Jon Oltsik

After Black Hat, DefCon, and the recent McAfee report, you are probably tired of all of the hype around APTs. I agree that the industry has co-opted and obfuscated but these "low-and-slow" attacks are something we need to understand and address before more of our private information and intellectual property flies out the IP-connected door.

One of the characteristics of APTs is some type of social engineering tactic where the bad guys somehow con an internal user to download a malicious executable. This creates an internal outpost where hackers can steal credentials, scan the network, and ultimately steal valuable data.

In spite of the fact that RSA Security and Epsilon recently suffered a security breach, Sony seems to be getting the majority of nightmare security headlines. Why? Probably because Sony and its PlayStation are more ubiquitous. Sony is a trusted brand that was producing high-end Trinitron TVs back in the 1970s, and anyone with young boys in their house probably owns a PlayStation or some similar gaming device.

Sony is under a lot of heat these days so it is finally going public with some details about the breach and its impact -- and things are worse than first thought. First, Sony now says that the PlayStation breach may have compromised the personal records of as many as 77 million user accounts. Second, early reports that user passwords were encrypted turned out to be false. Instead they were transformed using a hashing algorithm. Since some hashing algorithms aren't exactly bulletproof, this could also be a problem. Finally, Sony is getting dragged through as the U.S. and other government bodies press the companies for answers.

At the beginning of September, the two co-chairs of the Bipartisan House Cybersecurity Caucus (Jim Langevin, D-RI and Michael McCaul, R-TX) sent a letter to President Obama asking him to expedite the appointment of a Cybersecurity Coordinator. The congressman stated: "Specifically, we strongly believe that the continued absence of a permanent cybersecurity coordinator impedes the ability of federal agencies to move forward in updating and strengthening their aging cyber policies, while also complicating our efforts to collaborate with private institutions that play such a critical role in keeping our nation safe."

Here we are in October and there is still no Cybersecurity Coordinator in site. The House is not taking this inactivity lying down. Lacking executive cybersecurity leadership, House Intelligence Technical and Tactical Intelligence Subcommittee Chairman C.A. (Dutch) Ruppersberger (D-MD) is taking the matter in his own hands by reviewing Federal cybersecurity plans and working with the private sector to better understand the issues. The Congressman recently stated, "We need a road map to [help us] decide what we're going to do because this is going to cost us billions of dollars. And the government can't do it all."

As of this morning, unofficial sources are reporting that T-Mobile has acknowledged that some of its servers have in fact been compromised but it is still investigating the extent of the damages.

Okay so let's say that this is true and that thousands of T-Mobile subscribers' private information has been compromised. Will this breach be the tippingpoint that triggers massive action? After all, T-Mobile is in the networking business. If a company with the technical chops of T-Mobile is hacked, then banks, utilities, and government systems must be sitting ducks.