30 October 2014
From attackers trying to bring down planes to criminals targeting banks, the danger is growing
“The nature of cyber-defence is that we are constantly behind the adversaries and not just two but more like 20 steps." Photograph: Ints Kalnins/Reuters
It’s been a busy week in the skies above Europe’s periphery, as Nato has repeatedly scrambled jets to track “unusual” sorties by Russian bombers
However lively the aerial game of cat and mouse has been, it is nothing compared to the digital skirmishing that goes on in and around the servers and systems that sustain the western alliance.
“The threat landscape is vast, from malware and hacktivists to organised criminals and state-sponsored attacks,” says Ian West, a former RAF officer who now heads up Nato’s cyber-security services. “Things that we thought impossible can be done.”
West’s 200-strong team covers operations for about 100,000 people at 34 Nato sites. Their task is formidable even by the hyperbolic standards of the internet. “Our intrusion detection systems find around 200m suspicious events each day,” West says.
While only a fraction of those are seen as serious attacks on Nato computers, it still adds up. The unit dealt with more than 3,600 abnormal activity or intrusion attempts last year, of which there were about five confirmed cyber-attacks per week.
This month, cyber-intelligence firm iSight Partners revealed that Russian hackers had exploited a bug in Microsoft Windows to spy on Nato computers in a five-year hacking campaign dubbed Sandworm, which also targeted Ukrainian computers. Earlier this week, hackerssuccessfully breached the White House computer network.
“With cyber-attacks, defenders are trying to find the needle in the haystack,” West says.
“It is serious. If a business gets attacked, it can go under. If our systems at Nato fail, people may die.”
Cyber-terrorism is now treated in military and political circles as seriously as conventional attacks with bombs and tanks. Conflicts can now be virtual but with consequences that are real and destructive: malware and other computer viruses can be directed to shut down infrastructure such as power grids, hospitals, water networks, financial markets and air security. Stuxnet is perhaps the most famous: implanted into the Siemens operating system at an Iranian nuclear plant in 2010, the virus reportedly wrecked 1,000 centrifuges by making them spin out of control.
At their summit in Newport last month, in between debating Ukraine and Isis, Nato leaders endorsed a policy stating that a digital assault against any of their 28 members could trigger a response under article five, the alliance’s collective defence clause.
Attacks come in different guises, from phishing – attempting to dupe a recipient into disclosing sensitive data – to distributed denial of service (DDoS), where servers are swamped with so much data that they overload and collapse. Every organisation and individual is vulnerable, but much of it is organised crime aimed at clearing out bank accounts. One estimate puts annual profits from cybercrime as high as $1tn (£600m) – similar in size to the global narcotics trade.
In recent years, attacks have evolved from a scattergun approach to more targeted assaults. Organisations previously assumed to be secure have been hacked, from Google and JP Morgan to Lockheed Martin and the French economics ministry.
In the cyber-threat engine room, a team of engineers constantly monitors multiple screens, combing through lists of suspicious activities collected by intrusion detection sensors. Some attacks are obvious, brute-force attempts to take Nato offline, while others are under the radar.
Serious-looking problems can be dealt with by blocking traffic from certain nodes. “The issues are prioritised through a triage system, like in ER,” says one of the analysts, David Quigley. A former IT specialist with the US air force, his desk is stacked with books with titles such as Hacking For Dummies. “We had a week of tension in the office leading into the Nato summit last month, with three to four denial-of-service incidents attacking the website,” Quigley says. “Everyone was on edge, working long hours with little sleep. We know that attackers only need to find one vulnerability.”
Russians are widely assumed to be behind the attacks that knocked down systems in Estonia in 2007 and Georgia in 2008. In the case of Estonia, the websites of the parliament, ministries, banks, media groups and other organisations were swamped in a DDoS attack.
Hannes Krause, Estonia’s assistant defence counsellor at Nato, says: “The nature of cyber-defence is that we are constantly behind the adversaries and not just two but more like 20 steps – as they are not bound by any rules. The next major Nato crisis is likely to be cyber-driven. The new attacks will be something we have never seen before. These are the unknown unknowns.”
Nato itself has been targeted increasingly over the past decade. In March, CyberBerkut, a group of pro-Russian hacktivists, temporarily took down various Nato websites in an attack linked to the crisis in Crimea. West insists that classified operational networks were never in danger: one Nato-affiliated website was merely defaced with the image of Dumbledore from Harry Potter. “These are annoyances more than anything else.”
Still, next month a three-day cyber-defence exercise will gather more than 400 experts in a virtual war game to test capabilities against a sophisticated adversary. West says more than 95% of the cyber-attacks he faces are criminal activity – attempts to steal rather than to make aircraft fall out of the sky. In these cases, cyber-attackers often use sleeper cells, planting bugs or malware that allow undetected extraction over a long period. This ties in with industry figures that show the average time taken to detect a cyber-attack went up to 32 days last year, from 24 the year before.
No defence is foolproof. “There is no silver bullet,” says West. “If you want to seriously defend your networks against modern threats, then you need a layered defence. That means firewalls, intrusion detection systems, and cooperation. We are not always successful. But if they do get past one layer of defence, they don’t get further – and never the classified information.”
Recent measures include setting up rapid-reaction teams and an around-the-clock response to incidents. “This might sound obvious, but it wasn’t always the case,” West says. “On Fridays, I would think of putting up a sign saying ‘Don’t hack us this weekend, we’re back on Monday.’”
Our editors' picks for the day's top news and commentary delivered to your inbox each morning.
More from the Guardian
No comments:
Post a Comment