NSA Chief Hacker Explains How To Harden Defenses Against His Elite Attack Dogs

If you think that the likes of the NSA needs to rely on zero-day exploits to get their job done, you apparently have things completely wrong. At the USENIX Enigma security conference in San Francisco this week, the NSA's chief of Tailored Access Operations, Rob Joyce said that it's his team's sheer talent makes its attacks successful, not simple flaws waiting to be exploited.

While it does seem likely that the NSA makes use of zero-day exploits when the juicier ones are found, Joyce says that it's not as though his team simply has a "skeleton key" that's able to open any door it chooses. Instead, "persistence and focus will get you in." He continued that "There's so many more vectors that are easier, less risky, and quite often more productive than going down that route."

That latter comment should raise some red flags for anyone managing a network in the enterprise, or perhaps even at home. Sometimes, Joyce says, his hackers merely lurk in the shadows, waiting for an opportunity to present itself.

Even something as modest as Steam could open an attack vector

So you don't update the bevy of PCs you oversee quick enough? Depending on the vulnerabilities squashed, that means the door can sometimes be left wide open until action is taken. Another major issue is that otherwise secure networks can become unsecure because people introduce outside devices that could open up vulnerabilities. "Why go after the professionally administered enterprise network when people are bringing their home laptops, where their kids were going out and downloading Steam games the night before?"

As mentioned above, there's little doubt that the NSA takes advantage of zero-days when it makes sense to, but zero-days always have a time-limit, as companies tend to be quick to patch them. It's for that reason why the NSA prefers to not rely on them.

If there's a lesson to be learned from Joyce's comments, it's that if the government wants in, it has the resources to get in. The best thing we can do as home users is to keep our devices up-to-date, and just hope that no one would ever want to fiddle around with your network.