Can Corporations Really Defend Against Nation-State Cyberattacks?

The former CEO of Yahoo says Russian hackers are too sophisticated for the private sector to handle—and some in Congress agree.

Former Yahoo! Chief Executive Officer Marissa Mayer, (second from right) listens as Paulino do Rego Barros, Jr., (left) interim Chief Executive Officer of Equifax, Inc., answers a question as he testifies before the Senate Commerce Committee on Wednesday Richard Smith (second from left) former chief executive officer of Equifax, Inc., and Karen Zacharia (right), deputy general counsel and chief privacy officer at Verizon Communications, Inc., listen.
AP Photo/Susan Walsh
Nov. 9, 2017, 8 p.m.

During Wednesday’s Senate Commerce Committee hearing on the recent high-profile data breaches at Yahoo and Equifax, ranking member Bill Nelson declared that top-tier U.S. companies are little more than sitting ducks for America’s foreign adversaries in cyberspace.

“At this point I’m wondering if there’s no such thing as data security,” the Florida Democrat told Marissa Mayer, the former chief executive of Yahoo, and the current and former chief executives of Equifax, all of whom had been called to testify. “When you think of a sophisticated state actor such as China or Russia, your companies can’t stand up against them. The only person, or institution, that can stand up against them is the National Security Agency.”

“There’s going to have to be a cooperation between the most sophisticated player in the United States—which is the NSA—and you all,” Nelson continued. “Otherwise we—Americans—are not going to have any more privacy.”

Mayer backed up the senator’s assertion. “Even robust defenses and processes are not sufficient to protect against a state-sponsored attack, especially one that’s extremely persistent and sophisticated,” the former CEO said. Over four years after an attack backed by the Russian government compromised around 3 billion Yahoo accounts, Mayer said the company still isn’t sure how the hackers penetrated Yahoo’s network defenses. And unconfirmed reports that the Equifax hack was also perpetrated by a nation-state continue to percolate.

It’s become commonplace to see executives from companies hit by cyberattacks trudge to Capitol Hill, preparing for a browbeating as lawmakers berate them on behalf of victimized constituents. But when attackers are able to marshal the skills and resources of some of the most powerful nation-states on the planet, does it really make sense to blame the C-Suite? If not, is the U.S. government in a position to pick up the slack? And do companies even want them to?

If Russia or China really want to steal data from American companies, most cybersecurity experts say there’s not a corporate cybersecurity system in the world that can stop them. “When we’re talking about the top-tier, the upper echelon of nation-states out there that have very sophisticated programs—if their goal is to get in and they really want to do it, they’re going to find a way to get in,” said David O’Brien, a senior researcher at Harvard University’s Berkman Klein Center for Internet and Society.

But that doesn’t mean U.S. companies should throw up their hands and hope Uncle Sam can save them—or even that they’re incapable of defeating most nation-state attacks. “Not all operations of the most sophisticated states are going to be tasked to the A team,” said Tim Maurer, the codirector of the Cyber Policy Initiative at the Carnegie Endowment for International Peace. “And that means some of the companies—including Yahoo and some of the wealthiest companies on the planet—are able to defend against even some state-sponsored activity from some of the most advanced states.”

While Yahoo allegedly still doesn’t know if Russian-backed hackers penetrated their systems, the indictment and arrest of several of the perpetrators means other facts about the attack are public record. According to those documents, Russian intelligence agents contracted the Yahoo hack out to criminals, whom they allowed to make money from the attack on the side. Cybersecurity experts say that’s common practice for both Russia and China, whose “A teams” are often too busy targeting Western governments to hit corporate targets.

Maurer and O’Brien both believe that the success of the Russian-backed attack on Yahoo was largely due to weaknesses in the company’s security system—particularly its lack of segmentation, which allowed the hackers to access all of Yahoo’s networks after breaking into just one. “I wouldn’t consider integration with government agencies the panacea to what I think we’ve seen in the past two years, in that a lot of companies still don’t take even basic cybersecurity defense seriously enough to raise the bar,” Maurer said.

Still, some experts see an opening for greater government oversight if foreign adversaries continue to breach high-profile targets. Nelson’s proposal to integrate the NSA into the security systems of private networks sounds aggressive, but O’Brien says similar ideas have been discussed for years in the cybersecurity community. The Homeland Security Department’s EINSTEIN system now runs across most of the federal government, working to detect and block network intrusions in real time. “There’s been some debate about, well, should we deploy it on private networks too?” said O’Brien, explaining that intelligence analysts could monitor traffic on private networks deemed critical infrastructure and work quickly to shut out anomalies before sensitive consumer data is stolen.

But a government foray into the private sector’s cybersecurity networks would undoubtedly run up against opposition from across the spectrum—particularly from privacy advocates. Eva Galperin, the head of cybersecurity at the Electronic Frontier Foundation, said Nelson’s proposal is driven by “absolute ignorance about the landscape, and a lot of people spreading fear, uncertainty, and doubt.”

“It’s extremely common in Washington to believe, because Washington is the center of government, it is the answer to all of our problems,” Galperin added.

And even while some companies bemoan their vulnerability when faced with aggressive nation-states, most aren’t keen to give U.S. security agencies greater access to their systems. “What we’ve heard sort of collectively from the industry is they’re not very interested, at least at this point in time, in the government moderating their networks,” said O’Brien. That’s particularly true for firms that operate internationally, where customers in Europe and Asia would worry that U.S. intelligence agencies could use their access to snoop on their own private activities.

For now, at least, Nelson’s idea of a direct government footprint in private networks looks unlikely to gain traction on Capitol Hill. When asked about Nelson’s remarks at the conclusion of Wednesday’s hearing, Senate Commerce Committee Chairman John Thune was noncommittal. “In a lot of the conversations that we’ve had in the past about data-breach legislation, the NSA hasn’t played a prominent role in those conversations,” he said. “So we’ll bat that around a little bit, but it’s something we’ll kind of have to take a look at.”

What We're Following See More »
Mueller's Team Down to 10 Lawyers
1 days ago

"Mueller’s team, once filled with 17 lawyers, will soon be down to 10. The special counsel’s office confirmed in recent days that Zainab Ahmad’s detail has ended, and Andrew Weissmann will soon be leaving for the private sector. No one has been charged by the special counsel since longtime Trump adviser Roger Stone was indicted in January for allegedly lying to Congress."

Rosenstein Not Leaving DOJ Yet
2 days ago
Prosecutors Weighing Whether to Charge Greg Craig
3 days ago

A long-running federal investigation into former Obama White House counsel Gregory Craig "is reaching a critical stage, presenting the Justice Department with a decision about whether to charge a prominent Democrat as part of a more aggressive crackdown on illegal foreign lobbying." Federal prosecutors in New York have transferred the case to Washington. ... The investigation centers on whether Mr. Craig should have disclosed work he did in 2012 — while he was a partner at Skadden, Arps, Slate, Meagher & Flom — on behalf of the Russia-aligned government of Viktor F. Yanukovych, then the president of Ukraine. The work was steered to Mr. Craig by Paul Manafort."

Feds Raided Broidy's Offices Last Year
3 days ago

"Federal authorities raided the office of Republican fundraiser Elliott Broidy last summer, seeking records related to his dealings with foreign officials and Trump administration associates, according to a sealed search warrant obtained by ProPublica. Agents were authorized to use the megadonor’s hands and face to unlock any phones that required fingerprint or facial scans."

House Approves Resolution to Release Mueller Report, 420-0
1 weeks ago

"The House on Thursday overwhelmingly passed a resolution calling on the Justice Department to make special counsel Robert Mueller’s findings and full report public and available to Congress. The 420-0 vote came after a fiery debate on the House floor, during which some Democratic lawmakers were admonished for their criticisms of President Donald Trump. Republicans said the resolution was unnecessary and a waste of time, but ultimately joined Democrats to approve it. Four Republicans — Reps. Justin Amash of Michigan, Matt Gaetz of Florida, Paul Gosar of Arizona, and Thomas Massie of Kentucky — voted 'present.'"


Welcome to National Journal!

You are currently accessing National Journal from IP access. Please login to access this feature. If you have any questions, please contact your Dedicated Advisor.