Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

08:05 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now

Former FBI Agent James Gagliano: 'Cyber Touches Everything'

Former FBI Agent James Gagliano sees the worlds of physical security and cybersecurity increasingly merging in the area of critical infrastructure.

NEW YORK -- ISC East -- When James Gagliano joined the FBI in the early 1990s, Smith Corona typewriters still dominated the space on an agent's desk.

Gradually that changed, with three or four FBI agents typically sharing one desktop PC in an office. Eventually, especially after the September 11 terrorist attacks in New York, Washington, DC and Shanksville, Pa., laptops, smartphones and other digital equipment became standard gear within the agency.

Now, as the world faces an increasing array of cybersecurity problems, including cyber attacks that are targeting critical infrastructure such as ports, power plants and nuclear facilities, Gagliano notes that everything related to security is cyber centric.

"I saw the transition from the cyber side, and I also saw how cyber touches so many things in the realm of the FBI's focus, as well as in law enforcement and the security industry," Gagliano, now a retired FBI supervisory special agent, adjunct professor at St. John's University in New York, and current on-air analyst for CNN, told Security Now in an interview.

"It has a piece of counter-intelligence, a piece of counter-terrorism, a piece of criminal, a piece of intelligence gathering, a piece of special operations and even a piece of our admin branches, which are the six branches that the FBI focuses on... We realize that in law enforcement that just like narcotics that touch everything, especially the way terrorists earn money illegally through drug sales, it's the same way with cyber. Cyber touches everything," Gagliano added.

An Army infantry officer before starting his 25-year FBI career, Gagliano admits he was slow to see cyber threats as a major law enforcement concern and focused more on physical security, including stints with the agency's SWAT unit and Hostage Rescue Team. (See Let's Get Physical: Why Protecting Hardware Is Essential to Good Cybersecurity.)

However, the big eye opener for Gagliano was the 2015 San Bernardino, Calif., attack that turned into a legal tussle between Apple and the FBI over gaining access to one of the suspect's iPhones. Eventually, the agency found a hacker willing to crack the company's encryption.

In his view, the issue became whether Apple would unlock the iPhone in this one case, or whether by cooperating with law enforcement, the company would allow the government to have access to proprietary methods that would allow agents access to any phone at any time by bypassing the encryption.

This is where Gagliano sees a balancing act in the new world of cyber threats and the role technology plays.

"It raises issue and I don't know what the sweet spot is," Gagliano said. "I understand the concerns from the private sector and I understand the concerns from people who say, 'I have a right to privacy and I don't want the government or anyone else to be able to get into my phone.' But I also come from a law enforcement background where I see so many incidences where that is necessary to keep people safe."

Another area of interest for Gagliano is the protection of critical infrastructure.

This is also a place where the interests of the federal government and the private section converge, especially as structures such as airports become more secure and hardened against attacks, and terrorists and other attacks begin to look for other targets that are less secure, such as industrial ports, water treatment systems, chemical plants, healthcare facilities and other critical infastructure.

At the same time, several high-profile cyber attacks have targeted the industrial control systems (ICS) that manage the safety systems of these facilities. These cyber attacks could cause damage by causing a facility-wide shutdown, or creating an entrance into network for a long-term cyber espionage scheme. (See Industrial Manufacturing Sector Increasingly Susceptible to Cyber Attacks.)

To counter the convergence of physical and cyber threats to these structures, Gagliano believes that the industry will invest more in red teaming exercises that can challenge the security of these facilities and pinpoint where the weak spots are.

"Red teaming is not predictive. It's diagnostic. The whole goal of that is to go in, whether it's a power plant or a security system on your laptop, is to probe to see where the weaknesses are, so it can't be some within the firm with a vested interest in its success, Gagliano said. "It has to be a group that quote-unquote does not have a dog in this fight. That can look at attacking systems, and figure out where the weaknesses are, and where the vulnerabilities are, whether it's a power plant or a stadium venue or something out there in the cyber sphere. I think read teaming is something you don't hear a lot about right now, but you will hear a lot about it in the future."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-19
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
PUBLISHED: 2020-09-18
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
PUBLISHED: 2020-09-18
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
PUBLISHED: 2020-09-18
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11....
PUBLISHED: 2020-09-18
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-W...