CSIS Report: Securing Cyberspace

[AlxRogan]

Re: CSIS Report: Securing Cyberspace

i know wat u meen for crying out loud all anyone has to do to ovoid getting cought is hack the national grid then you have acsess to every computer on the planet firewalls are useless against this methode and once your in all you have to do is change the electronics pulse display to binory code and its all good secure the web they lie

from Digit

Whiskey Tango Foxtrot? There's no way you would get past the ROT-26 encryption that protects the Gibson which keeps the national grid going...

[artoir]

Re: CSIS Report: Securing Cyberspace

It really doesn't come as any surprise that we're vulnerable, but then can any country in the world say that they're not?

I doubt it. In any "cyberwar" I've read about recently, both sides have managed to either hack websites and servers or bring them down with DDOS. Even Georgian hackers managed to deface and crash Russian websites in South Ossetia towards the end of last August. Both Palestinian and Israeli websites are being hacked almost on a daily basis now. The only group that I personally feel are capable of mounting a large scale Cyberwar and defending their own systems is China. And they're not only testing out their tactics on the US; France, UK, Germany, Australia and New Zealand all reported attacks on government systems originating from China last year.

Perhaps I haven't come across the article yet but does anyone have any info on Chinese government websites being successfully penetrated? I'm sure there was some instances, but I doubt anything on the scale of attacks they have mounted (one Wired article quoted a Pentagon Official that they face "thousands of attacks every day")

And in case anyone takes this the wrong way, I'm not being political by discussing different countries abilities or tactics, just making some observations

[Digit]

Re: CSIS Report: Securing Cyberspace

While Cyber Security is an increasing threat to the US National Security, I feel as though it's being approached completely wrong. The term is often thrown around as a buzz word to attract attention and scare people. Someone needs to clarify some of the goals rather than throwing big sweeping statements like "we will secure the internet." Some ideas are: securing emergency telecom, isolating military networks to prevent access, enforcing and updating in place security standards, etc. I mean for instance let's take a look back at DC16 and we see discussions on securing SCADA systems. This isn't a new topic either. It's been raised several times before. Aren't basic utilities sort of vital to the national infrastructure?

I think we'd be a lot better off if they just started small. Review current security standards to make sure they are not only adequate but also practical. I'd say a lot of times people circumvent these standards simply because they are lazy and don't feel like dealing with them. Also: why should the FAA's new air traffic control system be told that DOD standards forbid them from having USB ports on their systems yet we just saw an issue where the US Army had an incident with USB thumb drives? People will always go after your weakest link in any security situation. I have a companion who said that following their post 9/11 analysis, the FAA reported their biggest security hole was ironically the link back to Pentagon. Let's set these standards and enforce them across agencies.

If you want to help boost the economy and also help secure the national infrastructure then let's start some public works projects. Take a bunch of the best penetration testers you can and split them up. Have them just attack without warning and see how far they can get. Take their report, fix it, shift the groups and start over. Let's get some people who actually know what they're doing in there working on these projects. I can just see the recruitment posters now...

Bottom line, if they want this to work, they need to actually set some realistic goals. Too often the phrases are used in a general sense and bad connotations get attached. For instance DRM and trusted computing would be great if it were being used to protect the users instead of protecting the producers from the users. Let's set these goals to actually secure the national infrastructure and stop trying to worry about the comcast user who is torrenting in his mother's back yard. It's also ironic that they're trying to control and centralize something that was originally designed to be decentralized and resilient to physical attack...

i know wat u meen for crying out loud all anyone has to do to ovoid getting cought is hack the national grid then you have acsess to every computer on the planet firewalls are useless against this methode and once your in all you have to do is change the electronics pulse display to binory code and its all good secure the web they lie

from Digit

[streaker69]

Re: CSIS Report: Securing Cyberspace

Well mid december, around the time this report was published, Booz Allen Hamilton ran a "cyber-war" simulation with 230 representatives of government defense and security agencies, private companies and civil groups. Sounds like what you're talking about on a smaller scale. Basically they had two teams; one defending, one attacking.

Oh and in case you couldn't gather for yourself, they concluded the US cyber defenses are apalling.

http://www.canada.com/topics/technol...tml?id=1096131

It really doesn't come as any surprise that we're vulnerable, but then can any country in the world say that they're not?

[DaKahuna]

Re: CSIS Report: Securing Cyberspace

Oh and in case you couldn't gather for yourself, they concluded the US cyber defenses are apalling.

As Gomer Pyle would say "surprise, surprise, surprise!" - NOT

[artoir]

Re: CSIS Report: Securing Cyberspace

Well mid december, around the time this report was published, Booz Allen Hamilton ran a "cyber-war" simulation with 230 representatives of government defense and security agencies, private companies and civil groups. Sounds like what you're talking about on a smaller scale. Basically they had two teams; one defending, one attacking.

Oh and in case you couldn't gather for yourself, they concluded the US cyber defenses are apalling.

http://www.canada.com/topics/technol...tml?id=1096131

[afterburn188]

Re: CSIS Report: Securing Cyberspace

Sorry to (possibly) thread jack but...

If you want to help boost the economy and also help secure the national infrastructure then let's start some public works projects. Take a bunch of the best penetration testers you can and split them up. Have them just attack without warning and see how far they can get. Take their report, fix it, shift the groups and start over. Let's get some people who actually know what they're doing in there working on these projects. I can just see the recruitment posters now...

Seems ITIF agrees on the subject and has a few numbers to support this:
http://www.itif.org/index.php?id=212

The CSIS have been making a point to avoid the topic all together however. Although not specifically in their domain, the question has been put forward before and they didn't even address it in the report. Just another issue I have with it....

[valkyrie]

Re: CSIS Report: Securing Cyberspace

apologize, but I do find this the worst piece of dreck I have ever read in my life. It rivals all the crap written by L. Ron Hubbard. Why?

Define CyberSpace. No where, no how, no time is the concept of "Cyberspace" ever defined in this document.
I'm done.

regards,

valkyrie
__________________________________________________ ____________
sapere aude


When you were a kid back during World War One, what was the equivalent?[/QUOTE]

[TheCotMan]

Re: CSIS Report: Securing Cyberspace

Installment 1 of ?:


(PDF p.7, printed p.1)

This strategy should be based on a public statement by the president that the cyber infrastructure of the United States is a vital asset for national security and the economy and that the United States will protect it, using all investments of national power, in order to protect national security and public safety, ensure economic prosperity, and assure delivery of critical services to the American public.

List of items to protect and guard includes items with known points of contention a sometimes mutually exclusive priorities.

If the FAA's only focus was to ensure passenger and pilot safety, then we wouldn't see many of the problems that the FAA has been plagued with over the pas 15 years. Burdening the FAA with a secondary purpose of on-time flights, and a tertiary purpose of keeping air-based commerce moving means there will be contention between these items. Passengers and pilots will just have to hope that their own safety is not overlooked so much (to keep flights on time and keep air-based commerce moving) that they don't die or get injured while flying.

(PDF p.8, printed p.2)

[a new office for cyberspace in the Executive Office of the President] would combine existing entities and also work with the National Security Council in managing aspects of security our national networks while protecting privacy and civil liberties.

Again, contradictions exist in the list of items for this one group. A judicial system exists with search warrants as an established system to primarily focus on laws with respect to civil right, privacy and more. Law enforcement's focus is primarily enforcement of the law, not civil rights and privacy. By ensuring each group maintains a simple focus of a single objective without conflict in their assigned goal, they can specialize and push full-force, without internal conflict or disagreement.

Assigning a collection of goals to any group which are or can be in conflict is trouble. It can be as harmful as decoupling control from responsibility. Privilege separation, Mandatory Access Controls, User vs. Kernel Space, programming API with clearly defined interfaces, and even domestic partners with clearly defined areas of responsibility and control in a domestic space and surrounding property are all examples of how it is possible to avoid ALL issues of contention caused by contradictory selections make any such, specific decisions a violation of agreement.

Decisions which require subjective evaluation for “right” and “wrong” answers will eventually lead to failure, as what you think is, “right,” may not be what your boss thinks is, “right.” Decisions which require only objective evaluation for “correct” and “incorrect” are simpler to follow, and can be replayed and re-tested with only one correct answer given the same set of circumstances and input.

Additionally, what advantage would exist by splitting cyberspace-specific issues from existing agencies? I see greater value in having each agency build their own cyberspace-specific teams based on their existing goals, mandates, or directives. Agencies focused on world trade, and international commerce have a specialized interest in cyberspace crime, while the FBI, CIA, or NSA would have totally different interests in cyberspace crime from detecting and recording violations of law for possible prosecution in court, to breaking laws in cyberspace through commission of actions instead of enforcement, or maybe eavesdropping and information gathering and analysis-- all different from each other.

A separate office for Cyberspace either means duplication of effort which presently exists in other agencies or government organizations or it means removing duplicate groups or sections in other agencies.

(PDF p.8, printed p.2)

Reinvent the public-private partnership.

This means using tax money in private business or it doesn't.
This means bypassing search warrant process or it doesn't
This means using private information gathering companies as a transparent government documentation repository which bypasses freedom of information acts, or it doesn't.

Separation of government from private business also provides more protection from abuse by raising the bar for abuse to requiring conspiracy and risk for papertrail. Arguments listed above with clearly defined boundaries (not responsibilities) also applies here.

(PDF p.8, printed p.2)

Regulate cyberspace

Regulation? This sounds very expensive.
I'll agree that a government is one of 3 ideal spaces for *standards* to exist, but regulation requires enforcement, and enforcement can be very expensive. At some point, a dollar amount will be made and a cut-off point for enforcement, and crimes with values less than that amount will be ignored, overlooked, or only documented, but not investigated. This will lead to an immediate refinement of attacks to choose attacks that fall under the arbitrary threshold and thus avoid investigation and penalty. Criminal elements are quick to react to changes in their environment, as those that don't learn quickly get caught sooner rather than later.
Additionally, why can't standards be created and passed through NIST for official review and use anyway?

(PDF p.12, printed p.6)
(See Item #8)
If CERT* remains with DHS, then why is there even a need for a NOC? Seriously.

(More comments later.)

[afterburn188]

Re: CSIS Report: Securing Cyberspace

If anything is unclear in the report, perhaps you can go over to Slashdot now and ask the question for clarification.

http://interviews.slashdot.org/artic...8/12/12/135207

Slashdot has now posted the results of that interview here: http://interviews.slashdot.org/artic.../12/19/1448238

[HighWiz]

Re: CSIS Report: Securing Cyberspace

I concur. Its good to see some regulatin' again. :)

Yea, you can't be just any geek off the street, gotta be handy with the steel if you know what I mean...

Anyway, the part of the CSIS report that interested me was the section "Identity Management for Cybersecurity" (p.61). This is something that has been a long time coming, but I don't really see how it could be implemented responsibly if businesses are given the option to create their own in-person proofing authentication methods(top of page 63). That would also create all sorts of interoperability problems I would think. It just seems like that could quickly escalate into a situation where all of my personal information is easily gained if one account (used on many different sites) is compromised.

It really depends on what they mean by businesses in relation to creating their own authentication. Will it be every mom and pop shop on the net or primarily organizations who process CC and banks. I think this is definitely an area where they need to focus some more attention and thought.

Given, this is already the case with SSNs, but I don't plan on using that to login to Facebook/Myspace any time in the future. Provided that they will not allow any social networking sites to use these new methods I may be more comfortable, but the whole internet is moving towards being social. Its a tricky situation, for sure.

There are a few technical hurdles they have to overcome, as well as a decision on usage. From reading the report, I don't think there was a single consensus as to what should be done for identity management while protecting civil liberties. I'm also concerned with a single point of failure if that's the avenue they are looking to go down.


Interesting for me was one of the last quotes in the report itself when they were discussing research and "reachitecting the internet" (p.75).

"Perhaps the most important game-changing research involves what we call 'rearchitecting the Internet". The Internet is a human creation and as a veteran of the 1970s DARPA effort said to us, "We built it; we can change it."

[Xodia]

Re: CSIS Report: Securing Cyberspace

GET SOME!!!

Welcome back. THIS is HighWiz. Bout time.

I concur. Its good to see some regulatin' again. :)

Anyway, the part of the CSIS report that interested me was the section "Identity Management for Cybersecurity" (p.61). This is something that has been a long time coming, but I don't really see how it could be implemented responsibly if businesses are given the option to create their own in-person proofing authentication methods(top of page 63). That would also create all sorts of interoperability problems I would think. It just seems like that could quickly escalate into a situation where all of my personal information is easily gained if one account (used on many different sites) is compromised.

Given, this is already the case with SSNs, but I don't plan on using that to login to Facebook/Myspace any time in the future. Provided that they will not allow any social networking sites to use these new methods I may be more comfortable, but the whole internet is moving towards being social. Its a tricky situation, for sure.

[Chris]

Re: CSIS Report: Securing Cyberspace

Listen Wanker (that's what you people call each other over there, right?), you're definitely trying my fucking patience. My general instinct isn't to be polite and nice, trust me when I tell you I'm being really gentle with you. I don't know if you're into rough trade, but it most assuredly looks like that's what you want.

You are comparing apples and sofas. You're talking about a Law Enforcement agency with your posts... I don't believe the Koreans are trying to recruit hackers for law enforcement... You have an agenda and you're trying to push it with the wrong motherfucker.

I as well as others have already covered the fact that Korea is playing catchup to the US in terms of "events" like the ones you described earlier.

Now cut your losses while you're ahead before I put you in fucking place.

GET SOME!!!

Welcome back. THIS is HighWiz. Bout time.

[HighWiz]

Re: CSIS Report: Securing Cyberspace

Which is EXACTLY what I was getting at when I mentioned the Korean Government running their own "hacker convention" with the sole purpose of recruiting!

I never said the US government doesn't recruit hackers, what I said was they would never OPENLY do it, as you rightly said from a political standpoint, nevermind set up an event similar to Korea's.

The only point I was trying to make, was that from a "political standpoint", the US government would never OPENLY recruit hackers on a scale that Korea is doing.

That was all. You were the one that tried turning it into something more.

Listen Wanker (that's what you people call each other over there, right?), you're definitely trying my fucking patience. My general instinct isn't to be polite and nice, trust me when I tell you I'm being really gentle with you. I don't know if you're into rough trade, but it most assuredly looks like that's what you want.

You are comparing apples and sofas. You're talking about a Law Enforcement agency with your posts... I don't believe the Koreans are trying to recruit hackers for law enforcement... You have an agenda and you're trying to push it with the wrong motherfucker.

I as well as others have already covered the fact that Korea is playing catchup to the US in terms of "events" like the ones you described earlier.

Now cut your losses while you're ahead before I put you in fucking place.

[artoir]

Re: CSIS Report: Securing Cyberspace

In his position, would it behoove him to admit to actively recruiting at a "hacker convention" from a political stand point?

Which is EXACTLY what I was getting at when I mentioned the Korean Government running their own "hacker convention" with the sole purpose of recruiting!

I never said the US government doesn't recruit hackers, what I said was they would never OPENLY do it, as you rightly said from a political standpoint, nevermind set up an event similar to Korea's.

The only point I was trying to make, was that from a "political standpoint", the US government would never OPENLY recruit hackers on a scale that Korea is doing.

That was all. You were the one that tried turning it into something more.