Experts: Cyber adversaries becoming more brazen

U.S. adversaries in the cyber domain are getting more skilled, more versatile and, of late, more openly aggressive, several security experts told Congress recently.

One example is Russia, which is believed to be one of the most capable actors in cyberspace. “What’s changed over the past few years is that we’ve had more visibility into their activity, there’s been much more public reporting of what they’re doing and, despite that public reporting, we do not see them changing their tactics,” Jennifer Kolde, lead technical director at FireEye Threat Intelligence, told a panel of lawmakers last week.

“We’ve also gotten to see some actors that we suspect very strongly are Russian nation-state [actors] through some of our incident response engagements and they’ve been extremely aggressive within victim environments,” Kolde said. “Some threat groups, when they’re detected, will go silent or they’ll abandon the network so that they just disappear once you know that they’re there.” But some Russian threat groups “fight very strongly to stay within that network and they do so with a great deal of skill and adaptability that challenged even our responders to keep ahead of them.”

Iran is another apparently emerging threat, following the sanctions relief and windfall of cash the Islamic Republic received with its compliance with a multi-national accord to curb its nuclear program.

“I do think there are some legitimate concerns and considerations in terms of not only, do they have additional cash to be able to devote to building out their computer network attack capabilities, but they had shown that they were willing to turn to those tools for quite some time now,” Frank Cilluffo, associate vice president and director of the Center for Cyber and Homeland Security at George Washington University, said at the hearing.

“During the so-called Green Revolution the way they were able to turn to basically shut down access to anyone inside Iran to the rest of the world was a clear indicator that they have some of those capabilities,” Cilluffo said. “I think most importantly, though, is that they are willing to work with proxies. And clearly when you look at the energy sector in particular, this is an area I think we need to be very concerned about.”

As for responding to attacks, lawmakers and witnesses decried the apparent lack of a clear deterrence strategy from the administration. “I feel we have not articulated and haven’t demonstrated a deterrence strategy,” Cilluffo said, adding that there have been several litmus tests, from the hack of Officer of Personnel Management databases to other breaches, that require responses and clearer policies.

However, one common thread that emerged was that the cyber domain’s connectivity to the other domains of warfare – air, land, sea and space – can provide a great deal of leverage for the United States in crafting deterrence. “We better have the political wherewithal then to be able to respond.  And not only through cyber means,” Cilluffo said. “At the end of the day, cyber is its own domain but it transcends air, land, sea, space.”  

“Cyberspace is one domain,” Rand Corp. researcher Isaac Porche said. “The United States military operates in many other domains and so we’ve heard press articles talk about potential Iranian hacktivists attacking a U.S. dam – I don’t have any information that says it’s there. But what prevents nation states from taking action [is] the fact that they would have to deal with the United States in other domains. And so it always has to include all domains, not just cyber. Our response to a cyber attack may not be in cyber.” 

The U.S. has maintained on many occasions that it might not return fire, so to speak, in cyberspace against a cyber incident, instead applying a “whole of nation” approach that could include kinetic, economic or other responses.    

Porche’s reference to the reported cyber attack on a dam in New York also is reflected in the Homeland Security Department’s recent warning to power companies that they could be taken out in the same way hackers took down Ukraine’s power grid.