Trust, not tech, is holding back a safer internet
- Reference: 1675675814
- News link: https://www.theregister.co.uk/2023/02/06/opinion_security_trust/
- Source link:
So where's the sheriff? There are plenty of posses; no end of companies both small and large selling security by the bushel. Firewalls, scanners, heuristic, intrinsic, behavioral, managed, managerial, in-cloud, on-prem, you can mix and match the buzzwords and buy into every new idea. What you can't do is make your systems safe.
If you do want a safe bet in cybersecurity, it's that things aren't going to change any time soon without some fundamental shift in how the market works – if 40 years of constant failure can be called working.
[1]
We have so little reason to trust what's on offer or those offering it. Several stories last week show this: Apple, which makes a big play of intrinsic platform security, is [2]heading to court for ignoring user consent and silently gathering app data anyway. Microsoft, even as it announces the [3]extension of its security platform into Linux , reveals it fumbled its switches on its service infrastructure and took business-critical access away from its customers. These are the big shots in town, but they can't shoot straight.
[4]
[5]
It's almost as if we can't rely on the private sector to protect us against crime. Guess what: we never could and we never will. The state has to take on that role – usually late, usually badly, and usually against the wishes of those who like their crimes kept in the private sector, but usually to better effect than the alternatives.
Public governance and policing of cybercrime is a mixed bag. After a decade or so of mischief, most legislatures got around in the 1990s to defining and outlawing computer misuse by unauthorized parties. If you get caught, there's at least a book to throw at you. It's the catching that's the problem.
[6]
State agencies concentrate on areas where IT is used to further more traditional crimes – drugs, extortion, organized theft and international money laundering, all those fun things. Less so the cybercrime that depends on the characteristic ability of the internet to let small groups operate at scale to commit data-centric badness and move on quickly from target to target. Effective policing here needs to replicate what works in the physical world: inhabit the places where the crimes take place, work with the consent of the general population, and become proficient with the tools, thought processes, and human networks of the criminals.
[7]FOSS could be an unintended victim of EU crusade to make software more secure
[8]Bill shock? The red ink of web services doesn't come out of the blue
[9]Time to study the classics: Vintage tech is the future of enterprise IT
[10]Disruptive innovation's like a party. It's always happening elsewhere
Would you trust the police – by extension, the state – with your data, personal or corporate? Bit of a problem there, especially with so many governments constantly banging on about forcing open encryption standards whether you like it or not. Yet that's the accommodation we've reached with the state over hundreds of years of postal services and old school telecommunications. We even consent to the massive increase in our legal vulnerability surface that comes when we buy a car.
And there are points in our virtual lives where trust just has to be given, if not in the inherent goodness of organizations but at least in the ability to take any misdemeanors to task. Even with end-to-end encryption and without active malicious attacks, your ISP and mobile providers know a great deal about you. Run services in the cloud as an organization, or use a VPN as an individual, and that's a lot more implicit trust.
With attention to transparency, responsibility, and accountability, the state's approach to controlling cybercrime would be a lot more effective. Cybercrime and its control is at heart a problem of data acquisition and pattern recognition, like all sleuthing, and the more you can do of both the better at it you can be – and the greater the risks of abuse.
What sort of automated data gathering would you consent to, if you knew and trusted the purpose, nature and limits of that? If there was a national endpoint security system, would you opt in? How would you decide? These are very hard questions that go to the heart of the social contract, but that's a conversation we'll have to have with ourselves and with the politicians.
[11]
Criminality didn't end when the Wild West got its rule of law, and we never get the police we really want, just those we can put up with. We know we can't put up with cybersecurity that demands a defense budget-sized investment in return for a global crimewave. We need a better sheriff: let's draw up the job description. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y@Dd0H1a@CnI0ZpkiiqGjgAAAEQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2023/01/28/apple_sued_privacy/
[3] https://www.theregister.com/2023/01/31/microsoft_defender_linux/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@Dd0H1a@CnI0ZpkiiqGjgAAAEQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@Dd0H1a@CnI0ZpkiiqGjgAAAEQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@Dd0H1a@CnI0ZpkiiqGjgAAAEQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/01/30/opinion_eu_foss_security/
[8] https://www.theregister.com/2023/01/23/opinion_column/
[9] https://www.theregister.com/2023/01/16/opinion_column/
[10] https://www.theregister.com/2023/01/09/opinion_column_disruption/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@Dd0H1a@CnI0ZpkiiqGjgAAAEQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
Re: "Global spending [is] a quarter of the US defense budget"
Yes, the US of A is certainly the country in the world that spends the most on its military (even though it is the least likely to be invaded)
I wonder why would that be? Maybe because they spend the most on its military?
Global spending on the stuff is at $190 billion a year
Sounds huge, but how much is spent on IT worldwide? What do $190 billion represent compared to the whole of IT spending?
Some evaluate that the correct proportion should be 5%, are we near or far of that value?
Talking about trust: trust no one.
How much of that spending are actually fake costs for tax avoidance purposes?
One is certain, workers' don't see much of those billions.
We need a better sheriff: let's draw up the job description.
Jurisdiction: All sovereign states connected to the internet.
Ah, well, that's fucked that then.
With no plausible way of bringing to justice criminals outside of your jurisdiction[1] you're limited to policing your territory and your borders. That happens relatively easily by geography. For the 'net? Police incoming trans-national data pipes? How will bad traffic be stopped crossing your borders? Governments have been attempting to "control" the internet since they heard of it. But no one owns the internet. And "we" don't want any one to.
If the UN can't handle geopolitical events, due to opt-outs and vetoes etc, what chance is there ever of having a United Internet Nations that is effective globally. Fuck all. Ever.
So individual sovereign states will bullshit their citizens and think of the children while hammering at reducing freedom. If they succeed the citizen loses freedom for no benefit.
As for amount of spend, that's a corporate level thing, and corporates can sort themselves out: pay or don't pay for security; sink or swim.
[1] Extradition treaties bring the accused into your jurisdiction (for better or worse, looking at you Land of the Free).
Trust the government / security services / police?
No.
From the UK, plenty of cases when security services & police have performed some very dubious actions (ranging from "big stuff" security services trying to bring down Harold Wilson, through to, at a more "Personal level" of abuse of power, "spy cops" getting into relationships with naïve peaceful protesters including having children with them, Brazilian electricians shot for no valid reason etc.).
So, not a fan of trusting them.
And as for the UK government - clowns, but malicious clowns (more Pennywise than Grimaldi).
Even in the unlikely event there was a government / security infrastructure you would trust with your personal data, no guarantee that in a few years time things it all may be totally different & trustworthiness has plummeted.
.. And I'm saying that as a fairly average sort of "nothing to hide" person who is not involved in crime & corruption & does not avoid / evade taxes (I'm obviously not Tory MP material!).... though I have long since been on the state "wrong 'un" list, back from when I was filmed by the authorities on anti SA demos (when SA was a white apartheid state & Thatcher called Mandela a terrorist) as conspicuously being against govt policies (even when those policies are obviously dubious) tends not to be approved of
We need politicians and media that understand technology
The main issue is that most politicians and media look stuck in the 1880s while criminals employ technology that to them looks something like Star Trek one. They are slow to react as if threats would come by horses, carriages, and sail vessels. A lot of them, put in front of technology, looks like old-style "savages" in front of coloured glass pearls and mirrors. Everything - social networks, blockchains, AI, metaverses, whatever, look like the next Promised Land to them - "evangelists" make them believe they have to drive their flocks there, and they will be the kings and the high priests (with all the advantages). The only thing they leanrt to fear is criptography - they wish to be able to intecept everybody but themselves.
Cryptocoins created the perfect tool for extortion and frauds, but they were all very slow to understand the inherent risks and upcoming disasters - because they still believe there are gold mines to be digged in California, and they can make you rich in day, and if you don't find one, you can still sell fake ones to suckers, and still become rich.
To fight a risk, you have to understand what it is really. Otherwise you result you fight a plague chasing plague spreaders and buying snake oil, instead understanding how bacteria and viruses spread - and adopting proper hygiene. The dirty, unpatched servers and clients are like the old city slums without septic systems to keep them healty. Administrators prefer to build the shiny facades that appeal to the elites, and let what is not seen rotting and polluted.
Until the situation changes, and those in charge at least enter the XX century if not the XXI yet, there's no hope. Throwing more money at an issue won't solve it magically, if the issue is not understood, and all that matters is money only.
"Global spending [is] a quarter of the US defense budget"
Following the data available [1]here , a quarter of the US defense budget for 2023 is $236 billion, not $190 billion.
Choosing to compare that to the US defense budget is curious. Yes, the US of A is certainly the country in the world that spends the most on its military (even though it is the least likely to be invaded), but that fact is irrelevant to the discussion.
If you're going by a quarter of the US defense budget, $236 billion is [2]the GDP of Egypt in 2017 (#44 in the list). $190 billion would be Iraq's GDP for the same year (#52).
It's much less sexy to compare global spending to a country's GDP, but I feel it's much more relevant than comparing to the world's single richest country's military spending.
But hey, American aircraft carriers are sexy, I admit.
And they work a lot better than [3]that Russian one , eh Putin ?
[1] https://www.usaspending.gov/agency/department-of-defense?fy=2023
[2] https://www.worldometers.info/gdp/gdp-by-country/
[3] https://www.youtube.com/watch?v=Y7XjrAFBr58