Cyber espionage has cost U.S.-owned businesses about $14 billion in reported economic losses since last October, according to the United States (FBI). But private security experts said this is a fraction of a huge problem that will take a cultural shift to put corporate America ahead of today?s high-tech spies.
, a Washington-based senior management scientist with , a non-profit research and analysis institution, said nobody knows how big the problem is. ?It takes a lot more worth than we?ve been willing to give it to try to estimate the size of the problem.?
?I don?t have an even good theoretical estimate, much less a practical estimate,? he added.
Companies are often too embarrassed to announce a security breach because people don?t always notice it when it first happens. ?It takes an average of a year and a half before you realize that something is wrong,? said Libicki.
Canada?s telecommunications company, , for example, told the in February that it lost data for nearly a decade before realizing it was being spied on.
Randall Coleman, FBI Section Chief at the agency?s Counterintelligence department in Washington said hacking by both organized groups and state-backed actors has taken off in recent years. ?It is certainly the wave of the future,? he said.
?There are state-sponsored corporations throughout the world that spy on the United States and attempt to steal our technology,? Coleman added.
One of the most frequently accused is China. But the Chinese government has repeatedly denied involvement in cyber espionage, saying it also suffers from the problem.
But , CEO of , a consulting company said it is hard to know if the perpetrator is ?the kid down the street, a teenager seeking gratification, a terrorist, a hacker, a nation-state, an insider - you don?t know.? She said it all starts from the premise that this was an unauthorized illegal activity.
The biggest threat is not coming from nations, but from other corporations, said cyber security expert Damien Miller, CEO of , a cyber security company.
A case in point is the legal action (AMSC), a global energy solutions provider, has brought against China?s . While AMSC has declined interview requests, its website stated that the company is seeking more than $1.2 billion in damages stemming from ?contractual breaches and property theft.?
, Senior Researcher with IT security company said cyber criminals typically go after companies with the weakest defenses. But with the kinds of targeted attacks taking place today, he said ?everybody needs to have very strong security. It?s no longer about being better than the weakest one.?
A few years ago, industrial spies mostly targeted Fortune 100 companies, but now all sorts of companies all over the world are being affected. ?That?s definitely worrisome,? said Schouwenberg, because ?for the longest time we?ve been working under the impression that as long as you are more secure than your competitors, you are fine.?
But the increasing sophistication of recent malicious software or has raised the threat level. Schouwenberg specifically cited , an intelligence tool that looks for data that could be useful for attacking industrial control systems, and its 2010 predecessor, , a ground-breaking cyber-weapon designed to sabotage machinery in an Iranian nuclear enrichment facility.
While security experts believe Duqu and Stuxnet were probably created by the same developers, Schouwenberg said this top-tier malware is now functioning ?as a source of inspiration for regular cyber criminals.?
Today?s threats sneak in and lie undetected for months before making a move, said Westby. They can circumvent anti-virus software - even change it to remain undetected - and load other software on the computer. ?You can get a malware kernel in there that?s then starting to bring in [and] that they can use to then steal data.?
She added that ?companies are just not prepared to deal with this level of sophistication.?
She said businesses have a ?false sense of security? that firewalls and anti-virus programs provide enough protection. ?They need to re-evaluate how they are approaching threats. And it?s not just going to be a technological solution,? she said.
Some of the immediate steps companies can take, Westby said, include re-evaluating whether or not they have the right personnel and adequate budgets, and whether roles and responsibilities are aligned so that their various entities communicate effectively when anomalies occur.