DNI Threat Assessment - Practical Guidance for your Company
DNI Threat Assessment - Practical Guidance for your Company
Last week the Director of National Intelligence released a Worldwide Threat Assessment. It’s fairly short and to the point (only 42 pages), but I wanted to summarize for those who don’t have time to read it and help apply it to enterprise defense.
The main two things to take away from this report are:
- Threats: there are real threats against your organization, and
- Capabilities: it’s important to understand their capabilities.
Who they are, their motivations, and where they live is not important for most organizations.
The report says that China can conduct localized attacks such as “disruption of a natural gas pipeline for days to weeks.” The same is said for Russia with the example being “disrupting an electrical distribution network for at least a few hours – similar to those demonstrated in Ukraine in 2015 and 2016… with the long-term goal of being able to cause substantial damage.”
Next we have Iran who is listed with similar capabilities against corporations: “capable of causing localized, temporary disruptive effects–such as disrupting a large company’s corporate networks for days to weeks.”
The last example I want to call out is the threat against financial institutions which is nicely summed up in two sentences. “North Korea continues to use cyber capabilities to steal from financial institutions to generate revenue. Pyongyang’s cybercrime operations include attempts to steal more than $1.1 billion from financial institutions across the world–including a successful cyber heist of an estimated $81 million from the New York Federal Reserve account of Bangladesh’s central bank.”
While the target of attack varies, the common theme is that there are attackers out there who want to do things which don’t align with your organizations goals. This is not surprise, but it raises the question of what actions should an organization take to combat these threats?
One option would be adversarial-based defensive modeling which uses threat intelligence to guess which technical systems will be attacked next and focus efforts on these systems. This means enumerating attackers against your enterprise and their motivations, which will influence their choice of specific targets. If an attacker is missed or the motivation is not accurately understood, this strategy can fall apart. A skilled attacker is going to use this to direct efforts away from the systems which are valuable to them. Meanwhile the less skilled attackers are going to go after the weak points.
Instead, I propose largely ignoring who the attackers are, where they live, or what their motivations are. Decisions about where to prioritize security efforts should be based on what is important to your organization, not what it important to your adversaries! For example, your security people are already working on important projects to prevent the most damaging attacks (e.g. stealing money/IP). You hear about a criminal group mapping out your organization. Should you pull them off what they’re currently working on to deal with this threat? Of course not.
That’s not to say that the DNI reports are not useful. They are evidence that the threats are not merely hypothetical, and they describe some of the capabilities, which are important to understand to have a better idea of what “adequate” defenses look like. At the same time, there’s a risk of the reports to change the narrative from “we need to stop people from stealing money from us” to “how do we find out what North Korea is doing?” The former protects you from all attackers, where the latter only protects you from one, at best.
[About GRIMM: GRIMM engineers have decades of experience helping organizations identify what to protect and how to protect themselves.]
