Cover terms, or "code names" as they are often called serve a very useful purpose in a wide range of operations. Their value in intelligence is undeniable. They are also useful in enterprise incident response (IR). As a consultant, I sometimes find myself needing to take a phone call in less than opportune environments and cover terms for customers and particular incidents help to keep me from disclosing any confidential information.
But there's an art to selecting cover terms for incidents. A few guidelines I follow are:
This last one (involve the PR team) is pretty important, but is rarely done. Experience has taught me to assume that everything will get out to the press eventually. You don't want a funny inside joke name to get out in the press. What's funny with the appropriate inside context, it probably won't be funny absent any context. That makes your organization look really bad. Over the years I've seen lots of obscene and questionable cover terms. In my younger, dumber days I might have even created a few myself. But I know better now.
Why am I bringing this up? The Equation Group tool leaked files being auctioned have a large number of tool cover terms in it, many of them questionable. For instance, I can't help but notice the obviously phallic undertone in the large number of BANANA related terms (e.g. EPICBANANA). Either that or someone maybe just loves bananas.
My personal favorite in the cover term set released has to be BUZZDIRECTION. Whoever snuck that past the cover term censors is a freaking genius at word play. At first glance it looks totally innocent, but try saying it fast once and you can't help but appreciate the adolescent quality it has. Totally innocent mistake? Given the other phallic references, I highly doubt it.
While others focus on the exploits and tools themselves, I figured I'd focus o this somewhat less obvious implication of the leak - namely that you must assume everything will be leaked eventually. A little care up front can prevent your organization from looking like a beer fueled frat house in the press later.
But there's an art to selecting cover terms for incidents. A few guidelines I follow are:
- Don't base the term on the name of the client (it's not much of a cover)
- Don't make the cover term the same as the name of the malware used (many different attacker may use variants of the same malware)
- Run your names past your PR department
This last one (involve the PR team) is pretty important, but is rarely done. Experience has taught me to assume that everything will get out to the press eventually. You don't want a funny inside joke name to get out in the press. What's funny with the appropriate inside context, it probably won't be funny absent any context. That makes your organization look really bad. Over the years I've seen lots of obscene and questionable cover terms. In my younger, dumber days I might have even created a few myself. But I know better now.
Why am I bringing this up? The Equation Group tool leaked files being auctioned have a large number of tool cover terms in it, many of them questionable. For instance, I can't help but notice the obviously phallic undertone in the large number of BANANA related terms (e.g. EPICBANANA). Either that or someone maybe just loves bananas.
My personal favorite in the cover term set released has to be BUZZDIRECTION. Whoever snuck that past the cover term censors is a freaking genius at word play. At first glance it looks totally innocent, but try saying it fast once and you can't help but appreciate the adolescent quality it has. Totally innocent mistake? Given the other phallic references, I highly doubt it.
While others focus on the exploits and tools themselves, I figured I'd focus o this somewhat less obvious implication of the leak - namely that you must assume everything will be leaked eventually. A little care up front can prevent your organization from looking like a beer fueled frat house in the press later.
This comment has been removed by a blog administrator.
ReplyDeleteI have been using Kaspersky Anti-virus for a few years now, I'd recommend this product to everyone.
ReplyDelete