Let Your Fingers Do the Fighting: Pre-Acquisition Exploits - The Technology Crucible

This paper addresses a new form of information warfare in the form of a serious hidden technology exploitation that poses a fundamental risk to all users of IT, telecommunications, and other "powered" systems, and proffers approaches for dealing with such threats. Such challenges if left unaddressed, represent the ultimate form of warfare. Heretofore, IT and telecommunications professionals in particular have been concerned principally with "post acquisition" exploits from viruses, worms, Trojans, password hacking, rootkits, EMI/RFI attacks, etc. Such traditional threats have been deemed to be from outside the protected boundaries of the enterprise. However, today it is becoming apparent that a much more pernicious threat exists in the form of "pre-acquisition" hidden exploits, exploits embedded in the product prior to acquisition, against which most are ill prepared to defend themselves. Such exploits represent the ultimate "Trojan Horse" attack in that the users themselves bring the compromised equipment into the protected boundaries of the enterprise thereby compromising traditional protections provided by authentication, access, and firewall defenses. And with numerous state organs apparently working with the manufacturers in their respective countries, the exploitation of other nation states and the enterprises within those states is real and substantive. These "pre-acquisition" technology exploits are examined and approaches are proffered to help in mitigating such challenges and risks.