April 2, 2007: The U.S. Department of Defense has
some good news on the Cyber War front, but is not sure if this masks some very bad
news. Basically, this past January, there were only 40 successful hacks against
Department of Defense computer networks, compared to 130 two years ago. The
number of attacks has grown enormously, from 16,000 in 2004, to 23,000 in 2005
and 30,000 in 2006.
What is unknown is the number of successful attacks
that were not detected. This is a growing problem, because the undetected
attack is the most valuable for the attacker. The longer a hacker can maintain
an undetected penetration, the more valuable that hack is. An undetected
penetration enables the hacker to steal stuff and monitor activity. A good
example of this was the recently discovered penetration of the computer systems
at the retail chain TJ Maxx. This went undetected for at least 18 months, and
data on over 46 million credit card accounts was stolen.
The problem is that the computer security industry
has put most of its efforts into defenses, and less into forensics (the
analysis of seemingly healthy computer systems, to discover if hackers have
gotten in.) Forensic tools have not kept pace with the stuff hackers have been
creating to secretly penetrate, and maintain themselves, on a network.
