Brother can you spare $100,000,000?

File this under “It really is less expensive to prevent an attack then to pay for cleaning up an attack”

Pentagon spends $100 million to fix cyber attacks

WASHINGTON – The Pentagon spent more than $100 million in the last six months responding to and repairing damage from cyber attacks and other computer network problems, military leaders said Tuesday.

Air Force Gen. Kevin Chilton, who heads U.S. Strategic Command, said the military is only beginning to track the costs, which are triggered by constant daily attacks against military networks ranging from the Pentagon to bases around the country.

“The important thing is that we recognize that we are under assault from the least sophisticated — what I would say the bored teenager — all the way up to the sophisticated nation-state, with some pretty criminal elements sandwiched in-between,” said Chilton, adding that the motivations include everything from vandalism to espionage. “This is indeed our big challenge, as we think about how to defend it.”

According to Army Brig. Gen. John Davis, deputy commander for network operations, the money was spent on manpower, computer technology and contractors hired to clean up after both external probes and internal mistakes. Strategic Command is responsible for protecting and monitoring the military’s information grid, as well as coordinating any offensive cyber warfare on behalf of the U.S.

Officials would not say how much of the $100 million cost was due to outside attacks against the system, versus viruses and other problems triggered accidentally by Defense Department employees. And they declined to reveal any details about suspected cyber attacks against the Pentagon by other countries, such as China.

Speaking to reporters from a cyberspace conference in Omaha, Neb., the military leaders said the U.S. needs to invest more money in the military’s computer capabilities, rather than pouring millions into repairs.

“You can either pay me now or you can pay me later,” said Davis. “It would be nice to spend that money proactively … rather than fixing things after the fact.”

Officials said that while there has been a lot of anecdotal evidence on the spending estimate, they only began tracking it last year and are still not sure they are identifying all the costs related to taking computer networks down after a problem is noticed.

The Pentagon has acknowledged that its vast computer network is scanned or probed by outsiders millions of times each day. Last year a cyber attack forced the Defense Department to take up to 1,500 computers off line. And last fall the Defense Department banned the use of external computer flash drives because of a virus threat officials detected on the Pentagon networks.

The cost updates come as the Obama administration is completing a broad government-wide review of the nation’s cybersecurity.

 

The Ancient Art of Cyber-Warfare Pt. 1

 

Over the weekend while listening to my Zune, an audio book of The Art of War started playing.  It had been awhile since I had actually listened to it, so I sat back grabbed a soda and let it played.  For those of you not familiar with this book let me give a brief overview.  Written sometime between 500 – 350 BCE the Ancient Art of War was written by the legendary Chinese General Sun Tzu.  Written as a military strategy guide for his officers, the Art of War has flourished for twenty five centuries.  Listing the military leaders who are considered students of Sun Tzu would sound like a history lesson. Napoleon, Lord Cornwallis, Gen Patton, Dwight Eisenhower, and Gen Colin Powell.  Recent readers include business professionals who incorporate the strategies into their “Business Conquests”.

Fighting for the King of Wu, Sun Tzu fought in a violate time when the provinces of what would become China were constantly at war with one another.  Losing a battle could mean the end of your province.  Therefore The Art of War conveys a win at all cost attitude, which I don’t believe is useful for many aspects of business.  In the realm of Cyber-Security though I believe we find an exception.  We have a real threat of forces that want to defeat us in order to obtain, sabotage, or destroy our treasures. Unlike sales, where you win one you lost one is a fact of life, in defending our company against cyber threats we must maintain a defend at all cost attitude.  We never know if the next incursion will be the blow that you or your company cannot bounce back from.

Throughout the next few post we’ll examine the strategies of Sun Tzu and delve into how we can use them in designing our Cyber strategies.

Lesson 1 – It’s not a matter of if, but when…

The art of war teaches us to rely not on the likelihood of the enemy’s not coming, but on our own readiness to receive him; not on the chance of his not attacking, but rather on the fact that we have made our position unassailable.

- Sun Tzu- Sun Tzu “The Art of War” 500 BCE

Growing up my father used to say “There are two certainties in life, death and taxes”.  I want to add a third, your network will be attacked.  In this day and age your network is under attack constantly.  The average network will be attacked hundreds if not thousands of times in a given day.  Your network is your modern castle and you are definitely under siege.  Yet I still hear business owners and IT professionals say something like “We don’t have to worry about cyber security; A. we’re too small of a company B. we don’t have any sensitive data C. we’re located in the middle of nowhere D. add your own lame excuse. 

First things first, most attacks are random.  From the internet side of things, you are an IP address.  It doesn’t matter if you are a stock firm in New York or a Farm store in Nebraska you connect to the same public network where scans for vulnerabilities are consistently being performed.  At Parameter our testing network drops a scan from the internet about once a minute.  That’s nearly 1500 scans a day.  Most attackers will hack first and if successful they will then look for their spoils, financial data, employee information, or even create a platform for future attacks on other systems, it doesn’t matter your system has been breached and your reputation has been tarnished.

The art of war teaches us to understand that we will be attacked; therefore we must focus on successfully detecting, evading, and repelling any attack that comes our way.  We must understand that no network is impenetrable. We must know our network’s weaknesses and if we cannot mitigate those dangers we must ensure we can detect any attempt to exploit the vulnerabilities and respond quickly.

Identify your companies “treasures” and ensure the proper defenses are in place.  If you do not know your treasures, cannot detect attempted attacks, or don’t employ defense in depth, you have no choice but to admit defeat and assume your treasure has been stolen.