Shawn Henry, the executive assistant director of the FBI’s Criminal, Cyber, Response, and Services Branch, told the Wall Street Journal that the government and private sector is outgunned, when it comes to the defending data and networks from cyber criminals.
Henry told the Journal that he didn’t see anyway to come out of the current situation ahead, unless companies were willing to make major changes to their consistently vulnerable networks.
“I don’t see how we ever come out of this without changes in technology or changes in behavior, because with the status quo it’s an unsustainable model. Unsustainable in that you never get ahead, never become secure, never have a reasonable expectation of privacy or security,” he said.
During his interview, Henry made his point by pointing out that agents had found data stolen from other companies during completely separate investigations, and that the executives had no idea they had been breached.
“We have found their data in the middle of other investigations,” he said. “They are shocked and, in many cases, they’ve been breached for many months, in some cases years, which means that an adversary had full visibility into everything occurring on that network, potentially.”
“We’ve been playing defense for a long time. …You can only build a fence so high, and what we’ve found is that the offense outpaces the defense, and the offense is better than the defense… In many cases, the skills of the adversaries are so substantial that they just leap right over the fence, and you don’t ever hear an alarm go off,” he said.
Henry is set to retire from the FBI soon, and will join an unidentified firm in Washington. In related news, the FBI’s CIO is also leaving to join the private sector. Chad L. Fulgham will leave the FBI on April 13th, in order to return to the private sector after only three years of service.
Fulgham was the driving force behind the Sentinel program, the FBI’s new case management system. Sentinel replaces the outdated Automated Case Support system, by moving it from a primarily paper-based case management system to an electronic work flow-based management system with data sharing capabilities.