5 ms·

I feel this everytime one of these articles comes out, but it seems totally bizarre to me that we rely on private enterprises to deal with state-level attacks s

I feel this everytime one of these articles comes out, but it seems totally bizarre to me that we rely on private enterprises to deal with state-level attacks simply because they are digital and not physical. If a Chinese fighter jet shot down a FedEx plane flying over the Pacific, that would be considered an attack on US sovereignty and the government would respond appropriately. Certainly we wouldn't expect FedEx to have to own their own private fleet of fighter jets to protect their transport planes. No one would be like, "Well it's FedEx's fault for not having the right anti-aircraft defenses." But somehow, once it hits the digital domain we're just supposed to accept that Microsoft is required to defend themselves against China and Russia.

eli 3y ago
Isn't that the idea behind CISA?
- tptacek 3y ago
  I don't think so? What makes you think it is?
- dboreham 3y ago
  NSA
  - c0pium 3y ago
    They’re explicitly forbidden from doing things like that. As they should be; do you really want the government to have access to the kind of private corporation data they would need in order to defend them?
- c0pium 3y ago
  Very much no. CISA defends the federal executive branch and advises critical infrastructure. They don’t and shouldn’t have a proactive role in defending private companies.
tschwimmer 3y ago
The digital domain is fundamentally lower stakes and harder to protect than the physical one. It is good that we do not respond to cyber attacks like we do physical ones because we would have escalated to nuclear war over a decade ago. The scope and volume of cyberattacks is very high but my understanding is that the US has a correspondingly high volume of outbound attacks as well.
- fragmede 3y ago
  Fundamentally? A power plant exploding or dam collapsing would kill way more people and cost far more in property damage than a single FedEx airplane with two crew being shot down.
  - lazide 3y ago
    Those all (currently) require a lot more than stealing a key from M$. Maybe stuxnet would be a better example for your point? Those uranium centrifuges Iran had were very expensive.
  - gmueckl 3y ago
    I have no idea how you would get a dam to collapse with only a laptop and a network connection. As for the power plant, the operators would have to be blind and deaf to let a plant get destroyed. The real threat is a cascading power grid failure due to undersupply, e.g. coordinated forced plant shutdowns. A few days without electricity at a large scale means reduced availability of medical and emergency services, no running water, failing refrigeration, no stoves/ovens for cooking for most of the population, no working gas pumps, no electronic payment, no banking (no way to get cash) etc.
    - networkchad 3y ago
      [dead]
    - salawat 3y ago
      >I have no idea how you would get a dam to collapse with only a laptop and a network connection. In a world where Stuxnet took out uranium centrifuges, and we've had actual PoC's of exploits that resulted in generators fragging themselves, I find your statement to be of the most shocking form of naivete I've heard in a while. And in point of fact, the network connection would probably be for disabling alarms and control systems in order to mask work done to weaken the integrity of the structure itself. Physical and digital is inextricably linked.
miki123211 3y ago
> If a Chinese fighter jet shot down a FedEx plane flying over the Pacific, that would be considered an attack on US sovereignty and the government would respond appropriately But if a bunch of Chinese people robbed a US bank, let's say the federal reserve, causing enormous financial damage but not loss of life, the response would be similar. Especially so if their link to the actual Chinese government was suspected couldn't reliably be proven. Governments catch foreign agents somewhat regularly, and those captures don't lead to an all-out war.
- bell-cot 3y ago
  Perhaps - but, whether or not people from $ForeignNation are involved, U.S. banks (or other corporations, or ordinary citizens) generally do not need to have their own armed police/security forces to deal with armed robberies. Nor their own DA's, courts, etc. Vs. any "cyber" crime? All that nice stuff about "...establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare..." falls on the floor, and...YOYO.
  - nerdponx 3y ago
    > generally do not need to have their own armed police/security forces to deal with armed robberies. They kind of do, no? Also, preventing crime and carrying out criminal justice are two very different things.
  - c0pium 3y ago
    Not true. It’s just that it doesn’t happen fast. This is just one example, there are many: https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical https://www.justice.gov/opa/pr/four-russian-government-emplo...
  - gostsamo 3y ago
    Are you ready to leave your authentication services, acl, patching procedures, tech stack choice, and network monitoring and management in the hands of the government? Because if you are not, you are asking the government to perform duties without the necessary means.
belltaco 3y ago
Firstly, no infrastructure was attacked or destroyed, or lives lost, unlike your example of FedEx plane. Some US govt folks had their emails read. Secondly, the US does this all the time, even to friendly countries, so it's hard to justify harsher measures.
- munificent 3y ago
  > no infrastructure was attacked or destroyed Value was destroyed in both cases. Users having their private data stolen have been harmed, the company's brand value is harmed, and they may lose users over this. > or lives lost Lives can be lost and real people can be harmed if their private information is stolen and used against them. There are dissidents and journalists in repressive countries whose safety depends on information security.
duped 3y ago
There are multiple cases of nation states blowing passenger jets out of the sky and commandeering ships without it being treated as an act of war.
- xmcqdpt2 3y ago
  Recently too, https://en.m.wikipedia.org/wiki/Malaysia_Airlines_Flight_17 https://en.m.wikipedia.org/wiki/Malaysia_Airlines_Flight_17 As far as I know Malaysia is not at war with Russia.
jonstewart 3y ago
Shooting down a commercial airline from the US to Asia with a US Congressman onboard did not actually cause WWIII: https://en.wikipedia.org/wiki/Korean_Air_Lines_Flight_007 https://en.wikipedia.org/wiki/Korean_Air_Lines_Flight_007
fullspectrumdev 3y ago
… and Russian, Chinese, French, whoever private entities have to defend themselves against the NSA, CIA, GCHQ… Espionage is a dirty game. What I always find interesting is how the US has taken on a strategy of indicting individual Chinese/Russian hackers for acting in the interests of their countries, whenever they can be identified by DoJ. This policy is interesting, because, as we all know, turnabout is fair play. How long before retired NSA operators are advised to never travel outside the US lest they be at risk of being picked up on international arrest warrants from China?
- markus_zhang 3y ago
  I'd say NSA probably already have such policy from decades ago. And all intelligence agency worthing their salt should more or less have done the same.

eli 3y ago

Isn't that the idea behind CISA?

tptacek 3y ago
I don't think so? What makes you think it is?
dboreham 3y ago
NSA
- c0pium 3y ago
  They’re explicitly forbidden from doing things like that. As they should be; do you really want the government to have access to the kind of private corporation data they would need in order to defend them?
c0pium 3y ago
Very much no. CISA defends the federal executive branch and advises critical infrastructure. They don’t and shouldn’t have a proactive role in defending private companies.

tschwimmer 3y ago

The digital domain is fundamentally lower stakes and harder to protect than the physical one. It is good that we do not respond to cyber attacks like we do physical ones because we would have escalated to nuclear war over a decade ago. The scope and volume of cyberattacks is very high but my understanding is that the US has a correspondingly high volume of outbound attacks as well.

fragmede 3y ago
Fundamentally? A power plant exploding or dam collapsing would kill way more people and cost far more in property damage than a single FedEx airplane with two crew being shot down.
- lazide 3y ago
  Those all (currently) require a lot more than stealing a key from M$. Maybe stuxnet would be a better example for your point? Those uranium centrifuges Iran had were very expensive.
- gmueckl 3y ago
  I have no idea how you would get a dam to collapse with only a laptop and a network connection. As for the power plant, the operators would have to be blind and deaf to let a plant get destroyed. The real threat is a cascading power grid failure due to undersupply, e.g. coordinated forced plant shutdowns. A few days without electricity at a large scale means reduced availability of medical and emergency services, no running water, failing refrigeration, no stoves/ovens for cooking for most of the population, no working gas pumps, no electronic payment, no banking (no way to get cash) etc.
  - networkchad 3y ago
    [dead]
  - salawat 3y ago
    >I have no idea how you would get a dam to collapse with only a laptop and a network connection. In a world where Stuxnet took out uranium centrifuges, and we've had actual PoC's of exploits that resulted in generators fragging themselves, I find your statement to be of the most shocking form of naivete I've heard in a while. And in point of fact, the network connection would probably be for disabling alarms and control systems in order to mask work done to weaken the integrity of the structure itself. Physical and digital is inextricably linked.

miki123211 3y ago

> If a Chinese fighter jet shot down a FedEx plane flying over the Pacific, that would be considered an attack on US sovereignty and the government would respond appropriately But if a bunch of Chinese people robbed a US bank, let's say the federal reserve, causing enormous financial damage but not loss of life, the response would be similar. Especially so if their link to the actual Chinese government was suspected couldn't reliably be proven. Governments catch foreign agents somewhat regularly, and those captures don't lead to an all-out war.

bell-cot 3y ago
Perhaps - but, whether or not people from $ForeignNation are involved, U.S. banks (or other corporations, or ordinary citizens) generally do not need to have their own armed police/security forces to deal with armed robberies. Nor their own DA's, courts, etc. Vs. any "cyber" crime? All that nice stuff about "...establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare..." falls on the floor, and...YOYO.
- nerdponx 3y ago
  > generally do not need to have their own armed police/security forces to deal with armed robberies. They kind of do, no? Also, preventing crime and carrying out criminal justice are two very different things.
- c0pium 3y ago
  Not true. It’s just that it doesn’t happen fast. This is just one example, there are many: https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical https://www.justice.gov/opa/pr/four-russian-government-emplo...
- gostsamo 3y ago
  Are you ready to leave your authentication services, acl, patching procedures, tech stack choice, and network monitoring and management in the hands of the government? Because if you are not, you are asking the government to perform duties without the necessary means.

belltaco 3y ago

Firstly, no infrastructure was attacked or destroyed, or lives lost, unlike your example of FedEx plane. Some US govt folks had their emails read. Secondly, the US does this all the time, even to friendly countries, so it's hard to justify harsher measures.

munificent 3y ago
> no infrastructure was attacked or destroyed Value was destroyed in both cases. Users having their private data stolen have been harmed, the company's brand value is harmed, and they may lose users over this. > or lives lost Lives can be lost and real people can be harmed if their private information is stolen and used against them. There are dissidents and journalists in repressive countries whose safety depends on information security.

duped 3y ago

There are multiple cases of nation states blowing passenger jets out of the sky and commandeering ships without it being treated as an act of war.

xmcqdpt2 3y ago
Recently too, https://en.m.wikipedia.org/wiki/Malaysia_Airlines_Flight_17 https://en.m.wikipedia.org/wiki/Malaysia_Airlines_Flight_17 As far as I know Malaysia is not at war with Russia.

jonstewart 3y ago

Shooting down a commercial airline from the US to Asia with a US Congressman onboard did not actually cause WWIII: https://en.wikipedia.org/wiki/Korean_Air_Lines_Flight_007 https://en.wikipedia.org/wiki/Korean_Air_Lines_Flight_007

fullspectrumdev 3y ago

… and Russian, Chinese, French, whoever private entities have to defend themselves against the NSA, CIA, GCHQ… Espionage is a dirty game. What I always find interesting is how the US has taken on a strategy of indicting individual Chinese/Russian hackers for acting in the interests of their countries, whenever they can be identified by DoJ. This policy is interesting, because, as we all know, turnabout is fair play. How long before retired NSA operators are advised to never travel outside the US lest they be at risk of being picked up on international arrest warrants from China?

markus_zhang 3y ago
I'd say NSA probably already have such policy from decades ago. And all intelligence agency worthing their salt should more or less have done the same.