How to Choose the Right Cybersecurity Solution REGISTER >
SAN FRANCISCO If anyone came to the RSA Conference this week expecting to hear technology was winning the war against cyber threats, they'd be sorely disappointed. Just as Homeland Security Chief Janet Napolitano did the previous day, FBI director Robert Mueller told an audience here at the conference that the U.S. risks falling dangerously behind in the fight against cyber criminals.
Noting the breadth of attacks by numerous criminal organizations here and abroad, Mueller said our computer systems are suffering "death by a thousand cuts, bleeding data, bit by bit and terabyte by terabyte," as he put it.
"We're playing cat and mouse and the mouse seems to be ahead most of the time," the FBI director continued. "We have to make the cost of business too expensive for them."
Wednesday, Napolitano urged that more and faster progress needed to be made to shore up the nation's cyber defenses. She said it's crucial the Department of Homeland Security evolve. "We don't live in a static world and ... we have to prepare for disasters from any source. The threats to cybersecurity are threats to our homeland," she said.
Like Napolitano, Mueller underscored that challenges remain and also ticked off a number of accomplishments and progress his department has made fighting cybercriminals.
He said Spain's apparent takedown of the group behind the Mariposa botnet that affected 13 million PCs was an example of the FBI's cooperative efforts with other governments. "This case emphasizes the need for global cooperation," he said, noting the FBI now has 60 attaché offices around the world working with other governments and institutions.
Mueller also said the FBI has had to advance how it tracks and identifies threats as the methods have evolved. "In recent years there's been a new trend where [hackers] are going after a collection of seemingly innocuous data in things like e-mail and Powerpoint that they're using to spear phish and contact employees."
"Spear phishing" attacks use personalized spam e-mail that appears to come from a trusted friend or colleague, but clicking on a link within the e-mail launches malware or other malicious software.
"If hackers make subtle changes to your code, it could give them permanent access to everything you do," warned Mueller.
FBI: Cooperation will pay off
Mueller acknowledged that large companies and other parts of the private sector have historically been leery of cooperating with the FBI when their security's been compromised, but he said such cooperation is crucial to solving such cases.
He recalled that hackers were recently able to create 400 fake ATM cards and steal more than $10 million dollars across 280 cities in a 24-hour period. "It was a revolutionary attack in terms of sophistication and its success," he said.
But because the companies affected quickly reported the crime to the FBI, the agency was able to deploy mobile teams that included experts in digital forensics and malicious code. "And we worked with our counterparts in the Secret Service and alerted private sector partner to make patches to the affected systems," said Mueller. "Today the top three actors in that case are in custody in Eastern Europe.
"If these companies didn't come forward, we wouldn't have found the perpetrators before they made another attack," Mueller added. In asking for the private sector's help, he said, "There's been a great divide between us, but it doesn't need to be there. You may believe that by notifying the FBI you may be hurting your competitive position. The last thing we want to do is victimize you a second time.
"We will minimize disruption to your business and will seek protection of any trade secrets and the means and methods of attacks," he said.
While some high-profile cases may have resulted in bad publicity for the companies affected, Mueller said the FBI primarily works behind the scenes. "For every investigation in the news, there are hundreds of others that never make the headlines."
Companies stay quiet at their peril, Mueller added. "Maintaining a 'cone of silence' will not protect you in the long run."