SoylentNews is people
SoylentNews
Seventy years into the computer age, Moshe Y. Vardi at ACM wants to know why we still do not seem to know how to build secure information systems:
Cyber insecurity seems to be the normal state of affairs these days. In June 2015, the U.S. Office of Personnel Management announced it had been the target of a data breach targeting the records of as many as 18 million people. In late 2016, we learned about two data breaches at Yahoo! Inc., which compromised over one billion accounts. Lastly, during 2016, close to 20,000 email messages from the U.S. Democratic National Committee were leaked via WikiLeaks. U.S. intelligence agencies argued that the Russian government directed the breaches in an attempt to interfere with the U.S. election process. Furthermore, cyber insecurity goes way beyond data breaches. In October 2016, for example, emergency centers in at least 12 U.S. states had been hit by a deluge of fake emergency calls. What cyber disaster is going to happen next?
[...] The basic problem, I believe, is that security never gets a high-enough priority. We build a computing system for certain functionality, and functionality sells. Then we discover security vulnerabilities and fix them, and security of the system does improve. Microsoft Windows 10 is much, much better security-wise than Windows XP. The question is whether we are eliminating old vulnerabilities faster than we are creating new ones. Judging by the number of publicized security breaches and attacks, the answer to that question seems to be negative.
This raises some very fundamental questions about our field. Are we investing enough in cybersecurity research? Has the research yielded solid scientific foundations as well as useful solutions? Has industry failed to adopt these solutions due to cost/benefit? More fundamentally, how do we change the trajectory in a fundamental way, so the cybersecurity derivative goes from being negative to being positive?
Previously:
It's 2015. Why do we Still Write Insecure Software?
Report Details Cyber Insecurity Incidents at Nuclear Facilities
(Score: 0) by Anonymous Coward on Tuesday April 18 2017, @01:17PM
Thus, are they not to blame?
Ultimately, yes.
To blame for what exactly? Sure, we can blame them and go neener neener, but what we've almost gotten at comes back to the thing about men and angels.
There is no well-defined contract between, say, a cloud service provider, the user as a customer of this cloud, the user as an actor that routes traffic over the internet, and the botnet operator. If a user's network participates in a DDOS against a cloud that user has never even heard of, how could we possible enforce a contract against them? If we could do that, the user might be able to cascade the responsibility to the botnet operator or equipment manufacturer, etc by way of some other contract (or maybe the buck stops at the user due to various contracts).
(It is within my capability to imagine some entity operating on the free market [which does not need to be an ISP necessarily] that all users of, say, a competing logical region of the internet requiring contracts with the botnet operator as another user or actor who routes traffic that would make enforcement possible in the abstract.)
What we have here is a lack of any kind of system to deal with these things. We don't have an egalitarian contract system where everybody is an equal (and I continue to think such a thing is unworkable). Additionally, the warlord whose violent imposition the user is subject to is also derelict in his duty.
The least we could hope for is for our violently imposed warlord (government) to bring his resources to bear on the (malicious) botnet operator; the (negligent) user, equipment manufacturer, ISP, OS vendor, etc; or some combination.
The only reason we accept this warlord is because he protects us from other warlords. What good is a warlord who won't do that? He's derelict in his duty because he's simply allowing another warlord (the botnet operator) infringe on our quiet enjoyment (to borrow a term from the implied rental contract with our warlord) without even so much as trying to do anything about it.