CyberWire Daily - Daily: RSA updates. US opens anti-ISIS cyber offensive. Industry consolidation?

Episode Date: March 2, 2016

Daily: RSA updates. US opens anti-ISIS cyber offensive. Industry consolidation? Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. anomaly detection, and threat intelligence, with an explanation of what counts as actionable.

Elsewhere, the U.S. says it's going after ISIS communications in cyberspace. ISIS sets out to deface Google, but defaces something else. Analysts see cyber sector consolidation coming. And we talked to the University of Maryland's Marcus Roshecker on Apple's invocation of both the First and Fifth Amendments in their dispute with the FBI. I'm Dave Bittner in San Francisco with your Cyber Wire summary for Tuesday, March 1st, 2016. We're at RSA today, podcasting, and a bit late because we're on Pacific time in San Francisco, the city by the other bay, from the floor of the world's leading cybersecurity conference and exposition. We'll take a look at the conference's first day events, and we'll offer our customary rundown on cyber news from around the world. Yesterday's proceedings at RSA

culminated in the announcement of 2016's Innovation Sandbox winner. This year, Phantom Cyber carried the prize away with what it describes as the first purpose-built, community-powered security automation and orchestration. We'll have more with Phantom and their product later this week when we sit down for an exclusive interview. In the meantime, congratulations also to the other finalists who did very well indeed to come as far as they did. Bastille, Elusive, Menlo Security, Preovti, ProtectWise, SafeBreach, Skyport Systems, Vera, and Versa Networks.

Our talks with companies exhibiting at RSA suggest that some of the common themes on people's minds include the importance of context and actionability in the development of threat intelligence. A.J. Shipley from Looking Glass put it this way. What you see an abundance of is threat data, but it actually doesn't become intelligence until some really smart person who has years of experience and years of training is able to derive the little bits that are relevant to an organization or derive the little bits that are relevant to an industry that can also be handed to a person or a process or a technology that once handed to them and some action is taken, the overall risk to an organization has been materially minimized down to a certain level that is now tolerable. Attribution of attacks is generally regarded as less important, except insofar as it can reveal information about threat actors' motivations, tactics, techniques, and procedures,

and understanding these can usefully inform the organization of defenses. The number of people working on integrating anomaly detection into defensive schemes is also striking. We'll have more detailed accounts and interviews with some of the most interesting companies on the exhibit floor in an upcoming special edition of our podcast. Turning from RSA to the larger cyber world, the U.S. appears to have opened a major cyber offensive against ISIS. The Department of Defense announces that offensive cyber operations are now being undertaken against ISIS communications infrastructure in Syria. The direct and unusually public avowal of a cyber operations campaign is accompanied by suggestions that cyber attacks are being carried out

in conjunction with special operations forces working in the theater. U.S. Secretary of Defense Carter has also returned to California in a continuing effort to enlist the technical support of the IT industry in the war against ISIS. The caliphate itself hasn't been idle either, continuing information operations at which it excels, and cyber attacks against ill-chosen or poorly defended targets, at which it has been less than fully successful.

Choice of target continues to baffle observers. Recent victims have included a solar panel manufacturer in Sussex, and, as Newsweek notes, a Japanese dance instructor and a laminate flooring firm based in Wales. They've also defaced a company called AdGoogle Online, apparently mistaking it for the real Google. But there's no mystery to this, really. It's opportunistic hacktivism modulated by limited understanding of the target's culture. Apple has continued to prepare its brief in response to the FBI's request for assistance under the All Writs Act. That brief is widely expected to invoke the First and Fifth Amendments.

We spoke with University of Maryland legal and policy expert Marcus Roshecker, who explained the general outlines of Apple's expected arguments for us. We'll hear from him after the break. The FBI's case, incidentally, may have been weakened by a decision in a New York drug trial Thank you. ready to assume its expected place in cyber risk management. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in- time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility

into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity.

That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joining me is Marcus Roschecker from the University of Maryland Center for Health and Homeland Security. They're one of our academic and research partners. Marcus, the story continues with Apple and their efforts against the FBI.

This week, Apple's been making some arguments that are centered around the First Amendment and the Fifth Amendment. Fill us in on what's going on here. Apple has made some interesting arguments in their motion to vacate that court order. Part of the argument circles around the First Amendment argument. And this is quite interesting because there are some court decisions out there that equate computer code to speech. And if that is the case, what we're seeing here in this order that would compel Apple to write computer code to help the FBI get access to a phone would be equivalent to the government compelling speech from Apple. And that, of course, then becomes a First Amendment issue.

And when we have a First Amendment issue where government is compelling speech from an individual or from a group, there are some flags that go up right away. And specifically, if government is going to compel speech, there is a test that must be undergone. And you have to look at the request from the government and apply some strict scrutiny to this test and make sure that the request is narrowly tailored to obtain a compelling government interest. Apple is saying that while the government certainly has a compelling state interest in its request,

their request isn't reasonable in that there is no real evidence, Apple is saying, that what government might find on the phone that they're trying to access will actually be of any use. Furthermore, when government asks that Apple write software to access the phone, Apple is arguing that this is fundamentally contrary to the view that Apple holds, which is that privacy is an important value and data privacy for the devices and for the customers that it has ought to be protected. So Apple is arguing that this really is a viewpoint discrimination on the government's part, and therefore is unconstitutional. The request, the court order, would be unconstitutional

in violation of the First Amendment. So that covers the First Amendment parts of it, but Apple is also invoking the Fifth Amendment. That's correct. Apple is invoking the Fifth Amendment as well, and that is somewhat surprising. Some commentators had expected Apple to make a First Amendment argument, but now we're seeing Apple make a Fifth Amendment argument too. Apple is saying that the government request

to compel them to assist them into getting into the iPhone would be a violation of due process, which is guaranteed under the Fifth Amendment. Basically, Apple is arguing that it has a right to be free from arbitrary deprivation of its liberty from government. And Apple is saying that there are no statutory authorizations that would give government the power to ask of Apple what it is asking in this case. Furthermore, the request is highly burdensome on Apple, Apple is arguing. And finally, the request is fundamentally contrary to Apple's core beliefs about privacy. So given all these reasons, Apple is arguing that the request really is a violation of the Fifth Amendment's due process clause. So it's important for everyone to keep in mind that there's more at stake than this individual iPhone. I believe so. I mean, this is an argument that Apple has made all along, that if the court order is upheld to compel Apple to assist in accessing this iPhone in this

particular case, a similar court order would be requested on the government's behalf in other cases down the road. Marcus Roschekker, thanks for joining us. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one third of new members discover they've already been breached.

Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.