Unfortunately, National Cyber Director is an unhelpful distraction. The idea that nominating a single person for an office that Congress hasn’t even bothered to fund yet will make a difference in confronting our nation’s numerous cyber challenges is ridiculous 1/4
We have a person in the White House who has been incredibly empowered to solve these problems. Her name is Anne Neuberger and she has a newly created and extraordinarily powerful role on the NSC as Deputy National Security Advisor for Cyber 2/4
I wish someone would tell me at least one thing that people think NCD would do that Anne can’t do in her (arguably much more powerful) role? 3/4
Let’s drop this foolish inside-the-beltway discussion about NCD and focus on what truly matters - executive and legislative actions that can address the challenges we face 4/5
The upcoming cyber EO from the administration with its focus on software supply chain to the government, breach reporting, increased security standards for government agencies is a great and very important step in that direction 5/5
• • •
Missing some Tweet in this thread? You can try to
force a refresh
It strikes me that how we respond to the #SolarWindsHack strategically, in public messaging, and in some ways, even tactically, would be vastly difference had we believed it was GRU, and not SVR intelligence service who was behind it 1/
The reason being that SVR, unlike GRU, has no post Soviet history of conductive destructive attacks or attacks that violate established norms (in cyber or physical worlds).
Another reason probably being that SVR is a civilian intelligence agency, not a military one 2/
This yet again highlights the critical importance of attribution for both strategic and tactical decision making in government and private sector alike.
And the importance of specificity of attribution on multiple levels. Nation State vs Criminal, RU vs CN, GRU vs SVR 3/
One word of caution, particularly for reporters publicizing hack victims. Many of the Orion platform customers have downloaded the backdoored update and it would have likely eventually contacted the C2 servers 1/4
Those backdoors and C2 connections are now being discovered by IR teams that are searching logs and systems for indicators published by @FireEye. However, this discovery does not necessarily mean the attackers did anything damaging to that organization 2/4
@FireEye In fact, most appear to have done a DNS lookup to the C2 server and received back a ‘kill switch’ response that indicates the adversaries had no interest in that victim 3/4
With the Fireeye breach news coming out, it's important to remember that no one is immune to this. Many security companies have been successfully compromised over the years, including Symantec, Trend, Kaspersky, RSA and Bit9 1/
Security companies are a prime target for nation-state operators for many reasons, but not least of all is ability to gain valuable insights about how to bypass security controls within their ultimate targets 2/
The biggest news here for me is the admirable standard that Kevin Mandia and @Fireeye team is setting in rapid and transparent disclosure of the intrusion, as well as release of red team tools stolen by the adversary 3/
Prediction for 2024 in Russia based on yesterday’s news:
Medvedev comes back into a now much weakened position of President
Putin steps back to a now very powerful position of Chairman of Security Council, a General Secretary of the Politburo of sorts 1/
Medvedev is the only successor that Putin truly trusts given their very long history together going back to St Petersburg in early 90s. Plus the presidency will be much weaker and will be of limited threat to Putin himself 2/
Putin’s very powerful new role as Chairman of Security Council will give him full control of the security forces (the only thing that matters for hanging on to true power, while allowing to step back from the boring and mundane job of running the country 3/