NSA’s Joyce outlines how U.S. can disrupt and deter foreign hacking

“We have to impose costs in a visible way to start deterrence,” the NSA's Rob Joyce told an industry association.

The United States will do more to disrupt the malicious cyber-activity that foreign adversaries are aggressively using to advance their interests, a National Security Agency official said Thursday.

“We have to impose costs in a visible way to start deterrence,” said Rob Joyce, senior cybersecurity adviser at NSA. “We have to go out and try to make those operations less successful and harder to do.”

Speaking to an industry association in Hanover, Maryland, Joyce cited the 2017 WannaCry and NotPetya malware outbreaks — and Russia’s use of information operations in the 2016 U.S. election — as examples of nation-states moving from “exploitation to disruption” to impose their will in cyberspace. Washington has blamed North Korea and Russia, respectively, for the devastating WannaCry and NotPetya attacks, which cost billions of dollars in economic damage.

Some foreign governments have less legal constraints on their activities in cyberspace than the U.S., Joyce told a local chapter of the Armed Forces Communications and Electronics Association (AFCEA).

“So they’re launching unconstrained operations against us,” said Joyce, the former White House cybersecurity coordinator. “And often, the responses come, if ever, after those costs are already realized.”

In a bid to more easily hit back against adversaries, the Trump administration has loosened policy rules on the U.S. military’s use of offensive cyber operations. Additionally, the Pentagon last September released a strategy that emphasized the need to “defend forward,” or engage adversaries before they strike U.S. computer networks.

The shift in approach outlined in the Pentagon strategy is key to repelling foreign hackers, according to Joyce.

“[W]e’ve said the time has come that we have to alter the field and not just stand back and wait for [our] opponents to probe us,” he said.

The more proactive stance in cyberspace includes scouring Department of Defense networks for malicious software tools and working with industry to remediate, publicize, and degrade the tools’ efficacy, according to Joyce.

He supplemented his call to tighten network defenses with a warning that it is getting easier for adversaries to leverage advanced hacking tools.

The amount of expertise needed to conduct cyberattacks is decreasing “as sophisticated internet tools become easier to use,” Joyce told the audience of industry executives and defense contractors. “So you have a small group of people who do the innovation, who understand the vulnerabilities and the capabilities that they can unleash.”

In cyberspace, superiority is ‘fleeting’

The head of the NSA and U.S. Cyber Command, Gen. Paul Nakasone, told lawmakers last month that the command was successful in deterring foreign adversaries from interfering in the 2018 midterm elections. Reports said a U.S. offensive disrupted Russia’s infamous social-media troll farm, the Internet Research Agency, on Election Day in November.

Asked how U.S. cyber forces would build on those efforts for the 2020 election, Joyce said the work was already underway.

“We’re pretty proud of delivering a midterm election that was free of malfeasance and interference, and we’re already working pretty hard on the 2020 [election],” Joyce said, adding that the NSA would partner with the Cyber Command, the Department of Homeland Security, and the FBI, among other agencies.

“I fully expect tradecraft to evolve in the adversary space, and we’ve got to do the same,” he said. “So that’s the focus for 2020.”

The continually-contested nature of cyberspace, and its status as an arena of geopolitical competition, was a theme in Joyce’s remarks.

Key to successfully navigating the domain, Joyce said, is understanding that “at any given time, if you can claim some cyberspace superiority, that’s probably fleeting, due to the nature of the technology, the networks, [and] everybody’s understanding of what you’re doing and where you’re going.”

Stryker attack highlights nebulous nature of Iranian cyber activity amid joint U.S.-Israel conflict

It’s been difficult early on to separate signal from noise, even if the attack on the medical device maker looks like a qualified success for the attackers.

Possible U.S.-developed exploits linked to first known ‘mass’ iOS attack

Google previews cyber ‘disruption unit’ as U.S. government, industry weigh going heavier on offense

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure