Internet Security Is Doomed Unless We Review Its Key Foundations And Architecture: US Experts And Mainstream News Report
It seems that everyone is so completely numbed by Microsoft smooth and systematic release of security patches, that the new mantra for feeling OK when it comes to Internet security is simply: "SP2 and automatic updates, with a sprinkle of good anti-virus, anti-spyware and a slice of anti-malware software tools is all (!) you need to keep Internet threats at bay".
I wish it was true.
Photo credit: LL
But let me tell you: for one I hate to have an operating system that needs to be patched every few days and a slew of complementary security tools running in the background at all times, and consuming nearly 50% of all my processing power and resources.
Do I need to move inside my house with a machine gun, armed to my teeth like a rambo, while three body guards look my back and my sides as I move from kitchen to bedroom?
Come on guys wake up!
This can't be the way to manage security on the Internet. the issue is that the premises and foundations on which our "false" sense of security is built today is engineered on thin air. Once again my claim is: there are no Internet security architectures in place.
"More than one million computers on the net have been hijacked to attack websites and pump out spam and viruses. The huge number was revealed by security researchers who have spent months tracking more than 100 networks of remotely-controlled machines. The largest network of so-called zombie networks spied on by the team was made up of 50,000 hijacked home computers.
Data was gathered using machines that looked innocent but which logged everything hackers did to them."
"Criminals also seem to be starting to use 'bot nets for mass identity theft, to host websites that look like those of banks so confidential information can be gathered and to peep into online traffic to steal sensitive data.
Leveraging the power of several thousand bots, it is viable to take down almost any website or network instantly," said the researchers. "Even in unskilled hands, it should be obvious that 'bot nets are a loaded and powerful weapon."
And now with the widespread adoption of wi-fi, the situation is going to get a lot worse for everyone not paying attentio to this.
Hotels are wide open. Universities are wide open. Your house and wi-fi connection are ....
People are committing all sorts of criminal activity over the Internet using wireless, but the terrible issue is not this. It is the fact that these crimes could all be traced back to somebody completely innocent.
"More than 10 million homes in the United States now have a Wi-Fi base station providing a wireless Internet connection, according to ABI, a technology research firm in Oyster Bay, N.Y. There were essentially none as recently as 2000, the firm said.
Those base stations, or routers, allow several computers to share a high-speed Internet connection and let users maintain that connection as they move about with laptops or other mobile devices. The routers are also used to connect computers with printers and other devices.
Experts say most of those households never turn on any of the features, available in almost all Wi-Fi routers, that change the system's default settings, conceal the connection from others and encrypt the data sent over it.
Failure to secure the network in those ways can allow anyone with a Wi-Fi-enabled computer within about 200 feet to tap into the base station's Internet connection, typically a digital subscriber line or a cable modem.
In addition, many universities are now blanketing campuses with open Wi-Fi networks, and dozens of cities and towns are creating wireless grids. While some locations charge a fee or otherwise force users to register, others leave the network open.
All that is needed to tap in is a Wi-Fi card, typically costing $30 or less, for the user's PC or laptop. (Wi-Fi cards contain an identification code that is potentially traceable, but that information is not retained by most consumer routers, and the cards can in any case be readily removed and thrown away.)"
It is also today's news (via Slashdot again) that "The President's Information Technology Advisory Committee in their February 2005 report to GW writes "...infrastructure of the United States, which is now vital for communication, commerce, and control of our physical infrastructure, is highly vulnerable to terrorist and criminal attacks."
The report goes on to say that "fundamentally new approaches are needed to address the more serious structural weaknesses of the IT infrastructure".
"PITAC found that the Nation's IT infrastructure - integral to national
and homeland security and everyday life - is highly vulnerable to attack.
While existing technologies can address some vulnerabilities, fundamentally new architectures and technologies are needed to address the larger structural insecurities of an infrastructure developed in a more trusting time when mass cyber attacks were not foreseen.
From the report:
"Today, it is possible for a malicious agent to penetrate millions of computers around the world in a matter of minutes, exploiting those machines to attack the Nation's critical infrastructure, penetrate sensitive systems, or steal valuable data. The growth in the number of attacks matches the tremendous growth in connectivity, and dealing with these attacks now costs the Nation billions of dollars annually.
Moreover, we are rapidly losing ground to those who do harm, as is indicated by the steadily mounting numbers of compromised networks and resulting financial losses."
What the report states in crystal clear terms is that there is no bright future by following the Microsoft road of endless patching. What we need is a fundamentally new way to look at security and a complete overhaul of how we architect and design security around interconnected IT systems.
The report states in its Conclusion section:
"The Committee analyzed more than 30 reports on cyber security R&D to identify 10 priority areas for increased emphasis. These areas are of paramount importance. Without significant advances in research in these areas, the Nation will not be able to secure its IT infrastructure."
Among the ten listed, the two that I think are essential to the transformations we need to make in order to get to the other side of this muddy river are:
1) Better authentication
"Authentication schemes for networked entities such as hardware, software, data, and users are needed for a variety of purposes, including identification, authorization, and integrity checking. These schemes must be provably secure, easy to verify, supportable for use with billions of components, and rapidly executable. Methods in traditional cryptography have focused on security but may not be efficient enough for widespread use in environments where, for example, millions of data packets per second must be authenticated by a single network router. Much useful work has been done on cryptographic protocols. But the requirement that the protocols be usable in an environment such as the Internet demands the development of new protocols.
Research subtopics include:
• Research on infrastructure and protocols for large-scale public
key distribution and management and on other possible
• Certificate and revocation management
• Integration with biometrics and physical tokens
• Decoupling authentication from identification to address
2) Holistic System Security
"Effective security in a complex, many-layered, global infrastructure such as
the Internet and its nodes requires more than the security of its component
Establishing sound methods for authentication, secure protocols for basic Web operations, and improved software engineering will undoubtedly become part of an evolving solution to this problem.
But most importantly, researchers must recognize from the outset that an end-to-end architectural approach to the security of the whole necessarily transcends the security of the individual parts.
For example, customers assume that their online banking transactions, based on secure socket layer (SSL), are indeed secure. But by spoofing the associated underlying protocols or end-user software, a malicious party can make a user's transaction appear secured by SSL while allowing the theft of confidential data. It is also possible to compromise the security of the end computing systems, obtaining the data even though it was secure in transit.
Software usability itself is a legitimate and important research topic in cyber security. Incorrectly used software or hostile or confusing user interfaces can lead to user frustration and unauthorized workarounds that can compromise even the most robust security schemes. Research is also needed on how to make large and complex systems, where components can interact in unexpected ways, secure as a whole.
Ultimately, fundamental research should address the development of entirely new, holistic security architectures including hardware, operating systems, networks, and applications.
Research subtopics include:
• Building secure systems from trusted and untrusted components, and integrating new systems with legacy components
• Proactively reducing vulnerabilities
• Securing a system that is co-operated and/or co-owned by an adversary
• Comprehensively addressing the growing problem of insider threats
• Modeling and analyzing emergent failures in complex systems
• Human factors engineering, such as interfaces that promote security and
user awareness of its importance
• Supporting privacy in conjunction with improved security"
Yes, this is indeed what we need. Without the spectrum of needing to be monitored and identified in everything we electronically do, without the need to give up completely our personal privacy, there are indeed ways set around a renewed way of looking at security architecture, authentication and identity management that could radically transform and prevent the doomed fate that Internet communication and online spaces face in the near future.
P.S:: Read again, if you have not yet done so, what security and identity futurist Wes Kussmaul wrote just two days ago in his guest article here.
blog comments powered by Disqus