The United States must ramp up its ability to defer and defeat cyberattacks, security experts and federal prosecutors agree, as foreign hackers target American networks with increasing scope and sophistication.
With security breaches being suffered by US-based corporations on a regular basis, panelists at a summit in Washington, DC this week sounded an alarm for firms to adopt aggressive yet defensive cyber policies – lest they want to risk becoming this year's Target, Home Depot or, most unfortunately, Sony Pictures Entertainment.
At the International Conference on Cyber Engagement at Georgetown University, two of the federal government's top attorneys urged private businesses to forge relationships with law enforcement in order to minimize in advance their response to a hypothetical – but increasingly possible – cyberattack.
READ MORE: Pentagon drafting thousands of ‘cyber forces’ in prep for cyber emergency
John Carlin, the assistant attorney general for the US Department of Justice's national security division, echoed a strategy for dealing with cyberattacks laid out in a report released by the Pentagon last week, which advocated for, among other objectives, making such assaults too costly to wage.
“A private company that has internet-connected computers cannot keep a dedicated nation state out of its systems,” Carlin said, so the government must do “everything we can to increase the costs for the bad guy so that they know there is going to be a consequence.”
In the wake of last year's Sony hack, attributed by the US to North Korea, Carlin's co-panelist, Assistant Attorney General Leslie Caldwell of the DoJ's criminal division, said that prosecutors are widening their net with regards to pursuing foreign suspects.
Caldwell said that cybercrime is currently the top priority for the Justice Dept., but stressed that it’s an issue that far exceeds other illegal activity when it comes down to how the players are dispersed. In nearly every cyber case she's worked, Caldwell said, an international component has complicated matters for US investigators. Federal prosecutors are nevertheless touting last year’s indictments against alleged hackers with China's People's Liberation Army, among other catches, as being a symbol of the DoJ's growing willingness to prosecute abroad.
At #GeorgetownCyber, @GGLouie: If govts want to avoid making stupid laws, they shouldn't adopt cyber laws they wouldn't want others adopting
— Michael Nelson (@MikeNelson) April 27, 2015
Threats against US networks are increasingly becoming issues of national security, the feds agreed, with the hack suffered by Sony being the best example as of late. They also admitted that not enough American companies are taking preventative measures to avoid becoming the next victims, however, and urged companies to embrace security before it risks becoming an afterthought.
“You need to have a point-of-contact in law enforcement before you're hacked,” Caldwell said, “... to know what you're supposed to do.”
“You should definitely have a relationship” with authorities, she added. “The FBI and Secret Service have agents all around the country who have a lot of expertise in this area.”
DOJ's Carlin on cyber: "Defense is not going to do it alone." #georgetowncyberpic.twitter.com/33Afgo55Xn
— Andrew Blake (@apblake) April 27, 2015
Caldwell and Carlin also both advocated for corporations to share cyberthreat information with the federal government – an item up for discussion in the US Congress as recently as last week. At a panel later in the afternoon, security experts agreed that firms must work with the feds as attacks become harder to counter.
Tom Kellerman, the chief cybersecurity officer for the firm Trend Micro, added that 44 percent of respondents in a recent poll taken among critical infrastructure industries said that they had fallen victim to a Sony-like attack, and the reason is because dangerous malware has become easier to get than ever.
Like the DoJ panelists before him, Shawn Henry, the president of CrowdStrike Services and a former FBI cyber agent, said that corporations and governments must work together in order to best fend off attacks that might otherwise be out of scope for either.
READ MORE: CISA's sibling: House passes new cyber threat-sharing bill
In the physical realm, Henry said, governments abide by an ethos of “Anything at any cost to protect the citizens.” Digitally speaking, though, “it's not happening,” he said. Malicious code on par with what the alleged North Korean actors used against Sony may be on every corporate network, Henry said, but it's not being stopped by the government. Rather, it's being purchased by crooks on the deep web and used again and again on unsuspecting, unprepared companies while governments watch idly.
“They don't have the capability, authority or capacity to do it in today’s environment for a lot of reasons,” Henry said of the governments’ response.
According to Kellerman, “the only way the internet is going to be sustainable in the next 20 years” is if Silicon Valley embraces cybersecurity, and not just by “investing in cyber security start-ups.”
Last week, the Dept. of Defense released its first official cyberstrategy report in five years, the contents of which advocated for waging offensive operations against foreign adversaries to disrupt and deter their ability to target American networks. Meanwhile, lawmakers in the House voted 307-116 last week favor of the Protecting Cyber Networks Act, advancing a bill that expanded legal liability protections for corporations if they choose to voluntarily share certain kinds of digital data with the government.