Human Frailty Lets Cyber Thieves Attack, Expert Says

As money becomes more mobile, the threat from cyberattackers is likely to increase, a top security expert told a U.S. Senate panel on Tuesday.

"I always believe wherever money goes, crime follows," Kevin Mandia, the founder and chief executive of digital security firm Mandiant, told an Armed Services subcommittee at a hearing on cyber threats. "Pretty soon we'll all be paying for things with our Android phones or iPhones and the minute we're doing all digital money, we're going to see more digital crime, and we're going to need more expertise."

Mandia, whose firm released a report in February that documents theft of intellectual property from more than a hundred U.S. companies by hackers backed by the Chinese military, stressed to senators that intruders' sending emails that induce victims to open them and other tactics that exploit behavior adds to both the sophistication of cyberattacks and the difficulty of defending against them.

"They're leveraging human weaknesses and human vulnerability and trust to break into these organizations," said Mandia, who added that the Chinese intruders his firm has witnessed have sought to steal corporate secrets, not to alter data or shut down networks. "Make no mistake, they're targeting our intellectual property," Mandia added.

Companies have little choice but to be on the lookout for electronic intrusions because trying to prevent them entirely can be futile. "Unless you are a top company that can hire top talent and scale those costs across the business, you can't afford defenses that will stop a Chinese unit or a Russian unit or anyone else," Richard Bejtlich, Mandiant's chief security office, told the panel.

Bejtlich added that in high-performing organizations, "people accept that you will be compromised, but you have to find it quickly, stop it quickly, and then contain it."

Mandiant's report shows "there is simply nothing left for the public to doubt about the magnitude or relentless character of China's theft of American technology and other valuable business information," Senator Kay Hagan (D-N.C.), the subcommittee chair who convened the hearing, said in prepared remarks.

"The issues are complex, technical and can at times seem very academic; but make no mistake, the consequences are real and potentially far-reaching," Senator Deb Fischer (R-Neb.), the subcommittee's top Republican, added.

For their part, Chinese officials have denied sponsoring the attacks, which the White House says underscores the need for a dialogue with China and other nations on what constitutes acceptable norms of behavior in cyberspace.

The hearing comes amid a wave of cyberattacks on some of the nation's biggest banks and a series of warnings about the threat that cyber intrusions pose to financial networks and other critical infrastructure. The Director of National Intelligence, James Clapper, recently told the Senate Intelligence Committee that cyberattacks present a growing threat to financial networks and other critical infrastructure.

Last week, roughly a half dozen banks weathered digital assaults on their websites that bogged down online banking and frustrated customers who were unable to log on to their accounts. The denial of service attacks continued an uptick in such attacks that started last year, when the number of such assaults rose 170% from a year earlier, according to Radware, a digital security firm.

Cyber intrusions are on the rise as well. Though the median time cyberattackers were present in the networks of companies and other victims dropped in 2012 to 243 days from 416 days in duration a year earlier, the downward trend was accompanied by a higher mean number of days of compromise, according to the latest threat report from Mandiant.