Vault 7: Adapt to Live Another Day...

When you spend enough time in any austere environment, you begin to respect it's abilities to change rapidly.  You begin to respect the changing natural forces and how these new potential threats could become a new Operational Risk in just minutes.  The decisions that you make in the next few seconds, could mean a positive outcome or a significant catastrophe.

Will you turn right or go left?  Will you accelerate or slow down?  Will you ascend or descend?  These decisions that you make in your quest to adapt to your changing austere environment will forever be remembered.  Whether they are stored in the synapses of the brain or the log files of an autonomous system executing code, the trust decision is evident.

How long has it been since you really took a deep look at your decisions the past minute, hour or day?  This analysis of the evident decisions made and the environment that you are operating in will forever allow for growth or death.

Systems thinking and the continuous learning of a changing environment can happen at 12,000 feet above sea level at minus 10 degrees, or within the climate-controlled data centers or corporate offices of your global enterprise.  What are you doing today to help achieve new levels of trust, in order to survive another day?

Why is it that so many individuals are surprised when they get a call from their CxO or even corporate counsel that sounds like this?  "It looks like our Intellectual Property or Trade Secrets, are now in the hands of our competition".  "Our enterprise is encountering significant new risks to our ongoing operations and we must adapt immediately'.

Introduction
Just as American and European critical infrastructure executives were beginning to wrap their minds around the devastation of the Office of Personnel Management, ransomware erupted onto the scene. We then experienced concentrated DDoS attacks such as the Mirai botnet attack on Dyn, which enabled a quantum leap for cyber criminals of even the most novice of technical aptitude to wreak havoc on targeted organizations at the click of a button or for less than one bitcoin. Unfortunately, adversaries continue to evolve, and cyber defense remains a reactionary culture. Numerous, persistent and adaptive, cyber-adversaries can more easily, remotely and locally besiege critical infrastructure systems, than information security personnel can repel the incessant barrage of multi-vector attacks. Now, all techno-forensic indicators suggest that an under-discussed cyber-kinetic attack vector will ubiquitously permeate all critical infrastructure sectors due to a dearth of layered bleeding-edge military grade cyber security solutions. Unless organizations act immediately, in 2017 The Insider Threat Epidemic Begins.

Some people are surprised.  Yet it is the small team of "Operational Risk Professionals" in your enterprise, that have been continuously training, operating in clandestine and unknown environments and learning each day, for this moment.  They are not surprised.  They are the people who have designed their operations and systems to be resilient, to endure austere environments and to adapt to live another day.

Seek out these people in your organization.  Find the expert individuals in each of the departments or business units, that also interface with your external environment and supply chain.  Now look inside and in the mirror.  Where are the vulnerabilities inside?  How can you adapt your operations to create trust with employees and simultaneously make your organization more resilient?

Take the “Vault 7” CIA data Wikileaks released this week. Assuming it is legitimate, it originated from a network that presumably has a very small attack surface. Wikileaks expressly claims that the data is from “an isolated, high-security network situated inside the CIA’s Center for Cyber Intelligence in Langley, Virgina,” and experts agree that seems likely. And knowing that CIA networks are probably secure and defended supports the notion that the the data was either leaked by someone with inside access, or stolen by a well-resourced hacking group. It’s far less likely that a random low-level spammer could have just casually happened upon a way in.

 Build digital trust in your organization by better understanding the entire surface for potential attacks.  Analyze the rules that are in place now and how they might need to be changed according to the continuously changing environment you operate in.

Finally, adapt to live another day...