[ISN] What CSOs can learn from Estonia

From: InfoSec News (alerts@private)
Date: Fri May 23 2008 - 00:13:43 PDT


By Bill Brenner
Senior Editor
May 20, 2008

It's been a year since the Baltic nation of Estonia wilted under the 
assault of coordinated cyber attacks and the country seems to have 
bounced back. In fact, NATO recently announced it will set up a cyber 
defense center there to research and help fight cyber warfare. In this 
Q&A, security researcher Gadi Evron reflects on his experiences after 
being called to Estonia to help investigate the attacks, and what other 
nations and private entities could learn from it all.

CSO: When you reflect on what happened in Estonia, what do you see as 
the big lesson for other nations?

Gadi Evron: Say, by some miracle, you have not yet experienced an attack 
via the Internet even though you have an Internet-based critical 
infrastructure. You can no longer say that it won't happen simply 
because it hasn't happened yet. The biggest lesson is that in today's 
ball game, the player can be the kid next door as much as it can be the 
big bad neighboring country. Work on your incident response capability 
with the private sector, because when you get hit you won't have time to 
address it at that point.

CSO: Since those attacks, have there been any similar incidents to your 

Evron: Several countries have publicly admitted to being attacked 
online. Most of these attacks are of the quiet,spying type. As to large 
incapacitating DDoS attacks, they happen daily on the Internet and 
impact the whole net unlike these spying incidents. I am not aware of a 
major country-debilitating DDoS attack since Estonia, though.

CSO: You've described the Estonian incident as a cyber riot rather than 
a case of nation-sponsored cyber terrorism. Do you think all the 
speculation about nation-sponsored attacks was overblown?

Evron: It was a riot because the online populace was energized to be the 
foot soldier. It was an organized attack, but whether by some ad-hoc 
group of individuals or not, I cannot say based on the technical data 
alone. Whether it was Russia or not, [the country] knew how to play the 
political game afterwards and achieved a high level of deterrence 
against the former Eastern-block countries at virtually no cost.

CSO: You mentioned in your Black Hat presentation last year that you 
headed to Estonia with images of the fictional nation of Elbonia from 
the "Dilbert" comic strips, where, as you noted, mud is the main export 
and babies are born with beards. But you said you were pleasantly 
surprised by what you found instead.

Evron: That stuff [from the presentation] was a joke. I was mainly 
concerned about visiting because of the cyber fraud activity happening 
there and the damage the criminals can suffer at the hands of people 
like me. I found a beautiful country with a very relaxed and fun 
culture. Their attitude was that if there were problems they wanted to 
talk about them and fix them.

CSO: If you could offer three pieces of advice to government or private 
entities hoping to avoid such attacks, what would it be?

Evron: Don't panic. Accept that the threat is there. Don't jump to 
solutions such as just better funding or adopting a cold-war strategy. 
On a practical note, though, establishing a country-wide incident 
response capability is important. Open channels to the private sector. 
Treat the Internet as insecure in your design when you build new 
infrastructure around it.

CSO: You live in the West Bank, and when you mentioned your initial 
mental picture of Estonia in that talk last year, it was easy to see how 
the TV news can give a distorted picture of cetain places that don't 
neccesarily reflect the reality of the situation. Do you think your 
corner of the world gets a bad rap when it comes to the overall security 

Evron: The reputation is understandable [but] the reporting is mostly 
biased and even plain-out wrong on both sides. This is true not just for 
the local situation but for computer security and anything else I've had 
the chance to be privy to and then later see reported in the news.

Copyright CXO Media Inc.

Attend Black Hat USA, August 2-7 in Las Vegas, 
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings 
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.  
Visit product displays by 30 top sponsors in 
a relaxed setting. http://www.blackhat.com

This archive was generated by hypermail 2.1.3 : Fri May 23 2008 - 00:30:33 PDT