AND RESPONSE. Continuity Insights Conference Chicago June 18-19, Unclassified

Transcription

1 CYBER THREATS AND RESPONSE Continuity Insights Conference Chicago June 18-19, 2013 Unclassified OBJECTIVES Why it is important Threats, players, and response FBI s Next Generation Cyber Government and Private Sector Partnerships Examples 1

2 Why important? (End) Growing problem China s economic cyber espionage has not diminished in fact, it has grown exponentially both in terms of its volume and damage it is doing to our nation s economic future The technological and national security of the United States is at risk because some of our most innovative ideas and sensitive information are being brazenly stolen by these cyber attacks. Open hearing to the House Permanent Select Committee on Intelligence, February

3 6/17/2013 Times have changed... Mayhem circa 1984 and today. The Cyber Threat "Technology is moving so rapidly that in the future, we anticipate that the cyber threat will pose the number one threat to our country. - FBI Director, March 2012 There has been a nearly twenty (20) fold increase in cyber-attacks against American infrastructure targets between 2009 and US military assessment,

4 FBI Priorities 1. Protect the U.S. from terrorist attack 2. Protect the U.S. against foreign intelligence operations & espionage 3. Protect the U.S. against cyber based attacks &high tech crimes 4. Combat public corruption at all levels 5. Protect civil rights 6. Combat transnational/national criminal organizations and enterprises 7. Combat major white collar crime 8. Combat significant violent crime 9. Support federal, state, local and international partners 10. Upgrade technology to successfully perform the FBI's mission Major Players: State Sponsored Actors Organized Criminal Syndicates Terrorists Hacktivists 4

5 Examples of threats & attacks DDoS Account take overs PII loss Credit card information Trade secrets loss Defacement hackmageddon.com Target examples 5

6 DDoS: What are we talking about? A Denial of Service attack (DoS) or Distributed Denial of Service attack (DDoS) is a type of Cyber attack that attempts to make a computer or computer network unavailable to users. Simply put, the attack overwhelms a computer or computer network. Anatomy of a DDoS Compromised computers called Bots or Zombies Command & Control Servers Cyber Actor Victim Website 6

7 The new #1 threat? For the first time computer-launched foreign assaults on U.S. infrastructure was ranked higher in the U.S. intelligence community s annual review of worldwide threats than worries about terrorism attacks on Wall Street over last six months - August 2012 computer intrusion at Saudi Aramco - Local example(s) Los Angeles Times, March 12, 2013 FBI Cyber Division Mission: Coordinate, supervise and facilitate the FBI's investigation of those federal violations in which the Internet, computer systems, or networks are exploited. *The FBI is the lead domestic agency for National Security Cyber investigations. 7

8 Lanes in the road The FBI will often be the first responder because of our nationwide coverage. But the investigative team, at a minimum, should include the expertise of both DHS and NSA. In other words, notification of an intrusion to one agency should be and will be notification to all. FBI DHS USSS DOD NSA -Robert S. Mueller, III Partnerships Play a Critical Role Cyber Task Forces Private sector is essential Possess the information, expertise and knowledge as well as building the components of cyber security Examples: Domestic Security Alliance Council InfraGuard 8

9 Cyber Intelligence Sharing and Protection Act of 2013 Provides authority to the government to provide classified cyber threat information to the private sector Knocks down barriers impeding cyber threat information sharing Among private sector companies Between private sector and the government Next Generation Cyber Initiative Dedicating more resources and building new tools to combat the nation s most serious cyber threat criminals, spies, and terrorists breaking into government and private computer networks. 9

10 FBI NextGen Cyber A coordinated nationwide effort Establish Cyber Task Forces Dedicating more resources Labs / Personnel / Scientists 24hr Cyber Watch Command Review all cyber incidents reported Quickly assess threats Assess for National Security threats Quick dissemination of leads Review malicious code CyWatch Command 24/7 Ops Floor Uninterrupted intake and analysis to: Contextualize leads Identify trends Coordinate investigative response Deconflict Link incident information provided by the field and other government agencies Produce real time intelligence reporting to investigators and analysts 10

11 Cyber Incident & Intrusion Reporting E-Guardian* Local Law Enforcement Guardian Federal Cyber Watch FBI Headquarters / 24 hours I-Guardian* Private Sector General Internet Fraud IC-3 Internet Crime Complaint Center FBI Chicago Field Office Criminal Intrusion Cyber Task Force National Security RCFL Other Criminal Squad *To be implemented in 2013 State/Local Police e-guardian A secure, user friendly system implemented in 2008 for to share terrorist threats, events, and suspicious activity among state, local, and federal law enforcement The system was enhanced in 2013 to allow events and suspicious activities involving computer intrusion events to be reported to FBI CTFs. i-guardian Reporting A system being developed for trusted industry partners to report incidents and submit malware. 11

12 Cyber Task Force CTF Task Force Officers Paid Overtime Paid vehicle, fuel, phone and equipment Paid training Three days/week; Two year commitment RCFL Task Force Members Three year commitment - full time Same paid overtime, vehicle, fuel, phone, equipment Full training toward CART Examiner certification Closing thought We must abandon the belief that better defenses alone will be sufficient. We must build better relationships. And we must overcome the obstacles that prevent us from sharing information and, most importantly, collaborating. -Robert S. Mueller, III 12

13 QUESTIONS? Our Ad Choice Sponsor: Points of Contact: SA Tim Hearl Desk: (312) Cell: (630) Blackberry/ FBI Chicago s Cyber Task Force (CTF) Telephone: (312) * chicago_cyberwatch@ic.fbi.gov 13