Cyber Cold War - Undeclared and unknown

This could be the story which finally brings the cyber war/corporate espionage into focus. To date, we have all read the articles regarding China-based hackers breaking in here or breaking in there. However, the "at least 760 companies" reference from this article suggests that this is not a "here or there" problem. It is more an "everywhere possible" problem.

Based on what is known of attacks from China, Russia and other countries, a declassified estimate of the value of the blueprints, chemical formulas and other material stolen from U.S. corporate computers in the last year reached almost $500 billion, said Rogers, a former agent for the Federal Bureau of Investigation.

Given Evizone's business, we regularly talk with companies regarding secure email, secure communications and secure documents. These discussions can lead to no decision and no change; leaving these organizations open to the loss of intellectual property through multiple means. Unfortunately, they often have difficulty quantifying something they haven't lost. However, this article suggests that they may be unaware that it has already been stolen.

Bloomberg, December 14, 2011 - China-Based Hacking of 760 Companies Reflects an Undeclared Cyber Cold War

...More worrisome, hackers might have used iBahn’s system as a launching pad into corporate networks that are connected to it, using traveling employees to create a backdoor to company secrets....Read further

Required reading

Normally I would skip over an article titled "9 Reasons Wired Readers Should Wear Tinfoil Hats". It conjures up images of The Lone Gunmen; the trio of conspiracy theorists/computer hackers from The X Files. If you feel the same urge to move past this article, don't!

For people and organizations who would like to keep private communications private, this is required reading. What is really surprising is simply the amount and variety of electronic information that can be gathered without the use of a warrant and without your knowledge.

Wired, November 24, 2011 - 9 Reasons Wired Readers Should Wear Tinfoil Hats

...If you’re already not wanting a dose of Prozac, consider that the law allows the government to obtain Americans’ e-mails, without a warrant, if it’s stored on some other company’s servers for more than six months....Read further

Secure information, secure workgroups and social media

Good article from the Wall Street Journal. Please click through and read.

There is a considerable gap between secure workgroup communication requirements and what a social network provides. Let's run through the requirements and see how social networks do.

One, copy and print protection so that recipients cannot copy, save, forward or print? Social networks are browser-based and everything posted can be copied or printed. Score an 'F' for social networks.

Two, effective organization and life cycle management of all secure communications is important for compliance reasons and potential eDiscovery efforts. When copy and print protection is missing, the effectiveness of message and document retention policies goes to zero. Just as conventional email gives correspondence an almost perpetual life, social networks take this further providing access to ever expanding list of contacts/friends. Score another 'F' for social media.

Three, control and audit for all communications. Within a secure workgroup, a user needs the ability to securely exchange files and view-only messages and documents to a known, typically small, group of users with a need to know. This includes the ability to withdraw messages and documents at any time with the ability to see who has read these communications and when. Social media scores another 'F' in this regard.

The implicit understanding of social media is that once posted, whatever you've posted will live forever; even if you remove it. So, if you are trying to protect something which must be shared, this is not the path to take.

Wall Street Journal, October 19, 2011 - Your Wall Has Ears

Today's corporate spies are increasingly likely to use malware and social media to steal sensitive data and intellectual property....Read further