海角大神

Suspected Chinese hackers have spent years sifting through other Asian countries' computer networks, which often don't have basic protections against cyberattacks.

This summer, political clashes brought cybersecurity into focus in Asia. After the听Hague-based Permanent Court of Arbitration ruled against China's territorial claims in the South China Sea in July,听 shut down airport check-in screens at Vietnam鈥檚 two largest airports (Vietnam and others are locked in a conflict with China over who owns the resource-rich waterway).听

And smaller Asian countries seem uniquely unprepared to fend off that kind of aggressive, high-profile hacking.听The cybersecurity firm FireEye reported听that hackers who penetrate Asian companies' corporate network听typically听听for up to 520 days before they're caught, compared to听an average of 146 days in the US.

But experts speaking at an Atlantic Council event Tuesday said there are ways to improve their overall cybersecurity practices.听Panelists included Will Glass, a threat intelligence analyst at the cybersecurity company FireEye; Robert Manning, senior fellow at the Atlantic Council's听Strategic Foresight Initiative;听and Denise Zheng,听a senior fellow at the Strategic Technologies Program at the听Center for Strategic and International Studies.听

Here are just a few things we learned:

1. When it comes to cybersecurity, Asia is behind

It鈥檚 not just China鈥檚 hacking prowess that has enabled Beijing-linked groups to break into systems at a number of targets, experts say听poor cybersecurity practices throughout Asia are enabling bad guys to steal files and engage in political espionage.听

鈥淭here used to be a perimeter model where you could set up a wall or a moat and some archers and you could pretty much keep everything out,鈥� said Mr. Glass听referring to听how Asian countries have traditionally thought about cybersecurity.听鈥淚 have to operate under the assumption that there鈥檚 some bad guy in my network, what do I do to make sure that I can mitigate the damage they can cause once they鈥檙e inside.鈥�

2. Deterrence is having some impact

While deterring innocuous cybercrime, like website defacements and social media pranks, remains听difficult, according to Ms. Zheng, the strategy so far has had an impact in Asia by limiting attacks on听critical听infrastructure听facilities.听

鈥淲hen you鈥檙e looking at really catastrophic cyberattacks, you could argue that we鈥檝e effectively deterred those types of things, mostly because of our conventional military capabilities,鈥� she said. 鈥淪o if you attack our power grid, if you bring our power grid down, we have many other options on the table to retaliate.鈥�

That鈥檚 why talk of a doomsday-like cyberattack in Asia might be overblown.

鈥淲hen people talk about building a cyber nuclear bomb, it鈥檚 not particularly useful,鈥� she said. 鈥淭hat鈥檚 why we use things like sanctions and indictments, we have used diplomatic actions, a combination of all of the above really, to deter this type of activity.鈥�

3. There鈥檚 room for negotiation

Even though the US and China have already agreed to a deal to limit corporate cyberespionage that appears to be having some impact, experts say there's still room from improvement.听

鈥淭here鈥檚 room for more detailed codes of conduct,鈥� said Mr. Manning.听鈥淭he more China develops, the more vulnerable it gets, and this mutual vulnerability cuts across the whole strategic relationship with China.鈥�

And that room for negotiation could grow, says FireEye鈥檚 Glass, as China has begun to move toward a model of economic development that depends upon direct investment from Western companies, not just foreign trade.

鈥淭here is a certain limit to which you can derive value from stealing blueprints for something, you need the people who know how to build it,鈥� he said. 鈥淚 think part of the reduction we might be seeing is somewhat of an attempt by the Chinese side to say, we鈥檙e going to scale this back a bit and build a more friendly environment for Western companies to come to China.鈥�