CyberWire Daily - Attribution issues: one story fizzles; another looks disappointingly circumstantial. Great powers jostle in cyberspace. Hacktivists resurface online. So, alas, do terrorists.

Episode Date: January 3, 2017

In today's podcast, we follow the way in which the Vermont utility hacking story fizzled. We also hear more serious grounds for concern about electrical grid security continue from Joe Weiss of Applied Control Solutions. Observers are disappointed by the Grizzly Steppe Joint Analysis Report—its evidence strikes many as mighty circumstantial. US-Russian cyber strategies and cyber diplomacy. Anonymous greets the Bilderbergers. ISIS claims responsibility for recent massacres as part of its online inspiration. Level 3 Communications' Dale Drew provides his take on the coming year. German police believe they've stopped a Saarland bomb plot. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindelet.com slash N2K, code N2K.

That Vermont utility hacking story fizzles, but grounds for concern about electrical grid security continue. Observers are disappointed by the grisly step joint analysis report. It strikes many as mighty circumstantial. U.S.-Russian cyber strategies and cyber diplomacy. Anonymous greets the Bilderbergers. And ISIS claims responsibility for recent massacres as part of its online inspiration. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Tuesday, January 3, 2016.

We start the new year with a story that flared briefly, only to be effectively debunked. It's a useful cautionary tale about the risks of hasty attribution. At the end of last week and last year, the Washington Post ran a much-quoted and widely redistributed story reporting that Burlington Electric, a utility in the northern New England state of Vermont, had been hacked by Russian intelligence services. A very disturbing story, but it's also a good news, bad news story. First, the good news. Essentially, the hacking story is bogus, based on misreading some evidence, dark hints drawn from official U.S. sources and then misunderstood,

some inflammatory headline writing, and what other media outfits are calling a breakdown in fact-checking. The initial story said, essentially, that no one less than Fancy Bear herself was in the Vermont power grid and holding the northern part of that small state at risk. But on further reflection, and with further investigation, people concluded that here's what actually seems to have happened. An employee's laptop, not connected to grid controls, turned up a warning that it might have connected to a suspicious IP address,

one associated with, but not exclusively used by, threat actors. Burlington Electric isolated the device from its networks and inspected it for indicators of compromise. And they found some, specifically signs of the Neutrino exploit kit. Neutrino has been associated in the past with Russian intelligence services, but it's also been associated with lots of other threat actors as well, most of them ordinary criminals. Neutrino is freely bought and sold in the cyber

black market, so this is, to put it mildly, very circumstantial evidence at best of the Russian hacking initially reported and vigorously denounced. And in any case, the laptop wasn't connected to control networks and was quickly isolated. It appears unlikely in the extreme that this infection will be leaving Vermonters shivering in the dark this winter. That's the good news. The bad news in this story, as media outlets from Forbes to The Intercept haven't been slow to point out, is that for all the concern about fake news, especially bogus rumors spread in the case of advocacy or information operations, it would appear the media gatekeepers could do with upping their fact-checking game.

Joe Weiss is managing partner of Applied Control Solutions. He's a well-respected and sometimes outspoken voice in the world of industrial control systems. While he agrees the most recent incident in Vermont has been misreported, there's still reason for concern. D.O.E. and DHS all initially claimed that the 2015 Ukrainian cyber attack could not happen here, which is obviously wrong. Can it happen here? Of course it can. The electric industry, and that includes nuclear, has made cybersecurity a compliance exercise, not a real security or risk event. So the very first thing that has to happen is really senior management, whether it's in the utilities or the government, et cetera, has to take control system cybersecurity as

seriously as they do IT security, and they do not. You need to really understand what you have installed. One of the things that the NERC SIPs allow, and there are both political and regulatory or, if you will, legislative reasons, the electric distribution systems are outside the scope of any of the cybersecurity standards. That was because of the Energy Policy Act of 2005. All electric distribution is excluded from any of these cybersecurity standards. That obviously doesn't make sense. What NERC has done has come up with all kinds of exclusions and scoping issues

to take out the bulk of these assets for even being considered critical so they don't even have to be looked at. So before you even ask anything about technical, you have to first get people to understand and believe it's real and be willing to take action and provide budget and to address security for the sake of security and not to say I've checked a box off on a NERC SIP compliance sheet. And then the next thing that has to happen is you need to train and cross-train the control system engineers and the IT people because neither can do this in a vacuum. And one of our major, people because neither can do this in a vacuum. And one of our major, major, major problems today is IT is not reaching out and working with control system people. And cyber is viewed

strictly as a network issue. And in the control system world, cyber is much more than just the network. So until you have the appropriate training, you can't get there from here. That's Joe Weiss from Applied Control Solutions. Americans aren't alone in getting the willies about malware in the power grid. The Hurriyet Daily News reports anonymous officials in Turkey's energy ministry

as saying they think they see signs of attempts to disrupt electrical distribution in Istanbul and other parts of the country. Some outages are weather-related, but they're also investigating the possibility of an attack. Thug or not, Vladimir Vladimirovich has certainly got into the head of the main enemy. That would be you, Americans, and of course we include us, as in you. Russian disinclination to retaliate for U.S. expulsion of Russian diplomats last week is drawing generally favorable notices, albeit begrudgingly ones. Security analysts tend to agree that while it's reasonable to conclude

there were GRU and FSB intrusions into U.S. political party networks during the election season, the voting itself was not manipulated. The U.S. intelligence community has high confidence in its attribution of the hacks to Russian intelligence services, but last week's FBI and NCCIC joint analysis report on Grizzly Step draws tepid reviews, its case seen by many as disappointingly circumstantial. So few serious observers doubt that the Russians were up to something,

but the information contained in the joint analysis report is regarded as heavy on best practice advice and light on dispositive evidence. If the intelligence community has the smoking gun, people aren't smelling the cordite in the report. Senator McCain is convening a hearing on Russian hacking this Thursday, and President-elect Trump says that he knows things other people don't, and suggests he'll share some of what he knows shortly.

ISIS, alas, hasn't gone away. Over the weekend, the caliphate resumed its long-familiar reporting of propaganda of the deed, claiming responsibility for massacres in Istanbul and Baghdad. The declared motive of the former was revenge against Turkey. The Baghdad bombing was intended to simply kill a gathering Shia. German police appear to have interdicted another bombing plot in the Zarland, arresting an ISIS adherent on the basis of his online attempts to coordinate attacks. And finally, Anonymous has resurfaced in the new year, defacing a Bilderberg Group website to demand a change of heart

from the Bilderbergers' elite membership. A resolution to work for the common good as opposed to one's narrow self-interest would doubtless be a good one for all of us, but we don't know whether a threatening defacement will have the desired effect. Perhaps we'll hear an update from the Bohemian Grove sometime this summer. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security,

but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Thank you. And I'm pleased to be joined once again by Dale Drew.

He's the Chief Security Officer at Level 3 Communications. Dale, it's a new year. 2017 is here. What's your outlook for the coming year? Job security. You know, I think 2017 is... What I really like about 2016 and the direction that we're heading in is this notion that behavior analytics, AI and machine learning sort of elements, people really are beginning to recognize the value of that. Not only as an independent capability, but as it enhances existing security technology. And what I love about that is that we couldn't agree more. We really think that machine learning and behavior

analytics to be able to detect things that you've never seen before in ways you've never seen it before, and then tying that knowledge directly into all of your existing security infrastructure is going to be the thing that is going to have a step function above anything else in protecting enterprise assets and critical infrastructure capability. things like machine learning into a buzzword or from a buzzword into a more practical product capability that is embedded in a vast majority of our security technology. So that one, I think, is going to be an amazing 2017 trend. And I look forward to that one. I think the other trend that we're going to see is IoT. I think that we've seen a significant explosion in bad guys just embracing IoT in a malicious way, right? We see that there are no security solutions for IoT. There is no endpoint protection. There's no intrusion detection. There's no nothing,

and there's no standards. And so the bad guys have found that when they gain access to an IoT device, they have a much longer life on those devices before they are detected. And so they've really come to embrace. And frankly, they have created a step function in evolution in bot control because their bots are now capable of controlling millions of endpoints as opposed to just thousands of endpoints. And that's all because of this sort of attraction to IoT. So we really think that the bad guys are going to be doing significant research in IoT exploits. It's going to cause a significant amount of reaction from the community, especially in the IoT space, to react to all these security threats until we can get a lot more proactive. Because it's not the same, we're not solving for new problems in IoT. It's

the exact same problems we've solved in every other computing platform. It's just the need to package that in a smaller device capability. I think it's going to be the challenge for us this year. All right, Dale Drew, thanks for joining us. The board-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire.

We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy.

Learn more at ai.domo.com. That's ai.domo.com.