Can Corporations Really Defend Against Nation-State Cyberattacks?

The former CEO of Yahoo says Russian hackers are too sophisticated for the private sector to handle—and some in Congress agree.

Former Yahoo! Chief Executive Officer Marissa Mayer, (second from right) listens as Paulino do Rego Barros, Jr., (left) interim Chief Executive Officer of Equifax, Inc., answers a question as he testifies before the Senate Commerce Committee on Wednesday Richard Smith (second from left) former chief executive officer of Equifax, Inc., and Karen Zacharia (right), deputy general counsel and chief privacy officer at Verizon Communications, Inc., listen.
AP Photo/Susan Walsh
Brendan Bordelon
Add to Briefcase
Brendan Bordelon
Nov. 9, 2017, 8 p.m.

During Wednesday’s Senate Commerce Committee hearing on the recent high-profile data breaches at Yahoo and Equifax, ranking member Bill Nelson declared that top-tier U.S. companies are little more than sitting ducks for America’s foreign adversaries in cyberspace.

“At this point I’m wondering if there’s no such thing as data security,” the Florida Democrat told Marissa Mayer, the former chief executive of Yahoo, and the current and former chief executives of Equifax, all of whom had been called to testify. “When you think of a sophisticated state actor such as China or Russia, your companies can’t stand up against them. The only person, or institution, that can stand up against them is the National Security Agency.”

“There’s going to have to be a cooperation between the most sophisticated player in the United States—which is the NSA—and you all,” Nelson continued. “Otherwise we—Americans—are not going to have any more privacy.”

Mayer backed up the senator’s assertion. “Even robust defenses and processes are not sufficient to protect against a state-sponsored attack, especially one that’s extremely persistent and sophisticated,” the former CEO said. Over four years after an attack backed by the Russian government compromised around 3 billion Yahoo accounts, Mayer said the company still isn’t sure how the hackers penetrated Yahoo’s network defenses. And unconfirmed reports that the Equifax hack was also perpetrated by a nation-state continue to percolate.

It’s become commonplace to see executives from companies hit by cyberattacks trudge to Capitol Hill, preparing for a browbeating as lawmakers berate them on behalf of victimized constituents. But when attackers are able to marshal the skills and resources of some of the most powerful nation-states on the planet, does it really make sense to blame the C-Suite? If not, is the U.S. government in a position to pick up the slack? And do companies even want them to?

If Russia or China really want to steal data from American companies, most cybersecurity experts say there’s not a corporate cybersecurity system in the world that can stop them. “When we’re talking about the top-tier, the upper echelon of nation-states out there that have very sophisticated programs—if their goal is to get in and they really want to do it, they’re going to find a way to get in,” said David O’Brien, a senior researcher at Harvard University’s Berkman Klein Center for Internet and Society.

But that doesn’t mean U.S. companies should throw up their hands and hope Uncle Sam can save them—or even that they’re incapable of defeating most nation-state attacks. “Not all operations of the most sophisticated states are going to be tasked to the A team,” said Tim Maurer, the codirector of the Cyber Policy Initiative at the Carnegie Endowment for International Peace. “And that means some of the companies—including Yahoo and some of the wealthiest companies on the planet—are able to defend against even some state-sponsored activity from some of the most advanced states.”

While Yahoo allegedly still doesn’t know if Russian-backed hackers penetrated their systems, the indictment and arrest of several of the perpetrators means other facts about the attack are public record. According to those documents, Russian intelligence agents contracted the Yahoo hack out to criminals, whom they allowed to make money from the attack on the side. Cybersecurity experts say that’s common practice for both Russia and China, whose “A teams” are often too busy targeting Western governments to hit corporate targets.

Maurer and O’Brien both believe that the success of the Russian-backed attack on Yahoo was largely due to weaknesses in the company’s security system—particularly its lack of segmentation, which allowed the hackers to access all of Yahoo’s networks after breaking into just one. “I wouldn’t consider integration with government agencies the panacea to what I think we’ve seen in the past two years, in that a lot of companies still don’t take even basic cybersecurity defense seriously enough to raise the bar,” Maurer said.

Still, some experts see an opening for greater government oversight if foreign adversaries continue to breach high-profile targets. Nelson’s proposal to integrate the NSA into the security systems of private networks sounds aggressive, but O’Brien says similar ideas have been discussed for years in the cybersecurity community. The Homeland Security Department’s EINSTEIN system now runs across most of the federal government, working to detect and block network intrusions in real time. “There’s been some debate about, well, should we deploy it on private networks too?” said O’Brien, explaining that intelligence analysts could monitor traffic on private networks deemed critical infrastructure and work quickly to shut out anomalies before sensitive consumer data is stolen.

But a government foray into the private sector’s cybersecurity networks would undoubtedly run up against opposition from across the spectrum—particularly from privacy advocates. Eva Galperin, the head of cybersecurity at the Electronic Frontier Foundation, said Nelson’s proposal is driven by “absolute ignorance about the landscape, and a lot of people spreading fear, uncertainty, and doubt.”

“It’s extremely common in Washington to believe, because Washington is the center of government, it is the answer to all of our problems,” Galperin added.

And even while some companies bemoan their vulnerability when faced with aggressive nation-states, most aren’t keen to give U.S. security agencies greater access to their systems. “What we’ve heard sort of collectively from the industry is they’re not very interested, at least at this point in time, in the government moderating their networks,” said O’Brien. That’s particularly true for firms that operate internationally, where customers in Europe and Asia would worry that U.S. intelligence agencies could use their access to snoop on their own private activities.

For now, at least, Nelson’s idea of a direct government footprint in private networks looks unlikely to gain traction on Capitol Hill. When asked about Nelson’s remarks at the conclusion of Wednesday’s hearing, Senate Commerce Committee Chairman John Thune was noncommittal. “In a lot of the conversations that we’ve had in the past about data-breach legislation, the NSA hasn’t played a prominent role in those conversations,” he said. “So we’ll bat that around a little bit, but it’s something we’ll kind of have to take a look at.”

What We're Following See More »
AND POLICE OFFICERS IN EVERY SCHOOL
Gov. Scott Wants to Raise Gun-Purchase Age to 21
1 days ago
THE LATEST
IN THE WAKE OF NEW CHARGES
Gates Expected to Plead Guilty, Cooperate with Mueller
1 days ago
THE LATEST

Former Trump campaign adviser Rick Gates is expected to plead guilty to a raft of new tax and fraud charges filed against him by special counsel Robert Mueller on Thursday. Gates is expected to cooperate with Mueller's investigation.

Source:
32 COUNTS
Mueller Hits Manafort, Gates with New Charges
2 days ago
THE LATEST

Robert Mueller announced new charges against former Trump campaign chairman Paul Manafort advisor Rick Gates. "The new indictment contains 32 counts, including tax charges." The pair had been indicted on 12 charges in October. Since then, Gates's attorneys have asked to be excused from the case.

Source:
SECOND TIME FBI FAILED TO ACT
FBI Failed To Act On Parkland Shooter Tip
2 days ago
THE DETAILS

The FBI has reported that it failed to respond to a warning from "a person close to" Nikolas Cruz, the teen accused of killing 17 people at Parkland High School on Thursday. "It was the second time the FBI apparently failed to follow up on Cruz." On the first occasion, it failed to properly investigate Cruz after it was reported to them that he left the following comment on a Youtube video: "Im going to be a school shooter."

Source:
FBI MISSED TIP ON PARKLAND SHOOTER
Florida Governor Calls on FBI Director to Resign
2 days ago
THE DETAILS

Florida Governor Rick Scott called on FBI Director Christopher Wray to resign following revelations that the FBI had failed to adequately investigate multiple warnings about Parkland High School gunman Nikolas Cruz. “The FBI’s failure to take action against this killer is unacceptable,'" said Scott. '...We constantly promote ‘see something, say something,’ and a courageous person did just that to the FBI. And the FBI failed to act.'" According to an FBI statement, the FBI failed to inform local offices of information regarding "Cruz's desire to kill people, erratic behavior, disturbing social media posts, as well as the potential of him conducting a school shooting."

Source:
×
×

Welcome to National Journal!

You are currently accessing National Journal from IP access. Please login to access this feature. If you have any questions, please contact your Dedicated Advisor.

Login