Slashdot Mirror
Major Cyber-Attack Will Happen Soon, Warns UK's Security Boss (theguardian.com)
Alex Hern, writing for The Guardian: A "category one" cyber-attack, the most serious tier possible, will happen "sometime in the next few years", a director of the National Cybersecurity Centre has warned. According to the agency, which reports to GCHQ and has responsibly for ensuring the UK's information security, a category one cybersecurity incident requires a national government response. Speaking at an event about the next decade of information security, Levy warned that "sometime in the next few years we're going to have our first category one cyber-incident." The only way to prevent such a breach, he said, was to change the way businesses and governments think about cybersecurity. Rather than obsessing about buying the right security products, Levy argued, organisations should instead focus on managing risk: understanding the data they hold, the value it has, and how much damage it could do if it was lost, for instance.
Man I feel like I'm in a James Bond movie. National Cybersecurity Centre ? Seriously?
Well, it sounds like the only reasonable thing to do would be to provide the National Cybersecurity Centre with much more funding!!
Why not use the same scale as hurricanes? A category 5 cyber should be the most dangerous kind of cyber. Personally, I tend not to go above category 2 cyber when I'm cybering. I think you need a safe word at category 3 cyber and above.
Rather than obsessing about buying the right security products, Levy argued, organisations should instead focus on managing risk: understanding the data they hold, the value it has, and how much damage it could do if it was lost, for instance.
But what do you suppose the chances are that the leaders of these organizations magically start thinking that way?
Also he forgot one important part. Planning for what to do when the inevitable happens.
This is nothing but an excuse to grab power. What with the advent of cryptocurrencies, strong encryption, and a growing distaste for governments and corporations, you can bet your last penny the people in power will do anything to keep it. If we in the West do not stop this sorry power grab stuff that keeps happening, we'll end up like China as regards the Internet.
so "soon" = "next few years" is cyber space?
and it is possible to accurately predict future of online world and its evolution for few years into future? so accurately that funds and laws infringing on other needs, and privacy, can be reallocated?
given the hurricane terminology, would there be a campaign against skeptics of these predictions, like against skeptics of climate change predictions?
nt
"I’ve often thought that the single most devastating cyberattack a diabolical and anarchic mind could design would not be on the military or financial sector but simply to simultaneously make every e-mail and text ever sent universally public. It would be like suddenly subtracting the strong nuclear force from the universe; the fabric of society would instantly evaporate, every marriage, friendship and business partnership dissolved. Civilization, which is held together by a fragile web of tactful phrasing, polite omissions and white lies, would collapse in an apocalypse of bitter recriminations and weeping, breakups and fistfights, divorces and bankruptcies, scandals and resignations, blood feuds, litigation, wholesale slaughter in the streets and lingering ill will."
Maybe he's talking about in the UK specifically, or maybe his definition of a category one cyber-attack is different from my own (confession - I didn't RTFA to find out how cyber attacks are classified!) But if you want to talk about major acts of sabotage perpetuated through "cyber" - http://www.zdnet.com/article/u... Also, that whole Stuxnet thing
So... worst case scenario: Internet is out for... a week? Or FB is down? or Amazon is inaccessible? Bank site is down? WhatsApp doesn't work?
I mean, what's the worst that can happen in a cyberattack?
I think a more sinister "attack" would be to quietly change prescriptions/dosage at national pharmacies (CVS, etc.) such that nobody immediately notices.
Will be have fast-and-furious like car swarms? Really???
Rather than obsessing about buying the right security products, Levy argued, organisations should instead focus on managing risk: understanding the data they hold, the value it has, and how much damage it could do if it was lost, for instance.
He has a good point. When an all out attack does happen you won't be able to stop it. So before it does, make sure your backups work, make sure your restores work, put fences up to stop the spread of an attack, etc, etc.
In other words, assume the attack will succeed. Then what will you do?
The various corporations and governments have been warned for years that trade secrets and infrastructure are extremely vulnerable. This warning is more of the same.
Repeated breaches have not convinced them to make the fundamental changes that are necessary. It seems that nothing short of a catastrophe will.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Don't know where all the funding stuff comes from in here, except maybe the history of it always leading to that, hah.. But he is right that building cybersecurity or generally running a business without basing it on sound risk analysis makes no sense. Realizing that should not be rocket science but somehow people/organizations don't seem to do it anyway. I find it good that someone tries to bring the message..
but I don't see them rushing to fund NASA.
...which will imprison people for using the word "cyber". Each instance of the word would carry the penalty of 24 hours locked inside a smelly hall closet with a small television blasting the movie Lawnmower Man on an endless loop.
Pretty obviously.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Better order your tinfoil hat before it's too late.
... putting more research into actual advances into computer security, or making systems more secure, for example by banning the most insecure products and demanding minimum evidence based security standards...
he probably just wants people buying exploits on the market in order to compromise the computational devices of innocent victims.
so why doesn't he take that position and use it to get the politicians to stop trying to back-door encryption? or get the politicians to enforce penalties for having these hacks happen on their watch?
Because he actually doesn't understand a single bloody thing hes talking about. evidence FTA:
"What that tells me is that the systems we've built, as technical systems, are not built for people. Techies build systems for techies, they don't build technical systems for normal people"
Encryption is math, it is not built for anyone! as far as how the encryption is used, well that lies on the c suite execs who dont want to spend the money to actually educate their employees. you cant expect security officials to make things for normal people. as the saying does "make a program more idiot proof and a larger idiot will come along"
another wonderful quote FTA:
"Cybersecurity professionals have spent the last 25 years saying people are the weakest link. That's stupid!" he said, "They cannot possibly be the weakest link - they are the people that create the value at these organizations."
just because a person creates value for an organization does not mean that they are not a security risk or the weakest link in the security chain. A sales person can make a company millions of dollars a year, yet re-use passwords over and over again and never be affected until a malicious person targets them.
the only thing stupid here is this director.
. . . the recent WannaCry attack was only a Category Two attack by NCSC standards . . . a Category One attack would strike without warning, and require a government-level response.
. . .
"Sometime in the next few years, we're going to have our first Category One cyber incident - one where you need a national response,” he said."
Clearly these are internal guideline to the NCSC, although I can't find them with a moment's Googling.
Also,
The attack will probably be caused by “one or two” people at an organisation doing something small that subverts the existing cybersecurity protection, leaving the company open to attack.
"And once that had happened,” Levy says, “there was no way that the organisation could have protected itself, and they will be really, really sorry that this sort of thing will have happened."
Actually, this sounds exactly like what Edward Snowden did, except the government is still too much in denial to admit what happened because calling it an "attack" is sort of a stretch - the attack is all the heart attacks people have when they learn the truth of how unconstitutional and ethically corrupt their government is.
... it took lone-contributor security researcher, Marcus Hutchins, to stop the WannaCry ransomware outbreak [by registering a domain name].
... Mr Levy is certain that all this evidence is wrong, and he is correct.
...
Ian Levy, the Director of the UK National Cybersecurity Centre and the individual quoted in the OP, heads an agency that is so good, so capable, so on-the-ball, that it took a private individual to identify a means of neutering WannCry.
Never mind the fact that it would have been Levy's organisation that was responsible for preventing the NHS and other UK government agencies from being compromised in the first place...
To give you an idea for just how misguided the man's thinking is, here's another of his quotes, from the same article:-
"“Cybersecurity professionals have spent the last 25 years saying people are the weakest link. That’s stupid!” he said, “They cannot possibly be the weakest link – they are the people that create the value at these organisations."
So, let's just get this right. When we have an abundance of evidence that shows that it is people, not technology, who select easily-guessed passwords, people, not technology, that click the links in phishing emails, people, not technology, that try and promote code that hasn't been properly tested, "because they know it's OK, they don't need to test..."
I think that having Mr Levy in charge at the NCC is actually more scary than his claims of a "Major Cyber Attack Happening Soon"
A "category one" cyber-attack, the most serious tier possible, will happen "sometime in the next few years",
Huh, putting a DNS server, a web server, and all that stuff into init increased the attack surface. Who knew?
Don't need a cyber attack, just physical against several Critical Infrastructure sectors to cripple a society, or worse, a mixture of the two. Mainly electricity, fuel (natural gas, petrol), and water. It all falls apart without any of those 3, but take out 2 or more o them and it is crippling.
But, as far as cyber goes, Ted Koppel's Lights Out is a great read. It's not just the US which would be crippled by such attacks.
Does this dood mean it's time to offshore even more Brit jobs to China???? These clowns are always soooo confusing . . .
I predict a category dumbass will hit us right now.\
Make the cybercriminals think they've hit paydirt!
This must count as the most inept warning - or is it merely a tragically poor attempt to scare a government into increasing their funding - for years.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Major cyber-attack will happen soon, followed by a call for even more onerous surveillance laws.
We do that with the problem in our IT department - a category five ****storm requires all staff to be inside the help desk and the main doors to be sealed and bolted shut until the crisis is over. Fortunately, we are in the basement next to the utility room, so they can't cut our air supply off.
What's that crazy-scared bitch going to do now? We all know who I'm talking about.
The approach suggested, give up and expect to lose data, is just another wrong approach.
Such an attack is likely to come in the form of IoT attack. Billions of devices are going online over the next few years.. Most of them use unpatched linux variants. A team of cunning programmers could exploit a few Linux zero days to spread a worm across the internet. They could in theory destroy billions of devices causing hundreds of billions in direct damage and hundreds of billions more in indirect damage from the the chaos .
The right approach is legislation,. Mass production network enabled software/firmware should first be certified just like we certify electrical. We need to do this now in a level headed fashion before some hurricane hits because if it comes later much more draconian ill considered laws become more probable. Unfortunately people need Chicago to burn to the ground to figure out fire regulations are smart idea even if sometimes cumbersome.Thus is will take an internet outage that cripples the economy to finally sink in that software in the digital age presents a safety issue.
If it was a fictional movie script what would 1 to 5 look like AC?
1. An artist cant log into the cloud to get their online only art software to work. The consumer internet is no longer useful.
2. The company buying the artists work for a larger project cant use their internet. The dedicated telco networks are having problems.
3. Non vital infrastructure fails. Lights, billing, banking systems, power to towns, cities.
4. Vital infrastructure fails. Contractor grade networks on dual use networks fail.
5. Mil communications, mil networks fail. Special forces per city cant be tasked on existing mil networks. Surveillance of interesting people in real time stops. Voice print tracking fails and really interesting people in the community are no longer been tracked in real time.
The most secure mil/gov/industrial sites can no longer report in on standard gov/mil networks in real time.
Domestic spying is now "Benign Information Gathering"
Anyone could predict that. Is that his only job?? Take up media time predicting the obvious?
OK, apart from this Levy guy being a tier one nut job, and his goal is primarily to get more powers and money after showing repeated signs of incompetence, what kind of attack does he expect?
Maybe something that exposes important information to the public that would totally destroy confidence in a government or institution?