By Bill Brenner
May 20, 2008
It's been a year since the Baltic nation of Estonia wilted under the
assault of coordinated cyber attacks and the country seems to have
bounced back. In fact, NATO recently announced it will set up a cyber
defense center there to research and help fight cyber warfare. In this
Q&A, security researcher Gadi Evron reflects on his experiences after
being called to Estonia to help investigate the attacks, and what other
nations and private entities could learn from it all.
CSO: When you reflect on what happened in Estonia, what do you see as
the big lesson for other nations?
Gadi Evron: Say, by some miracle, you have not yet experienced an attack
via the Internet even though you have an Internet-based critical
infrastructure. You can no longer say that it won't happen simply
because it hasn't happened yet. The biggest lesson is that in today's
ball game, the player can be the kid next door as much as it can be the
big bad neighboring country. Work on your incident response capability
with the private sector, because when you get hit you won't have time to
address it at that point.
CSO: Since those attacks, have there been any similar incidents to your
Evron: Several countries have publicly admitted to being attacked
online. Most of these attacks are of the quiet,spying type. As to large
incapacitating DDoS attacks, they happen daily on the Internet and
impact the whole net unlike these spying incidents. I am not aware of a
major country-debilitating DDoS attack since Estonia, though.
CSO: You've described the Estonian incident as a cyber riot rather than
a case of nation-sponsored cyber terrorism. Do you think all the
speculation about nation-sponsored attacks was overblown?
Evron: It was a riot because the online populace was energized to be the
foot soldier. It was an organized attack, but whether by some ad-hoc
group of individuals or not, I cannot say based on the technical data
alone. Whether it was Russia or not, [the country] knew how to play the
political game afterwards and achieved a high level of deterrence
against the former Eastern-block countries at virtually no cost.
CSO: You mentioned in your Black Hat presentation last year that you
headed to Estonia with images of the fictional nation of Elbonia from
the "Dilbert" comic strips, where, as you noted, mud is the main export
and babies are born with beards. But you said you were pleasantly
surprised by what you found instead.
Evron: That stuff [from the presentation] was a joke. I was mainly
concerned about visiting because of the cyber fraud activity happening
there and the damage the criminals can suffer at the hands of people
like me. I found a beautiful country with a very relaxed and fun
culture. Their attitude was that if there were problems they wanted to
talk about them and fix them.
CSO: If you could offer three pieces of advice to government or private
entities hoping to avoid such attacks, what would it be?
Evron: Don't panic. Accept that the threat is there. Don't jump to
solutions such as just better funding or adopting a cold-war strategy.
On a practical note, though, establishing a country-wide incident
response capability is important. Open channels to the private sector.
Treat the Internet as insecure in your design when you build new
infrastructure around it.
CSO: You live in the West Bank, and when you mentioned your initial
mental picture of Estonia in that talk last year, it was easy to see how
the TV news can give a distorted picture of cetain places that don't
neccesarily reflect the reality of the situation. Do you think your
corner of the world gets a bad rap when it comes to the overall security
Evron: The reputation is understandable [but] the reporting is mostly
biased and even plain-out wrong on both sides. This is true not just for
the local situation but for computer security and anything else I've had
the chance to be privy to and then later see reported in the news.
Copyright CXO Media Inc.
Attend Black Hat USA, August 2-7 in Las Vegas,
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.
Visit product displays by 30 top sponsors in
a relaxed setting. http://www.blackhat.com