Cyber security, civil liberties, our common welfare and the stability of Nations.
How bad is the cyber security situation really? If we have a serious security problem, how do we get ourselves out of this mess? In particular, what can I do to improve my situation and protect those I care about?
"There is no such thing as 'secure' anymore".
Worse, critical aspects of today's mainstream civilian cyber security ecosystem foundations are fundamentally flawed at the conceptual design, architecture and implementation levels. (See Synaptic Labs' free 2012 "Annual Cyber Security Reports" online for the full blow-by-blow disclosure.) In the second article, we explored why weak cyber security is one of the most serious (inter)national security challenges we face today. We learnt how computers used in industrial systems can be hacked, and reprogrammed to make room sized power generators jump up and down, emit smoke, and shake themselves to pieces. We also learnt how "it is possible to contaminate the database upon which banking operates. [As] there is no gold standard, no dollar bills, so if you can just contaminate the data in one large bank, you could cause global banking to collapse." Last week we looked at the perverse economic incentives favouring cybercrime. We also explored how inadequate resourcing (training and application of cyber security best practices) continue to expose our communities to cyber fraud, costing victims more than $388 billion worldwide in 2010-2011 and even bankrupting companies.
"There are problems today in cyber security practice that impact the community as a whole, and we need to solve those problems soon. They are pervasive, ongoing, and getting worse, not better." … "Right now, the community at large is applying the wrong or inadequate engineering practices, and taking a lot of short cuts. This adds greatly to our collective security risks." Ultimately, this joint duty of cyber care must be shared between Governments, vendors, employers and employees.
This week we talk about that 8000 pound elephant sitting in the room; we will recall how systematically poor governance decisions around the world has undermined the community and resulted in severe risks to National, Regional and Global stability.
Between 1970 and 2000, individuals and organizations concerned with protecting their personal privacy and corporate secrets were engaged in heated discussions with governments around the world. They wanted the response-ability to employ high assurance security techniques and technologies to safeguard their legitimate interests, and the legitimate interests of their stakeholders. i.e. The ability to defend their domain. During that period of time, policies and legislation discouraged or outright prevented the private sector from building genuinely secure computing systems for the civilian community. The Australian Government – Department of Defence – Defense Signals Directorate website ( http://dsd.gov.au ) openly promotes their mission statement as: "Reveal Their Secrets – Protect our Own". Unfortunately in the past, in practice, most Governments around the world defined "Their Secrets" as the private or sensitive data of any person or organisation not part of their own Government. To ensure easy *covert* access to historically unprecedented amounts of sensitive data Governments around the world systematically undermined and prohibited effective civilian cyber security. Not surprisingly, this made it possible for any malicious actor on the Internet to trivially exploit cyber vulnerabilities which should have been avoidable. Predictably this "Total Information Awareness" style policy has caused untold financial and personal damage to the global community, and now is undermining their own country's economic stability.
Around 2000, the political environment in the West changed in favour of stronger civilian cyber security. Today, civilian ICT organizations have had 12 years to change their development practices… for the most part they have not. Generally speaking, the destructive momentum of low assurance (safety and security) development practices continued throughout the entire ICT industry. As a direct consequence, cyber fraud has cost victims more than $388 billion worldwide in 2010-2011 alone. Feelings of powerlessness and lack of justice continue to be felt by its victims worldwide.
Today Western Governments openly acknowledge that weak cyber security places the stability of (their) nations at risk. Increasingly the Information Assurance Directorates (IAD) of intelligence organisations are proactively supporting and empowering their civilian communities to protect their legitimate interests. Indeed, Governments are now making it extremely clear that there are many economic and social benefits to high assurance security and safety.
Governments and the civilian community as a whole must invest, develop, deploy and maintain strong information security techniques and best practices to protect the legitimate interests of all stakeholders.
Each intelligence community will have to decide for themselves: is it better to expose their own country to attacks that exploit known cyber vulnerabilities so they can attack others, or is it it better to protect the millions of Government, enterprise and personal computing systems in their country and let go of the attack capability against a few targets?
Are Nations going to invest in the ability to inflict pain, or will they invest in advancing the collective protection of the global community?
The stakes are high. A mistake on this point will expose all of us to unnecessary high risks and unnecessary pain.
In the same way that the Global community has almost completely abandoned political dictatorships due to the dangers of having a `single point of failure' in their architecture, the community at large must ultimately abandon security systems with single points of trust/security failure. Unfortunately, secure cyber-security foundations based on a system of checks-and-balances, as called for by the US NSA IAD and others, are not widely available today. Synaptic Laboratories Limited is one example of a company that has taken up the gauntlet, and has several projects under development to address these specific issues.
Working individually and collectively, applying "duty of care" and striving to protect the legitimate interests of all stakeholders, we can, and will, work our way out of this cyber mess. It might be true that there are seven billion people in the world and counting. It might be true (as the U.K. and U.S. Governments say) that our shared cyber problems can not be solved by one person or even one country. Nevertheless, what you do on a day-to-day basis makes a difference, and we need you on board. We look forward to working with you to secure (y)our world.
You can find all articles in this series online at www.independent.com.mt, and shortly in the news section at www.ictgozomalta.eu . You can find full citations to all materials referenced in this article, and related cyber security materials including Brian Snow's presentation, at tinyurl.com/SynapticLabsAnnualReports2012 . Co-author Pierluigi Paganini, Director and CISO of Bit4ID, Italy has 20+ years of security experience and has many years of in-depth investigative cyber security journalism on important cyber events. Find his blog at: securityaffairs.co . ICT Gozo Malta is a joint collaboration between the Gozo Business Chamber and Synaptic Labs, part funded by the Ministry for Gozo, Eco Gozo Project, and a prize winner in the 2012 Malta Government National Enterprise Innovation Awards. www.ictgozomalta.eu has links to free cyber awareness resources for all age groups. To promote Maltese ICT to the world, we encourage all ICT Professionals to register on the online ICT GM Skills Register and keep aware of developments, both in Cyber Security and other ICT R&D initiatives in Malta and Gozo. For further details contact David Pace at david.pace@ictgozomalta.eu .