber attacks.

Despite the increased engagement in cyber warfare, the US must faces a crisis which has inevitable effects on the budgets allocated to defense. U.S. Defense Secretary Leon Panetta often has expressed concerns about the possibility of a major cyber attack against the US and its critical infrastructure.

The government is planning the cuts to defense budgets in the last decade, around $450 billion over a period of ten years. Persistent rumors speak of a further cut of $500 billion due an automatic mechanism of protection known as sequestration after members of Congress failed to reach an agreement to reduce the nation’s deficit.

The cuts represent a serious problem for the development of US capabilities in a delicate historical period, where principal enemies of the US such as IranChina and also Russia are massively investing to acquire a strategic advantage under this perspective.

Secretary Panetta warned of the possible risks deriving from the cuts:

“It would guarantee that we hollow out our force and inflict severe damage on our national defense. I think you all recognize that sequester would be entirely unacceptable and I really urge both sides to work together to try to find the kind of comprehensive solution that would de-trigger sequester and try to do this way ahead of this potential disaster that we confront."

“I’m very concerned that the potential in cyber to be able to cripple our power grid, to be able to cripple our government systems, to be able to cripple our  financial systems would virtually paralyze this country and as far as I’m concerned that represents the potential for another Pearl Harbor  as far as the kind of attack that we could be the target of using cyber."

The scenario hypothesized by Panetta is realistic and dramatic, a cyber attack against a US critical system could represent a disaster. The possible source of the attacks could be foreign government, but also cybercriminals or cyber terrorists.

Every day thousands of attacks hit US networks, and the trend shows an increasing frequency, as cyber espionage is the most insidious cyber threat. To tackle this offensive it is necessary for continuous and huge investments in cyber defense capabilities.

Another question raised by the main military authorities is related to the enormous expenses for the campaigns abroad of American troops, first of all in Afghanistan where the cost of sending supplies into through alternate routes is about $100 million a month. If the economic situation is complex and dangerous, other clouds are gathering on US cyber warfare capabilities.

Leading cyber experts have alerted the US government of the shortage of talented computer security specialists for hire in the cyber security circuit. The research of these skilled experts is one of the first goals of a US administration that has promoted several projects such as Plan X.

According to estimates, the US is lacking tens of thousands of experts to allocate for activities related to cyber defense and cyber offense. Of course the shortage could represent a desirable opportunity of business for private companies, for example US defense contractor Northrop Grumman Corp has recently promoted the first undergraduate honors program in cyber security with the intent to be highly specialized in cyber warfare.

Government agencies are also trying to hire consultants from private industry, but in some cases security firms have refused to send their most talented cyber experts to avoid losing them.

According many experts, due to this reason, government project usually involve a "second level" of experts from private businesses, or they are locking down the main resources with special agreements.

According unofficial sources, government is also searching for experts in the cyber underground and attending hacker events all over the world.

Let me conclude with a declaration by Eugene Kaspersky ,CEO of Kaspersky Labs, on the actual cyber situation:

"Now we’re living in the era of cyber weapons. The world is different. Not just cyber hooligans, vandals. Not just criminals. But governments are in the game and I’m afraid for the worst, I’m still expecting, cyber terrorism.”

The involvement of government is critical,and the problems with US cyber defenses represents serious concerns. Cyberspace could soon become the reign of anarchy and the impact on the real world could be dramatic.

Cross-posted from Security Affairs

Possibly Related Articles:
13950
Network->General
Federal
Budgets Government Cyberwar Cyber Security Network Security National Security Cyber Defense Leon Panetta
Post Rating I Like this!
73d0e1095870b725152f48157d253034
Keith Glass There is, alas, a problem with doing Cyber in the Government space. And that problem is. . . managers. Managers that know very little about cyber, and thus start directing their cyber professionals to do VERY dumb things.

An example: a 24/7 SOC crew gets told that "production" on nights and weekends is significantly lower than that of the main day shift during the business week.

Of course, they never consider that most of the "production" is due to users accessing unsafe sites, opening infected attachments, or responding to phishing and spear-phishing emails.

So, instead, to preserve their jobs, the night and weekend crews write up such routine things as SSH Brute Force attacks that were denied at the firewall, instead of watching for more substantial threats. . .
1339959217
03b2ceb73723f8b53cd533e4fba898ee
Pierluigi Paganini Hi Keith, I agree.
1339963704
1de705dde1cf97450678321cd77853d9
Ian Tibble Keith, this has been the root of all evil in infosec going all the way back. There is nothing more dangerous that the self-righteousness of poor security management.

There has always been a lack of actual talent in infosec at the analyst level, but the lack of managers (who can inspire and lead rather than dictate a misguided strategy) is even more chronic.

Managers need to have graduated from analyst roles themselves, and analyst roles need to be well...more analytical. If we're talking "cyber", then the hacker mindset fits, and there's so few of them around since the 90s.
1340102985
03b2ceb73723f8b53cd533e4fba898ee
Pierluigi Paganini Hi Ian I share your opinion regarding the poor knowledge and commitment of IT security Managers ... cases such LinkedIN and Sony have demonstrated it.
Regards
Pierluigi
1340106183
35d93e1eda881f6e3dde4e87428a975e
Michael Johnson Also agree with Ian. I'm assuming by 'cyber experts' they mean people with actual programming, networking, configuration and hacking experience. It's impossible to defeat the bad guys without looking at whatever network with the mindset of a hacker.
1340121899
03b2ceb73723f8b53cd533e4fba898ee
Pierluigi Paganini that's correct!
1340122935
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.