someone can steal all the operational information it took you six years to develop and open a facility that on day one has the exact same level of efficiency, they have effectively stolen the majority of the profit for your facility. What is being stolen is something enormously more valuable than what has been lost to credit card or bank fraud. This is a huge issue and puts these companies and potentially entire domestic industries in jeopardy of survival.

noRTon: Should we assume that the attackers also lift one or two key staff people to help interpret this information?

BoRG: If you take Asia as an example, using this type of information is often limited by the availability of people who understand Western business practices. This is not something you learn by taking a course locally. To use the information effectively, you have to send someone not only to study in the West but also to work in Western industry.

BianCo: It used to be that you had to be just secure enough that an attacker would give up and go to a less-secure competitor. This is no longer true. Being targeted today means you have something of specific value, and the attackers will probably not go away until they get it. This is fundamentally different from past practices. The people who learned about this in January when Google made its Gmail announcement are probably several years behind everyone else.

CLaRK: Much of the business community looks at security as being the people who make sure all the doors and windows are locked. Rarely are security processes aligned with the business, but it’s the business that drives security, and security should protect and support valued business processes. That’s easier said than done.

There is also the ethical dilemma of assuming that my competitor and I do business in the same way. That is clearly asymmetric, because your competitor may not follow your business rules. It’s hard enough to run a business, be ethical, and work within your regulatory framework without an actor coming in outside of that framework.

We need to: (a) educate people that

Steve Bourne, CTO, El Dorado Ventures; past president, ACM; chair, ACM Queue Editorial Board; chair, ACM Professions Board

Mache Creeger (moderator) principal, Emergent Technology Associates

CREEGER: While past definitions
have narrowly defined valued infor-
mation as banking codes or secret in-
ventions, criminals have broadened
that definition to where they can clone
entire businesses through the com-
prehensive theft of more mundane
information such as manufacturing
processes, suppliers, customers, fac-
tory layout, contract terms, general
know-how, and so on. This new shift
kind. Further investigation indicated
that when the attackers were in the
control networks, they gave equal at-
tention to equipment regardless of its
ability to blow things up.

Roundtable panel from bottom left: Jim norton, David Bianco, mache Creeger, Louise Bennett; top left: Steve Bourne, Scott Borg, andy Clark, Jeremy Epstein, and BCS Director for Professionalism adam Thilthorpe.

 

has significant implications to the competitive balance of entire industries, regardless of company size, and it has implications across the global economic landscape. How do you see this new security threat evolving, and how should businesses respond?

photographS by marjan SadoUghi

BoRG: In 2004, when the U.S. Cyber Consequences Unit started, we were concerned about intrusions into critical infrastructure facilities, such as chemical plants and refineries. We believed that some of these intrusions were reconnaissance in preparation for an attack that would cause physical destruction.

We got that one wrong, because
there were no major attacks of that
popping up in Southeast Asia. No visi-
tors were allowed, and we believe it’s
because they were exact replicas of at-
tacked facilities.