Just After Reports of Another North Korean Ballistic Missile Test ...

My followers began asking for clarity from an expert on the relationship between China and North Korea's nuclear program.  I asked Gordon Chang, author of Nuclear Showdown: North Korea Takes on the World, and internationally respected pundit on security matters in Asia, about this.





With his comprehensive approach and gracious style, Gordon Chang is renowned for his incisive analyses and commentary.  He lived and worked in Shanghai as Counsel to the American law firm Paul Weiss, and earlier in Hong Kong as Partner in the international law firm Baker & McKenzie.  He has briefed the United States CIA, Pentagon and State Department on security developments and he shared this assessment with me this week:

"North Korea has three launchers--theTaepodong-2, the KN-08, and KN-14--that can hit the lower 48 states.  The better view is that the North cannot mate a nuclear warhead to them, but that is only a matter of about three years.  The North Koreans have already put a nuke on top of their intermediate-range Nodong.

Beijing could rein in North Korea, but Chinese leaders do not want to do so because they view America as their main strategic rival.  They find Kim Jong Un's antics useful in keeping us and our allies off balance. 

We could force Beijing into being helpful--by, for example, imposing secondary sanctions on Chinese banks and enterprises--but so far there have been only tentative moves to do so.  The U.S. sanctions on Dandong Hongxiang industrial, imposed last month, show attitudes in the American capital are changing.  They are changing because an unstable Kim Jong Un in control of the world's most destructive weapons is presenting American policymakers with little choice."

N.B. Gordon Chang will be presenting The New Nuclear Politics: China, Iran and North Korea, at the Election Night 2016 Security Summit, 80 Minutes Around the World: Security Briefings for the Next American President, in Westport, CT, on November 8th.

 

With News of the Iraqi Effort to Take Back Mosul from the Islamic State ...

 

I asked Dr. Austin Long, authority on international security matters and particularly urban operations in counterinsurgency, to put this in perspective for us.  He replied:  "The long awaited offensive to retake Mosul is a welcome sign of progress in the war on the Islamic State but should not be heralded as the beginning of the end. The loss of Mosul will hurt the group but not fatally.  We should always remember that retaking Fallujah in 2004 was seen as a major sign of progress but two years later Al Qaeda in Iraq, the Islamic State's predecessor, was stronger than ever."

Hear Dr. Long on Monday, November 7, 2016, at 7:00 p.m. at Sacred Heart University in Fairfield, CT.  He delivers, The Islamic State in Iraq and Syria: Crucible for the Next American President.  For details: LisaBernard@SecuritySpeak.net or www.Facebook.com/PodiumTime.

October is National Cyber Security Awareness Month and Robert Bigman, Former CISO of the United States CIA - under whose watch the Agency was never hacked – shares his thoughts with Lisa Bernard

 

I arrived in Arlington, Virginia, at News Channel 8 Studios to meet Robert "Bob" Bigman before he went on the air as Francis Rose’s guest on Government Matters. From the get-go, I sensed the “quiet celebrity” he enjoys among those in-the-know in Washington, D.C. He is the man who served for thirty years at the Central Intelligence Agency – most of the latter years as Chief Information Security Officer (CISO).  Simply put, he kept the CIA’s data secure.  Now, at a time when most Americans – private citizens and public officials – feel the threat or pain of being hacked, Bob's insights seem particularly pertinent and his achievements especially notable.  I was delighted that this down-to-earth professional – who for so long was under the radar – was graciously coming into the spotlight to share his sense of this with us.  What he conveyed was as inspiring as it was stirring.  His cheerful manner and serene demeanor bespoke a guarded “could-be-done” attitude about recovering the upper hand in the cyber security challenges we face – “guarded” being the operative word.  My takeaway was that we Americans can combat these threats provided 1) our resolve comes with calm, candor and clarity about the nature of the technologies and the humans who engage them and 2) that we have devoted leadership at the organizational and national levels.

LISA BERNARD: On one thing all cyber-security experts agree: human behavior and psychology loom large as key factors.  We are a nation of e-consumers, wed to convenience and beginning to integrate into the job force a generation raised on the efficiency of their smart phones.  Bob, what will it take - new technology or a crisis - to shift the pendulum from user-myopia to individual vigilance? 

 

LISA BERNARD: We are electing ourselves a new Commander-in-Chief next month and although it is now common knowledge that the software we use is outdated - even in our nuclear missile systems -  we hear little about this from the candidates. Just how outdated is government software and why are antiquated systems still in use? 

 

LISA BERNARD: Many of my followers are CISOs themselves or CEOs who rely on them.  With the proliferation of mobile devices and the trend toward super-computing what advice can you give them?

 

 

LISA BERNARD:  If our next POTUS appointed you "Tsar of Cyber Security," with all the resources you would need to set our nation on a modern and safe course, what would be your first priority?

 

 

LISA BERNARD: Since leaving government service,  as a consultant,you have been moving the dial, persuading firms to move toward more managed and isolated networks.  In the private sector, where the internet is like oxygen, how are you doing this? 

 

ROBERT BIGMAN: The really bad news is that even if you wanted to stay disconnected, increasingly, technology and the evolution of your world will connect you.  The marketplace has already determined that you're going to stay connected to the internet.  So what can you do?  Start with your biggest risk - which is how you and your devices - computers, mobile devices, smart phones - how they actually connect to the internet. Know that to ameliorate this risk, you just can't simply any longer rely on commercial capabilities like firewalls, modems and router protection and control lists.  There's a collection of simple things you can do. First, I recommend that you NOT use commercial applications like Windows or Adobe. Instead use alternative operating systems like Ubuntu and Opera as a browser. 

 

 

LISA BERNARD: What products are now available to make this "shift" possible and attractive in a culture that is hyper-connected?

 

ROBERT BIGMAN: There are probably very few products that I would recommend where you can say that if you buy this product that you can secure your data completely and your don’t have to worry any more.  In fact, there are no products like that despite what vendors will tell you.  What I find is the biggest problem is that organizations simply don’t understand the risks to their systems, their networks, and their data and they too often – as a result of attending the RSA conference, the Black Hat conference, the DefCon conference – they too often fall into the trap of using technology to solve very complex problems that require people issues, process issues, policy issues and yes, some technology issues.  But trying to address them with just technology is the number one mistake.  And I know the vendors don’t want you to hear that message, but the fact is that unless you have a cyber-security program and that you have as the component parts of governance, IT management, public policies and processes, no matter how much technology you buy, you’ll still get beat.  And every event, every incident I’ve been involved where we’ve investigated – unauthorized access, penetration, hacking, unauthorized use of data – all involve the process and policy issues violations as ever as they involve misuse or improper technology.

###

 

Bob Bigman is available for briefings, talks and workshops via Lisa Bernard's SecuritySpeak, LLC. See his bio at www.SecuritySpeak.net.  To discuss the particulars of hosting him, phone (203) 293-4741 or email LisaBernard@SecuritySpeak.net.

 

 

 

 

 

Russian Foreign Policy Turns on a DIME (Diplomacy, Information, Military, Economics): An Interview with Dr. Stephen J. Blank

 

The weather was just the first treat on July 19^th when I arrived in Washington, D.C., at the Capitol Hill Club on that cool, dry and sunny morning to hear Dr. Stephen J. Blank deliver an address, Russia’s Global Probes. Like a luxury cruise ship, Dr. Blank navigated his remarks with expert engineering, using sophisticated instruments that work below deck to produce a smooth sail and memorable journey. His talk docked in three parts of the globe – Latin America, the Middle East and Europe. In each port of Russian activity, he delivered his audience reality-checks on Russian history in the region, Vladimir Putin’s objectives, Russia’s intrinsic nature, and the problems for U.S. national security with projecting American values into the interpretation of Russia’s undertakings. With the temporal breadth of a skilled historian of Russian, Soviet and post-Soviet affairs, Dr. Blank portrayed a crisp yet comprehensive snapshot of the world today through the Russian lens. He deftly decoded Russian behavior and Vladimir Putin’s positions, leaving his listeners sobered and empowered with a ready frame of reference for understanding and interpreting Russian diplomatic, information, military and economic operations. 

 

Dr. Blank and I then returned to his office at the American Foreign Policy Council for an interview. His generosity continued. A former professor of Russian National Security Studies and U.S. National Security Affairs at the Strategic Studies Institute of the US Army War College, he rolled up his sleeves and got to work informally as if my viewers were students there with him in his private office hours. Here are excerpts.

 

BERNARD:  I heard U.S. Secretary of State John Kerry assert that "nowhere is there a greater hotbed or incubator for these terrorists than in Syria," as he wrapped up meetings in Moscow with Russian President Putin and Foreign Minister Lavrov exploring U.S.-Russian cooperation to end the five-year civil war there. Reports are conflicting about the outcome of their talks and the possibility at all for military cooperation and intelligence-sharing. As an old Cold Warrior, it's not my first instinct to imagine us "sharing" intelligence with the Russians or "cooperating" militarily. Yet, the Syrian situation is compelling.  What's your take on all this? 

 

 

BERNARD: My clients at SecuritySpeak include global investors, businesspeople and entrepreneurs.  Some are exploring markets and opportunities in the energy and other resource-rich regions of the former USSR.   How stable is Central Asia today?



 

BERNARD: My clients at SecuritySpeak are concerned about threats like North Korean missile strikes and cyber-attacks.  What do you see as the Russian role in these scenarios?

BERNARD: In four months, we Americans will elect ourselves a new President and Commander-in-Chief.  What frame of reference can you offer him or her for advancing American and global security interests?



 

BERNARD:  Thank you, Steve, for your insights, time and energy.  I know you have an interview with Romanian TV journalists at noon and you're only just back from delivering a master class in Brussels last week.  It was a pleasure attending your address this morning at the Capitol Hill Club and speaking with you here now.

 

To arrange a presentation by Dr. Blank for your firm, association or university, contact Lisa Bernard's SecuritySpeak, LLC at 203.293.4741 or LisaBernard@SecuritySpeak.net. 

 

 

 





Terrorism in America: A Reality Check on the Surreal



 

Sunday, the 12^th of June, was surreal.  I was outdoors in the fresh air and morning sunshine reading Holy War on the Home Front: The Secret Islamic Terror Network in the United States in preparation for my interview with its author, Dr. Harvey Wolf Kushner, Director of the Homeland Security and Terrorism Institute at LIU Post.  When I left for work early that morning I had heard about "a shooting" in Orlando.  By lunchtime, I learned that the attack was at an LGBTQ nightclub, had been declared an act of terrorism and the death toll was climbing. News outlets reported that the terrorist declared his allegiance to ISIS at the outset of his rampage.  My heart was racing as I tried frantically to recall where my gay family members said they would be over the weekend.  There were more ironies than I could process, including that I left this book for last in my reading of Dr. Kushner’s publications.  Why?  Because, I reasoned, it was published in 2004 and now it is 2016, and surely things have “changed.”  I would read it – but last and leisurely on the Sunday before the interview.  By the time I got home to hear President Obama’s address to the nation, it was all too clear that Harvey Kushner’s book is still pertinent in 2016.  Words from his Introduction were haunting me, “I chair a department at a university, but I quickly learned that when dealing with terrorists that death is not academic.  Terrorists kill people.  They pull triggers, plant bombs, and blast holes in the NYC skyline.”  

Like so many Americans, I am forlorn and on Tuesday, June 14^th, when I walked into Harvey Kushner’s office, I couldn’t hold back.  “These terrorists are playing ‘soft-target roulette’ with us,” I proffered.  “That’s what’s got us feeling anxious.  The Boston Marathon, San Bernardino, and now Orlando …. We get it.  While we are exercising, recreating, and socializing – precisely to blow off stress – we are actually most vulnerable to opportunistic terrorists.  We don’t need to be flying or on the high seas.  That is what is now so unnerving.”  A genial host and gracious respondent, Harvey Wolf Kushner immediately delivered the perspective available only from one with the breadth and depth of counter-terrorism experience his forty-plus years of service provides.  From the 1972 Munich Olympics Massacre, through the bombing of Pan Am Flight 103 at Lockerbie, to the mass shooting in Orlando, Harvey Kushner embodies his book, Encyclopedia of Terrorism.  The walls of his office are alive with commendations and warm letters of appreciation for his service from elected officials, representatives of allied governments, those in law enforcement at all levels, as well as branches of the U.S. military and federal agencies. I couldn’t help but note how fortunate his graduate students are to study with him and the notable faculty he has assembled from among the best professionals actively engaged in counter-terrorism. Congress declared his institute a National Security Center of Excellence. 

I asked for twenty minutes but Harvey Kushner gave me a full afternoon of his time as he responded to my questions and the concerns of my followers at Security Briefs.  I left the interview wiser, more insightful and crystal clear on one thing:  Dr. Harvey Wolf Kushner is, and has been, unabashedly devoted to one goal: keeping civilians safe from terrorists. Here are some excerpts. 

BERNARD:  I read in your 2004 book that "[m]ost say even three years after 9/11, the FBI and related federal intelligence and law-enforcement agencies still don't 'download' real-time-information to local agencies."  I am hearing that very same thing in the analyses of the Orlando Massacre in 2016. Is this so and why?

 



BERNARD:  We heard it with the Tsarnaev brothers, Nidal Hasan and now again with Omar Mateen - they "fell off" the FBI's watch list.  How does such a thing happen in the post 9/11 era and what does this portend for "lone wolf" attacks?



 

BERNARD:  My followers at Security Briefs are educators, retail executives, medical professionals, practitioners in law and accounting, clergy, and other concerned citizens who are responsible for other people - their students, clients, customers, congregants and families.  What steps can they take to make their workplaces and social spaces are more secure?
 

 

BERNARD:  In a Q&A Session with former Newtown Chief of Police, Michael Kehoe, I heard him underscore the importance for local law enforcement to maintain "informal" communication with first responders and emergency management professionals at all levels - county, state and federal.  In short, you need your crisis management allies to be just a cell-phone call away.  Your reaction?

 

BERNARD:  Many of my followers at Security Briefs are professionals in human resources, law, the military, financial services, IT, etc., who are considering applying their expertise in a different capacity in the next phases of their careers.  Others are parents of college-bound kids considering their first-career options.  What are the job and career prospects for those interested in counter-terrorism?





 

BERNARD:  In seven months, we Americans will inaugurate a new President and Commander-in-Chief.  What guidelines would you offer her or him?



 

 

BERNARD:  Harvey Kushner, it is good to know you. Thank you for your service and for your thoughts and candor this afternoon.

 

Lisa Bernard is Founder and President of Lisa Bernard's SecuritySpeak, LLC, a speakers bureau devoted to educating people from all walks of life on matters of national, global and cyber-security.  To discuss your need for a guest speaker, contact her at LisaBernard@SecuritySpeak.net or via phone at (203) 293-4741.

 



 

 

Scott N. Schober's HACKED AGAIN Earns its Place on the Permanent Bookshelf

HACKED AGAIN:  It Can Happen to Anyone Even a Cybersecurity Expert, ISBN 978-0-9969022-1-2, by Scott N. Schober, 2016.  Available on Amazon for $14.95 in paperback.

HACKED AGAIN makes a welcome contribution to our cyber-security literacy.  This easy-to-read, Tiger’s Eye of a book, is a must-have and must-keep-handy tool for becoming and staying conversant on cyber-safety matters.  If you head a firm or family, but feel too busy, anxious or uncomfortable to learn about your cyber-security, let Scott N. Schober make your foray manageable.  A software engineer, inventor and CEO of a wireless security tech firm, he writes in personal voice and reveals his own frustrations, curiosity and reflections on the risks of contemporary cyber-spatial life.  He chronicles his own learning curve, from his original vulnerabilities stemming from being human, to the victimization of his firm via the exploitation of technologies by cyber-thieves.   Investigating hacks against himself and cyber-crimes against his firm, Mr. Schober is a modern day Sherlock Holmes working the clues, tools, evidence and psychologies of all the players – hackers, institutions and victims.  He is a clever and humble private eye with the public’s interest at heart.  For each of us with a cyber-spatial footprint, from simple social media profiles to email accounts to complex e-commerce platforms, HACKED AGAIN is more than a primer.  It’s a mentor for learning the lingo and the ropes and replacing the generalized anxiety we have about cyber-security with basic competence.  In less than 200 pages, we non-techies can feel more confident about managing our digital footprints as sensibly and routinely as we protect our brick and mortar offices and homes.   

My recommendation is to start at the end with Mr. Schober’s carefully composed glossary which removes the first obstacle to individual cyber-vigilance – the language barrier.  If you feel that the lexicon of cyber-security is as confounding as the topic itself, rest assured that this glossary demystifies terms from the “bot” to the “TOR.”  A handle on the acronyms and jargon will immediately improve the ease with which you process news, instructions and information on cyber-security matters.  Then I suggest going back to Part I to piggy-back Mr. Schober on his journey.  He grows from ignorance through denial and into reality and reconciliation with what is now, for all of us, the “new normal” of personal, professional and civic life in our cyber-spatial world.  In Part 2, he prescribes behaviors and protocols to minimize one’s vulnerabilities and risks.  He concludes each chapter with useful mini-summaries, one paragraph “Quick-Tips” that you can apply or adopt immediately.   Particularly helpful are those that are counter-intuitive and thereby especially eye-opening and cyber-protective.   One such tip is “Do not click on the bottom of a spam e-mail and ask to be removed from the ‘Do Not E-mail’ list.  You will likely receive more spam because hackers now know you are a real person and will then sell your name for more money to other spammers.”  A reasonable person might think that eliminating their name from such a list is wise and lessens their unintentional digital footprint when, in fact, it expands it and their vulnerability.  They become more likely to be cyber-stalked and have their social media accounts mined for data and clues to their passwords. 

In his latter chapters, Mr. Schober expands his probe to our challenges as a society that shops with credit cards, banks online and works in cyberspace.  In an apolitical and non-judgmental manner, he assesses the dynamics of headline breaches and hacks like those that bedeviled so many at Target, JP Morgan Chase and Sony before moving on to threats we face as a cyber-warrior nation starting with the U.S. government’s Office of Personnel  Management.   Perhaps most meaningful for us laypeople, is that at no time does Mr. Schober lose sight of the human factors or toll as he explains the technological components of these violations and the news coverage of them.  This is among Scott Schober’s most valuable and consistent contributions to this field – he puts a human face on the subject of cyber-security in all its facets.   And it is an accessible and welcome one.  

HACKED AGAIN leaves room for a future edition as Scott Schober nimbly wrestles the next generation of cyber-technologies, schemes and malicious hackers.  Going forward, I hope he adds an index to the book to expedite the many references I see in my copy’s future.   HACKED AGAIN is a hard-copy keeper and will be dog-eared on my bookshelf until its sequel comes along.   

Get Smart: Learn your Cyber Risk in Under an Hour

 

Do you run a small to mid-sized firm, non-profit or department not yet as focused on cyber security as you need to be?  You’re not alone.  And, help is available.  I’ve been sharing with clients word of the impressive Confidential Cyber Risk Assessment (CCRA) being offered by Marc Groz ‘s firm Right Risk, LLC, and realized how many of my readers here might benefit from exploring this as well.  Marc is an authority on risk and financial markets, with a special focus on cyber and systemic risks.  He brings a unique experience profile to Right Risk, having served in senior risk, technology, and research roles for well-known hedge funds and a multi-billion-dollar asset manager.  I welcomed Marc to my interview seat to get a better sense of Right Risk’s cyber risk assessment for managers like you.  The following are excerpts from our talk. 

BERNARD:  Welcome back to Security Briefs, Marc.  In your promotional material you mention “the experts” at Right Risk involved in your CCRA offer.  Who are these experts and what do they deliver specifically?

 

BERNARD:   You have a powerful team at Right Risk and this is a sophisticated assessment, Marc.   Practically speaking, how does it work?  It sounds like a team of cyber-warriors will descend on the office in Ghost-busters gear and start frantically scanning all the computers and tablets.  Please clarify this for us. 

 

BERNARD:  If my readers want to take advantage of this offer, how do they get started?

 

BERNARD:  Thank you, Marc.  I know you’re speaking today on cybersecurity in salon format at LaunchTalk  so I especially appreciate your time. 

To learn more about Marc Groz and his availability for briefings and presentations see his biographical profile at www.SecuritySpeak.net or email LisaBernard@SecuritySpeak.net.