In January, Dick Marchinko spoke to my company. Here are some of the lessons that I drew from his hard-to-follow speech:
Most importantly, he said, there is no substitute for human intelligence.
Attackers can…
- defeat security systems, such as locks, by replacing them with their own security system in advance of a break-in. Security response will trust in their security system to help catch or contain attackers, not realizing that it was replaced and turned to the service of the attacker.
- use decoys to mislead security response. For example, crews might diffuse one bomb, and they forget to look for a second one.
- attack during noisy, chaotic, busy times, like shift-change. (My note: Hackers like to hide their malware on busy networks and on busy file servers, such as in university or ISP networks.)
- trip alarms to assess response capabilities. Once assessed, booby-trap the response capabilities so they are ineffective.
- evade security systems. TSA secures airports from passengers, but what about security airport construction sites and access? America’s ports and waterways are largely unprotected.