4 ms·
TL;DR: Estonia had a heavy reliance on internet infrastructure but wasn't big enough to take the gut punch of a large-scale, sustained, possibly state-sponsored
by throwaway729 10y ago
TL;DR: Estonia had a heavy reliance on internet infrastructure but wasn't big enough to take the gut punch of a large-scale, sustained, possibly state-sponsored DDoS. To prevent a similar scenario, the US should broaden the legal authority of law enforcement and intelligence agencies and invest in R&D.
To be honest, I don't really follow this line of reasoning, and felt like this was basically two separate articles glued on top of each other (a nice summary of the Estonia situation, followed by an unrelated and therefore mostly ill-motivated set of policy proposals)
The author himself concedes that an Estonia-like scenario is highly unlikely in the US for the obvious reason -- we have a crap-load more bandwidth than Estonia and a lot of experience with large-scale DDoS attacks. Conversely, intrusions, not DDoS, are apparently the most damaging form of cyber-attack against the US government and US organizations. But the concrete policy recommendations (esp. regarding taking the gloves off of LE/intel agencies) are mostly motivated by DDoS, not intrusions. And the policy recommendations that do address intrusions contain a lot of IMO magical thinking -- throwing R&D money at military contractors, for instance.
- wnevets 10y agoIt's all just evil hacking to a large group of people which makes it very easy to link the two.
- stcredzero 10y agoIt does all fall under the rubric of "governments aren't yet as good at computer and network security as they need to be."
- saint_fiasco 10y agoSpeaking of gluing separate issues on top of each other: If the US government had the same kinds of online services they have in Estonia, could those services withstand the kind of DDoS attack recently used against krebsonsecurity?
- AnimalMuppet 10y agoWell, let's take one agency - the IRS. Could they take what happened to krebsonsecurity? Maybe, maybe not. But then you have the Department of Agriculture, the State Department, and on and on. So: Could that scale of attack shut down one agency? Plausibly yes. Could it shut down the Federal government's internet presence? Almost certainly no.
- asimuvPR 10y agoThere might be a potential issue regarding architecture. Government systems are typically dependant on each other within the same agency. Taking down one server le service might have a domino effect on the rest. Lots of these systems are old and have merely been updated with web guis.