Attribution issues - one story fizzles; another looks disappointingly circumstantial. Great powers jostle in cyberspace. Hacktivists resurface online. So, alas, do terrorists.

Dave Bittner: [00:00:03:18] That Vermont utility hacking story fizzles, but grounds for concern about electrical grid security continue. Observers are disappointed by the Grizzly Steppe Joint Analysis Report. It strikes many as mighty circumstantial. US-Russian cyber strategies and cyber diplomacy. Anonymous greets the Bilderbergers. And ISIS claims responsibility for recent massacres as part of its online inspiration.

Dave Bittner: [00:00:33:09] Time for a message from our sponsor, Netsparker. You know web applications can have a lot of vulnerabilities. I'm sure you know that - you're listening to this podcast. And of course, every enterprise wants to protect its websites. But if you have a security team you know how easy it is for them to waste time culling out false positives. You need to check out Netsparker. Their technology not only automatically finds vulnerabilities in web applications but it automatically exploits them too, and even presents a proof of exploit. Netsparker Cloud scales easily. You can use it to automatically scan 1000s of websites in just a few hours. Learn more at netsparker.com. But don't take their word for it, go to Netsparker.com/Cyberwire for a free 30 day fully functional trial of Netsparker Desktop or Cloud. Scan your websites with Netsparker for a month no strings attached. That's Netsparker.com/Cyberwire. We thank Netsparker for sponsoring our show.

Dave Bittner: [00:01:37:05] Major funding for the CyberWire podcast is provided by Cylance. I'm Dave Bittner, in Baltimore, with your CyberWire summary for Tuesday, January 3rd, 2016.

Dave Bittner: [00:01:47:15] We start the new year with a story that flared briefly only to be effectively debunked. It's a useful cautionary tale about the risks of hasty attribution.

Dave Bittner: [00:01:56:18] At the end of last week, and last year, the Washington Post ran a much quoted and widely redistributed story reporting that Burlington Electric, a utility in the northern New England state of Vermont, had been hacked by Russian intelligence services. A very disturbing story, but it's also a good news/bad news story. First, the good news: essentially, the hacking story is bogus, based on misreading some evidence, dark hints drawn from official US sources, and then misunderstood, some inflammatory headline writing, and what other media outfits are calling a breakdown in fact-checking.

Dave Bittner: [00:02:31:01] The initial story said, essentially, that no one less than Fancy Bear herself was in the Vermont power grid and holding the northern part of that small state at risk. But on further reflection and with further investigation, people concluded that here's what actually seems to have happened. An employee's laptop, not connected to grid controls, turned up a warning that it might have connected to a suspicious IP address, one associated with, but not exclusively used by, threat actors. Burlington Electric isolated the device from its networks and inspected it for indicators of compromise. And they found some, specifically signs of the Neutrino exploit kit. Neutrino has been associated in the past with Russian intelligence services, but it's also been associated with lots of other threat actors as well, most of them ordinary criminals. Neutrino is freely bought and sold in the cyber black market, so this is, to put it mildly, very circumstantial evidence, at best, of the Russian hacking initially reported and vigorously denounced. And in any case, the laptop wasn't connected to control networks and was quickly isolated.

Dave Bittner: [00:03:35:18] It appears unlikely in the extreme that this infection will be leaving Vermonters shivering in the dark this winter. That's the good news. The bad news in this story, as media outlets from Forbes to the Intercept haven't been slow to point out, is that, for all the concern about "fake news" especially bogus rumors spread in the case of advocacy or information operations, it would appear the media gatekeepers could do with upping their fact-checking game.

Dave Bittner: [00:04:01:01] Joe Weiss is managing partner of Applied Control Solutions. He's a well respected and sometimes outspoken voice in the world of industrial control systems. While he agrees the most recent incident in Vermont has been misreported, there's still reason for concern.

Joe Weiss: [00:04:15:23] NERC, DOE, and DHS all initially claimed that the 2015 Ukrainian cyber attack could not happen here, which is obviously wrong. Can it happen here? Of course it can. The electric industry, and that includes nuclear, has made cybersecurity a compliance exercise, not a real security or risk event. So the very first thing that has to happen is, really, senior management, whether it's in the utilities or the government et cetera, has to take control system cyber security as seriously as they do IT security - and they do not. You need to really understand what you have installed. One of the things that the NERC CIPs allow, and there are both political and regulatory or, if you will, legislative reasons, the electric distribution systems are outside the scope of any of the cyber security standards. That was because of the Energy Policy Act of 2005. has done has come up with all kinds of exclusions and scoping issues to take out the bulk of these assets from even being considered critical so they don't even have to be looked at. So, before you even ask anything about technical, you have to first get people to understand and believe it's real and be willing to take action and provide budget and to address security for the sake of security. And not to say, I've checked the box off on a compliance sheet.

Joe Weiss: [00:05:32:20] All electric distribution is excluded from any of these cyber security standards. That obviously doesn't make sense. What NERC has come up with all kinds of exclusions and scoping issues to take out the bulk of these assets for even being considered critical, so they don't even have to be looked at. Before you even ask anything about technical, you have to first get people to understand and believe it's real and be willing to take action and provide budget and to address security for the sake of security, and not to say, I've checked the box off on a NERC CIP compliance sheet.

Joe Weiss: [00:06:26:08] The next thing that has to happen is you need to train and cross-train the control system engineers and the IT people because neither can do this in a vacuum. And one of our major, major, major problems today is IT is not reaching out and working with control system people, and cyber is viewed strictly as a network issue. And in the control system world cyber is much more than just the network. So until you have the appropriate training, you can't get there from here.

Dave Bittner: [00:07:04:01] That's Joe Weiss from Applied Control Solutions.

Dave Bittner: [00:07:08:02] Americans aren't alone in getting the willies about malware in the power grid. The Hürriyet Daily News reports anonymous officials in Turkey's energy ministry as saying they think they see signs of attempts to disrupt electrical distribution in Istanbul and other parts of the country. Some outages are weather-related, but they're also investigating the possibility of an attack.

Dave Bittner: [00:07:29:20] Thug or not, Vladimir Vladimirovich has certainly got into the head of the Main Enemy - that would be you, Americans, and of course we include us as in you. Russian disinclination to retaliate for US expulsion of Russian diplomats last week is drawing generally favorable notices, albeit begrudgingly ones. Security analysts tend to agree that while it's reasonable to conclude there were GRU and FSB intrusions into US political party networks during the election season, the voting itself was not manipulated. The US Intelligence Community has high confidence in its attribution of the hacks to Russian intelligence services, but last week's FBI and NCCIC Joint Analysis Report on Grizzly Steppe draws tepid reviews, its case seen by many as disappointingly circumstantial. So few serious observers doubt that the Russians were up to something, but the information contained in the Joint Analysis Report is regarded as heavy on best-practice advice, and light on dispositive evidence.

Dave Bittner: [00:08:30:05] If the Intelligence Community has the smoking gun, people aren't smelling the cordite in the report. Senator McCain is convening a hearing on Russian hacking this Thursday, and President-elect Trump says that he "knows things other people don't," and suggests he'll share some of what he knows shortly.

Dave Bittner: [00:08:49:19] ISIS, alas, hasn't gone away. Over the weekend the Caliphate resumed its long-familiar reporting of propaganda of the deed, claiming responsibility for massacres in Istanbul and Baghdad. The declared motive of the former was "revenge" against Turkey. The Baghdad bombing was intended to simply to kill "a gathering Shia." German police appear to have interdicted another bombing plot in the Saarland, arresting an ISIS adherent on the basis of his online attempts to coordinate attacks.

Dave Bittner: [00:09:19:20] Finally, Anonymous has resurfaced in the new year, defacing a Bilderberg Group website to demand a change of heart from the Bilderbergers' elite membership. A resolution to work for the common good as opposed to one's narrow self-interest would doubtless be a good one for all of us, but we don't know whether a threatening defacement will have the desired effect. Perhaps we'll hear an update from the Bohemian Grove sometime this summer.

Dave Bittner: [00:09:49:12] Time to take a moment to thank our sponsors, Cylance. Are you looking for something beyond legacy security approaches? Of course you are. So you're probably interested in something that protects you at machine speed and that recognizes malware for what it is. No matter how the bad guys have tweaked the binaries or cloaked their malice in the appearance of innocence, Cylance knows malware by its DNA. Their solution scales easily and it protects your network with minimal updates, less burden on your system resources and limited impact on your network and your users.

Dave Bittner: [00:10:16:13] Find out how Cylance is revolutionizing security with artificial intelligence and machine learning. It may be artificial intelligence, but it's real protection. Visit cylance.com to learn more about the next generation of anti-malware. Cylance: artificial intelligence, real threat prevention. We thank Cylance for sponsoring our show.

Dave Bittner: [00:10:42:15] I'm pleased to be joined once again by Dale Drew. He's the Chief Security Officer at Level 3 Communications. Dale, it's a new year - 2017 is here. What's your outlook for the coming year?

Dale Drew: [00:10:53:11] Job security. What I really like about 2016 and the direction that we're heading in, is this notion that behavior analytics, you know, AI, machine learning elements, people really are beginning to recognize the value of that, not only as an independent capability but as it enhances existing security technology. And what I love about that is that we couldn't agree more. We really think that machine learning and behavior analytics, to be able to detect things that you've never seen before in ways you've never seen it before, and then tying that knowledge directly into all of your existing security infrastructure, is going to be the thing that is going to have a step function above anything else in protecting enterprise assets and critical infrastructure capability. So, I cannot look forward enough to turning the things like machine learning into a buzzword, or from a buzzword into a more practical product capability that is embedded in a vast majority of our security technology. So that one I think is going to be an amazing 2017 trend and I look forward to that.

Dale Drew: [00:12:16:20] I think the other trend that we're going to see is IoT. I think that we've seen a significant explosion in bad guys just embracing IoT in a malicious way. Right? You know, there are no security solutions for IoT. There is no end point protection. There's no intrusion detection. There's no nothing. And there's no standards. And so the bad guys have found that when they gain access to an IoT device they have a much longer life on those device, before they are detected. Frankly, they have created a step function in evolution in bot control because their bots are now capable of controlling millions of end points, as opposed to just thousands of endpoints, and that's all because of this attraction to IoT. We really think that the bad guys are going to be doing significant research in IoT exploits, that's going to cause a significant amount of reaction from the community especially in the IoT space to react to all these security threats, until we can get a lot more proactive.

Dale Drew: [00:13:24:16] We're not solving for new problems in IoT - it's the exact same problems we've solved in every other computing platform. It's just the need to package that in a smaller device capability, I think is going to be the challenge for us this year.

Dave Bittner: [00:13:37:13] Dale Drew, thanks for joining us.

Dave Bittner: [00:13:42:02] That's the CyberWire. For links to all of today's stories, along with interviews, our glossary, and more, visit thecyberwire.com. Thanks to all of our sponsors, who make the CyberWire possible, and special thanks to our sustaining sponsor, Cylance. Learn more about how Cylance prevents cyber attacks at cylance.com.

Dave Bittner: [00:13:58:20] The CyberWire Podcast is produced by Pratt Street Media. Our editor is John Petrik. Our social media editor is Jennifer Eiben, and our technical editor is Chris Russell. Our executive editor is Peter Kilpe. I'm Dave Bittner. On behalf of all of us at the CyberWire, thanks for listening, and best wishes for the new year.