Five Eyes Intelligence Chiefs Point The Finger

Western countries are naming cyber-attacks by other countries. One of the ideas behind naming and shaming is to discourage cyber-attacks and to encourage potential victims into improve their cyber security strategy and tactics, according to 5Eyes Intel leaders.

Intelligence experts from the Five Eyes Intel group, which is the UK, the USA, Canada, Australia and New Zealand, spoke at CYBERUK 19, the National Cyber Security Centre's (NCSC) cybersecurity conference in Glasgow, in an unusual public discussion.

Recently the Five Eyes have accused some countries of cyber-attacks, such as North Korea and Russia of NotPetya. They group have also accused the Iranian and Chinese governments of hacking.

"There's a small set of nations who are not behaving within international norms," said Rob Joyce, senior cybersecurity advisor for the USA's National Security Agency. 

"If you look at the countries that have blatantly come out and attacked other countries in cyberspace, countries who are stealing wealth to avoid sanctions, literally bank-robbing in the cyber realm, it's a small group, you can name them on one hand," he said.

Joyce said Five Eyes members have "got to get comfortable as nations going out and saying these countries are behaving in a way that's unacceptable and turning up that pressure," adding, "we won't get international norms without being able to speak that truth".

"An important enabling component for making like-minded coalitions is bringing that intelligence forward, doing that attribution and having a specific entity that we have to rally around and deter," said Joyce.

"If we're not talking about the bad actors in this space, we're not going to be able to rally and bring the coalitions, and it's much wider than the Five Eyes."

Some question what real impact calling out attacks in this way can have, but Ciaran Martin, CEO of the NCSC, argued that it makes a difference.

"Do any of us do attribution for its own sake? No, we do it as a means to an end and that end being better cybersecurity and better national security," he said, arguing that it "sometimes" alters the behaviour of attackers, although he did not discuss how this happens. 

Martin told the Glasgow audience that attribution also plays a role in helping organisations protect against potential attacks.

"It matters because we're trying to tell people how to understand risk. So it does help to be able to say what are the Russians interested in, what sort of attacks do they do, what sort of organisations and assets do they tend to be interested in, the same as the Chinese? They're not the same," he said.

"That means you can frame your defence, because some people need to be worried about one country over another, some need to be worried about organised crime, some need to be aware about all of them"

Ultimately, Martin explained, attributing a threat to a particular nation state or malicious actor appears to provide additional incentives for organisations to act on information on how to protect against coming cyber-attacks.

"When we used to put out anonymised, non-attributable attacks, we'd say we'd seen something somewhere and this is how you can fix it, you can get a certain response. When you say this is Russia, you get a bigger response and that does matter," he said.

For all of the Five Eyes nations, attribution is a big deal and the intelligence agencies will only issue public accusations about cyberattacks if they're confident about their conclusions, it's why the official attribution of WannaCry to North Korea only came over six months after the global ransomware attack.

"We'll only attribute an attack to another country if it's within our own national interests to do so," said Jan Thornborough, unit manager of outreach and engagement at New Zealand's National Cyber Security Centre, making four attributions in 18 months.

"We took a lot of time to think about what it means for the country and we were very considerate in the approach," she added.
Australia takes the same approach, ensuring that all the pieces of the puzzle have been put together before public attribution is made.

"Attribution is not trivial: there are people who think they understand attribution and can pull something out and just say something. It's not that easy. We need time for an attribution, it's a very, very high bar for us," said Scott McLeod, first assistant director-general at Protect, Assure & Enable.

Scott Jones, head of the Canadian Centre for Cyber Security, agreed with the idea that attribution must be solid before action is taken. "The bar is very high. We set the bar high for ourselves because we have to have extremely high confidence," he said.

Canada's approach to attribution is the same as that of the US, engaging in order to warn about the actions of nations who are engaging in aggressive behaviour in cyberspace. "The key thing is to say no, this is too far: this is going into a space where this is unacceptable," Jones said.

ZDNet:

You Might Also Read: 

Five Eyes Spies Turn To Commercial Innovation:

 
 
 
« AI Will Shape The Future 6G Network
Cybercrime Cost US Business $2.7B In 2018 »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

International Association for Cryptologic Research (IACR)

International Association for Cryptologic Research (IACR)

(IACR is a non-profit scientific organization whose purpose is to further research in cryptology and related fields.

Heimdal Security

Heimdal Security

Heimdal Security provides proactive protection against cyber threats including ransomware, exploit kits and financial malware.

CybergymIEC

CybergymIEC

CybergymIEC is a global leader in cyber defense solutions and training services.

Zanasi & Partners

Zanasi & Partners

Zanasi & Partners is a security research and advisory company active in the EU and MENA areas. Services focus on technology solutions.

Internet Storm Center (ISC)

Internet Storm Center (ISC)

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with ISPs to fight back against the most malicious attackers.

Egis Technology

Egis Technology

Egis specializes in the IC design, research and development, and the testing and sales of capacitive fingerprint sensor.

AntemetA

AntemetA

AntemetA specializes in network infrastructure, security and cloud computing, helping companies transform their Information Systems.

Viscount Systems

Viscount Systems

Viscount Systems is a global security software solutions company that is changing the way access control is deployed and managed in the enterprise.

Cyber Intelligence (CI)

Cyber Intelligence (CI)

Cyber Intelligence is an award winning 'MSC status' cyber security education and training company.

International Accreditation Forum (IAF)

International Accreditation Forum (IAF)

The IAF is the world association of Conformity Assessment Accreditation Bodies. Its primary function is to develop a single worldwide programme of conformity assessment.

ThreatSwitch

ThreatSwitch

ThreatSwitch a software platform for cleared federal contractors to get and stay compliant with NISPOM and Conforming Change 2.

Blackfoot Cybersecurity

Blackfoot Cybersecurity

At Blackfoot, we work in partnership with you to deliver on-demand cyber security expertise and assurance, keeping you one step ahead of threats & compliant with regulations.

AVANTEC

AVANTEC

AVANTEC is the leading Swiss provider of IT security solutions in the areas of cloud, content, network and endpoint security.

StrikeReady

StrikeReady

StrikeReady have developed CARA, an advanced technology solution that offers personalized and proactive assessment and remediation of future and current risk in real-time.

Interos

Interos

Interos is the operational resilience company — reinventing how companies manage their supply chains and business relationships — through a breakthrough AI SaaS platform.

Index Engines

Index Engines

Index Engines is the world’s leading AI-powered analytics engine to detect data corruption due to ransomware.