Willfro sends in a piece by Evgeny Morozov at the Boston Review about the hyperbole and the reality of "cyber war." Quoting:
"At the end of May, President Obama called cyber-security 'one of the most serious economic and national security challenges we face as a nation.' His words echo a flurry of gloomy think-tank reports. Unfortunately, these reports are usually richer in vivid metaphor — with fears of 'digital Pearl Harbors' and 'cyber-Katrinas' — than in factual foundation. So why is there so much concern about 'cyber-terrorism?' Answering a question with a question: who frames the debate? Much of the data are gathered by ultra-secretive government agencies — which need to justify their own existence — and cyber-security companies — which derive commercial benefits from popular anxiety. Journalists do not help. Gloomy scenarios and speculations about cyber-Armaggedon draw attention, even if they are relatively short on facts."
Unfortunately, these reports are usually richer in vivid metaphor -- with fears of 'digital Pearl Harbors' and 'cyber-Katrinas' -- than in factual foundation. So why is there so much concern about 'cyber-terrorism?'
Because no one fully understands it. And not understanding something can easily lead to fear. And those standing to make money off that fear (journalists, contractors, agencies) are unashamed to exploit it.
I'm a computer scientist and I don't even understand or know about every potential vulnerability. It's simply too complex... and that's easy to turn into fear when you're talking to the people who are in charge of protecting us from threats. And the potential mitigation techniques are another endless myriad of complex software/hardware. All I can say is that it is highly unlikely that a Live Free or Die Hard 'fire-sale' scenario will happen. I can't in good conscious tell you it's impossible. I can tell you that the probability of it happening within a year would most certainly be dealt with in multi-digit negative powers of ten. Then there's the possibility of lesser attacks which are highly probable but I feel that the cost-risk ratio is all messed up. Again, I believe this is due to ignorance.
You get into a weird sort of emperors-new-clothes kind of situation when the only people who understand your problems are also the ones trying to sell you a solution. And they're just not being openly honest nor realistic with you.
I agree. And seems there just keeps coming more and more news about how this goverment facility was attacked, how that goverment office was hacked and how pretty much whole goverment is in cyber war with china and other "bad countries". For me it seems like US is trying to push that into peoples minds, so they can more easily create new laws to restrict internet. Seems goverments are quite afraid now that normal citizens can quite freely tell their opinions to large user base. TV and radio and other ways to
I agree and I would add the simple fact of life that politicians love to BS and love to be seen as though they are "with it", whatever "it" happens to be at the time. Same thing over here in the UK, all the policticians are using the prefix "cyber" on every bloody thing they can, without really thinking about it. Old gits, with about 5 years of working life left, before they bugger off to some highly paid consultant job, bandying "cyber" about like so much confetti. Just to make it seem like they understand
Not to mention that in the process of securing against the "cyber-terrorism" bogeyman [slashdot.org], an big added benefit for ruling elites will be removing net anonymity and related speech in the name of national security, bringing all those blogs and uncontrollable information channels under heel in a more hierarchical system - or at least more accountable to an "authorized views", type system - ("Take down that anti-war protest site and uncensored video footage - preempt information warfare against our war, sir") and of course, only authorized p2p channels and protocols allowed in this future we are manufacturing, thanks.
by Anonymous Coward
on Wednesday July 01, @11:51AM (#28544627)
"I'm a computer scientist and I don't even understand or know about every potential vulnerability. It's simply too complex"
And yet you're claiming that "the probability of it happening within a year would most certainly be dealt with in multi-digit negative powers of ten."
Not sure where you're getting your confidence from. You've basically just said that these complex systems are extremely vulnerable. Meaning, even you can't be clear to what extent these vulnerabilities can be used to cause damage.
Because no one fully understands it. And not understanding something can easily lead to fear.
Understanding plays a large part. But, it's also about an individual's lack of control. Most everyone depends upon the network and computer infrastructure of our world to meet their basic, day-to-day needs. Almost all of that infrastructure is out of their individual control. Their actions have no direct relationship to how likely they are to be affected by any "cyber"-attack.
People don't get this batty about hurricanes or even conventional terrorist attacks (like 9/11); not everyone is equally likely to experience such an event, and there are actions one can take to minimize their risk. Things like cyber-attacks and virulent diseases provoke more fear because they are seemingly harder to mitigate by individual action, and are seen as more equal-opportunity.
Most everyone depends upon the network and computer infrastructure of our world to meet their basic, day-to-day needs.
Really? I personally don't. Can you cite examples? Most of the systems that I rely on predate the computer and network infrastructure by decades. I have enough food and water around the house to last a week of normal consumption (i.e. without rationing). I'm pretty sure that I don't need a computer for my toilet to flush (I'll admit I could be wrong about that).
Other than that, I rely on roads, but I don't *need* the traffic signals to work. Power is a nice to have, but again not required. what else
Really? I personally don't. Can you cite examples?
Sure.
Though you state later that you don't need electricity, a large percentage of the food sold in the US requires refrigeration of some kind. Most people could last a week eating just the non-perishables in their homes, but any longer and they might start running into problems.
The production and transportation network which gets that food to your supermarket is heavily reliant upon computers. Just-in-time shipping, and complex international supply chains rely upon networks of computers to function.
Agreed - the likelihood of a "fire sale" scenario is very minimal, but the odds for any given individual getting caught up in a specific attack on a "soft target" such as in the TJ Maxx case are about 1:1. I have already been involved in 3 - one of those incidents put a coworker in the sights of an identity thief. This is the issue: It's the same old game - "Security is a cost to be minimized, not a "value-added" feature of a business", "It's not like we're protecting national security info", "Why would
It's fear, yes. But it is extremely well-justified fear.
I do penetration tests for large companies. It's bad. Everywhere. The only reason penetration tests are ever unsuccessful is when the tester's hands are tied. Attacker's hands are not tied. Furthermore, denial-of-service flaws are universally ignored because information disclosure is considered a higher priority, and most companies have their hands full dealing with those flaws.
So let me make this as clear as possible: A single individual could shut down pretty much any large company. A group of individuals (say, from a hostile government) could halt operations in multiple simultaneous companies. Target a few large supply-chain management companies and a few large payment-processing/banking companies, and it would be relatively easy to shut down the economy for a while.
That means food rots on delivery trucks while paychecks stop flowing to employees. And don't think we will all switch over to doing things by hand during such an attack. The infrastructure to do so has been dismantled. We are entirely dependent on digital transactions these days.
Why hasn't such an attack happened? Is the probability really "low" as you suggest? It's just a matter of motivation. There isn't much profit in doing such a (tedious) thing for the eastern-european hacker crime groups, nor for the bored teenagers. There is more profitable, lower-hanging fruit. But if we went to war with a sophisticated nation, the motivations are entirely different. Widespread DoS combined with targeted database corruption would do much more damage to the economy (that thing that allows us to have the best military) than similarly-funded missile strikes.
Ignore the sound-bites security companies feed the media, but don't ignore the problem. This is perhaps the weakest part of our nation's defense infrastructure.
My point is that you can shut down the economy with a very small effort. It could be done much more easily and inexpensively than trying to plant an ICBM on, or fly a bomber over, every power plant in the country.
Furthermore, banks have disaster recovery plans to operate from alternative datacenters if a natural disaster or fire wipes out one of their buildings. Such DR plans don't help much against hackers and DoS attacks.
When all you have is a hammer, everything starts to look like a nail. But now we have pneumatic hammers with 100 round magazines and a plethora of frightened people willing to get their hands on them.
I don't have time to Google it all, but it has been a pretty regular stream of "Pentagon loses data/gets hacked" and "US military data found on Chinese file sharing sites" etc. etc. etc.
And in an era where more and more of our bombs are dropped by computer-controlled drones....
Yeah, but it's not cyber-"terrorism;" nothing is going to blow up. It's just espionage.
Plus, I've got to wonder how much of this is truly "hackers" from the outside, and how much is just the result of employees taking data with them -- whether they're just being sloppy, or actually malicious (e.g., ethnic Chinese with misplaced loyalties (god do I hate nationalism)).
Whatever the case, without disclosure for each "incident" of what actually happened in technical terms, we the public will never understand what's going on at any level besides "OMG HACKERS" -- which can mean anything.
Maybe, maybe not. When the Chinese missile hits the F22 because they have the specs for our anti-missile countermeasures, something blows up. When the Iranians take control of a predator drone with full armament and turn it against our bases in Iraq, something blows up. When the Russians hack into NORAD, something blows up. Etcetera..
Granted these things haven't happened yet. But its not idle hand-wringing to think that they might. And its not a waste o
This is why I think that true security lies not in keeping people from obtaining information, but from setting things up so that it is irrelevant if people obtain that information.
Consider the situation where someone knows all the internal workings of, say, the JSF, but it's designed in such a way that that knowledge would not allow someone to prevent the use of the JSF.
Or consider "identity theft": what if it didn't matter if someone stole your "identity" because there was nothing they could do with it any
Everybody, governments, companies, content creators, privacy advocates, have the same problem: digital information is cheap to disseminate.
If somebody breaks into a library of secret documents, there's a limit to how many copies they can make and take out. Even if they were to scan and store every page in every folder in every cabinet, it's still extremely time-consuming.
If somebody breaks into a computer full of secret documents, it takes seconds, maybe minutes, to copy the whole thing. And, the person doesn't have to be physically located by the computer. The person could be halfway around the world, or just right next door but seem halfway around the world.
What it amounts to is that secret-keeping is becoming more and more difficult. Actually, this isn't true. The difficulty of secret-keeping hasn't changed. But society desires convenience. And little do people know, these two concepts are mutually exclusive.
Furthermore, while convenience is individual, keeping secrets is communal. "Secret" is a term that only has meaning within the context of systems, i.e. only people inside the system know the secret, while people outside the system do not know. The problem is when one individual wants convenience and compromises secrecy for it, then the secret is effectively compromised.
Everybody just wants to have their cake and eat it too. That kind of logical impossibility will not happen, no matter how much we might desire it.
Its kind of a big deal when the U.S. military can't keep its data secure.
"Having the plans" is not enough. You have to have people able to interpret them and put them into action. Critical elements are often left out of engineering documentation and there's also always that stuff which was figured-out on the shop floor and never written down.
Slashdot's comments are frequently amusing, as armchair experts bolstered by 30 second's worth of Google search know everything. And are smug in their ignorance. T
some pretty good ones, and many lame ones. I have a machine running apache on linux that hosts some "sensitive files". Nothing that a government would want, but something that people who would want to mod certain hardware would want. I had one attack that tried to exploit an IIS vulnerability relentlessly for over an hour against my machine. It was funny because the files it was looking for didn't even exist, and had the script kiddie thought about it, would have checked the server type prior to launching
Of the 63 MILLION emails we've processed for our clients (About 60 companies run through our spam filter) 58 million of them are blocked as SPAM. So only 1/12th of the email traffic we see is legit. One of our clients has its own spam filter because they process that much email all by themselves and they have closer to a 1/20 legit traffic. SPAM is a bigger threat to the network than some hypothetical cyber-terrorist.
Internet security has been an issue ever since the beginning and we have been handeling it just fine. Why should it suddenly become a government issue?
Disagree. It should be a government issue, but not solely a government issue and certainly not a clandestine government organization issue. Information and Network Security should be shared and handle by all end-points, government, commercial and private; and they should all work together and share information openly.
The 'we' that you refer to is evidently not a part of the set of people that connect insecure equipment to the Internet. Good for you, but you don't represent the majority of users.
I wish there was something akin to a driver's license for the web, where a judge could order incompetents to hand it over, box their computer up and take it back to the store. But that's not likely to happen in the near future.
The US no longer has to worry about nuclear war or even conventional war because we have the means of "winning" a nuclear war and can easily crush any country in a conventional war except, perhaps, the PRC. Even the European Union would not likely hold out against us in a conventional war. Our military knows that, and the majority of the world knows that. We are in a period of relative peace and stability, a Pax Americana. Thus we have to manufacture existential threats to keep the momentum going.
Going back to that post about government IT spending, I'd like to point out something about the military industrial complex that many don't realize. Just keeping the US military ready to go as a kick ass self-defense force with modest offensive capabilities is expensive. There is plenty of money to go around, and you're much more likely to see the agencies that now have to justify their existence like DHS getting in on this bandwagon than the DoD. For the traditional apparatus, it's always business as usual keeping the basic defense of US sovereignty going. For the rest, like DHS which has to find a new enemy under every bush, they have a lot of good reasons to be afraid.
The U.S. no longer has to worry about nuclear war? Probably. However, those nice N. Koreans are about as well adjusted as a squirrel after his third cup of coffee. Want to bet that even knowing full well they'd get annihilated, they wouldn't lob one in our direction if they started something they couldn't win? How about Al Qaeda and those gentle Islamic fanatics. Care to guess what they'd do with one of Pakistan's nukes if they were to, I don't know, maybe get one slipped to them as long as no they didn't ask questions?
Yes, DoD is expensive, losing a war is vastly more expensive. Let's talk some numbers, shall we. The U.S. DoD recurring budget (forgetting about Iraq and Afghanistan) is roughly $600 Billion/yr. Our recurring budget deficit is over $1 trillion. So even halving DoD's budget won't put us in the money. That doesn't count the Me Generation demanding their slice when they start retiring because there's nothing worse than a Baby Boomer who isn't made to feel the center of attention. Deficits from those nutjobs are well north of several trillion.
So no, there's isn't plenty of money to go around. Also, before you hop on the disarmament wagon train, you might want to consider that other countries reactions to the loss of the U.S. nuclear umbrella are probably not what you'd like them to be. First off, if Iran goes nuclear and the U.S. isn't around to back up the Arabs that hate us, the Arabs will want theirs too...of course they could rely on the Europeans...bwahahaahahaha...seriously, no one relies on those jokers. Hell, the U.S. is allied with them and knows better than to rely on them. Then there's the Asian countries who dearly love their Chinese brothers...as long as the their Chinese brothers don't have designs on their land, raw materials, etc...which they do. They will likely demand a nuclear counterpoint to China, Japan will find their pacifist notions are mere indulgences they can ill afford with China pushing them around, not to mention those nice well-adjusted N. Koreans.
If country A were to take down country B internet connection then country A wouldn't be able to spy on country B or even get sensative info. I honestly don't think it's a big of a problem as they make it out to be.
Most of it's just hollywood and bad publishing, but the main idea behind all this is revenue.
The gov get's more spending, the site/paper that publishes the story gets more notice, and the list could go on forever. The truth of the fact is if people knew the facts then no one would beable to sell "
At my job if email goes down, work stops.. 100% shutdown. The organization has largely gone paperless. I'd imagine most other gov't organizations are the same way. That's only one service of many.. so cybersecurity is very important in my book. Unfortunately a national level of security seems impossible, offensively yes, but not defensively.
At my job if email goes down, work stops.. 100% shutdown. The organization has largely gone paperless. I'd imagine most other gov't organizations are the same way....
Uh, OK, stop right there. Paperless in Government? You are referring to the US Government, yes? The same Government who requires forms filled out in triplicate just to order...more forms?
Apparently you've not caught a glimpse of that tree-killing beast up close and personal.
About 5 years ago the government made a big push towards being paperless. Especially for the military. LESs are online, every record gets digitized now (including medical), training manuals and regulations are distributed by cd instead of book. Not only that but paper recycling is absolutely manditory, no exceptions.
Maybe it's the civilian government that is still operating primarily with paper. Military organizions only use it as a temporary means of information storage, not a primary.
d. Take that $20 bill in your wallet (better yet in a different society, you wouldn't need money)
e. Go buy a slice of pizza. Enjoy the outside environment.
.
.
See that wasn't so hard.
.
That what would likely happen in a cyber attack. It's more like a 'snow' day in DC. Of course, if a physical Pearl Harbor, 9/11 or Katrina happened, you would NOT be able to do the above. As for money: if major bank computer systems gets wiped for instance, as long as 'someone' has an audit of recent account info and transactions, you'll be taken care of to some extent. Sure you may lose money, but life isn't going to end.
.
Therefore, this is exploiting technology for the purpose of generating 'progress'. A. That's a politician's job (to look useful in keeping your "well being" SAFE) and B. that's a skill where gov't excels (exploitation).
I guess that is the fear. We assume that vital systems are not only "hardened" but that they have a robust backup/restore plan. State systems that deliver vital services are a really good example where you'd assume everyone would be fired and start from scratch if auditors found there was no backup/restore plan in place. It might be a matter of degree that we're talking about here. Does every vital system need a cold site that can be made hot with yesterday's data within 12 hours? Maybe.
In the face of meatspace terrorism, meatspace liberties can be curtailed. That's why there's "concern" over cyberterrorism. Because the internet is not healthy for the establishment. It can spread both truth and propaganda, but currently, it tends too much toward truth for the establishment. If that sounds crazy to you (nothing on the internet but lies and pr0n!) then you haven't looked around.
FTA:
It is alarming that so many people have accepted the White House's assertions about cyber-security as a key national security problem without demanding further evidence. Have we learned nothing from the WMD debacle? The administration's claims could lead to policies with serious, long-term, troubling consequences for network openness and personal privacy.
Yes, this same thing keeps happening, where a (possibly) real world problem is used to justify a curtailing of freedom, consolidation of power, and serving various agendas of people in power at the time. A cynic might say it's planned, but we're not cynical, are we?
I suggest we give it a name. Let's call it Problem-Reaction-Solution.
Fear is one of the biggest motivators. The squeaky wheel gets the grease. As Americans, we are unfortunately conditioned by fear based language. Unless something is presented to us as scary and threatening, we tend to ignore it. In order to get funding for projects, politicans and the like have to play the fear card. They will present doomsday what-if scenarios, and threaten to put responsibility for failure on anyone who gets in the way of getting things done.
Look, for the first round of clean up no "cyberwarriors" are needed. We just had yet another article about how single city, for a single Windows worm, lost millions due to clean up.
In that case it lost over $2.5 million [slashdot.org], including rewarding the designers of the security flaws to the tune of $1 million.
Knocking down a water tower would probably cost less to repair. So why are not the defense and law enforcement agencies stepping in here?
It's not a nameless or faceless "terrorist" group that is costing our businesses, shutting down our infrastructure, tangling our air traffic control, our power grid, or our hospitals. The people promoting Windows and Microsoft technologies have real names and faces and walk among us every day. Take them out and we've won the first round. It could be as simple as organizing a large scale round up under the RICO Act [cornell.edu].
From there we can go on to hardening the net with IPv6 and dealing with the usual intelligence / counter-intelligence activities. But the first step, before we can stop the economic bleeding [bastiat.org] is to deal with the cause of the problem: the people who promote and profit from known defective technology.
MS is not the one perpetuating the attacks, or causing the damage. There are no laws holding them responsible for creating a secure operating system. Rounding them up and punishing them is hardly legal/ethical/moral. The first thing we should do is start with laws requiring the people creating the networks/data warehouses to secure them properly. Then they'll demand a better product (from MS or some other vendor) if not they should be responsible (unless said vendor wishes to indemnify them).
MS is just trying to make a buck, they're not actually attacking anyone.
MS is not the one perpetuating the attacks, or causing the damage...
Re-read the post: those who promote and profit from known defective technology are at fault. That spreads out the blame to include all those Certified Gold Partners and M$ monkeys who go around posing as IT experts. In fact, the licensing partially takes M$ off the hook by stating that it is made available "as-is" and without claims to suitability for any particular task. They know their products can't cut it.
The fault also lies on all those Certified Gold Partners and M$ monkeys who go around posing
If you form a think-tank, or oversight committee, or regulatory office with a nice, big budget and charge them with feeding into the decision making process, that's what they'll do. They are hardly likely to say "we've checked - everything's fine". The two obvious reasons being:
There might be something they missed
If there is no "threat", they're out of a job
So it happens that every time a new office is created to look into the potential of a hazard to the country - lo and behold: they find one. Amazing!
I'm in security research, but none of you will be potential customers (trust me, you won't), so I needn't lie to you: It's hopeless, but not serious.
The problem is not insecure applications. It's not the stealthy superhacker from China. It's not the RBN (ok, it is, but they couldn't do jack without the original culprit). The biggest problem in IT security and internet security is (drumroll please) the user. And his inability and unwillingness to take responsibility for his crate.
There are security holes, granted. They are not the main source of malware, though. I do assume here that the average/. reader knows a bit more about his machine than "push this button to turn on, when a window opens that you don't know, panic". Likewise, a lot of you say they have no AV suit installed and never had troubles with malware. I believe you. You're probably not into dancing pigs and if you are, you don't let any arbitrary webpage gain root access to show those pigs dancing.
A lot of users do. And thus get infected. And thus become a security problem.
Governments will create a lot of laws concerning the problem, without one that actually addresses the problem: Making the user responsible for his security. I don't mean "get infected, get your pants sued off". I mean that you are required to take reasonable (!) means and surf safely, that includes not clicking on every friggin' crap you run into, that includes not opening every goddamn spam mail and run the infector. This would require educated users, and education has always been the mortal enemy of surveillance and monitoring, so we won't see any of this anytime soon. So it's hopeless.
On the other hand, the infections we face currently (which may change, but so far didn't) don't even come close to enabling anyone to cause a global network meltdown. It is a nuisance (because of spam, page infections and so on), attacks may take out certain parts of the net, but there's no global threat. So it's not serious.
Much of the data are gathered by ultra-secretive government agencies
Bush wanted to know who was moving porn in cyberspace. Obama wants to know who's moving cash. Both are legitimate concerns on the surface, but the searches will suffer from many false positives. Most porn doesn't involve kids or coerced victims. Likewise, the amount of money needed to finance another 9/11 could easily moved down below the noise level of AIG's CDS operations. While law enforcement is looking for the rare needle in each haystack, they'll be motivated to take action on the other stuff they fin
There have been some very vivid demonstrations of the impacts of cyber-warfare, such as the attacks on Estonia and Georgia, Chinese and Iranian suppresion of free speech and media, air traffic control penetrations, and demonstrated penetrations of SCADA networks (power grid in particular). In Estonia, gov't services were disrupted, and the local equivalent of 911 was broken. Georgia was not as badly dinged as Estonia, largely because they're less reliant on networked services. (c.f. http://www.economist. [economist.com]
You point out a huge problem: today we have little redundancy and almost no wiggle room for any sort of failure. JIT inventory means that if UPS or FedEx drivers go out on strike commerce shuts down, even the stores on Main Street. Factories operate on the thinnest of margins with no reserve capacity.
So what if Something Bad happens? In 1970 it would have mean almost nothing. Today, almost any major event is going to distrupt supply chains, inventory and commerce. The result if we are talking about pap
Ignorance Leads to Fear Leads to Profit (Score:5, Insightful)
Unfortunately, these reports are usually richer in vivid metaphor -- with fears of 'digital Pearl Harbors' and 'cyber-Katrinas' -- than in factual foundation. So why is there so much concern about 'cyber-terrorism?'
Because no one fully understands it. And not understanding something can easily lead to fear. And those standing to make money off that fear (journalists, contractors, agencies) are unashamed to exploit it.
... and that's easy to turn into fear when you're talking to the people who are in charge of protecting us from threats. And the potential mitigation techniques are another endless myriad of complex software/hardware. All I can say is that it is highly unlikely that a Live Free or Die Hard 'fire-sale' scenario will happen. I can't in good conscious tell you it's impossible. I can tell you that the probability of it happening within a year would most certainly be dealt with in multi-digit negative powers of ten. Then there's the possibility of lesser attacks which are highly probable but I feel that the cost-risk ratio is all messed up. Again, I believe this is due to ignorance.
I'm a computer scientist and I don't even understand or know about every potential vulnerability. It's simply too complex
You get into a weird sort of emperors-new-clothes kind of situation when the only people who understand your problems are also the ones trying to sell you a solution. And they're just not being openly honest nor realistic with you.
Re: (Score:3, Interesting)
I agree. And seems there just keeps coming more and more news about how this goverment facility was attacked, how that goverment office was hacked and how pretty much whole goverment is in cyber war with china and other "bad countries". For me it seems like US is trying to push that into peoples minds, so they can more easily create new laws to restrict internet. Seems goverments are quite afraid now that normal citizens can quite freely tell their opinions to large user base. TV and radio and other ways to
Re: (Score:3, Insightful)
I agree and I would add the simple fact of life that politicians love to BS and love to be seen as though they are "with it", whatever "it" happens to be at the time. Same thing over here in the UK, all the policticians are using the prefix "cyber" on every bloody thing they can, without really thinking about it. Old gits, with about 5 years of working life left, before they bugger off to some highly paid consultant job, bandying "cyber" about like so much confetti. Just to make it seem like they understand
Re:Ignorance Leads to Fear Leads to Profit (Score:5, Insightful)
Not to mention that in the process of securing against the "cyber-terrorism" bogeyman [slashdot.org], an big added benefit for ruling elites will be removing net anonymity and related speech in the name of national security, bringing all those blogs and uncontrollable information channels under heel in a more hierarchical system - or at least more accountable to an "authorized views", type system - ("Take down that anti-war protest site and uncensored video footage - preempt information warfare against our war, sir") and of course, only authorized p2p channels and protocols allowed in this future we are manufacturing, thanks.
Parent
Target sited - Game On!!!! (Score:2)
You nailed it exactly, Good Citizen FriendlyLurker - one cannot improve upon your excellent and spot on post.
Re:Ignorance Leads to Fear Leads to Profit (Score:4, Insightful)
"I'm a computer scientist and I don't even understand or know about every potential vulnerability. It's simply too complex"
And yet you're claiming that "the probability of it happening within a year would most certainly be dealt with in multi-digit negative powers of ten."
Not sure where you're getting your confidence from. You've basically just said that these complex systems are extremely vulnerable. Meaning, even you can't be clear to what extent these vulnerabilities can be used to cause damage.
Parent
Re:Ignorance Leads to Fear Leads to Profit (Score:4, Interesting)
Because no one fully understands it. And not understanding something can easily lead to fear.
Understanding plays a large part. But, it's also about an individual's lack of control. Most everyone depends upon the network and computer infrastructure of our world to meet their basic, day-to-day needs. Almost all of that infrastructure is out of their individual control. Their actions have no direct relationship to how likely they are to be affected by any "cyber"-attack.
People don't get this batty about hurricanes or even conventional terrorist attacks (like 9/11); not everyone is equally likely to experience such an event, and there are actions one can take to minimize their risk. Things like cyber-attacks and virulent diseases provoke more fear because they are seemingly harder to mitigate by individual action, and are seen as more equal-opportunity.
Parent
Re: (Score:3, Insightful)
Most everyone depends upon the network and computer infrastructure of our world to meet their basic, day-to-day needs.
Really? I personally don't. Can you cite examples? Most of the systems that I rely on predate the computer and network infrastructure by decades. I have enough food and water around the house to last a week of normal consumption (i.e. without rationing). I'm pretty sure that I don't need a computer for my toilet to flush (I'll admit I could be wrong about that). Other than that, I rely on roads, but I don't *need* the traffic signals to work. Power is a nice to have, but again not required. what else
Re: (Score:3, Interesting)
Really? I personally don't. Can you cite examples?
Sure.
Though you state later that you don't need electricity, a large percentage of the food sold in the US requires refrigeration of some kind. Most people could last a week eating just the non-perishables in their homes, but any longer and they might start running into problems.
The production and transportation network which gets that food to your supermarket is heavily reliant upon computers. Just-in-time shipping, and complex international supply chains rely upon networks of computers to function.
Even th
Re: (Score:2)
You're wrong. (Score:5, Interesting)
It's fear, yes. But it is extremely well-justified fear.
I do penetration tests for large companies. It's bad. Everywhere. The only reason penetration tests are ever unsuccessful is when the tester's hands are tied. Attacker's hands are not tied. Furthermore, denial-of-service flaws are universally ignored because information disclosure is considered a higher priority, and most companies have their hands full dealing with those flaws.
So let me make this as clear as possible: A single individual could shut down pretty much any large company. A group of individuals (say, from a hostile government) could halt operations in multiple simultaneous companies. Target a few large supply-chain management companies and a few large payment-processing/banking companies, and it would be relatively easy to shut down the economy for a while.
That means food rots on delivery trucks while paychecks stop flowing to employees. And don't think we will all switch over to doing things by hand during such an attack. The infrastructure to do so has been dismantled. We are entirely dependent on digital transactions these days.
Why hasn't such an attack happened? Is the probability really "low" as you suggest? It's just a matter of motivation. There isn't much profit in doing such a (tedious) thing for the eastern-european hacker crime groups, nor for the bored teenagers. There is more profitable, lower-hanging fruit. But if we went to war with a sophisticated nation, the motivations are entirely different. Widespread DoS combined with targeted database corruption would do much more damage to the economy (that thing that allows us to have the best military) than similarly-funded missile strikes.
Ignore the sound-bites security companies feed the media, but don't ignore the problem. This is perhaps the weakest part of our nation's defense infrastructure.
Parent
Re: (Score:3, Informative)
My point is that you can shut down the economy with a very small effort. It could be done much more easily and inexpensively than trying to plant an ICBM on, or fly a bomber over, every power plant in the country.
Furthermore, banks have disaster recovery plans to operate from alternative datacenters if a natural disaster or fire wipes out one of their buildings. Such DR plans don't help much against hackers and DoS attacks.
Re: (Score:3, Insightful)
Think of the children, goddamnit! (Score:2, Insightful)
Uh, seriously? Journalists and other people with something to gain from it take a sensationalist view point and run with it?
Holy crap, really? They do that? Huh.
Oh well. /eats some Cheetos. What's on the tube?
Are you kidding? (Score:5, Insightful)
Its kind of a big deal when the U.S. military can't keep its data secure.
Like when plans for the JSF fighter were taken.
http://www.cnn.com/2009/US/04/21/pentagon.hacked/index.html [cnn.com]
I don't have time to Google it all, but it has been a pretty regular stream of "Pentagon loses data/gets hacked" and "US military data found on Chinese file sharing sites" etc. etc. etc.
And in an era where more and more of our bombs are dropped by computer-controlled drones....
Yeah, its kind of a big fucking deal. IMHO..
Re:Are you kidding? (Score:5, Insightful)
Yeah, but it's not cyber-"terrorism;" nothing is going to blow up. It's just espionage.
Plus, I've got to wonder how much of this is truly "hackers" from the outside, and how much is just the result of employees taking data with them -- whether they're just being sloppy, or actually malicious (e.g., ethnic Chinese with misplaced loyalties (god do I hate nationalism)).
Whatever the case, without disclosure for each "incident" of what actually happened in technical terms, we the public will never understand what's going on at any level besides "OMG HACKERS" -- which can mean anything.
Parent
Re: (Score:3, Insightful)
Maybe, maybe not. When the Chinese missile hits the F22 because they have the specs for our anti-missile countermeasures, something blows up. When the Iranians take control of a predator drone with full armament and turn it against our bases in Iraq, something blows up. When the Russians hack into NORAD, something blows up. Etcetera..
Granted these things haven't happened yet. But its not idle hand-wringing to think that they might. And its not a waste o
Re: (Score:3, Insightful)
This is why I think that true security lies not in keeping people from obtaining information, but from setting things up so that it is irrelevant if people obtain that information.
Consider the situation where someone knows all the internal workings of, say, the JSF, but it's designed in such a way that that knowledge would not allow someone to prevent the use of the JSF.
Or consider "identity theft": what if it didn't matter if someone stole your "identity" because there was nothing they could do with it any
Re:Irrelevant Info (Score:3, Interesting)
We can brainstorm this on email if you like.
It's just about my top interest topic.
Re:Are you kidding? (Score:4, Insightful)
Everybody, governments, companies, content creators, privacy advocates, have the same problem: digital information is cheap to disseminate.
If somebody breaks into a library of secret documents, there's a limit to how many copies they can make and take out. Even if they were to scan and store every page in every folder in every cabinet, it's still extremely time-consuming.
If somebody breaks into a computer full of secret documents, it takes seconds, maybe minutes, to copy the whole thing. And, the person doesn't have to be physically located by the computer. The person could be halfway around the world, or just right next door but seem halfway around the world.
What it amounts to is that secret-keeping is becoming more and more difficult. Actually, this isn't true. The difficulty of secret-keeping hasn't changed. But society desires convenience. And little do people know, these two concepts are mutually exclusive.
Furthermore, while convenience is individual, keeping secrets is communal. "Secret" is a term that only has meaning within the context of systems, i.e. only people inside the system know the secret, while people outside the system do not know. The problem is when one individual wants convenience and compromises secrecy for it, then the secret is effectively compromised.
Everybody just wants to have their cake and eat it too. That kind of logical impossibility will not happen, no matter how much we might desire it.
Parent
You must mean this data (Score:2)
plans for the JSF fighter were sold.
Fixed that for you. Seriously, you must mean ALL THIS DATA [google.com].
Re: (Score:3, Informative)
"Having the plans" is not enough. You have to have people able to interpret them and put them into action. Critical elements are often left out of engineering documentation and there's also always that stuff which was figured-out on the shop floor and never written down.
Slashdot's comments are frequently amusing, as armchair experts bolstered by 30 second's worth of Google search know everything. And are smug in their ignorance. T
Re: (Score:2)
Re: (Score:3, Informative)
some pretty good ones, and many lame ones.
I have a machine running apache on linux that hosts some "sensitive files". Nothing that a government would want, but something that people who would want to mod certain hardware would want. I had one attack that tried to exploit an IIS vulnerability relentlessly for over an hour against my machine. It was funny because the files it was looking for didn't even exist, and had the script kiddie thought about it, would have checked the server type prior to launching
Re: (Score:3, Funny)
Its a lot easier to sink a warship if you have the blueprints for the warship.
Haven't you seen Star Wars??!?
More worried about SPAM (Score:5, Interesting)
Of the 63 MILLION emails we've processed for our clients (About 60 companies run through our spam filter) 58 million of them are blocked as SPAM.
So only 1/12th of the email traffic we see is legit. One of our clients has its own spam filter because they process that much email all by themselves and they have closer to a 1/20 legit traffic.
SPAM is a bigger threat to the network than some hypothetical cyber-terrorist.
No governance required. (Score:2)
Internet security has been an issue ever since the beginning and we have been handeling it just fine. Why should it suddenly become a government issue?
Re: (Score:3, Insightful)
Re: (Score:2)
Bruce Schneier has an interesting essay which touches on this subject. http://www.schneier.com/essay-265.html [schneier.com]
Re: (Score:2)
The 'we' that you refer to is evidently not a part of the set of people that connect insecure equipment to the Internet. Good for you, but you don't represent the majority of users.
I wish there was something akin to a driver's license for the web, where a judge could order incompetents to hand it over, box their computer up and take it back to the store. But that's not likely to happen in the near future.
The post-nuclear war threat (Score:5, Interesting)
The US no longer has to worry about nuclear war or even conventional war because we have the means of "winning" a nuclear war and can easily crush any country in a conventional war except, perhaps, the PRC. Even the European Union would not likely hold out against us in a conventional war. Our military knows that, and the majority of the world knows that. We are in a period of relative peace and stability, a Pax Americana. Thus we have to manufacture existential threats to keep the momentum going.
Going back to that post about government IT spending, I'd like to point out something about the military industrial complex that many don't realize. Just keeping the US military ready to go as a kick ass self-defense force with modest offensive capabilities is expensive. There is plenty of money to go around, and you're much more likely to see the agencies that now have to justify their existence like DHS getting in on this bandwagon than the DoD. For the traditional apparatus, it's always business as usual keeping the basic defense of US sovereignty going. For the rest, like DHS which has to find a new enemy under every bush, they have a lot of good reasons to be afraid.
Re:The post-nuclear war threat (Score:4, Insightful)
The U.S. no longer has to worry about nuclear war? Probably. However, those nice N. Koreans are about as well adjusted as a squirrel after his third cup of coffee. Want to bet that even knowing full well they'd get annihilated, they wouldn't lob one in our direction if they started something they couldn't win? How about Al Qaeda and those gentle Islamic fanatics. Care to guess what they'd do with one of Pakistan's nukes if they were to, I don't know, maybe get one slipped to them as long as no they didn't ask questions?
Yes, DoD is expensive, losing a war is vastly more expensive. Let's talk some numbers, shall we. The U.S. DoD recurring budget (forgetting about Iraq and Afghanistan) is roughly $600 Billion/yr. Our recurring budget deficit is over $1 trillion. So even halving DoD's budget won't put us in the money. That doesn't count the Me Generation demanding their slice when they start retiring because there's nothing worse than a Baby Boomer who isn't made to feel the center of attention. Deficits from those nutjobs are well north of several trillion.
So no, there's isn't plenty of money to go around. Also, before you hop on the disarmament wagon train, you might want to consider that other countries reactions to the loss of the U.S. nuclear umbrella are probably not what you'd like them to be. First off, if Iran goes nuclear and the U.S. isn't around to back up the Arabs that hate us, the Arabs will want theirs too...of course they could rely on the Europeans...bwahahaahahaha...seriously, no one relies on those jokers. Hell, the U.S. is allied with them and knows better than to rely on them. Then there's the Asian countries who dearly love their Chinese brothers...as long as the their Chinese brothers don't have designs on their land, raw materials, etc...which they do. They will likely demand a nuclear counterpoint to China, Japan will find their pacifist notions are mere indulgences they can ill afford with China pushing them around, not to mention those nice well-adjusted N. Koreans.
Parent
Fear == Revenue (Score:2, Insightful)
If country A were to take down country B internet connection then country A wouldn't be able to spy on country B or even get sensative info. I honestly don't think it's a big of a problem as they make it out to be.
Most of it's just hollywood and bad publishing, but the main idea behind all this is revenue.
The gov get's more spending, the site/paper that publishes the story gets more notice, and the list could go on forever. The truth of the fact is if people knew the facts then no one would beable to sell "
No email, no working (Score:2)
At my job if email goes down, work stops.. 100% shutdown. The organization has largely gone paperless. I'd imagine most other gov't organizations are the same way. That's only one service of many.. so cybersecurity is very important in my book. Unfortunately a national level of security seems impossible, offensively yes, but not defensively.
Paperless Government? (Score:2)
At my job if email goes down, work stops.. 100% shutdown. The organization has largely gone paperless. I'd imagine most other gov't organizations are the same way....
Uh, OK, stop right there. Paperless in Government? You are referring to the US Government, yes? The same Government who requires forms filled out in triplicate just to order...more forms?
Apparently you've not caught a glimpse of that tree-killing beast up close and personal.
Re: (Score:2)
About 5 years ago the government made a big push towards being paperless. Especially for the military. LESs are online, every record gets digitized now (including medical), training manuals and regulations are distributed by cd instead of book. Not only that but paper recycling is absolutely manditory, no exceptions.
Maybe it's the civilian government that is still operating primarily with paper. Military organizions only use it as a temporary means of information storage, not a primary.
The only places y
Elevating a simple scenario to a movement (Score:3, Insightful)
b. Turn off your phone.
c. Turn off your TV.
d. Take that $20 bill in your wallet (better yet in a different society, you wouldn't need money)
e. Go buy a slice of pizza. Enjoy the outside environment.
.
. See that wasn't so hard.
That what would likely happen in a cyber attack. It's more like a 'snow' day in DC. Of course, if a physical Pearl Harbor, 9/11 or Katrina happened, you would NOT be able to do the above. As for money: if major bank computer systems gets wiped for instance, as long as 'someone' has an audit of recent account info and transactions, you'll be taken care of to some extent. Sure you may lose money, but life isn't going to end.
.
Therefore, this is exploiting technology for the purpose of generating 'progress'. A. That's a politician's job (to look useful in keeping your "well being" SAFE) and B. that's a skill where gov't excels (exploitation).
Re: (Score:3, Funny)
$20! For a slice of pizza? That's outrageous! And you say we have nothing to fear.
OMG, we're all gonna die!
Re: (Score:2)
Re: (Score:3, Interesting)
Then there a
concern over cyberterrorism (Score:3, Insightful)
In the face of meatspace terrorism, meatspace liberties can be curtailed. That's why there's "concern" over cyberterrorism. Because the internet is not healthy for the establishment. It can spread both truth and propaganda, but currently, it tends too much toward truth for the establishment. If that sounds crazy to you (nothing on the internet but lies and pr0n!) then you haven't looked around.
FTA:
Yes, this same thing keeps happening, where a (possibly) real world problem is used to justify a curtailing of freedom, consolidation of power, and serving various agendas of people in power at the time. A cynic might say it's planned, but we're not cynical, are we?
I suggest we give it a name. Let's call it Problem-Reaction-Solution.
Welcome to psychology 101 (Score:2)
Fear is one of the biggest motivators. The squeaky wheel gets the grease. As Americans, we are unfortunately conditioned by fear based language. Unless something is presented to us as scary and threatening, we tend to ignore it. In order to get funding for projects, politicans and the like have to play the fear card. They will present doomsday what-if scenarios, and threaten to put responsibility for failure on anyone who gets in the way of getting things done.
Although I agree that "cyber security" sho
No "cyberwarriors needed", first round (Score:5, Insightful)
Look, for the first round of clean up no "cyberwarriors" are needed. We just had yet another article about how single city, for a single Windows worm, lost millions due to clean up. In that case it lost over $2.5 million [slashdot.org], including rewarding the designers of the security flaws to the tune of $1 million. Knocking down a water tower would probably cost less to repair. So why are not the defense and law enforcement agencies stepping in here?
It's not a nameless or faceless "terrorist" group that is costing our businesses, shutting down our infrastructure, tangling our air traffic control, our power grid, or our hospitals. The people promoting Windows and Microsoft technologies have real names and faces and walk among us every day. Take them out and we've won the first round. It could be as simple as organizing a large scale round up under the RICO Act [cornell.edu].
From there we can go on to hardening the net with IPv6 and dealing with the usual intelligence / counter-intelligence activities. But the first step, before we can stop the economic bleeding [bastiat.org] is to deal with the cause of the problem: the people who promote and profit from known defective technology.
Re:No "cyberwarriors needed", first round (Score:4, Insightful)
Parent
Sold "as-is" (Score:3, Insightful)
MS is not the one perpetuating the attacks, or causing the damage...
Re-read the post: those who promote and profit from known defective technology are at fault. That spreads out the blame to include all those Certified Gold Partners and M$ monkeys who go around posing as IT experts. In fact, the licensing partially takes M$ off the hook by stating that it is made available "as-is" and without claims to suitability for any particular task. They know their products can't cut it.
The fault also lies on all those Certified Gold Partners and M$ monkeys who go around posing
Merely self-preservation (Score:2)
There might be something they missed
If there is no "threat", they're out of a job
So it happens that every time a new office is created to look into the potential of a hazard to the country - lo and behold: they find one. Amazing!
A little bit of non-commercial input (Score:3, Insightful)
I'm in security research, but none of you will be potential customers (trust me, you won't), so I needn't lie to you: It's hopeless, but not serious.
The problem is not insecure applications. It's not the stealthy superhacker from China. It's not the RBN (ok, it is, but they couldn't do jack without the original culprit). The biggest problem in IT security and internet security is (drumroll please) the user. And his inability and unwillingness to take responsibility for his crate.
There are security holes, granted. They are not the main source of malware, though. I do assume here that the average /. reader knows a bit more about his machine than "push this button to turn on, when a window opens that you don't know, panic". Likewise, a lot of you say they have no AV suit installed and never had troubles with malware. I believe you. You're probably not into dancing pigs and if you are, you don't let any arbitrary webpage gain root access to show those pigs dancing.
A lot of users do. And thus get infected. And thus become a security problem.
Governments will create a lot of laws concerning the problem, without one that actually addresses the problem: Making the user responsible for his security. I don't mean "get infected, get your pants sued off". I mean that you are required to take reasonable (!) means and surf safely, that includes not clicking on every friggin' crap you run into, that includes not opening every goddamn spam mail and run the infector. This would require educated users, and education has always been the mortal enemy of surveillance and monitoring, so we won't see any of this anytime soon. So it's hopeless.
On the other hand, the infections we face currently (which may change, but so far didn't) don't even come close to enabling anyone to cause a global network meltdown. It is a nuisance (because of spam, page infections and so on), attacks may take out certain parts of the net, but there's no global threat. So it's not serious.
Depends on your agenda (Score:2)
Much of the data are gathered by ultra-secretive government agencies
Bush wanted to know who was moving porn in cyberspace. Obama wants to know who's moving cash. Both are legitimate concerns on the surface, but the searches will suffer from many false positives. Most porn doesn't involve kids or coerced victims. Likewise, the amount of money needed to finance another 9/11 could easily moved down below the noise level of AIG's CDS operations. While law enforcement is looking for the rare needle in each haystack, they'll be motivated to take action on the other stuff they fin
Because the threat is real (Score:2, Informative)
There have been some very vivid demonstrations of the impacts of cyber-warfare, such as the attacks on Estonia and Georgia, Chinese and Iranian suppresion of free speech and media, air traffic control penetrations, and demonstrated penetrations of SCADA networks (power grid in particular). In Estonia, gov't services were disrupted, and the local equivalent of 911 was broken. Georgia was not as badly dinged as Estonia, largely because they're less reliant on networked services. (c.f. http://www.economist. [economist.com]
Re: (Score:2)
You point out a huge problem: today we have little redundancy and almost no wiggle room for any sort of failure. JIT inventory means that if UPS or FedEx drivers go out on strike commerce shuts down, even the stores on Main Street. Factories operate on the thinnest of margins with no reserve capacity.
So what if Something Bad happens? In 1970 it would have mean almost nothing. Today, almost any major event is going to distrupt supply chains, inventory and commerce. The result if we are talking about pap