5 ms·

The incentives are all misaligned and the solutions aren't obvious. How is the USG going to secure some random admin access password? Are they going to update t

The incentives are all misaligned and the solutions aren't obvious. How is the USG going to secure some random admin access password? Are they going to update the code in the repo? I agree with hack-back. I agree with a number of proposed solutions, but at the very end of the day the problem with cybersecurity is that most orgs don't have the fiscal allocation that they need if they were to have any hope of stoping foreign states. Rather than compare it to armies, I think we should compare it to spies. If this is truly at the army level we could send a couple dozen missiles and the attackers would get the message. But there are reasons we don't do that though. First, we're not always sure who did what. Second, it's a political quagmire. Armies don't come to your house and help secure it from air strikes. Armies understand attack asymmetry and they hit back. But when it comes to dealing with foreign spies there is a different playbook. The government helps organizations that are critical to national security secure their entry points and resources. They help, but they don't do everything. This only works if the parties involved are interested in working with the government. Long after Nortel was first told of the Chinese hacking / stealing of their IP they were still woefully insecure. They went from being a third of the Canadian stock index to bankruptcy in a couple of years. I don't actually think cybersecurity is possible. I've tried very hard to get governments to change, and there is some progress on the most fragrant violations, but the space is growing too fast and the domain is too maneuverable. I don't think it is possible. All we can hope for is some combination of more defence and realignment of incentives of the actors involved limiting the eventual damage.

edmundsauto 5y ago
> The incentives are all misaligned and the solutions aren't obvious. How is the USG going to secure some random admin access password? Are they going to update the code in the repo? They can publish best practices, research vulnerabilities, provide educational support, and generally do all the kinds of things governments do to encourage the right behaviors. We have some of this, but at some point, switched to the sexier "the best defense is a good offense". Likely because defense is hard.
- mulmen 5y ago
  It makes me wonder there the offense is. Where is the asymmetric response that sends a clear message not to do this again?
  - Red_Leaves_Flyy 5y ago
    What’s a proportional response? Say we shut down the druzhba by bricking Transnefts systems. How are we going to handle the calls from very angry officials in Ukraine, Belarus, Poland, Hungary, Slovakia, the Czech Republic and Germany?
DickingAround 5y ago
I think if you had good attribution it's more like armies. We have been focused on locking our doors, on building better walls, etc. But there is a non-defensive side. In meatspace we expect the government to use kinetic force to stop people from attacking us. Like if I leave my door unlocked and some person comes in to start stealing my stuff, the cops really will respond and come stop that person (I have had a home breakin they responded quickly to). They didn't blame me for having bad locks. I pay a lot of taxes so my walls and locks don't have to be perfect. In cyber land, it's an anarchy. The government offers no defense. But there's no reason someone can't offer a deterrent. Like if you knew who broke into your servers, and there was a goon squad that went and broke down their door either kinetically or electronically I think a deterrent strategy could eventually work. Like it literally does for meat-space security. (Not totally sure I want that, but I'm just saying it would probably work and we haven't really tried it yet.)
- unionpivo 5y ago
  So you have group of 20 somethings in russia that you suspect are behind the hack. What do you do ? Sending a single missile/drone wont work because Russia has air defense (probably - with them you never know how on top they are, but they will after the 1st one). Sending multiple might work, but Russia might fire back and start a war. Sending special forces, or whatever would probably work better first few times, until Russia deliberately set's a trap for them. How about if they are form China, or maybe France or India and you don't relay have prof that would stand in court ? And then what, it's not like USA doesn't have its own hackers that do shady stuff internationally. Other countries have spacial forces as well. I am not sure we want to go this way. In practice that means US doing whatever they want in poor countries (where they already do whatever they want), and not doing much in powerful enough countries where most of those criminals actually are. Most of the time we don't even know definitively who is behind the hacks, so it's kind of a moot point.
  - DickingAround 5y ago
    Yea, I'm not saying I want a kinetic or offensive solution either. More like, it might be possible. Like if someone kills a bunch of people in France and flees to Germany, then Germany is going to hand them back over to France. Clearly not everywhere has extraditions, but you can imagine a world where hacking isn't so much tolerated and defended against as punished and thus uncommon (like breaking into a house; you can but you're not supposed to and there's consequences).
IggleSniggle 5y ago
When you can drop a bomb into a pickle barrel from 30000 ft, the question is not “how do I make my pickle barrel stronger?” it is “how do I decrease my reliance on this single pickle barrel?” Spy-craft is notoriously laughable in its effectiveness. InfoOps, on the other hand... I guess I’m saying comparisons to both Air based warfare and to the propaganda machine are both the most useful analogs, imho.
haimez 5y ago
> most fragrant violations I love the smell of marginally improved security practices in the morning.
- 3pt14159 5y ago
  Thank you for teaching me the difference between the two words with humour. I'm 35 and I somehow completely forgot it was spelled flagrant.

edmundsauto 5y ago

> The incentives are all misaligned and the solutions aren't obvious. How is the USG going to secure some random admin access password? Are they going to update the code in the repo? They can publish best practices, research vulnerabilities, provide educational support, and generally do all the kinds of things governments do to encourage the right behaviors. We have some of this, but at some point, switched to the sexier "the best defense is a good offense". Likely because defense is hard.

mulmen 5y ago
It makes me wonder there the offense is. Where is the asymmetric response that sends a clear message not to do this again?
- Red_Leaves_Flyy 5y ago
  What’s a proportional response? Say we shut down the druzhba by bricking Transnefts systems. How are we going to handle the calls from very angry officials in Ukraine, Belarus, Poland, Hungary, Slovakia, the Czech Republic and Germany?

DickingAround 5y ago

I think if you had good attribution it's more like armies. We have been focused on locking our doors, on building better walls, etc. But there is a non-defensive side. In meatspace we expect the government to use kinetic force to stop people from attacking us. Like if I leave my door unlocked and some person comes in to start stealing my stuff, the cops really will respond and come stop that person (I have had a home breakin they responded quickly to). They didn't blame me for having bad locks. I pay a lot of taxes so my walls and locks don't have to be perfect. In cyber land, it's an anarchy. The government offers no defense. But there's no reason someone can't offer a deterrent. Like if you knew who broke into your servers, and there was a goon squad that went and broke down their door either kinetically or electronically I think a deterrent strategy could eventually work. Like it literally does for meat-space security. (Not totally sure I want that, but I'm just saying it would probably work and we haven't really tried it yet.)

unionpivo 5y ago
So you have group of 20 somethings in russia that you suspect are behind the hack. What do you do ? Sending a single missile/drone wont work because Russia has air defense (probably - with them you never know how on top they are, but they will after the 1st one). Sending multiple might work, but Russia might fire back and start a war. Sending special forces, or whatever would probably work better first few times, until Russia deliberately set's a trap for them. How about if they are form China, or maybe France or India and you don't relay have prof that would stand in court ? And then what, it's not like USA doesn't have its own hackers that do shady stuff internationally. Other countries have spacial forces as well. I am not sure we want to go this way. In practice that means US doing whatever they want in poor countries (where they already do whatever they want), and not doing much in powerful enough countries where most of those criminals actually are. Most of the time we don't even know definitively who is behind the hacks, so it's kind of a moot point.
- DickingAround 5y ago
  Yea, I'm not saying I want a kinetic or offensive solution either. More like, it might be possible. Like if someone kills a bunch of people in France and flees to Germany, then Germany is going to hand them back over to France. Clearly not everywhere has extraditions, but you can imagine a world where hacking isn't so much tolerated and defended against as punished and thus uncommon (like breaking into a house; you can but you're not supposed to and there's consequences).

IggleSniggle 5y ago

When you can drop a bomb into a pickle barrel from 30000 ft, the question is not “how do I make my pickle barrel stronger?” it is “how do I decrease my reliance on this single pickle barrel?” Spy-craft is notoriously laughable in its effectiveness. InfoOps, on the other hand... I guess I’m saying comparisons to both Air based warfare and to the propaganda machine are both the most useful analogs, imho.

haimez 5y ago

> most fragrant violations I love the smell of marginally improved security practices in the morning.

3pt14159 5y ago
Thank you for teaching me the difference between the two words with humour. I'm 35 and I somehow completely forgot it was spelled flagrant.