RiskUKAugust2017

Cyber Security: Risk Management for Automated Cyber Weapons
arms ‘bazaar’ wherein criminals can purchase
the cyber equivalent of smart bombs, complete
with user guides, money-back guarantees and
TripAdvisor-style user ratings.
Powerful custom-made tools designed to
exploit unpatched vulnerabilities and
autonomously reproduce themselves across the
world are widely available to buy, rent or
franchise. They can also be repurposed and
customised for any particular task, from
hacking a bank through to attacking a hospital.
These sophisticated weapons often contain
an autonomous ‘transport’ mechanism that
enables the malware to scan for vulnerabilities
and spread itself along with a ‘payload’ that
then delivers the attack.
The Internet is also replete with intelligencegathering
tools that lie dormant inside an
enemy system like a cyber ‘sleeper cell’,
covertly mapping out the network architecture,
domains, servers and IP addresses of potential
targets. A recent investigation showed that the
UK’s national rail network had been unwittingly
infiltrated by four nation state cyber attacks
which appeared to be ‘exploratory’ exercises.
Two-way relationship
One cyber expert has warned the US
Government that: “The Internet allows
malicious cyber actors to deliver weaponised
tools at a scope and scale we’ve never seen.”
Even worse, nation states are deliberately
‘leaking’ cyber weapons to illegal hacker
collectives, hiding their activities behind proxy
groups. The relationship works both ways, with
cyber crime groups also sharing tools with
Governments in return for payment or
protection from prosecution. These tools then
work their way lower down the food chain until
they end up in the hands of low-level hackers,
with the end result being that highly classified
cyber offensive expertise is being transplanted
into the laptops of teenagers.
According to cyber security body (ISC) 2 , this
comes at a time when the Human Resources
needed to prevent these increasingly advanced
and widespread attacks are in scarce supply.
The world is set to face a shortfall of 1.8 million
cyber security professionals in five years. Rising
demand for a dwindling pool of talent is
pushing up the cost of hiring, rendering it
increasingly difficult for companies to recruit
and retain the necessary and best talent.
Given this major manpower shortage
combined with a rise in automated hacking
tools entering wider circulation, business and
industry is now under greater threat than ever
before. The central problem is that machines
are far faster and more efficient at hacking than
“The central problem is that machines are far faster and
more efficient at hacking than humans. Automated tools
can launch many simultaneous worldwide attacks at a
speed and scale beyond the capacity of human attackers”
humans. Automated tools can launch many
simultaneous worldwide attacks at a speed and
scale beyond the capacity of human attackers.
For example, computer ‘worms’ are capable of
autonomously replicating themselves millions
of times in order to simultaneously infect a
wide array of targets.
To illustrate that statement, studies have
shown how an automated worm could ‘infect’ a
single lightbulb and then cross-contaminate all
neighbouring lightbulbs, spreading like wildfire
to plunge entire cities into darkness at
lightning speed. In this way, widely-available
automated weapons dramatically increase the
speed, power and reach of cyber attacks on
faraway targets.
Autonomous tools also enable human
hackers to cover their tracks, like a thief
evading detection by sending a drone to burgle
a house. While companies lack the time and
Human Resources needed to find and fix all of
their vulnerabilities, automated tools afford
cyber criminals limitless time and resources to
find and exploit vulnerabilities. It’s no surprise
that, in a race between human defenders and
autonomous attackers, the humans are losing.
To turn this around, we simply must use
autonomous tools as a defence mechanism.
Automating our defences
Whereas traditional ‘dumb’ scanners
indiscriminately bombard a network from the
outside in the hope of exposing a vulnerability,
modern ‘smart’ tools can autonomously scour
the individual blueprint of any network or
system to find deep structural vulnerabilities
and explain how to fix them. It’s the digital
equivalent of going through every line of an
architect’s drawings and identifying
weaknesses in the structure within seconds.
‘Smart’ tools dramatically reduce the
demands placed on heavily-overstretched
Human Resources, using automated systems to
plug the cyber security skills gap that shows
little sign of diminishing any time soon.
With advances in automation enabling
today’s criminals to launch devastating attacks
in minimal time and with few Human Resources
of their own, we really must begin to deploy the
same ‘smart’ technologies to cut the time and
cost of shoring up our defences. Frankly, we
neglect to do so at our peril.
Nicola Whiting: Chief
Operating Officer at Titania
61
www.risk-uk.com