Cyber state

CYBER STATEThreats, Opportunities and the Future of Cyber Strategy at a National Level

Presented for:

the Organization of American States Caribbean Telecommunications Union

9th Ministerial Strategic Seminar (Cyber Security)

Thursday, December 8, 11

Iftach Ian Amit

VP Consulting at Security-Art

16 years in the Security Industry

Cyber Defense at the Israeli Air-Force

Founding member - the Penetration Testing Execution Standard

SME for NATO’s Cyber Commons Strategy 2011 (CCD-COE)


AgendaReview of the current state of Cyber Threats at a national level

Linking criminal efforts to state interests

National readiness - where are we?

Creating Cyber Capabilities - the right way

eGovernance

Partnerships

Public-Private


Cyber ThreatsLocality

Global

Regional

Local


Cyber Threats

Criminals

Hacktivists

Terrorists

Threat CommunitiesLocality

Global

Regional

Local


Cyber Threats

Criminals

Hacktivists

Terrorists

Threat Communities Approach Vectors

Public Internet

Communication Infrastructure

Private Networks

Locality

Global

Regional

Local


Cyber Threats

Criminals

Hacktivists

Terrorists


Public Internet


Private Networks

Locality

Global

Regional

Local


Cyber Threats

Criminals

Hacktivists

Terrorists


Public Internet


Private Networks

Locality

Global

Regional

Local

Assets

$

Public Opinion

Critical Infrastructure


Cyber Threats

Criminals

Hacktivists

Terrorists


Public Internet


Private Networks

Locality

Global

Regional

Local

Assets

$

Public Opinion

Critical Infrastructure


Quick Summary:

Crime and War are

NOT FAIR

Deal with it!


CyberCrime


A-Symmetrical conflict

Crime enterprises are operating like global businesses

Legislation is behind ==> more freedom to run fraud

Law enforcement success is only at the low-end (small fish)

Defensive mechanisms focus on post-infection


Hacktivists


Links (crime-hacktivists)?






Cyber Terrorists

Much more disperse

Local

Regional

International

Focus on recruiting

Both physical actions, as well as Cyber actions






Links (crime-hacktivists-terror)


Links (crime-hacktivists-terror)


13

Russian Government

Crime

ESTDom RBN

HostFresh

UkrTeleGroup

ESTDomains

McColo

Atrivo


13

Russian Government

Crime

ESTDom RBN

HostFresh

UkrTeleGroup

ESTDomains

McColo

Atrivo

Hosted by


13

Russian Government

Crime

ESTDom RBN

HostFresh

UkrTeleGroup

ESTDomains

McColo

Atrivo

Hosted byCustomer


13

Russian Government

Crime

ESTDom RBN

HostFresh

UkrTeleGroup

ESTDomains

McColo

Atrivo

Hosted byCustomerNetwork provider


13

Russian Government

Crime

ESTDom RBN

HostFresh

UkrTeleGroup

ESTDomains

McColo

Atrivo

Hosted byCustomerNetwork provider


National Readiness?

More focus on eGovernance

Financial systems are still exposed

Critical Infrastructure is behind a “feel good” solution

Capability building is lacking a strategic goal!

Lack of Intelligence and correlation of data


eGovernanceDeveloping outreach is great, efficient and transparent

Remember to THREAT MODEL when providing services

Threat communities may surprise you (examples: Mexico, Colombia, Russia, South Korea)














Public-Private Partnerships

You don’t own the Internet

A lot of critical infrastructure and communication is privately owned or privately operated.

Symbiotic relationships are a MUST! (See US CyberStorm III)

Advantage (state): Access to more raw information, early warning

Advantage (private sector): More accessibility, broadening threat community detection and intelligence (readiness)


Global Partnerships

Model after the CERT community

Global intelligence on threat communities

Early warning

Sample sharing

Proactive defense and incident handling

Helps to bypass legal/political issues


Strategic ApproachStart from the basics

No - advanced offensive capabilities come LAST!

Build an intelligence and correlation infrastructure

Early warning, feeds from multiple sources (open and closed)

Remember social media!

Defense is not a reactive practice. Push forward, place yourself in “enemy” territory


Strategic ApproachOffensive capability building

Coupled with the defensive requirements

Focused on what is needed - not what everyone else is using...

Working alone == FAIL. Establish partnerships, work on international legislation on crime/war treaties

NATO article 5 for the cyber commons?


Questions?

Thank you!

Iftach Ian Amit

VP Consulting, Security-Art

[email protected]

www.iamit.org/blog


mailto:[email protected]

mailto:[email protected]

http://www.iamit.org/blog

http://www.iamit.org/blog

Cyber state

Documents

cyber capabilities

cyber terroristsmuch

cyber actionsthursday

threat model

cyber state threats

servicesthreat communities

future of cyber strategy

links crimehacktivists