Journal of Cyber Policy interviews founder and CEO Jason McNew on national cyber defense

January 31, 2018
Jason McNew
Cyber Defense, Cyber Security, Cyber Security News, Government, Stronghold Cyber Security In The News

Journal of Cyber Policy‘s Hugh Taylor recently interviewed Stronghold Cyber Security’s Jason McNew on the topic of national cyber defense. In it, McNew discusses the federal government’s ability to handle a massive cyber attack, some of the nation’s most vulnerable infrastructure, as well as counterfeit hardware from China posing a serious security risk (Note: see an earlier blog post titled “China Turns Cyber Weapons on American Small Businesses via APT10” where McNew discusses other risks posed by China). An excerpt of this interview is posted below:

Hugh Taylor: Having worked in the government, what’s your impression of the U.S. federal government’s ability to handle a massive cyberattack?

Jason McNew: Well, this might sound kind of cynical, but when you look at COOP and COG, Continuity of Operations and Continuity of Government and those sorts of things, they’re chiefly designed to protect all the people that work and operate within the beltway. And I say that because I’ve personally seen some of that stuff. It’s more designed to protect them than anything.

Hugh Taylor: How do you see a cyberwar scenario playing out?

Jason McNew: If we got into a shooting match with China in the Pacific Ocean, I don’t think they’re going to go onto direct combat with the U.S. fleet. They’re going to shut down the ACH system, for example, or attack DFAS, which is what funds the federal government, something like that.

Or they could attack the power grids. And just to give you an example, if you look at something that, in my opinion, should definitely be funded by Congress and it’s constitutional, too, as far as I can tell, is the Shield Act. The Shield Act is intended to short up our electrical infrastructure, the transformers, against an EMP attack. Not only is an EMP attack a threat against the grids, also there’s natural threats to that as well. You might be familiar with the Carrington event, that was in 1859, and that was a coronal mass ejection. A CME is when the sun burps out a pile of ionized crap, and it energies circuits, and it induces current, and these things. And the Carrington even was so bad that it set telegraph wires on fire at the time and electrocuted people. And if something like the Carrington event were to happen today, then there’s no guesses. It’s anybody’s guess as to what would happen. So, that’s similar to … So there’s two different reasons why we should be funding the Shield Act. And my point is that congress is really not doing a good job doing anything to identify and mitigate these threats at all.

Hugh Taylor: One question I have, because I’ve heard this answered in two different ways, some people say, “Well, this sort of disaggregated nature of the infrastructure in the U.S. makes it a little harder to attack,” like nobody could really attack everything all at the same time. Do you think that’s true or is that wishful thinking?

Jason McNew: No, I think that’s a valid argument. There’s two sides to that coin, though, because one thing we do know with the grids, in particular, is that there’s a cascading effect and there’s certain … And I’m not an electrical engineer, and my understanding of those kinds of things is somewhat rudimentary, but there’s theoretical attacks that could cause cascading failures in the grid, even though they’re federated and desegregated, so to speak.

So that if you attack a single point, or a couple of points at once, that it would shut the grids down. But as far as the IP infrastructure goes, that is certainly true because there’s a bunch of different providers that have different pipes that go all over the place, and fiber nodes and those sorts of things. And it makes the United States harder to attack than, for example, a European country. That argument is true and untrue at the same time. You can make strong arguments in both directions on that one.