3 ms·

That program is completely misguided. You don't need thousands of "cyber soldiers", just a few good computer scientists, mathematicians and engineers. Because a

by RGamma 11y ago

That program is completely misguided. You don't need thousands of "cyber soldiers", just a few good computer scientists, mathematicians and engineers. Because a system built from trusted and provably correct components (hardware and software) is infinitely better than a swiss cheese with dozens of people attempting to keep it from falling apart. And from that point on, you only need to teach soldiers to operate their equipment correctly. The challenges of information technology w.r.t. warfare are fundamentally different from usual war tactics. You can't solve them by throwing lots of personel or big guns at them. If midst-fight your equipment or infrastructure fails because of security flaws, it's not because there's no personel to deal with it (for that it's already too late): it's because its designers failed at the drawing board. It'd be better they concentrated on quality instead of quantity and the resignative "anything can be hacked" myth a lot of popular media is putting forward, as if information technology operated according to the same rules the physical battlefield does. These analogies only go so far... (of course the same applies to non-military contexts as well)

emmelaich 11y ago
You'd need a lot more for offensive operations. And although the article says only a few of those thousands will be used for offensive ops, I suspect that many more will be. I think you can make a better effort with more people; the critical thing is the quality of the people. Of course there's a good chance more will be less valuable!
- RGamma 11y ago
  Yes, I was focussing more on the defensive aspect. In offense the situation may be different, but in that case, if your enemy is in large-scale possession of technology that would make it susceptible to this in the first place, bad things have happened...
jcrawfordor 11y ago
As someone who works in security operations, there is absolutely a need for people. Yes, a small number of experts could, given enough time, produce some small amount of thoroughly secure components. But that's not the situation we're facing. In real life, governments are some of the largest enterprises that exist, and use the same software and systems as everyone else. Complete replacement with provably correct systems is such a large task that it would never be completed, for just the same reasons as in private industry. The attack surface of a government ranges from sophisticated military hardware to mobile apps. Deterring, detecting, and remediating security incidents is thus done the same way the private sector does it: testing, continuous monitoring, hunting, forensics, etc. All of these activities are person-hour intensive, and I don't think there's a security operations center in the world that wouldn't tell you right now that they are limited by the size of their staff. That said, full-service security departments will include technical auditing and software security components, and I suspect the German government intends to include this. Of course, these functions are quite limited by being on the client end of the relationship, as I doubt the German government produces any more of its software in-house than the US government does (which is not very much).

by RGamma 11y ago

emmelaich 11y ago

You'd need a lot more for offensive operations. And although the article says only a few of those thousands will be used for offensive ops, I suspect that many more will be. I think you can make a better effort with more people; the critical thing is the quality of the people. Of course there's a good chance more will be less valuable!

RGamma 11y ago
Yes, I was focussing more on the defensive aspect. In offense the situation may be different, but in that case, if your enemy is in large-scale possession of technology that would make it susceptible to this in the first place, bad things have happened...

jcrawfordor 11y ago

As someone who works in security operations, there is absolutely a need for people. Yes, a small number of experts could, given enough time, produce some small amount of thoroughly secure components. But that's not the situation we're facing. In real life, governments are some of the largest enterprises that exist, and use the same software and systems as everyone else. Complete replacement with provably correct systems is such a large task that it would never be completed, for just the same reasons as in private industry. The attack surface of a government ranges from sophisticated military hardware to mobile apps. Deterring, detecting, and remediating security incidents is thus done the same way the private sector does it: testing, continuous monitoring, hunting, forensics, etc. All of these activities are person-hour intensive, and I don't think there's a security operations center in the world that wouldn't tell you right now that they are limited by the size of their staff. That said, full-service security departments will include technical auditing and software security components, and I suspect the German government intends to include this. Of course, these functions are quite limited by being on the client end of the relationship, as I doubt the German government produces any more of its software in-house than the US government does (which is not very much).