加油站里焦急的司機排起長隊,希望趕在油賣光之前加上油,這一場景無疑預(yù)示著經(jīng)濟遭逢困境。
20世紀(jì)70年代,由于經(jīng)歷了長達(dá)數(shù)月的石油禁運,輸氣管道變成美國生活中非常普遍的特征,而2012年美國東北部地區(qū)“油荒”的罪魁禍?zhǔn)讋t是颶風(fēng)桑迪(Hurricane Sandy)。不過此前這類事件均因為地緣政治僵局和歷史性自然災(zāi)害而引發(fā),今年夏天的燃油短缺則是因為勒索軟件攻擊。當(dāng)時,黑客劫持了科洛尼爾管道運輸公司(Colonial Pipeline)的數(shù)據(jù)和網(wǎng)絡(luò),迫使該公司支付贖金。盡管此后加油站排起的長隊只是短期現(xiàn)象,但隨之而來的價格和供應(yīng)問題讓人們清醒地意識到,網(wǎng)絡(luò)攻擊對經(jīng)濟造成的風(fēng)險巨大,并且呈現(xiàn)出不斷擴大的趨勢。
2020年,勒索軟件加密貨幣支付金額超過4億美元,是2019年的四倍多,這還只是網(wǎng)絡(luò)攻擊造成經(jīng)濟損失的一小部分。網(wǎng)絡(luò)罪犯和勒索軟件行為者越來越擅長利用技術(shù)創(chuàng)新,為違法犯罪尋找安全匿名的支付方式。要想加以阻止,需要新式協(xié)調(diào)的戰(zhàn)略,要結(jié)合公共和私營部門資源。這是保護(hù)經(jīng)濟和國家安全,避免受到網(wǎng)絡(luò)犯罪和勒索軟件攻擊的唯一途徑。
美國政府已經(jīng)將該戰(zhàn)略的要素付諸行動。今年5月,美國總統(tǒng)喬·拜登簽署了一項行政命令,消除了共享網(wǎng)絡(luò)事件相關(guān)信息的障礙,加強了聯(lián)邦政府的網(wǎng)絡(luò)安全,并改善了軟件供應(yīng)鏈的安全性。聯(lián)邦政府正在就該問題與其他國家積極接觸。各項努力中包括通過G7網(wǎng)絡(luò)專家組(G7 Cyber Expert Group)和其他國際論壇解決網(wǎng)絡(luò)攻擊造成的全球風(fēng)險,也意味著對縱容惡意網(wǎng)絡(luò)活動的國家采取堅定立場。正如今年早些時候拜登總統(tǒng)提到的:將采取“任何必要行動”,避免經(jīng)濟和基礎(chǔ)設(shè)施遭受襲擊。
這就是為何在9月下旬,美國財政部(Treasury Department)宣布采取新行動,打擊利用勒索軟件攻擊企業(yè)的網(wǎng)絡(luò)犯罪。首先,美國財政部對虛擬貨幣交易所Suex實施制裁,因為Suex為至少8種勒索軟件變體的非法收益提供便利。Suex的交易所對犯罪分子從勒索軟件攻擊中賺取利潤至關(guān)重要。被制裁后,Suex無法與美國公司和個人開展業(yè)務(wù),也無法加入全球經(jīng)濟交流中心的美國金融體系。這一行動充分顯示,美國決意揭露并破壞網(wǎng)絡(luò)攻擊中使用的非法基礎(chǔ)設(shè)施。
其次,美國財政部正在更新2020年勒索軟件指南,以進(jìn)一步支持并保護(hù)與執(zhí)法部門共享信息的勒索軟件受害者。新指南體現(xiàn)了美國財政部的觀點,即政府和行業(yè)合作并共享相關(guān)信息以阻止網(wǎng)絡(luò)攻擊,必要時對網(wǎng)絡(luò)攻擊采取補救行動,就能夠最大程度地保護(hù)經(jīng)濟。
我們深知,在涉及網(wǎng)絡(luò)安全時,最好的進(jìn)攻就是良好的防御。美國的很多關(guān)鍵基礎(chǔ)設(shè)施,例如公用事業(yè)公司、管道、鐵路和醫(yī)院,均屬于私營。相關(guān)公司和其他公司都要果斷采取行動,加強網(wǎng)絡(luò)防御,預(yù)防網(wǎng)絡(luò)攻擊。這意味著網(wǎng)絡(luò)安全水平要達(dá)到最高標(biāo)準(zhǔn),并要求可以訪問其網(wǎng)絡(luò)和數(shù)據(jù)的第三方服務(wù)提供商達(dá)到同樣的高標(biāo)準(zhǔn)。
私營領(lǐng)域里的多家公司已經(jīng)宣稱將遵守承諾。最近的一項旅行者風(fēng)險指數(shù)(Travelers Risk Index)調(diào)查中提到,網(wǎng)絡(luò)風(fēng)險是各種規(guī)模公司最關(guān)心的問題。相關(guān)擔(dān)心也在推動行動。今年8月在拜登總統(tǒng)牽頭的一場會議上,亞馬遜(Amazon)、蘋果(Apple)、谷歌(Google)、IBM和微軟(Microsoft)等幾家科技公司承諾在供應(yīng)鏈安全方面發(fā)揮領(lǐng)導(dǎo)作用,投資網(wǎng)絡(luò)安全培訓(xùn),提供先進(jìn)的安全解決方案,運營中進(jìn)一步整合網(wǎng)絡(luò)安全。
最后,必須將網(wǎng)絡(luò)攻擊可能造成的經(jīng)濟損失當(dāng)成金融體系的風(fēng)險。銀行和保險提供商等金融公司決策時,也要考慮網(wǎng)絡(luò)風(fēng)險。相關(guān)公司必須讓客戶、投保人和交易對手采取謹(jǐn)慎舉措,貫徹網(wǎng)絡(luò)安全標(biāo)準(zhǔn)。
我們并不是期望私營部門自行解決網(wǎng)絡(luò)攻擊和勒索軟件問題。當(dāng)公共和私營部門共同努力解決最大挑戰(zhàn)時,經(jīng)濟運行最為順當(dāng)。通過密切合作、關(guān)鍵信息共享并開發(fā)合作解決方案,就能夠維護(hù)經(jīng)濟穩(wěn)定并促進(jìn)經(jīng)濟安全增長。(財富中文網(wǎng))
沃利·阿德耶莫是美國財政部副部長。
譯者:馮豐
審校:夏林
加油站里焦急的司機排起長隊,希望趕在油賣光之前加上油,這一場景無疑預(yù)示著經(jīng)濟遭逢困境。
20世紀(jì)70年代,由于經(jīng)歷了長達(dá)數(shù)月的石油禁運,輸氣管道變成美國生活中非常普遍的特征,而2012年美國東北部地區(qū)“油荒”的罪魁禍?zhǔn)讋t是颶風(fēng)桑迪(Hurricane Sandy)。不過此前這類事件均因為地緣政治僵局和歷史性自然災(zāi)害而引發(fā),今年夏天的燃油短缺則是因為勒索軟件攻擊。當(dāng)時,黑客劫持了科洛尼爾管道運輸公司(Colonial Pipeline)的數(shù)據(jù)和網(wǎng)絡(luò),迫使該公司支付贖金。盡管此后加油站排起的長隊只是短期現(xiàn)象,但隨之而來的價格和供應(yīng)問題讓人們清醒地意識到,網(wǎng)絡(luò)攻擊對經(jīng)濟造成的風(fēng)險巨大,并且呈現(xiàn)出不斷擴大的趨勢。
2020年,勒索軟件加密貨幣支付金額超過4億美元,是2019年的四倍多,這還只是網(wǎng)絡(luò)攻擊造成經(jīng)濟損失的一小部分。網(wǎng)絡(luò)罪犯和勒索軟件行為者越來越擅長利用技術(shù)創(chuàng)新,為違法犯罪尋找安全匿名的支付方式。要想加以阻止,需要新式協(xié)調(diào)的戰(zhàn)略,要結(jié)合公共和私營部門資源。這是保護(hù)經(jīng)濟和國家安全,避免受到網(wǎng)絡(luò)犯罪和勒索軟件攻擊的唯一途徑。
美國政府已經(jīng)將該戰(zhàn)略的要素付諸行動。今年5月,美國總統(tǒng)喬·拜登簽署了一項行政命令,消除了共享網(wǎng)絡(luò)事件相關(guān)信息的障礙,加強了聯(lián)邦政府的網(wǎng)絡(luò)安全,并改善了軟件供應(yīng)鏈的安全性。聯(lián)邦政府正在就該問題與其他國家積極接觸。各項努力中包括通過G7網(wǎng)絡(luò)專家組(G7 Cyber Expert Group)和其他國際論壇解決網(wǎng)絡(luò)攻擊造成的全球風(fēng)險,也意味著對縱容惡意網(wǎng)絡(luò)活動的國家采取堅定立場。正如今年早些時候拜登總統(tǒng)提到的:將采取“任何必要行動”,避免經(jīng)濟和基礎(chǔ)設(shè)施遭受襲擊。
這就是為何在9月下旬,美國財政部(Treasury Department)宣布采取新行動,打擊利用勒索軟件攻擊企業(yè)的網(wǎng)絡(luò)犯罪。首先,美國財政部對虛擬貨幣交易所Suex實施制裁,因為Suex為至少8種勒索軟件變體的非法收益提供便利。Suex的交易所對犯罪分子從勒索軟件攻擊中賺取利潤至關(guān)重要。被制裁后,Suex無法與美國公司和個人開展業(yè)務(wù),也無法加入全球經(jīng)濟交流中心的美國金融體系。這一行動充分顯示,美國決意揭露并破壞網(wǎng)絡(luò)攻擊中使用的非法基礎(chǔ)設(shè)施。
其次,美國財政部正在更新2020年勒索軟件指南,以進(jìn)一步支持并保護(hù)與執(zhí)法部門共享信息的勒索軟件受害者。新指南體現(xiàn)了美國財政部的觀點,即政府和行業(yè)合作并共享相關(guān)信息以阻止網(wǎng)絡(luò)攻擊,必要時對網(wǎng)絡(luò)攻擊采取補救行動,就能夠最大程度地保護(hù)經(jīng)濟。
我們深知,在涉及網(wǎng)絡(luò)安全時,最好的進(jìn)攻就是良好的防御。美國的很多關(guān)鍵基礎(chǔ)設(shè)施,例如公用事業(yè)公司、管道、鐵路和醫(yī)院,均屬于私營。相關(guān)公司和其他公司都要果斷采取行動,加強網(wǎng)絡(luò)防御,預(yù)防網(wǎng)絡(luò)攻擊。這意味著網(wǎng)絡(luò)安全水平要達(dá)到最高標(biāo)準(zhǔn),并要求可以訪問其網(wǎng)絡(luò)和數(shù)據(jù)的第三方服務(wù)提供商達(dá)到同樣的高標(biāo)準(zhǔn)。
私營領(lǐng)域里的多家公司已經(jīng)宣稱將遵守承諾。最近的一項旅行者風(fēng)險指數(shù)(Travelers Risk Index)調(diào)查中提到,網(wǎng)絡(luò)風(fēng)險是各種規(guī)模公司最關(guān)心的問題。相關(guān)擔(dān)心也在推動行動。今年8月在拜登總統(tǒng)牽頭的一場會議上,亞馬遜(Amazon)、蘋果(Apple)、谷歌(Google)、IBM和微軟(Microsoft)等幾家科技公司承諾在供應(yīng)鏈安全方面發(fā)揮領(lǐng)導(dǎo)作用,投資網(wǎng)絡(luò)安全培訓(xùn),提供先進(jìn)的安全解決方案,運營中進(jìn)一步整合網(wǎng)絡(luò)安全。
最后,必須將網(wǎng)絡(luò)攻擊可能造成的經(jīng)濟損失當(dāng)成金融體系的風(fēng)險。銀行和保險提供商等金融公司決策時,也要考慮網(wǎng)絡(luò)風(fēng)險。相關(guān)公司必須讓客戶、投保人和交易對手采取謹(jǐn)慎舉措,貫徹網(wǎng)絡(luò)安全標(biāo)準(zhǔn)。
我們并不是期望私營部門自行解決網(wǎng)絡(luò)攻擊和勒索軟件問題。當(dāng)公共和私營部門共同努力解決最大挑戰(zhàn)時,經(jīng)濟運行最為順當(dāng)。通過密切合作、關(guān)鍵信息共享并開發(fā)合作解決方案,就能夠維護(hù)經(jīng)濟穩(wěn)定并促進(jìn)經(jīng)濟安全增長。(財富中文網(wǎng))
沃利·阿德耶莫是美國財政部副部長。
譯者:馮豐
審校:夏林
The sight of anxious drivers forming long lines at gas stations, hoping to fuel up before supplies run out, is a sure signal of economic distress.
In the 1970s, a months-long oil embargo made gas lines an all-too-common feature of American life, while in 2012 shortages hit the Northeast following Hurricane Sandy. But those events were the result of a geopolitical standoff and a historic natural disaster. This past summer’s gas shortages were caused by a ransomware attack—an attack in which criminal hackers take a target’s data and network hostage until the victim makes a ransom payment—on Colonial Pipeline. Though the resulting lines at gas stations were short-lived, the ensuing price and supply issues were a stark reminder of the significant and growing risk that cyberattacks pose to our economy.
In 2020, the amount paid in ransomware cryptocurrency payments reached over $400 million, more than four times the level in 2019, and just a fraction of the economic harm caused by all cyberattacks. Cybercriminals and ransomware actors are increasingly exploiting technological innovations that offer secure, anonymous payments for nefarious and criminal purposes. Stopping them requires a novel and concerted strategy, one that combines the resources of the public and private sectors. This is the only way to protect our economy and national security from the risk created by cybercrime and ransomware attacks.
The U.S. government is already putting elements of this strategy into action. In May, President Biden signed an executive order that removes barriers to sharing information related to cyber incidents, enhances the federal government’s cybersecurity, and improves software supply-chain security. The federal government is actively engaging with our foreign counterparts on this issue. This includes addressing the global risks that cyberattacks pose through the G7 Cyber Expert Group and other international forums. It also means taking a firm stance with countries that turn a blind eye to malicious cyber activity. As the President said earlier this year, we will take “any necessary action” to defend our economy and infrastructure from these attacks.
That is why, in late September, the Treasury Department announced new actions to combat cybercriminals that use ransomware to take companies hostage. First, we are imposing sanctions on Suex, a virtual currency exchange that has facilitated transactions involving illicit proceeds for at least eight ransomware variants. Exchanges like Suex are critical to criminals’ ability to extract profits from ransomware attacks. As a result of yesterday’s designation, Suex will be unable to conduct business with American companies and individuals or access the U.S. financial system that sits at the center of global economic exchange. This action is a signal of our intention to expose and disrupt the illicit infrastructure used in these attacks.
Second, the Treasury is updating our 2020 ransomware guidance to further support and protect ransomware victims that share information with law enforcement. This new guidance reflects our view that we can best protect our economy when government and industry collaborate and share all relevant information to deter and—where necessary—remediate cyberattacks.
We also know that when it comes to cybersecurity, our best offense is a good defense. In the United States, much of our critical infrastructure—like utility companies, pipelines, rail lines, and hospitals—are owned by private companies. These firms and others need to take decisive action to bolster their cyber defenses and prevent attacks from happening in the first place. This means meeting the highest standards for cybersecurity and holding third-party service providers, with access to their networks and data, to the same high standards.
Many in the private sector have demonstrated that they share this commitment. A recent Travelers Risk Index survey cited cyber risk as a top concern across companies of all sizes. These concerns are already driving action. During a meeting led by President Biden in August, several technology companies including Amazon, Apple, Google, IBM, and Microsoft committed to lead improvements in supply-chain security, invest in cybersecurity training, deliver advanced security solutions, and further integrate cybersecurity throughout their operations.
Finally, the potential for economic damage posed by cyberattacks must be understood as a risk to our financial system. Financial firms like banks and insurance providers need to integrate cyber risk into their decision-making. These firms must hold their clients, policyholders, and counterparties accountable for taking prudent steps to implement cybersecurity standards.
We do not expect the private sector to solve the problem of cyberattacks and ransomware on its own. Our economy works best when the public and private sectors work together to solve our greatest challenges. Through close collaboration, the sharing of critical information, and the development of cooperative solutions, we can safeguard our economy and promote secure economic growth.
Wally Adeyemo is deputy secretary of the U.S. Treasury.