I also read your other comment that you posted in the comment >This is a serious problem, not only from the problems intelligence angies with many powers and poor oversight; ignoring defense is going to bite a lot of people in bad ways. We are already seeing the beginnings of this with the escalating impact computer-based attacks are having on their victims.
I agree. Yes its embarrassing and they keep claiming "Do more Penetration Testing, more Vulnerability Scanning, more Risk assessment" Nobody even knows what the hell that even means and we're still getting breached! The biggest mistake we've made is to claim, "a great offense is always the best defense."
We should be doing Security Compliance aka Defense in Depth! But everybody seems to think Defense in Depth is somehow different from Security Compliance.
>Defense in Depth is when multiple layers of security controls are placed throughout a critical environment. It is a layering tactic, conceived by the National Security Agency (NSA) as a comprehensive approach to information and electronic security.
If they actually went through the diligence of conforming with the security controls (ISO 27002, FEDRAMP, NIST 800-53) that they defined (much like financial compliance conforms to policies, standards, or laws), they'd be in a much more comprehensive shape. Even PCI-DSS...just replace the word cardholder data with sensitive data and you have more defense than whatever snake-oil Security Risk Plan is out there.
I champion for compliance =).
"We don't need a firewall, we have good host security"
"We don't need host security, we have a good firewall"
This kind of practical defense isn't the only thing we've been skipping. We need a lot more basic research into how to secure modern technology. We need a design culture that isn't building features that require insecurity.
It is limiting top think of this problem as a "cybesecurity" problem. These same technologies will create problems in all areas of life, so we need a lot more education about what capabilities exist how they can be used. We need to be teaching people - from a very young age - what happens to your {meta,}data in a world with permanent data storage and powerful machine learning analysis. We need this education "yesterday", as these problems are not theoretical anymore[5].
[5] http://www.nytimes.com/2012/02/19/magazine/shopping-habits.h...
We're working on something in this vein -- https://www.trycryptomove.com -- our technology does security via continuous concealment. Actively defends against insider attacks and catastrophic breaches, because the attacker can't even identify the data.
We've gotten two types of reactions: (1) we get it, layered security, defense in depth; (2) solution in search of a problem, we have good host security, we have a good firewall, legacy data-at-rest security is good enough. Thankfully far more of #1 than #2, but it's telling about an organization's approach to security.
IMO, this isn't a castle approach. Its more like you've added a security control to help with Data Retention.
>We don't need a firewall, we have good host security >We don't need host security, we have a good firewall
The "quote" (paraphrase of a very-common attitude) is from this link in my first post:
http://www.ranum.com/security/computer_security/editorials/d...
That is completely wrong. The CSS is largely devoted to IA and IP, not to mention many other defensive cyber support units. In fact DHS, FBI and FCC have heavily invested in Critical Infrastructure protection, NETSEC and related capabilities.
Is it sufficient? No, but saying that the USG strategy is 100% offensive is completely and totally untrue.
[1]https://www.nsa.gov/about/central_security_service/index.sht... [2]http://www.dhs.gov/topic/cybersecurity
In the late-80s/early-90s, I used to laugh at the common sci-fi trope of always having some convenient way to hack into anything. I originally assumed this was literary license[3]; surely nobody would actually be dumb enough to to put critical systems on a publicly-accessible network! Well... I guess I was wrong. Not only were we stupid enough to connect everything to a network, some people are trying to start an entire industry based on the idea of plugging things into the internet.
We've simply gotten lucky so far; we have barely scratched the surface of what can be done. I know rare problems are notoriously hard to model. Getting people to properly prepare for these events or even simply understand the actual cost of failure can be incredibly difficult, but that doesn't mean the problem can be ignored.
I almost see a similarity to the martingale[4] betting strategy. It works ok until you get your first rare set of consecutive losses and you bottom out your bankroll. The core problem in martingale is that it requires you to have an unbounded pool of cash to work with, so maybe the answer insecurity is related to only accepting risks if the risk has known bounds.
[1] https://news.ycombinator.com/item?id=10482498
[2] http://www.ranum.com/security/computer_security/editorials/d...
[3] JMS has talked about the need for license when he wrote Babylon 5, where he said that the ships always move "at the speed of plot".
[4] https://en.wikipedia.org/wiki/Martingale_%28betting_system%2...