Stuxnet Changes Terrorism Equation, Says Former CIA Official
The attack marks a turning point for counterterrorism efforts, making cyber a potential threat to any nation's domestic security.
Black Hat Security Briefings in Las Vegas, a UBM TechWeb event.
Until now, the primary worry of the U.S. government's counterterrorism groups has been stated by CBRN, which listed threats in order of likelihood: chemical, bacteriological, radiological, and nuclear, said Cofer Black, vice president for global operations for threat analysis firm Blackbird Technologies, and a 30-year veteran of the CIA's counterterrorism efforts. Since Stuxnet, terrorism concerns have morphed into KBC: kinetic, bacteriological, and cyber, he said.
More Security Insights
- Get Actionable Insight with Security Intelligence for Mainframe Environments
- Cloud Security: It’s Not Just for IT Anymore
- The 451 Group Impact Report: Skybox Enters Vulnerability Management Space
- Skybox Security Survey: Next-Generation Firewall Management
"The Stuxnet attack is the Rubicon of our future," Black told attendees, referring to the river near Rome that Julius Caesar crossed to start an insurrection and become emperor, and which has become synonymous with a point of no return. "Your world, which people thought was college pranks cubed and squared, has now morphed into physical destruction ... from the victim's view, of a national resource. This is huge."
The extensive research and development required to make Stuxnet a reality suggests a nation-state's efforts. And the ability to affect physical assets means that cyber must now be considered a tool that could be utilized by terrorists, Black said.
Stuxnet, considered the first known cyberweapon, caused centrifuges critical to uranium processing to malfunction in Iran's processing facility, setting back that nation's attempts to develop a nuclear program.
Black's statements came the same day security firm McAfee revealed that dozens of companies had been targeted by a massive spy network that attempted to steal intellectual property and sensitive government information. Dubbed Shady RAT, the network appears to be the work of a nation-state, although McAfee would not name a particular country.
Security concerns give many companies pause as they consider migrating portions of their IT operations to cloud-based services. But you can stay safe in the cloud. In this Dark Reading Tech Center report, we explain the risks and guide you in setting appropriate cloud security policies, processes and controls. Read our report now. (Free registration required.)