Exposure you cannot see

Public reporting from KrebsOnSecurity describes a sustained, high-volume campaign directed at systems exposed through publicly available vulnerability information. That reporting is now circulating widely enough to reach this Board. The circulation itself is not the risk. The risk is that the same publicly available vulnerability information that informs this campaign is available to any actor evaluating our environment, without regard to whether we have been named in any account.

Exposure is defined by access, not by attention. A campaign that selects systems on the basis of public vulnerability information does not require the deliberate selection of a specific victim. It requires only that a matching system be reachable. Whether our environment presents such a system cannot be determined from the reporting alone. That uncertainty is the reason the matter is now before you rather than being handled as routine operational noise.

For this Board, the material question is not the accuracy of the reporting or the identity of the actor. It is whether the conditions the reporting describes could exist within our own environment, and whether we would know if they did. These are two distinct questions. The first concerns exposure. The second concerns visibility. The second is the more serious of the two, because an environment can survive exposure it can see and act on, and cannot reliably survive exposure it cannot.

The assumption carried into this discussion has been that existing controls adequately mitigate this class of risk. That assumption rests on two beliefs commonly held at this level: that exposed systems are identified and reduced before they can be targeted, and that activity of this nature would be observed if it occurred. Both beliefs are reasonable to hold. Neither is self-proving.

The second belief is the load-bearing one. Leadership is routinely assured that automated detection stands between exposure and consequence, that a campaign of this profile reaching our systems would surface as a correlated signal someone is expected to act on. That assurance is credible on its face. It is also, until tested against this specific activity profile, unconfirmed. An assurance that detection would function is not the same as evidence that it does.

An assumption of adequate control is defensible only where the control is demonstrated to function at runtime. Policy that describes detection is not detection. Coverage that is asserted is not coverage that is observed. The distinction is not academic. It is the difference between a control that exists in practice and a control that is presumed to exist because it was designed, funded, and documented. Governance is measured by enforcement at the moment it is needed, not by the presence of the policy that describes it.

What has changed is not our environment. What has changed is what can no longer be assumed about it. The reporting establishes that a campaign of this profile is active and sustained. It establishes nothing about our specific exposure. The extent and duration of any comparable activity within our environment remain unconfirmed, and cannot be determined from the available information. What the reporting does remove is the option of treating this risk as hypothetical.

The specific concern raised is that no evidence has been identified of automated detection correlating with the activity described. That is not a finding that detection failed. It is a statement that we cannot presently confirm detection would function against this profile. Absence of evidence of detection is not evidence of coverage. It is the precise reason the prior assumption can no longer stand unexamined. The outcome indicates a gap between what we believe our detection covers and what we have confirmed it covers.

What is known is narrow. A campaign of this type exists, and it operates against systems exposed through information available to anyone. What is implied is that our environment may present comparable exposure. What is unknown is whether it does, whether such activity has occurred against us, and whether we would detect it if it did. Those unknowns are not a gap in this briefing. They are the substance of it, and the reason this sits with the Board rather than being resolved beneath it.

The mechanism that converts this reporting from external news into internal risk is not an attack. It is the distance between a control that is presumed and a control that is demonstrated. A detection capability that has not been exercised against this specific activity profile provides no confirmed protection at the moment it would be required. Its value remains theoretical until the function is observed under the conditions it was built to address. Nothing in the reporting closes that distance, because the reporting speaks to the campaign, not to our environment.

A control that is not confirmed to function at runtime does not reduce exposure. It reduces the perception of exposure. Those two move in opposite directions, and that is why the distinction is not academic. Presumed coverage lowers perceived risk while leaving actual risk unchanged. Where detection is assumed rather than evidenced, the environment carries the exposure of an undetected condition and the confidence of a detected one at the same time. That combination is more dangerous than the exposure alone, because it withdraws attention from the point at which attention is required.

No evidence of automated detection correlating with the described activity has been identified. That statement does not establish that detection is absent, and it does not establish that any event has occurred. It establishes that the function on which our assurance depends is currently unverified against the single profile that prompted this briefing. An unverified control cannot be counted as a control. The duration and extent of any comparable activity within our environment remain unconfirmed and cannot be determined from available information, which means the precise condition detection exists to reveal is the condition we are presently unable to rule out.

The specific campaign is not the pattern. The pattern is that our assurance rests on controls described in policy and presumed in practice, measured against expectation rather than against observed adversary behaviour. This reporting brought that gap into view because it is public and sustained. The gap itself is not a property of this campaign. It is a property of any control whose effectiveness has been asserted but not demonstrated, and it exists wherever that condition holds regardless of whether an incident has occurred.

Publicly available vulnerability information removes the requirement for an actor to know us. It requires only that a matching system be reachable. Any assurance that depends on being an unlikely, unnamed, or unnoticed target is not an assurance the Board can rely on, because none of those conditions is under our control and none of them is confirmed. The broader environment should be read as a set of exposures selected by reachability, not by intent, and each should be evaluated on whether it is visible, not on whether it has so far been noticed. Attention has never been a control. Access defines exposure, and access does not wait to be observed before it is used.

The question this reporting forces - whether detection can be demonstrated against this profile - is not confined to this profile. It applies to every class of exposure where assurance is asserted rather than observed. Wherever coverage is claimed without runtime evidence, the environment holds the same unmeasured distance between believed protection and confirmed protection. This matter should therefore be treated as a representative instance of how the environment is governed, not as an isolated response to one account. What is unresolved here is very likely unresolved elsewhere on the same terms.

Going forward, adequacy of control cannot be accepted on the basis of design, funding, or documentation. It must be established by evidence that the control functions at the moment it is needed. For this class of risk, that means detection must be demonstrated to correlate with activity of this profile, and the demonstration must be observable rather than asserted. A description of what detection should do has no standing at this level. Only a confirmed outcome does. Governance is measured by enforcement at the point of demand, not by the presence of the policy that describes it.

Until that evidence exists, this exposure must be treated as present rather than absent. Absence of evidence of an event is not evidence that none occurred, and absence of evidence of detection is not evidence of coverage. The environment must be governed on what has been confirmed, not on what has been assumed, and where confirmation is unavailable the condition must be carried as unresolved and owned at this level until it is closed. It should not be returned beneath the Board while the question that raised it remains unanswered.

The standard the Board should enforce is narrow and defensible. A control counts only when its enforcement can be observed. Three conditions follow from that standard and each is enforceable: that detection against this activity profile be demonstrated rather than presumed; that any exposure comparable to the reported profile be identified and confirmed as visible; and that the result return to this Board as evidence, not as reassurance. What must be true is simple to state and not negotiable to hold. Nothing described as a control may be counted as one until it has been shown to function against the conditions it exists to address.