Losing the plot – hacking corporate networks

States should police corporate cyber-security more toughly—but react to breaches cautiously

From The Economist

THE cyber-attacks that have emerged in recent weeks have begun to sound like a screenplay. One unknown adversary destroys a German blast furnace by interfering with the computers that control it. An attack by the “Guardians of Peace” on Sony Pictures wipes its computers, loots its intellectual property and humiliates its bosses by publishing their private e-mails (see article). Another group called Lizard Squad ruins Christmas for millions by swamping video-game networks.

But these attacks were all too real, and reality is messier than fiction. Businesses and governments now face troubling questions. The Federal Bureau of Investigation quickly blamed North Korea for the attack on Sony, which had made a comedy featuring the assassination of that country’s leader. Barack Obama vowed retaliation, and North Korea’s internet connection has since crashed twice.  But the evidence produced was weak. Many computer-security experts think it more likely the culprits were disgruntled employees, gangsters or pranksters. It is sobering to think that the world’s greatest nuclear power and the trigger-happy regime in Pyongyang could be brought into confrontation by a motley array of mischief-makers.

After a traumatic year of spectacular breaches, including the theft of the details of 83m JPMorgan Chase customers and of 56m credit- and debit-card records from Home Depot, few businesses should need reminding of the importance of computer security. Working out what to do about these attacks is harder. Watertight protection is impossible. But some simple steps could have protected Sony. One is encryption of important stored information. If you must write derogatory e-mails about your company’s leading lights, don’t store them in plain text. Databases of passwords and logins, whether of employees or customers, should be “hashed and salted” properly—not stored in a folder labelled “Password”. Most large companies take cyber-security very seriously these days, but some, as Sony shows, are still getting the basics wrong.

Game of thrones

One problem is that much cybercrime is buried. Sony, JPMorgan and Home Depot are the exceptions. They had no alternative to publicly admitting what happened. Many companies prefer to lick their wounds in private, fearing damage to their reputation, or lawsuits, if they confess to sloppy security. That may make some sense for them, but not for society as a whole. The latest breaches highlight the need for mandatory reporting of intrusions into corporate computer networks. That would allow other firms to learn lessons, and encourage laggards to get their act together and beef up their security.

The danger is that forcing firms to announce even the tiniest virus outbreak is a recipe for over-regulation. But they should have to report attacks to the authorities in the same way that they would any other kind of theft or assault. Finance provides a model: banks have to tell regulators when people try to pinch things, without necessarily broadcasting every lapse.

Sony will pay a high price for its sloppiness with employees’ private data: lawsuits are looming. Mr Obama may also be shamed into producing more evidence against North Korea. But the best hope for the future of the internet is to reinforce the international co-operation needed to track down crooks, hooligans and hacktivists wherever they are. In the meantime, companies must do their best to defend themselves. They can no longer claim that they weren’t warned.