Mandiant’s provocative but hardly conclusive report has created a news wave on cybersecurity.
Hardly conclusive because as Mandiant states:
we have analyzed the group’s intrusions against nearly 150 victims over seven years (page 2)
A little over twenty-one victims a year. And I thought hacking was common place. 😉
Allegations of hacking should require a factual basis other than “more buses were going the other way.” (A logical fallacy because you get on the first bus going your way.)
Here we have a tiny subset (if general hacking allegations have any credibility) of all hacking every year.
Who is responsible for the intrusions?
It is easy and commonplace to blame hackers, but there are other responsible parties.
The security industry that continues to protect the identity of the “victims” of hacks and shares hacking information with a group of insiders comes to mind.
That long standing cult of secrecy has not prevented, if you believe the security PR, a virtual crime wave of hacking.
In fact, every non-disclosed hack, leaves thousands if not hundreds of thousands of users, institutions, governments and businesses with no opportunity to protect themselves.
And, if you are hiring a contractor, say a defense contractor, isn’t their record with protecting your data from hackers a relevant concern?
If users, institutions, governments and businesses had access to the details of hacking reports, who was hacked, who in the organization was responsible for computer security, how the hack was performed, etc., then we could all better secure our computers.
Or be held accountable for failing to secure our computers. By management, customers and/or governments.
Decades of diverting attention from poor security practices, hiding those who practice poor security, and cultivating a cult of secrecy around computer security, hasn’t diminished hacking.
What part of that lesson is unclear?
Or do you deny the reports by Mandiant and others?
It really is that clear: Either Mandiant and others are inventing hacking figures out of whole clothe or the cult of cybersecurity secrecy has failed to stop hacking.
Interested? See Crowdsourcing Cybersecurity: A Proposal (Part 2) for my take on a solution.
Just as a side note, President Obama’s Executive Order — Improving Critical Infrastructure Cybersecurity appeared on February 12, 2013. Compare: Mandiant Releases Report Exposing One of China’s Cyber Espionage Groups released February 19, 2013.
Is Mandiant trying to ride on the President’s coattails as they say?
Or just being opportunistic with the news cycle?
Connected into the beltway security cult?
Hard to say, probably impossible to know. Interesting timing none the less.
I wonder who will be on the various panels, experts, contractors under the Cybersecurity executive order?
Don’t you?
