The cyberattack which paralysed Sony Pictures last month exposed flaws in the studio’s data security, but Hollywood rivals and other big corporations have been given a chilling warning: it could happen to anyone.
You can spend millions investing in firewalls, encryption and ultra-sophisticated passwords and still find your secrets plundered and splashed across the internet, security experts warned.
Sony is still reeling from the 24 November attack which leaked at least five films online, potentially crippling box office revenues, and unveiled private information about more than 6,000 employees and stars, from Sylvester Stallone’s social security number to the amount – $6,000 – James Franco earns for driving himself to work.
“The only way to fully protect yourself from something like this is to shut down your business,” said Paul Proctor, chief of research for security and risk management at Gartner, a technology research firm.
Critics have accused Sony of having lax controls, but the uncomfortable truth is that organisations need to balance security with the needs of running a business, creating inevitable vulnerabilities, Proctor said.
“A dedicated enemy with sufficient resources can compromise any security system,” he said. “There is no such thing as perfect protection. This is just a demonstration of it. People who believe they can be protected are likely to have their trust shaken by reality.”
Suspicion about those responsible for Sony’s nightmare before Christmas has oscillated between North Korea and company insiders or former insiders, with speculation increasingly tilting toward the latter.
Sony employees in Los Angeles discovered the breach when they logged on to computers and were greeted with the image of a red skeleton and a mocking message: “Hacked By #GOP” – a reference to a group calling itself Guardians of Peace.
In addition to leaking films like Brad Pitt’s second world war tank movie Fury, which is still in cinemas, and Annie, an upcoming release, the hackers dumped passwords, employee performance appraisals, salaries and other sensitive information online.
The FBI is investigating. On Thursday, the US Justice Department announced it was creating a unit within its computer crime and intellectual property section to help the private sector repel cyber attacks.
“It is important that we address cyber threats on multiple fronts, with both a robust enforcement strategy as well as a broad prevention strategy,” said Leslie Caldwell, head of the department’s criminal division.
John Arquilla, a professor of defence analysis at the US Naval Postgraduate School in Monterey, who invented the term “cyberwarfare” two decades ago, said the attack reinforced his view that the US should actively recruit talented coders who know how to break into networks – and thus how to defend them.
“Today’s master hackers are as important to securing cyberspace as yesteryear’s German rocket scientists were to exploring outer space. Many countries actively recruit these master hackers,” he said.
“In the United States, however, the relationship is very fraught, with officials torn between their desire to deter hacking by punitive means and their growing awareness that, without hacker help, improving cyber security will be a slow, halting process.”
Commercial enterprises are “terribly vulnerable”, as are critical information and military infrastructures, said Arquilla. “Far too little progress has been made in developing sound defences.”
Suspicion for the Sony attack fell on North Korea because of Pyongyang’s anger over a forthcoming Sony comedy, The Interview, starring Franco and Seth Rogen, which depicts a fictional plot to assassinate Kim Jong-un. In a June letter to United Nations secretary-general Ban Ki-moon, North Korea called the film an “undisguised sponsoring of terrorism, as well as an act of war”.
After initial coyness about any involvement, a New York-based North Korean diplomat told the Voice of America broadcast network his government had nothing to do with it.
Data security experts with Trend Micro and AlienVault said a destructive malware programme which the FBI warned about this week was probably used in the Sony attack. It used the Korean language its its system and was the same malware which crippled South Korea in March 2013, in attacks dubbed “Dark Seoul”.
But experts also said it was easy to insert fake Korean-tinged data into the malware and that the Sony attack’s use of taunting imagery, publication of salaries, and emails to journalists bore hallmarks of a “hacktivist play”, possibly related to disgruntled employees or former employees.
The studio, already under pressure to cut overheads by $250m, is expected to have to spend tens of millions of dollars on rebuilding its computer network and cyber sleuthing, plus possible legal costs.
Legal and technical experts said security and the needs of running a modern business involved a difficult balance.
“There is no legal requirement to make maximum effort in every instance to protect data. The law requires you to do what is reasonable,” said Behnam Dayanim, co-chair of global privacy and data security protection at Paul, Hastings, Janofsky & Walker. “It’s not clear to me if Sony reasonably could have done something to prevent this breach from happening.”
Sony would not be the last company to suffer in this way because underlying network infastructure was designed for a time when data was protected in silos, said Suni Munshani, chief executive of Protegrity, a data security firm.
“To expect organisations to recognise and secure all the gaps that exist among all those exposed connection points is an extraordinary challenge.”
This article was written by Rory Carroll in Los Angeles, for theguardian.com on Friday 5th December 2014 19.10 Europe/Londonguardian.co.uk © Guardian News and Media Limited 2010