DDoS , Device ID , Risk Management

The internet of things is under attack, and the impetus for attackers is clear. Compromising thousands of legitimate devices gives cybercriminals tough-to-trace platforms for launching online attacks, ranging from distributing spam and malware to providing distributed denial-of-service attack services.

See Also: Eight Capabilities IT Pros Should Look for in a CASB

Some individual botnets today comprise 100,000 compromised devices or more, security experts warn. And this has enabled attackers to direct record-shattering amounts of bogus traffic against targets, unleashing DDoS mayhem.

More than a dozen types of common IoT-targeting malware are in use, according to the security firm Symantec. Furthermore, the recent release of source code used to build Mirai malware - which targets IoT devices sporting one of 62 different default passwords, according to the security researcher known as MalwareTech - presages what will surely be an increase in attacks.

Attacked in 60 Seconds

For one measure of the current IoT attack problem's severity, consider a Linux-based digital video recorder that was connected to the internet via a home cable modem by Johannes Ullrich, dean of research for the SANS Technology Institute, to act as a honeypot. The device allows remote logins via telnet, provided a user knows the password, which Ullrich left set to its default. It also used a normal Comcast IP address.

On average, the DVR was successfully exploited at least once every 30 minutes, Ullrich reports. But it also experienced intermittent denial of service conditions due to the volume of remote login attempts.

"The IP address is hit by telnet attempts pretty much every minute," Ullrich says in a blog post. "Instead of having to wait for a long time to see an attack, my problem was that the DVR was often overwhelmed by the attacks, and the telnet server stopped responding. I had to reboot it every few minutes."

Anatomy of an Attack

Many of the remote login attempts use a couple of commands to try and avoid logging into either a router or a well-known type of honeypot, Ullrich notes.

If the login is successful, then the attacker will often attempt to fingerprint the device and implant it with a malicious binary, Ullrich says. The binary file, once executed, starts scanning the internet for more vulnerable IoT devices, typically at a rate of more than 100 connections per second. The list of vulnerable devices is likely then routed back to a command server, so that those devices also can be attacked.

When it came to the DVR honeypot, however, "not all attacks were successful," Ullrich says. "The attacks used various passwords, and my honeypot only allowed logins for one of them. But a couple times an hour, someone used the correct password."

Phoning Home

Ullrich reports that a wave of brute-force telnet login attempts against IoT devices started in mid-September and is continuing.

Security experts say some of those login attempts are coming via Mirai malware. The security researcher known as Hacker Fantastic notes that Mirai-compromised devices will attempt to phone home via port 48101 TCP connections. Security researcher Kyle Lovett reports that as of Oct. 3, he had seen nearly 1 million unique devices creating port 48101 TCP connections. That suggests that the number of IoT devices compromised by Mirai attackers may have reached seven figures.

@hackerfantastic port 48101 has been showing increasingly growing numbers, a week ago around 450k, 2 days ago 850k and 950k today pic.twitter.com/LnOnkD1lnU

Default Problems

The success of these IoT attacks can be directly traced to many manufacturers opting to ship devices that have numerous services - including telnet - enabled by default. Many devices also sport default usernames and passwords, and these have been exhaustively cataloged by penetration testers and hackers and often circulated via "DVR password recovery software."

One commonly seen username plus password combination being tried by IoT attackers, for example, is "root" plus "xc3511," which is used to log into numerous types of DVRs, Ullrich says.

Honeypot Access Attempts Attempts to use a common, default IoT password - "xc3511" - to remotely access an internet-connected digital video recorder set up by SANS Institute to act as a honeypot.

Another default password being targeted by attackers is "7ujMko0admin," Ullrich says. As multiple online forums have documented, numerous devices built by Dahua Technology have firmware for which the telnet password is the device's default username and password - both are "admin" - prepended by "7ujMko0." For attackers, compromising devices that have left the default credentials intact takes virtually no effort.

I've reached out to Dahua for comment on the recent wave of IoT attacks that appear to be compromising large numbers of its devices, but have yet to hear back.

Manufacturers' Culpability

A large part of the IoT problem can be traced to manufacturers shipping devices that are not secure by default. Too many IoT devices sport default usernames and passwords and services that are active by default. Both are grossly irresponsible practices. In addition, too few manufacturers support IoT devices - which consumers may leave internet-connected for a decade or more - by issuing firmware updates to fix known flaws throughout the life of the device. And too few have a reliable mechanism for ensuring that still-in-use devices somehow get and install these updates (see The Internet of Buggy Things).

The problem doesn't just involve consumer devices and behavior. I've been told by some manufacturers of carrier-grade and enterprise IT equipment that the system integrators who install their products at customer sites prefer to use equipment that has a default configuration - to make their lives easier. Too often, however, this equipment gets rolled out by less experienced personnel, who leave the defaults intact. As a result, the devices become sitting ducks and are used to attack the rest of us.

Welcome to the growing internet of hacked things.

Cybersecurity , Insider Threat , Risk Management

The FBI arrested a 51-year-old National Security Agency contractor in late August for allegedly stealing top-secret documents that could compromise national security if made public, the U.S. Department of Justice says. There are indications that the case could be resolved before an indictment is filed.

See Also: API vs. Proxy: Understanding How to Get the Best Protection from Your CASB

Harold T. Martin III was detained after investigators executed a search warrant on Aug. 27, finding hard copies and digital copies of classified information after searching a vehicle, storage sheds and his residence in Glen Burnie, Md., according to the Justice Department. Booz Allen Hamilton, Martin's employer, fired him upon learning of his arrest.

Martin's arrest on Aug. 27 was kept secret until a judge approved the unsealing of an FBI affidavit on Oct. 5. Martin has been charged in federal court in Maryland with theft of government property and unauthorized removal and retention of classified materials by a government employee or contractor.

Martin's case may come to a quick resolution. On Sept. 13, federal prosecutors asked the court for more time to file an indictment. The motion, which was unopposed by Martin's defense counsel, was granted by U.S. Magistrate Judge Beth P. Gesner. The new deadline is March 1, 2017.

In asking for an extension, prosecutors cited several reasons, including that attorneys are "exploring the possibility of resolving this matter prior to presentation of the case to a grand jury." Martin's public defender couldn't immediately be reached for comment.

If convicted, Martin could face one year in prison for the unauthorized removal and retention of classified materials charge and 10 years for theft of government property.

Shadow Brokers Link?

Martin's arrest comes three years after NSA contractor Edward Snowden, who also worked for Booz Allen Hamilton, rocked the intelligence world by leaking tens of thousands of documents describing sensitive government data collection programs and cyber-espionage tools used to infiltrate foreign networks (see How Did Snowden Breach NSA Systems?).

It's unclear from the FBI's affidavit if the material allegedly stolen by Martin has been publicly released. But his arrest came less than two weeks after a mysterious group called the Shadow Brokers released in mid-August cyber-espionage tools that many experts suspect were developed by the NSA (see Confirmed: Leaked Equation Group Hacking Tools Are Real).

The U.S. government appears to be particularly concerned about six documents investigators recovered, which the Justice Department says were drawn from sensitive intelligence and produced by a government agency in 2014. The documents are critical to a "wide variety of national security issues," the Justice Department claims.

"The disclosure of the documents would reveal those sensitive sources, methods and capabilities," according to the Justice Department's news release.

The Sept. 13 motion gives an indication of the volume of material involved in Martin's case. Thousands of pages of documents and dozens of computers and digital storage devices were taken after he was served with a search warrant, it reads.

"The digital media contained many terabytes of information that must be reviewed by appropriate authorities," according to the motion. In it, a footnote describes a terabyte as equivalent to 500 hours of digital video, 200,000 image files or 1 million electronic books.

How Many Leakers?

Since the Snowden disclosures, subsequent releases of secret information have led to speculation that a second person inside U.S. government intelligence circles may be leaking information.

The theory gained traction after the German publication Der Spiegel in December 2013 published a 50-page catalog of tools from the NSA's Tailored Access Operations unit, which focuses on offensive cyber operations. Der Spiegel did not describe its source for the catalog but did not attribute it to Snowden.

The U.S. government has said Snowden's disclosures caused severe damage to intelligence operations. Snowden, who has been living in Moscow since June 2013, says he leaked the documents to show how the U.S. government's surveillance techniques infringed on the Constitutional rights of Americans. But his claim of being a whistleblower hasn't curried favor with the government, and a presidential pardon seems unlikely.

A fresh blow was delivered to the U.S. government in August when a then-unknown group calling itself the Shadow Brokers released a sample of exploit code and hacking tools that experts say probably came from the NSA (see Mystery Surrounds Breach of NSA-Like Spying Toolset).

The Shadow Brokers set up an auction for an additional batch of secret data it claimed to possess. A note written by the group was filled with what many suspected to be intentional grammar errors contrived by a native English speaker, again fueling theories that an insider may be responsible for the leak.

The hacking tools were sometimes sloppily coded but nonetheless effective, targeting widely used networking equipment that, if compromised, would allow an attacker to intercept and decrypt traffic. Cisco was among the hardest hit vendors, and subsequently patched zero-day exploits in its latest firewalls.

Martin's Background

When investigators questioned Martin, he initially denied taking the documents. But he later admitted taking documents and digital files that he knew were classified, according to the Justice Department.

Martin's LinkedIn profile is still online. The profile, which is under the name Hal Martin, shows he started work in July 2015 as a technical advisor and investigator on offensive cyber issues. It does not list an employer. Before that, Martin's profile says he worked as a contractor and consultant after doing an eight-year stint in the U.S. Navy that ended in 1996.

Martin profile says he started his PhD at University of Maryland, Baltimore County, in 2007 but that he is "trying to finish that dissertation."

Included in the profile is a link to Martin's academic web page, once hosted by UMBC. That web page is offline, but is still in Google's cache. The page contains a collection of links, including one to a research paper from 2014 that includes his university email address.

It appears Martin used his university email address to occasionally comment on security industry discussion forums. In February 2009, the same email address is listed on a discussion thread about the changing nature of applications hosted in data centers, referred to as cloud computing.

The post expresses an opinion about the security of applications that move around different data center environment and server farms. It warns of "commandos and dirty dozen types mounting the electronic castle walls," in an apparent reference to cyberattackers.

The post continued: "You just have to ask yourself if you are ready for digital aiki-do, or do you intend to let digital banditry win the day and plunder your lands. Up to you all. I'm ready if you are." The message was signed with the name "Sanjuro."

Dave Aitel, a former NSA research scientist who's now CEO of Immunity, posted an email he received from Martin in September 2012, in which he references practicing "Tomiki-ryu style Aikido." The email appears to be part of a discussion about activities at Infiltrate 2013, an annual security conference that Immunity runs.

Data Breach

Britain's privacy watchdog agency has slammed TalkTalk with a record fine of £400,000 ($511,000) for information security failings that allowed a hacker to steal customer data "with ease."

See Also: From Authentication to Advanced Attack Vectors: Top Trends in Cybercrime in Q1 2016

The London-based TV, broadband, mobile and phone provider, formally known as TalkTalk Telecom Group, suffered a devastating breach last year that ran from Oct. 15 to 21. The incident could have been prevented had the company put some basic security measures in place, the U.K. Information Commissioner's Office determined (see 5 Lessons from the TalkTalk Hack).

The ICO imposed the fine after finding that TalkTalk, which trades on the London Stock Exchange, violated the U.K.'s Data Protection Act by failing to put proper security measures in place to safeguard user data.

The attacks against TalkTalk resulted in the exposure of personal data - name, address, date of birth, telephone number, email address and financial information - on almost 157,000 customers, plus bank accounts and sort codes for more than 15,000 customers, according to a partially redacted report published by the ICO.

"TalkTalk's failure to implement the most basic cybersecurity measures allowed hackers to penetrate TalkTalk's systems with ease," Information Commissioner Elizabeth Denham says in a statement. "Yes hacking is wrong, but that is not an excuse for companies to abdicate their security obligations. TalkTalk should and could have done more to safeguard its customer information. It did not and we have taken action."

Database Unpatched

The ICO's report says that the TalkTalk breach involved infrastructure that was created by Italian telecommunications firm Tiscali - TalkTalk acquired its U.K. operations in 2009 - and in particular webpages that had access to a database called "Tiscali Master." The ICO says TalkTalk had failed to properly scan its infrastructure for potential threats and thus "was not aware that Tiscali's infrastructure included webpages that were still available via the internet in 2015" and which had access to the database and thus should have either been secured or removed.

In addition, TalkTalk was using an outdated version of the MySQL open source SQL database management system, which contained a known flaw that allowed the attacker to bypass access restrictions on the database. "The bug was first publicized in 2012 when a fix was made available by the software vendor," the ICO notes.

SQL Inject Attacks Could Have Been Prevented

After bypassing the access controls, the attacker then used the open source penetration testing tool sqlmap to scan the database for SQL injection flaws and exfiltrated data via a SQL injection attack, the ICO says. "User input was not validated," it adds, a step that could have blocked the SQL injection attack.

The ICO notes that TalkTalk failed to put proper defenses in place against SQL injection exploits despite having suffered a successful SQL injection attack on July 17, 2015, followed by another such attack less than two months later.

The maximum fine that the ICO can levy is £500,000 ($635,000). TalkTalk likely wasn't slammed with the maximum penalty because the privacy watchdog report found that the security failings were not a deliberate attempt "to ignore or bypass" the Data Protection Act, but rather amounted to "serious oversight."

In addition, the ICO report notes that the attack against TalkTalk cooperated fully with investigators; notified its customers and offered 12 months of free credit monitoring; and has since undertaken appropriate remedial action.

Reminder: Duty to Customers

But the ICO says the episode is a reminder that no organization should overlook cybersecurity concerns or skip basic information security practices.

"Today's record fine acts as a warning to others that cybersecurity is not an IT issue, it is a boardroom issue," the ICO's Denham says. "Companies must be diligent and vigilant. They must do this not only because they have a duty under law, but because they have a duty to their customers."

If TalkTalk pays the fine by Nov. 1 without contesting it, then the ICO notes that the monetary penalty will be reduced by 20 percent to £320,000 ($405,000).

That's a far cry from the fine that could have been imposed on TalkTalk under the EU General Data Protection Regulation, which U.K. businesses will be required to comply with as of May 2018, at least until Britain negotiates its "Brexit" from the EU. Under the GDPR, information commissioners can fine firms that violate EU privacy law up to 4 percent of their global annual revenue or €20 million ($22.5 million) - whichever is greater.

TalkTalk in February reported that the breach had already cost it £50 million ($76 million) and led to the loss of 100,000 customers.

London's Metropolitan Police is continuing a criminal investigation into the attack against TalkTalk.

So far, six individuals - ages 15 to 20 - have been arrested in connection with the attacks or subsequent attempts to blackmail TalkTalk (see TalkTalk Hack: UK Police Bust Teenage Suspect).

Anti-Malware , DDoS , Risk Management

Bad news: A hacker has released source code for malware that can be used to automatically find and hack internet of things devices that use default accounts and passwords, then use them to launch distributed denial-of-service attacks. Numerous Linux-based routers, security cameras and digital recorders, among other devices, are at risk and have been compromised in this manner to unleash record-breaking attacks (see Hacked IoT Devices Unleash Record DDoS Mayhem).

See Also: 2016 Annual Worldwide Infrastructure Security Update

Good news: Using the attack code isn't as simple as clicking "compile," meaning that unskilled "script kiddies" may find themselves hard-pressed to create an army of hacked IoT devices ready to do their DDoS bidding.

More bad news: It's a virtual certainty that the leaked code will be widely used, as well as eventually refined and turned into point-and-click attack tools for less technically sophisticated DDoS attackers.

Those are just a few of the takeaways following malware developer "Anna-senpai" releasing for free the supposed source code for Mirai malware, which has been tied to massive DDoS attacks launched via hacked IoT devices.

The source code dump was announced by Anna-senpai Sept. 30 in a post to Hack Forums, a social network devoted to hacking that security experts say attracts numerous hacker wannabes - a.k.a. script-kiddies - who lack technical knowledge but want to know how to bolster their skills. Many cybercrime-as-a-service purveyors advertise their wares on the site.

"Just so it's clear, I'm not providing any kind of 1 on 1 help tutorials," Anna-senpai said, noting that configuring the related scripts should take someone who knows what they're doing less than one hour.

Some security experts say the Mirai botnet appears to be the one that deep-sixed the website of information security journalist Brian Krebs, who ironically was also the first to report on the subsequent source code release. The malware targets Linux systems' SSH or telnet accounts, according to an analysis of the Mirai botnet published by the group of security researchers who are part of the "Malware Must Die" team.

The security researcher known as "Hacker Fantastic," via Twitter, rates the Mirai code "5/10, easy on the eyes, well commented, not an innovative malware but would read again. A++" and says it's designed to disrupt sites via UDP, TCP, DNS, GRE and HTTP attacks.

Hacker Fantastic says Mirai targets default credentials in IoT devices.

Thankfully, getting the code to work requires some technical knowledge. "The Mirai source code appears to be legitimate, but has been modified to mess with scriptkiddies who just compile and run," the security researcher known as Malwaretech says via Twitter.

Anna-senpai claims to now be giving up the DDoS thug life. "When I first go in DDoS industry, I wasn't planning on staying in it long. I made my money, there's lots of eyes looking at IOT now, so it's time to GTFO," Anna-senpai's post reads. "So today, I have an amazing release for you. With Mirai, I usually pull max 380k bots from telnet alone. However, after the Kreb [sic] DDoS, ISPs been slowly shutting down and cleaning up their act. Today, max pull is about 300k bots, and dropping."

Stresser/Booter Options Abound

DDoS attacks and related tools have long been sold via cybercrime sites by groups such as Lizard Squad, often labeled as stresser/booter services.

But Mirai is just one type of malware designed to compromise IoT devices. "We're thinking this is the tip of the iceberg," Dale Drew, head of security at Level 3 Communications, told The Wall Street Journal.

Level 3 operates one of the world's biggest backbones, thus giving it insight into network traffic. It says a notable number of recent DDoS attacks appear to be getting launched via compromised devices - especially security cameras and digital video recorders - built by Chinese manufacturer Dahua Technology. The company's technology is often re-branded and sold by other companies; its website lists dozens of technology partners in the United States alone.

Dahua Technology didn't immediately respond to my request for comment on those reports. But a spokeswoman told The Wall Street Journal that it's reviewing Level 3's research, noted that older devices running outdated software could be easy prey and recommended users set a password on the devices as well as upgrade the firmware.

If all it took to create biggest recorded DDoS attack in history was a telnet scanner and 36 weak credentials the net has a huge IoT problem

Socialism for IoT-Built Botnets

In August, Level 3 reported that it had detected that 1 million IoT devices built by Dahua Technology had been infected with malware called Bashlite - a.k.a. Lizkebab, Torlis, Gafgyt - which is also used to generate DDoS attacks. Together with cybersecurity firm Flashpoint, Level 3 said it was tracking more than 200 related command-and-control servers, which are used to send and receive instructions to hacked devices. Some C&C servers, it added, launched up to 100 attacker per day.

Today, any would-be attackers can tap Bashlite malware. "The source code for this malware was leaked in early 2015 and has been spun off into more than a dozen variants," according to a blog post from Level 3's threat research labs.

No doubt the same will now happen with Mirai source code.

If there's one upside, however small, it's that at least one solo hacker no longer controls thousands of compromised devices, MalwareTech says via Twitter. "Nice thing about the [Mirai] code being public is it mean less devices for any single person to control .... kinda like socialism for botnets."

Governance , Risk Management

A long list of information security weaknesses, including inadequate access controls, that a federal watchdog agency found at the Food and Drug Administration are similar to those found at many healthcare organizations, some security experts say. But the FDA should be held to an even higher standard than the organizations that implement FDA-regulated drugs and devices, they argue.

See Also: Avoid 75% of all Data Breaches by Keeping Privileged Credentials Secure

"These are weaknesses that are common everywhere," says Kate Borten, founder of the privacy and security consulting firm The Marblehead Group. "I would hope the FDA knows better but has staffing issues."

The Government Accountability Office report issued on Sept. 29 says that although the FDA has taken steps to safeguard seven systems GAO reviewed, a significant number of security control weaknesses jeopardize the confidentiality, integrity and availability of the agency's information and systems.

"The agency did not fully or consistently implement access controls, which are intended to prevent, limit and detect unauthorized access to computing resources," according to the GAO report. The report says the FDA did not always:

GAO also noted: "FDA conducted background investigations for personnel in sensitive positions, but weaknesses existed in other controls, such as those intended to manage the configurations of security features on and control changes to hardware and software; plan for contingencies, including systems disruptions and their recovery; and protect media such as tapes, disks and hard drives to ensure information on them was 'sanitized' and could not be retrieved after they are disposed of."

Federal Standards Missed?

GAO says the FDA control weaknesses existed, in part, "because FDA had not fully implemented an agencywide information security program, as required under the Federal Information Security Modernization Act of 2014 and the Federal Information Security Management Act of 2002.

For example, GAO says the FDA did not ensure risk assessments for reviewed systems were comprehensive and addressed system threats; review or update security policies and procedures in a timely manner; complete system security plans for all reviewed systems or review them to ensure that the appropriate controls were selected; ensure that personnel with significant security responsibilities received training; always test security controls effectively and at least annually; and always ensure that identified security weaknesses were addressed in a timely manner.

"Until FDA rectifies these weaknesses, the public health and proprietary business information it maintains in these seven systems will remain at an elevated and unnecessary risk of unauthorized access, use, disclosure, alteration, and loss," GAO writes.

Common Issues

Because the FDA is an important regulatory body within the Department of Health and Human Services, its security weaknesses are especially disturbing, some security experts say.

"These are fairly common weaknesses found during risk assessments and audits for a lot of different organizations, but for the FDA, which should be setting the example, and which has a fairly prescriptive requirement, namely FISMA, that they are supposed to be compliant with, this is a pretty damning appraisal of their performance," says Mac McMillan, CEO of security consultancy CynergisTek.

McMillan says three of the most troubling findings in the GAO report are "the technical vulnerabilities alluded to with the perimeter, access management and auditing and monitoring. What these three things combined say is that the FDA could be easy to breach, and then exploit, and might never even know it. That is about as serious as it gets."

GAO Recommendations

GAO reports that it's making 15 recommendations to the FDA to fully implement its agencywide information security program.

Some of those recommendations involve improvements to risk assessment; developing procedures for security controls, including identification and authentication; enhancing procedures for a number of security control families including access control and configuration management.

GAO also notes that in a separate report with limited distribution, it's recommending that FDA take 166 specific actions to resolve weaknesses in information security controls.

The report notes that FDA concurred with GAO's recommendations and has begun implementing several of them.

In a statement, the FDA notes it "takes very seriously the GAO report's recommendations, but the report's limited findings should not be broadly applied to the FDA's entire IT enterprise."

FDA also notes that it has not experienced any major data breaches that exposed industry or public health information.

"We recognize the risks associated with operating our large global IT enterprise and have implemented processes, procedures and tools to ensure the deterrence, prevention, detection and correction of incidents," the FDA statement notes. "In addition to addressing the majority of the recommendations identified in the GAO report, we have also undertaken several other key activities and initiatives to ensure our IT systems and sensitive information are appropriately protected by safeguarding against unauthorized disclosure, access or misuse.

Lessons in GAO Report

Borten, the security consultant, notes that the GAO reviewed "very standard information security controls that should be universally understood and applied." Together they constitute a security program, she says.

"They are all important; an adequate security program must have numerous controls," she says. "Whether mandated or not, it is distressing that today's government and businesses don't yet accept and apply them."

Covered entities and business associates should pay attention to the GAO's list of security shortcomings at the FDA, she stresses. "Hopefully, the takeaway isn't, 'since the FDA has these problems, we shouldn't be too concerned about our security program'," she says. "Instead, CEs and BAs should learn from this report what additional controls are essential and perhaps missing in their own programs."

Cybersecurity , Risk Management

The U.K. government on Oct. 3 launched a new National Cyber Security Center to help British organizations better defend against cyberattacks and respond to security incidents.

See Also: From Authentication to Advanced Attack Vectors: Top Trends in Cybercrime in Q1 2016

The new center is part of GCHQ, Britain's signals intelligence and cybersecurity agency that's comparable to the U.S. National Security Agency. It's being led by Ciaran Martin, a career civil servant who previously helped GCHQ connect with private industry via his position as director general for government and industry cybersecurity.

"Our role is helping to make the U.K. the safest place to live and do business online. So we're going to tackle the major threats from hostile states and criminal gangs," Martin says in a statement. "But we're also going to work tirelessly to automatically protect people from those smaller scale and deeply damaging attacks that cause so much disruption and frustration. We'll also continue our work helping people and businesses understand better what they need to do to protect themselves."

NCSC brings together CESG - the information security arm of GCHQ - as well as the Center for Cyber Assessment, Britain's computer emergency response team CERT-UK and the cyber-related responsibilities of the country's Center for the Protection of National Infrastructure.

CESG is now part of the National Cyber Security Centre #UKNCSC please follow us @ncsc and have a look at the website https://t.co/3SuePp1mO7

In a speech delivered at a September cybersecurity summit in Washington, Martin noted that the National Cyber Security Center will include security experts drawn from the domestic security service - MI5 - as well as CERT-UK and GCHQ. "We'll have formalized and integrated operational partnerships with law enforcement, defense and private industry," he said.

Even so, "being part of the intelligence community poses challenges" for the new center, because it needs to focus not on intelligence gathering, but incident response, he noted. To help, he said in his speech that the center will be reviewing the effectiveness of U.S. Presidential Policy Directive 41. Released in July, PPD-41 specifies how U.S. federal agencies will respond "to any cyber incident, whether involving government or private sector entities," and also creates a framework for federal agencies to respond to "significant cyber incidents."

Based in London

Plans for NCSC were announced in November 2015 by George Osborne, then the Tory government's chancellor of the exchequer. He said the center would comprise the nation's first "cyber force" tasked with handling major cyber incidents. The center was to be based in Cheltenham, where GCHQ is headquartered, according to the original announcement.

But now the government plans to locate NCSC in central London at the Nova building, the newspaper Evening Standard reports, adding that at least half of the center's staff will be based there.

Police Intelligence-Sharing Uncertainty

As Britain stands up NCSC to help U.K. organizations better battle online attacks, however, critical intelligence-sharing and policing efforts for combating cybercrime may be falling down.

The reason is simple: Brexit. In a June referendum on Britain's EU membership, a majority of voters opted for their country to exit the European Union.

While the British government continues to attempt to sort out what that means and when related moves will take place, current intelligence-sharing efforts in place via the EU's law enforcement intelligence agency Europol and its Electronic Cybercrime Center, or EC3, are at risk.

Those risks cut both ways. Britain has played a vital role in establishing and running Europol and EC3, and their respective leaders are British civil servant Rob Wainwright and Police Scotland veteran Steven Wilson.

One near-term deadline is the end of 2016, which is when the U.K. government must opt in again to Europol, or risk its domestic law enforcement organizations losing access to Europol's resources - including European arrest warrants, which allow any EU member state to issue EU-wide arrests warrants beginning in June 2017.

The Scottish government has urged the U.K. government to sign membership protocols that would ensure that the U.K. remains a Europol member, at least pending the close of the Article 50 Brexit negotiations, which currently look like they'll wrap up in April 2019.

"The ability to share information quickly and coordinate operations with other law enforcement agencies through Europol is key to detecting, disrupting and detaining criminals across borders," Scotland's Justice Secretary Michael Matheson says in a statement. "That is necessary to keep Scotland and the rest of the U.K. safer from the threats of organized crime, cybercrime and terrorism."

UK Government Has No Europol Plan, Yet

But a representative for the U.K.'s Home Office, which oversees the country's security and law and order arrangements, told the BBC that the government hasn't yet decided what to do, but will decide "in due course."

The representative adds that the government plans to push for continued intelligence sharing post-Brexit. "The prime minister has stated that law enforcement cooperation will continue when the U.K. is outside the EU," the representative said. "We will do what is necessary to keep our people safe. We are exploring options for cooperation arrangements with Europol once the U.K. has left the EU, but it is too early to speculate at this stage what future arrangements may look like."

One significant wrinkle, however, is that Europol is an EU agency; full access is reserved for EU members. By exiting the EU, Britain forfeits the right to belong to Europol and potentially to use such EU judicial instruments as EU arrest warrants.

Borderless Crime Challenges

One rallying cry of Britain's "Leave" campaigners was to "take back control of our borders." Given the borderless nature of so much crime today, however, Brexit may make it more difficult, from a law enforcement perspective, for Britain to battle cybercrime (see Police After Brexit: Keep Calm and Carry On).

Already, some EU officials have suggested that they plan to make an example of Britain to the other 27 EU member states, demonstrating what's at risk if they too chose to leave. As a result, Britain may find itself with far less access to EU agency resources. Accordingly, it may need the new NCSC more than ever.