By Ira Winkler
February 10, 2010
A few years ago, I was called in by the CSO of a Fortune 25 company. He
hired 4 of the best known companies that do penetration testing to find
problems with their corporate network. All 4 companies came back two
weeks and $100,000 later, and told the CEO that they had full control of
his network. The CSO went immediately to the CEO, who basically replied,
"I don't care."
The CSO then hired me to perform an espionage simulation. I came back
within one week, and handed the CSO their mergers and acquisitions
plans, their new technologies that were being released in three years,
multi-billion dollar proposals, pictures showing how I bugged the CEO's
office, and told him that I had full control of their entire network.
The next week, the CEO raised the security budget by $10,000,000 and
they hired security managers for all business units.
The reason that the CEO reacted that way is because I grabbed the
company by their proverbial balls and squeezed. I showed him the pain
related to bad security. A value was placed on the vulnerabilities and
it showed the CEO that they had to be addressed.
I thought of this story as I read how Dennis Blair, the Director of
National Intelligence, testified to Congress telling them how the
Chinese hack of Google should serve as a wake up call. Frankly, while I
admit that Google is a large American business, and the attack sounds
outrageous, I have to reply, "I don't care."
In the grand scheme of things, China can hack Google, but the overall
effects to the United States are rather minimal. Besides of the fact
that you don't want to see any U.S. company being targeted by a foreign
nation, the hack of Google really has no impact on the U.S. It is much
more likely that the 33 other companies that were hacked by China during
the same attacks, which of course don't get any press, pose a much more
dire threat to the U.S. and its economy.
Did a friend send you this? From now on, be the
first to find out! Subscribe to InfoSec News