Credit: Shutterstock/Amir Kaljikovic
Are you a good guy or a bad guy? Are you for us or against us? Can we truly trust all the people working for my company (or hired contractors) to protect sensitive data?
These basic questions are again being asked all over the world regarding the recent actions of technology and cybersecurity professionals.
For example, take a look at these four representative stories that have happened since May 2015:
Enormous leak exposes Hacking Team as blackhat organization(In Italy) –
“The security community is buzzing about the release of more than 400GB of corporate data from the Italian security firm Hacking Team, a revelation that’s being called the security industry’s version of the Edward Snowden leaks. Hacking Team has been previously accused of being willing to sell its services and software to anybody, even authoritarian regimes with active human rights investigations ongoing. ...”
23-year-old twins allegedly tried to rip off the State Department and sell a bunch of passport data -
“Muneeb and Sohaib Akhter are twin 23-year-old computer whizzes who live in Springfield, Virginia. Last week they were indicted by the Department of Justice on accusations of hacking into various computer systems, stealing credit-card funds, and hatching a plan to access US government computers and sell passport and visa data.
In total, the Akhter twins racked up 12 criminal charges. ...”
Cybersecurity intern accused in huge hacking bust –
“The guy accused of being one of the world's top Android phone hackers is a bright young student who's been honing his skills as an intern at the cybersecurity firm FireEye.
On Wednesday the U.S. Justice Department announced a massive international bust of Darkode, an online black market for hackers. Among those charged with crimes was Morgan Culbertson, a 20-year-old from Pittsburgh. He's accused of creating a nasty malware that infects Android phones, steals data and controls the device.
Culbertson is currently a sophomore at Carnegie Mellon University in Pittsburgh. He's a two-time intern at the cybersecurity software maker FireEye where he's been researching malware on Android smartphones, tearing apart viruses, and analyzing them. ...”
Man accused of hacking into college women's accounts, 'sextorting' –
“A U.S. Department of State employee was arrested at Hartsfield-Jackson Atlanta International Airport and is accused of hacking into college-age women’s accounts and stealing compromising photographs for blackmail.
Federal investigators say he used government computers at the U.S. Embassy in London to commit the crime. Investigators say Michael C. Ford is a U.S. citizen who has worked as an embassy employee in London since 2009. ...”
Are You a Spy? – No, This is Not a Movie
While the world has become accustomed to both James Bond films for decades and new cyberthriller movies with double agents working for multiple organizations at once, the current reality with technology and cybersecurity professionals has become much more complex.
The common definition given to a “good guy” or ethical hacker is a “white hat” hacker. The “bad guys” are generally labeled as “black hat” hackers. Some like to think of themselves as “grey hat” hackers as well.
But these distinctions are becoming increasingly blurred, as highlighted by USA Today earlier this year.
“The recent history of one such hacking group suggests it's getting harder to neatly divide so-called white-hat and black-hat hackers into discernible camps.
Last week, a group aligned with the amorphous hacktivist entity that calls itself Anonymous declared cyberwar against militant Islamists like those who killed 17 people in France. ...”
A further complication regarding definitions comes into play when you consider cybersecurity industry conferences like Black Hat USA 2015, which opened yesterday in Las Vegas. Here’s how the website describes the conference:
“Black Hat – built by and for the global InfoSec community - returns to Las Vegas for its 18th year. This six-day event begins with four days of intense Trainings for security practitioners of all levels (August 1-4) followed by the two-day main event including over 100 independently selected Briefings, Business Hall, Arsenal, Pwnie Awards, and more (August 5-6).”
And front-page highlighted press coverage at the event offers helpful advice regarding the recent Chrysler hack, alarms over driver safety and a conference attendee report describing the cybe mess we are in.
The attendee survey proclaims that it is time rethink enterprise IT security and offers potential solutions to our global online security problems. These are very helpful tools and answers for enterprises being offered at the biggest hacker event in the world.
If you are attending Black Hat 2015 and/or DEFCON this week, you’d better prepare for the hackers all around you. There are numerous websites and tip sheets to help you not become a victim yourself. I find it interesting that so many precautions must be taken, which just proves that the norm has become “hacking back” as one answer.
My point is that our society has made it trendy and attractive to be a black hat hacker and get attention by hacking a growing list of connected things.
Answers Please?
Lasting answers in the area of cyberethics are very difficult to find right now. The situation seems even more like the Wild, Wild West or like the situation in 1930s Chicago, than when I wrote this popular “Are You An Insider Threat” blog for CSO Magazine back in 2010. News events describing new data breaches and other cyber incidents are quickly overtaking established laws, company policies and other rules.
Those who try to stand up for traditional definitions of right and wrong in cyberspace are largely laughed at by the majority in the hacker community. We have largely moved to a new online world in which the primary motivator is whatever cause you support, and “hacking back” is becoming the norm for more and more people.
What can I offer? It starts with your own situation and the people you are working with and relying on to protect and defend sensitive data. We must trust and verify, but what does that really mean?
Obviously this is a very complex topic. I wrote a series of LinkedIn advice articles on this topic to help some struggling friends and professional colleagues at the end of 2014:
Part 1) Are You For Us or Against Us?
Part 2) Changing Security Culture With a New Approach
Part 3) Are You Engaged In Building Trust & Fixing The Security Culture?
In closing, I now take the terms “white hat,” “black hat” or “grey hat” hackers with a level of suspicion. I know plenty of people who view themselves in one category, who are very likely in another category based upon a long list of factors.
We need to remember President Ronald Reagan’s “Trust But Verify” quote, which pertains to everyone on our cybersecurity and technology teams.
