The "RISKY BUSINESS" Blog

Much Ado About "nothing" ... A Very Significant "nothing"

Unless you have been living under a rock for the last few weeks you are likely aware of “Operation Aurora” – the Chinese state sponsored cyber attack on Google and at least 20 other prominent US firms (Adobe, Juniper, Rackspace, Yahoo, Symantec, Northrop Grumman and Dow Chemical).  It’s a big enough story that our clients have enquired as to why we have not blogged about it to this point.

Honestly, in much the same way that Seinfeld was a show about “nothing” (the Chinese Restaurant episode where the entire episode is them waiting for a table, is perhaps the best example), I look at the Operation Aurora story the same way (the irony of using the Chinese Restaurant episode is not lost on me.) 

The only thing surprising about state sponsored cyber attacks against key US companies is that people were surprised by it.

Over the last five or six years we have seen a steady increase in the number of projects where we have helped defend our clients against industrial espionage, insider attacks, and cyber-attacks by organized groups.   Even more “telling”, we have been approached by “potential clients” with malicious project opportunities: hacking into Gmail, industrial espionage, eradicating evidence of criminal activities in advance of an FBI forensic investigation, etc. (needless to say our hats are white and these potential clients were rebuffed. 

Seinfeld was significant in that a show about “nothing” was really something, and that “nothing” became part of our collective cultural consciousness.  Operation Aurora is significant in that  “nothing new” has been escalated in the media to a point where it may become part of our collective information security consciousness. For that reason … it was a very significant “nothing” – and will hopefully have a positive impact on our understanding of evolving information security risks.