Emails are a huge cyber security threat, Mandia says – a single click on a malicious email link can be the downfall of entire networks. “You’re hacking your own device, or you’re hacking your own system,” he warns.
This captain of the tech industry is not a wide-eyed evangelist, but a realist on the frontlines of cyberwarfare. In an exclusive interview, he shares on his cyber fatalism, the threat of North Korea, his distaste for cryptocurrency, and the future of cyberspace.
Cyber fatalism
As warfare moves from physical realm to cyberspace, cyber attacks are now the new norm in the world. So how can institutions keep up? “I don’t know if you can”, Mandia says. Governments and people should expect to be hacked at some point. “People are always going to be vulnerable to some extent”. “An attacker needs to break into one machine; defenders need to defend millions,” he notes. “It doesn’t make it a fair fight.”
According to Mandia, the biggest aggressors in cyberspace are now countries, which are increasingly using cyber attacks to twist geopolitical situations to their own advantage. “Most modern nations will have an offensive capability, whether you want to admit it or not,” he remarks.
Earlier this June, personal information of 1.5 million patients in the networks of SingHealth, Singapore’s largest group of healthcare institutions, were stolen – an attack, that Mandia believes, was likely state-sponsored. “Looking at this from the outside, my gut is that breaches like the SingHealth breach are targeted attacks. Somebody wanted to break into them specifically, which adds to the complexity of countermeasures.”
North Korea a threat
And one country has fast emerged as one of the world’s biggest cybersecurity threats: North Korea, says Mandia. “North Korea is not predictable,” he says. “In cyberspace, there’s not a deterrent in place.”
Earlier this year, FireEye successfully traced three North Korean hacking units to the world’s most high-profile cyber attacks – with two groups specialising in political cyber-espionage and one specialising in cyber-heists of banks and other financial institutions. In 2014, North Korean hackers leaked thousands of internal emails and unreleased movies from Sony Pictures. “I don’t know if I learned anything good from the Sony breach other than we don’t want to see it happen again,” Mandia says. But “you have to hold people who do it accountable,” he adds.