4 ms·

This is theatre. Were Congress to expand tort law to mandate standards and consequences similar to products liability regulations for other products, then the a

by rrggrr 10y ago

This is theatre. Were Congress to expand tort law to mandate standards and consequences similar to products liability regulations for other products, then the attack surface available to state and non-state actors would meaningfully shrink. If there is one thing the plaintiff's lawyers excel at, it is inflicting extensive expenses and pain on parties who negligently or fraudulently create, fund creation, or use products that injure property or person; thereby creating effective incentives to harden products. You will know the USGOV is serious about INFOSEC when they stop issuing reports and start legislating, regulating and enforcing meaningful standards, as they already do for automobiles, drugs, machinery, etc.

firasd 10y ago
Agreed. I wrote this on FB last year when people were calling hacks 'cyberwar': I’m still not sure what to think of the Sony hack. I instantly rejected the idea that it amounted to “cyber war”, but beyond that, I think governments can take a legitimate interest in digital attacks on private companies, same as law enforcement would get involved in a physical attack on a corporate building. I think the main response to IT breaches has to be “defensive”; secure code and networks. You can’t find and retaliate towards every hacker. And the benefit is that unlike retaliatory policy responses, good network security is designed to protect against all third parties, whether it’s your own government, random financial criminals, James Bond villains, whatever the entity or motive.
- rrggrr 10y ago
  The Sony hack is a great example. The shareholders, employees and other stakeholders should have enjoyed legal remedies that could have rocked the corporate world into enacting meaningful INFOSEC practices. Instead I've seen reports they paid only $8m USD in a class action settlement. Its not enough to serve the public policy need.
wilde 10y ago
But if we did that, it would be harder to spy on other people, no? sigh
dv_dt 10y ago
I don't really see it as a primarily driven by liability. I see various federal agencies as strongly discouraging increased private investment in security infrastructure via very public demands vs Apple to decrypt their devices, and very secret national security letters also requiring decryption. Any company has to see that as a potential risk - after putting in R&D funding to secure their products, they could be then required to break their own encryption or face legal jeopardy. Several small businesses have been driven out of business by such behavior, and large business have mostly capitulated.
AnthonyMouse 10y ago
> Were Congress to expand tort law to mandate standards and consequences similar to products liability regulations for other products, then the attack surface available to state and non-state actors would meaningfully shrink. The problem is the organization sizes are the opposite of what works for products liability. It's not Joe Homeowner buying an appliance from Sears or GE, it's an insurance company or government contractor getting software from an individual or a company with nine employees. You can't use that to force improvements from small entities because they barely even have lawyers to tell them what they have to do, and nobody will actually sue them if they have no money anyway. What you need isn't for the software vendor to be liable, it's for the company holding all the customer data to be liable to those customers. Then those companies will start caring about actual security instead of "compliance" and figuring out how to pass the buck, and software vendors will still have to make secure software because nobody will buy anything else anymore. It also forces companies to start treating huge databases as the security liability that they are. And it conveniently applies to the large tech companies that are also data warehousing companies like Yahoo or LinkedIn/Microsoft.
- nickpsecurity 10y ago
  "it's an insurance company or government contractor getting software from an individual or a company with nine employees." The good news is high-assurance systems have been built with smaller teams than that. We also have cases like Bernstein's where one person builds all kinds of stuff with provably better security using a bit of brains and methods that work. We also have tools like SPARK for static systems and Rust/Eiffel for larger ones that can easily eliminate entire classes of attack. Ada & SPARK have been around decades. Eiffel over a decade. Hardly anyone in security-critical space using them. Most of what you see is easily prevented. Even with small teams. They just don't care or try. A baseline stopping code injection or insecure configurations would knock out a ton of problems. The next thing that would happen, as did with DO-178B regulation & TCSEC, would be reusable components and consulting services designed to meet the standard where the cost & limited expertise is spread among many customers. It could be done. Even for smaller players to a large degree. "What you need isn't for the software vendor to be liable, it's for the company holding all the customer data to be liable to those customers." Doesn't solve the DDOS problem which can also be used for extortion, interfering with government operations, etc. My approach targeting root cause handles that, too.
someuser001 10y ago
The report also disregards various other sources of foreign manipulation on US networks including spam and propaganda which as everyone knows are also forms of hacking. For instance the 'fake news' on Youtube and spam links on Facebook and Instagram which link to phishing sites. Companies must be held accountable for harboring this type of material.
all_blue_chucks 10y ago
It was a spear-phishing attack. The only way to protect against that is to ban email.

by rrggrr 10y ago

firasd 10y ago

Agreed. I wrote this on FB last year when people were calling hacks 'cyberwar': I’m still not sure what to think of the Sony hack. I instantly rejected the idea that it amounted to “cyber war”, but beyond that, I think governments can take a legitimate interest in digital attacks on private companies, same as law enforcement would get involved in a physical attack on a corporate building. I think the main response to IT breaches has to be “defensive”; secure code and networks. You can’t find and retaliate towards every hacker. And the benefit is that unlike retaliatory policy responses, good network security is designed to protect against all third parties, whether it’s your own government, random financial criminals, James Bond villains, whatever the entity or motive.

rrggrr 10y ago
The Sony hack is a great example. The shareholders, employees and other stakeholders should have enjoyed legal remedies that could have rocked the corporate world into enacting meaningful INFOSEC practices. Instead I've seen reports they paid only $8m USD in a class action settlement. Its not enough to serve the public policy need.

wilde 10y ago

But if we did that, it would be harder to spy on other people, no? sigh

dv_dt 10y ago

I don't really see it as a primarily driven by liability. I see various federal agencies as strongly discouraging increased private investment in security infrastructure via very public demands vs Apple to decrypt their devices, and very secret national security letters also requiring decryption. Any company has to see that as a potential risk - after putting in R&D funding to secure their products, they could be then required to break their own encryption or face legal jeopardy. Several small businesses have been driven out of business by such behavior, and large business have mostly capitulated.

AnthonyMouse 10y ago

> Were Congress to expand tort law to mandate standards and consequences similar to products liability regulations for other products, then the attack surface available to state and non-state actors would meaningfully shrink. The problem is the organization sizes are the opposite of what works for products liability. It's not Joe Homeowner buying an appliance from Sears or GE, it's an insurance company or government contractor getting software from an individual or a company with nine employees. You can't use that to force improvements from small entities because they barely even have lawyers to tell them what they have to do, and nobody will actually sue them if they have no money anyway. What you need isn't for the software vendor to be liable, it's for the company holding all the customer data to be liable to those customers. Then those companies will start caring about actual security instead of "compliance" and figuring out how to pass the buck, and software vendors will still have to make secure software because nobody will buy anything else anymore. It also forces companies to start treating huge databases as the security liability that they are. And it conveniently applies to the large tech companies that are also data warehousing companies like Yahoo or LinkedIn/Microsoft.

nickpsecurity 10y ago
"it's an insurance company or government contractor getting software from an individual or a company with nine employees." The good news is high-assurance systems have been built with smaller teams than that. We also have cases like Bernstein's where one person builds all kinds of stuff with provably better security using a bit of brains and methods that work. We also have tools like SPARK for static systems and Rust/Eiffel for larger ones that can easily eliminate entire classes of attack. Ada & SPARK have been around decades. Eiffel over a decade. Hardly anyone in security-critical space using them. Most of what you see is easily prevented. Even with small teams. They just don't care or try. A baseline stopping code injection or insecure configurations would knock out a ton of problems. The next thing that would happen, as did with DO-178B regulation & TCSEC, would be reusable components and consulting services designed to meet the standard where the cost & limited expertise is spread among many customers. It could be done. Even for smaller players to a large degree. "What you need isn't for the software vendor to be liable, it's for the company holding all the customer data to be liable to those customers." Doesn't solve the DDOS problem which can also be used for extortion, interfering with government operations, etc. My approach targeting root cause handles that, too.

someuser001 10y ago

The report also disregards various other sources of foreign manipulation on US networks including spam and propaganda which as everyone knows are also forms of hacking. For instance the 'fake news' on Youtube and spam links on Facebook and Instagram which link to phishing sites. Companies must be held accountable for harboring this type of material.

all_blue_chucks 10y ago

It was a spear-phishing attack. The only way to protect against that is to ban email.