3 ms·
USA cyber defenses are NOT up to the task of defending our critical electronic infrastructure. Letting every company that runs critical services decide their o
by raemike123 10y ago
USA cyber defenses are NOT up to the task of defending our critical electronic infrastructure. Letting every company that runs critical services decide their own security posture is not scalable and has left us vulnerable. While no one is getting hurt, we are taking cyber missile hits from our enemies and eventually the damage will be worse. Other countries with more central controls will be less vulnerable than we are to crippling infrastructure take downs.
- bluejekyll 10y agoNo. What we need are new techniques for creating back-pressure to all the routers which are forwarding on this type of attack. The issue is that our Routing technology does not give downstream nodes any way to push back on the flood of packets. Cisco could step up to the plate here. And no, I'm not talking about firewalls. We need newer ICMP type packets to create this back-pressure, so that we can stop floods like this.
- andrewmchen 10y agoIt looks like we used to have something similar but it got deprecated. https://tools.ietf.org/html/rfc6633 https://tools.ietf.org/html/rfc6633
- Animats 10y agoI was a big fan of ICMP Source Quench in the early 1980s, but it wouldn't help now. It doesn't have authentication.
- bogomipz 10y ago>"What we need are new techniques for creating back-pressure to all the routers which are forwarding on this type of attack" What is this type of attack? TCP/UDP/ICMP has no notion of of a compromised host. Or even that it was crafted packet. Back pressure already exists in TCP, see slow-start and window sizes, flow control is part of the "control part". When a router's porst buffers are full the router drops the packets on the floor. It does not do further processing of those packets. What would ICMP do here? If I have a million compromised hosts and each sends a single SYN packet towards a destination host, how would ICMP help? ">Cisco could step up to the plate here" What would Cisco do? Cisco doesn't control the ICMP protocol. I think you are not understanding ICMP. The job of ICMP is to report error conditions. ICMP serves as a helper to IP which is itself unreliable and has no form of error control or checking. A router or host being overrun is not a network error condition it is a resource condition. No ICMP type is ever going to be able to stop a host from originating UDP/TCP/ICMP towards a destination. Even if it could you would just overwhelm it in the outbound direction by replying to potentially millions of hosts.
- castis 10y ago> we are taking cyber missile hits A better analogy would be 'mocked cyber mass protests' seeing as how no infrastructure will need to be rebuilt after this passes.
- etherealflux 10y agoThankfully, we don't leave in the Star Trek universe, where hacking a computer causes it to explode in a shower of white-hot shrapnel.
- floatboth 10y agoWho the hell uses the word "cyber" and especially "cyber missiles" non-ironically these days? (Government people, for some reason, but yeah.) Critical infrastructure MUST NOT rely on PUBLIC networks like the Internet. It's a TERRIBLE idea. If you're working on anything actually critical, build your own fucking ISOLATED network with your own fucking cables.
- pbarnes_1 10y agoZzzz. The USG is not responsible for a corporation that runs DNS services.