The Sony Breach and The U.S. Government’s Responsibility to Act

By Eric Noonan • December 2, 2014

The last week or so marks what I would describe as an unprecedented shift in the impact of cyber attacks with the Sony breach. I run from the constant fear, uncertainty, and doubt (FUD) that gets circulated and recirculated by vendors and media outlets but I see this attack and more specifically the impact as different for several reasons. The Sony attack is also a call to action for the government of the United States to get their act together on cybersecurity and DO something to help American businesses large and small better defend themselves.

So what was different about the Sony attack?

Scope and impact. The scope of the attack as we know it so far is different from anything I can ever have remembered seeing before. Instead of a massive attack targeting specific information like large volumes of credit card or social security numbers, this attack stole intellectual property, HR records and caused disruption to “the network”. That’s malice and the intent to do measurable harm to a specific company rather than gain financially, the scale and scope of which we have never seen before.

The impacts of this attack were swift and far-reaching. Intellectual property in the form of five or more movies from Sony Pictures was stolen and are being shared illegally around the web. Salaries, home address and other Human Resources related data of 6,000 Sony Pictures employees were stolen and shared and posted in one form or another across the web. Finally, the company was reportedly shut down and held hostage to ransom demands that left many computers unresponsive.

All of these details in both and scope and impact represent an unprecedented attack on a US-based company (Sony Pictures Studios is located in Culver City, CA).  Our government has fiddled while Rome burns and it’s time that the government step in and partner with industry to find a way to stop the bleeding. I’ve had the pleasure to be part of a measurably productive government/industry partnership in cybersecurity with the Defense Industrial Base (DIB) program and I testified before the House Armed Services Committee (HASC) Subcommittee on Emerging Threats and Capabilities extolling the incredible value of the DIB program and how it could and should be meaningfully expanded. So I know we have the talent, both in government and industry to address (not solve) this issue.

We have all the right people to deal with this in a meaningful way that can improve the current situation. I’m the last person to ever ask the government to lead anything but in this case, I really do think it’s their job and I know firsthand that they have a template for doing it.

CyberSheath Blog

Dr. Robert Spalding to Address Nation-State Attacks at CMMC Con 2021

Since the inaugural CMMC Con, we’ve seen some of the most malicious attacks on American infrastructure ever executed. The SolarWinds attack reverberated across the entire government as agencies scrambled to discover what nation-state attackers had accessed and stolen. The Colonial Pipeline, shut down by a ransomware attack, led to fuel…

CMMC-AB vice chair Jeff Dalton to address CMMC Con 2021

The swiftness and severity of recent cyber attacks has dominated headlines and revealed that many organizations still don’t quite know what to do to protect themselves, as well as the businesses and government entities they’re connected to.   Ransomware attacks were a big point of discussion at the recent G7…

CMMC Con 2021 Opens Registration, Reveals Theme and Speakers

CMMC compliance stands in the way of revenue for every defense contractor in the supply chain. Now that CMMC is a reality for the Defense Industrial Base (DIB), learn how contractors — primes and subs, large and small, foreign-owned — are handling the standards and requirements, as well as the…

Our Trusted Partners

Cyberark McAfee Thycotic RSA Tenable Alien Vault Alert Logic Microsoft

CMMC Con 2021 is here! Save your spot to hear the latest on CMMC from our expert speakers across the government and Defense Industrial Base.