{"id":1261,"date":"2012-12-08T13:46:48","date_gmt":"2012-12-08T18:46:48","guid":{"rendered":"http:\/\/blog.cedsolutions.com\/?p=1261"},"modified":"2012-12-08T13:46:48","modified_gmt":"2012-12-08T18:46:48","slug":"hack-the-hackers-companies-itching-to-go-on-cyber-offense","status":"publish","type":"post","link":"https:\/\/blog.cedsolutions.com\/1261\/hack-the-hackers-companies-itching-to-go-on-cyber-offense\/","title":{"rendered":"Hack the Hackers? Companies Itching To Go On Cyber Offense"},"content":{"rendered":"
\"hacking<\/a>

Training Needed To Stop Hackers From Accessing Information<\/p><\/div>\n

Fatigued by a relentless onslaught from hackers, Corporate America is mulling a more aggressive and reactive approach to powerful cyber evildoers.<\/p>\n

Offensive counterstrikes are likely illegal in today\u2019s murky legal structure, but some security professionals are calling for at least a more proactive stance that utilizes measures like disinformation campaigns, honey pots and intelligence gathering.<\/p>\n

All of this is aimed at squashing cyber attacks that can generate millions of dollars in damages and lost revenue, lead to the loss of intellectual property and even cause reputational harm.<\/p>\n

\u201cThese adversaries are like a dog with a bone. They will not go away,\u201d said Dmitri Alperovitch, co-founder of security firm CrowdStrike. \u201cIt doesn\u2019t matter how many times you stop them, the one time they get through they cause very, very serious damage.\u201d<\/p>\n

Whether it\u2019s from vindictive terrorists, anti-capitalistic hacktivists or stealthy Chinese hackers, it\u2019s clear that companies are under attack from nefarious online forces.<\/p>\n

Just in the past few years there have been known high-profile attacks that have slowed the websites of big U.S. banks like Bank of America (BAC), shut down Sony\u2019s (SNE) PlayStation Network and destroyed 30,000 workstations at state-owned oil giant Saudi Aramco.<\/p>\n

According to a report last month from security firm Radware (RDWR), 65% of organizations polled suffered an average of three distributor denial of service attacks in the past 12 months, costing financial-services companies a hefty $32,560 a minute.<\/p>\n

CED Solutions\u00a0provides training on Security for Windows Server 2008, Windows Server 2012, Windows 7, Cisco security equipment including CCNA security, CCNP security, and Ethical Hacking, Computer Forensics, and many additional classes.<\/p>\n

No Prevent Defense Here<\/strong><\/p>\n

This helps explain a rising frustration about the limited options companies have to fight back.<\/p>\n

\u201cIf someone were to rob a bank today, doesn\u2019t the bank have a responsibility to protect its customers and employees from someone armed? They don\u2019t simply wait until someone shoots innocent victims,\u201d said Frank Cilluffo, director of George Washington University\u2019s Homeland Security Policy Institute.<\/p>\n

Some security firms like CrowdStrike are advocating a more proactive defense, though companies need to be careful to navigate U.S. laws.<\/p>\n

\u201cWe\u2019re not advocating hacking back. In most cases that is illegal,\u201d said Alperovitch. \u201cWe\u2019re talking about doing legal things on your network\u2026that are more aggressive as opposed to just sitting there and trying to swat away these intrusions.\u201d<\/p>\n

Alperovitch added: \u201cThis active defense, which the U.S. government has also embraced quite openly, can be a very effective deterrent.\u201d<\/p>\n

One such strategy involves creating a disinformation campaign by distributing fake documents throughout a company\u2019s own network to confuse and potentially misguide potential adversaries.<\/p>\n

This can help companies do everything from protect intellectual property to obscure strategic plans like acquisitions or bids.<\/p>\n

\u2018Like Going Fishing\u2019<\/strong><\/p>\n

Another proactive defense includes the use of so-called honey pots, which like the name implies, aim to lure adversaries.<\/p>\n

\u201cIt\u2019s like going fishing,\u201d said Jeffrey Carr, founder and CEO of boutique security firm Taia Global. \u201cThe worm is files you create that are entirely fake but would attract the interest of bad actors.\u201d<\/p>\n

Those files are then tracked by the security firm in an effort to learn more about adversaries and test the safety of the system.<\/p>\n

While Carr advocates the use of honey pots, he said \u201ca lot of corporations have problems, especially the legal departments,\u201d due to liability concerns.<\/p>\n

Another option is for companies to engage in snooping of their own through buying cyber-intelligence services that aim to provide the methods, identities and motivations of hacker groups.<\/p>\n

Carr said this type of threat intelligence is tantamount to knowing what\u2019s in the other team\u2019s playbook before a football game.<\/p>\n

Cyber Vigilantes?<\/strong><\/p>\n

Others believe the U.S. government should unleash private companies, letting them punch back at hackers through offensive measures such as counterstrikes.<\/p>\n

\u201cWe\u2019re never going to have nor should we have virtual law enforcement everywhere. We should provide opportunities and responsibilities to the private sector to hack back,\u201d said Cilluffo, who has testified before Congress and served as a Homeland Security adviser in the Bush Administration.<\/p>\n

Cilluffo compared offensive measures with a football linebacker, who technically plays on the defense. \u201cYou\u2019re blitzing and attacking the adversary, or quarterback, who is trying to score on you,\u201d he said.<\/p>\n

Of course, counterstrikes can backfire, especially because DDoS attacks often employ systems owned by unwilling participants. That means an effective counterpunch could inadvertently hit innocent bystanders.<\/p>\n

\u201cYou can\u2019t simply just shoot back because there will be a lot of collateral damage unrelated to the attacker, but we don\u2019t want to just sit there and call the locksmith\u201d either, said Cilluffo.<\/p>\n

Some are more cautious about giving companies the power to fight back.<\/p>\n

\u201cDo you want vigilante justice in cyberspace? Maybe you do,\u201d said Jim Rickards, senior managing director at Tangent Capital in New York. \u201cIt just conjures up notions of pirates on the high seas and wild west posses.\u201d<\/p>\n

Legal Gray Area<\/strong><\/p>\n

Companies could also find themselves in violation of privacy and computer abuse laws.<\/p>\n

\u201cCitizens aren\u2019t allowed to walk around with guns without permits just because they want to be vigilantes. Even though your intentions might be good, you have to refrain from breaking the law,\u201d said Rickards.<\/p>\n

Tel Aviv-based Radware said its security measures stop short of counterattacks.<\/p>\n

\u201cIt\u2019s unfair that hackers can do whatever they want and companies have to follow rules. But companies should only operate within the law and not even operate within the gray area,\u201d said Ronen Kenig, director of security product marketing at Radware.<\/p>\n

Harriet Pearson, a partner at law firm Hogan Lovells, said the policy discussion and norms \u201chaven\u2019t really settled out yet,\u201d pointing out that the law doesn\u2019t even use the offensive and defensive terms.<\/p>\n

\u201cThe time to plan corporate cyber strategy is before something happens,\u201d said Pearson, who urged companies to conduct \u201cadvance thinking and analysis of the relevant law\u201d ahead of time.<\/p>\n

Clarity From D.C.?<\/strong><\/p>\n

U.S. companies are understandably quiet about the extent of their cyber defenses.<\/p>\n

Two high-value targets of hackers, NYSE Euronext (NYX) and Nasdaq OMX Group (NDAQ), both declined to comment on the matter.<\/p>\n

Cyber security experts have been urging Washington to issue new guidance to companies about what\u2019s permitted as they defend themselves from hackers.<\/p>\n

While an executive order from the White House could be forthcoming, Cilluffo said legislation from Congress would be far more helpful and could even indemnify companies from lawsuits.<\/p>\n

\u201cWe need to have these conversations because the current approach is doomed for failure. We\u2019re losing too much,\u201d said Cilluffo.<\/p>\n

http:\/\/www.foxbusiness.com\/technology\/2012\/12\/07\/hack-hackers-companies-itching-to-go-on-cyber-offense\/<\/a><\/p>\n

CED Solutions is the #1 location for Microsoft Certifications in North America, with many courses on Network Administration, Security, Cisco, IT Healthcare training, Oracle, EC Council, ISC2 and many more.\u00a0 www.cedsolutions.com<\/a>, info@cedsolutions.com<\/a>, (800) 611-1840<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Fatigued by a relentless onslaught from hackers, Corporate America is mulling a more aggressive and reactive approach to powerful cyber evildoers. Offensive counterstrikes are likely illegal in today\u2019s murky legal structure, but some security professionals are calling for at least a more proactive stance that utilizes measures like disinformation campaigns, honey pots and intelligence gathering. […]<\/p>\n","protected":false},"author":4,"featured_media":1262,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wds_primary_category":0},"categories":[4,5,7],"tags":[23,25],"_links":{"self":[{"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/posts\/1261"}],"collection":[{"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/comments?post=1261"}],"version-history":[{"count":0,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/posts\/1261\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/media\/1262"}],"wp:attachment":[{"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/media?parent=1261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/categories?post=1261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/tags?post=1261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}