CSIS Report: Securing Cyberspace

[valkyrie]

Re: CSIS Report: Securing Cyberspace

apologize, but I do find this the worst piece of dreck I have ever read in my life. It rivals all the crap written by L. Ron Hubbard. Why?

Define CyberSpace. No where, no how, no time is the concept of "Cyberspace" ever defined in this document.
I'm done.

regards,

valkyrie
__________________________________________________ ____________
sapere aude


When you were a kid back during World War One, what was the equivalent?[/QUOTE]

[afterburn188]

Re: CSIS Report: Securing Cyberspace

Sorry to (possibly) thread jack but...

If you want to help boost the economy and also help secure the national infrastructure then let's start some public works projects. Take a bunch of the best penetration testers you can and split them up. Have them just attack without warning and see how far they can get. Take their report, fix it, shift the groups and start over. Let's get some people who actually know what they're doing in there working on these projects. I can just see the recruitment posters now...

Seems ITIF agrees on the subject and has a few numbers to support this:
http://www.itif.org/index.php?id=212

The CSIS have been making a point to avoid the topic all together however. Although not specifically in their domain, the question has been put forward before and they didn't even address it in the report. Just another issue I have with it....

[artoir]

Re: CSIS Report: Securing Cyberspace

Well mid december, around the time this report was published, Booz Allen Hamilton ran a "cyber-war" simulation with 230 representatives of government defense and security agencies, private companies and civil groups. Sounds like what you're talking about on a smaller scale. Basically they had two teams; one defending, one attacking.

Oh and in case you couldn't gather for yourself, they concluded the US cyber defenses are apalling.

http://www.canada.com/topics/technol...tml?id=1096131

[DaKahuna]

Re: CSIS Report: Securing Cyberspace

Oh and in case you couldn't gather for yourself, they concluded the US cyber defenses are apalling.

As Gomer Pyle would say "surprise, surprise, surprise!" - NOT

[streaker69]

Re: CSIS Report: Securing Cyberspace

Well mid december, around the time this report was published, Booz Allen Hamilton ran a "cyber-war" simulation with 230 representatives of government defense and security agencies, private companies and civil groups. Sounds like what you're talking about on a smaller scale. Basically they had two teams; one defending, one attacking.

Oh and in case you couldn't gather for yourself, they concluded the US cyber defenses are apalling.

http://www.canada.com/topics/technol...tml?id=1096131

It really doesn't come as any surprise that we're vulnerable, but then can any country in the world say that they're not?

[Digit]

Re: CSIS Report: Securing Cyberspace

While Cyber Security is an increasing threat to the US National Security, I feel as though it's being approached completely wrong. The term is often thrown around as a buzz word to attract attention and scare people. Someone needs to clarify some of the goals rather than throwing big sweeping statements like "we will secure the internet." Some ideas are: securing emergency telecom, isolating military networks to prevent access, enforcing and updating in place security standards, etc. I mean for instance let's take a look back at DC16 and we see discussions on securing SCADA systems. This isn't a new topic either. It's been raised several times before. Aren't basic utilities sort of vital to the national infrastructure?

I think we'd be a lot better off if they just started small. Review current security standards to make sure they are not only adequate but also practical. I'd say a lot of times people circumvent these standards simply because they are lazy and don't feel like dealing with them. Also: why should the FAA's new air traffic control system be told that DOD standards forbid them from having USB ports on their systems yet we just saw an issue where the US Army had an incident with USB thumb drives? People will always go after your weakest link in any security situation. I have a companion who said that following their post 9/11 analysis, the FAA reported their biggest security hole was ironically the link back to Pentagon. Let's set these standards and enforce them across agencies.

If you want to help boost the economy and also help secure the national infrastructure then let's start some public works projects. Take a bunch of the best penetration testers you can and split them up. Have them just attack without warning and see how far they can get. Take their report, fix it, shift the groups and start over. Let's get some people who actually know what they're doing in there working on these projects. I can just see the recruitment posters now...

Bottom line, if they want this to work, they need to actually set some realistic goals. Too often the phrases are used in a general sense and bad connotations get attached. For instance DRM and trusted computing would be great if it were being used to protect the users instead of protecting the producers from the users. Let's set these goals to actually secure the national infrastructure and stop trying to worry about the comcast user who is torrenting in his mother's back yard. It's also ironic that they're trying to control and centralize something that was originally designed to be decentralized and resilient to physical attack...

i know wat u meen for crying out loud all anyone has to do to ovoid getting cought is hack the national grid then you have acsess to every computer on the planet firewalls are useless against this methode and once your in all you have to do is change the electronics pulse display to binory code and its all good secure the web they lie

from Digit

[artoir]

Re: CSIS Report: Securing Cyberspace

It really doesn't come as any surprise that we're vulnerable, but then can any country in the world say that they're not?

I doubt it. In any "cyberwar" I've read about recently, both sides have managed to either hack websites and servers or bring them down with DDOS. Even Georgian hackers managed to deface and crash Russian websites in South Ossetia towards the end of last August. Both Palestinian and Israeli websites are being hacked almost on a daily basis now. The only group that I personally feel are capable of mounting a large scale Cyberwar and defending their own systems is China. And they're not only testing out their tactics on the US; France, UK, Germany, Australia and New Zealand all reported attacks on government systems originating from China last year.

Perhaps I haven't come across the article yet but does anyone have any info on Chinese government websites being successfully penetrated? I'm sure there was some instances, but I doubt anything on the scale of attacks they have mounted (one Wired article quoted a Pentagon Official that they face "thousands of attacks every day")

And in case anyone takes this the wrong way, I'm not being political by discussing different countries abilities or tactics, just making some observations

[AlxRogan]

Re: CSIS Report: Securing Cyberspace

i know wat u meen for crying out loud all anyone has to do to ovoid getting cought is hack the national grid then you have acsess to every computer on the planet firewalls are useless against this methode and once your in all you have to do is change the electronics pulse display to binory code and its all good secure the web they lie

from Digit

Whiskey Tango Foxtrot? There's no way you would get past the ROT-26 encryption that protects the Gibson which keeps the national grid going...

[streaker69]

Re: CSIS Report: Securing Cyberspace

know wat u meen for crying out loud all anyone has to do to ovoid getting cought is hack the national grid then you have acsess to every computer on the planet firewalls are useless against this methode and once your in all you have to do is change the electronics pulse display to binory code and its all good secure the web they lie

from Digit

How would 'hacking the national grid' give one access to all the computers on the planet? It's a National grid, not a world wide grid. Do you eve have the remotest clue as to what grid you're even talking about.

I doubt it. In any "cyberwar" I've read about recently, both sides have managed to either hack websites and servers or bring them down with DDOS. Even Georgian hackers managed to deface and crash Russian websites in South Ossetia towards the end of last August. Both Palestinian and Israeli websites are being hacked almost on a daily basis now. The only group that I personally feel are capable of mounting a large scale Cyberwar and defending their own systems is China. And they're not only testing out their tactics on the US; France, UK, Germany, Australia and New Zealand all reported attacks on government systems originating from China last year.

Perhaps I haven't come across the article yet but does anyone have any info on Chinese government websites being successfully penetrated? I'm sure there was some instances, but I doubt anything on the scale of attacks they have mounted (one Wired article quoted a Pentagon Official that they face "thousands of attacks every day")

And in case anyone takes this the wrong way, I'm not being political by discussing different countries abilities or tactics, just making some observations

Websites are really the least of the concern in what they're talking about, even though the media likes to bring them up because the average person understands them. The bigger concerns are people actually infiltrating the control networks for public utilities. I could care less if some ub3rl33t hax0r defaces someone's website. I'm more concerned that a foreign government is paying large groups of blackhatters to shutdown power plants, reverse the flow of pumps or reroute trains.

[Thorn]

Re: CSIS Report: Securing Cyberspace

i know wat u meen for crying out loud all anyone has to do to ovoid getting cought is hack the national grid then you have acsess to every computer on the planet firewalls are useless against this methode and once your in all you have to do is change the electronics pulse display to binory code and its all good secure the web they lie

from Digit

https://forum.defcon.org/showpost.ph...1&postcount=13

[theprez98]

Re: CSIS Report: Securing Cyberspace

i know wat u meen for crying out loud all anyone has to do to ovoid getting cought is hack the national grid then you have acsess to every computer on the planet firewalls are useless against this methode and once your in all you have to do is change the electronics pulse display to binory code and its all good secure the web they lie

from Digit

Did you finish your PM spree asking people how to hack?

[HighWiz]

Re: CSIS Report: Securing Cyberspace

Did you finish your PM spree asking people how to hack?

Yea... I've got a great idea. Maybe we should create a newbie forum, all new members can be automatically subscribed and only those members who wish to view it can. Then we'll be able to save our PM's as well as the rest of the forum from being overrun by "teach me to hack" posts. And we might even be able to help a few n00bs why we're at it.

Ah well, that'll never happen. It's much easier for everyone to be elitist...

/me shrugs.

[TheCotMan]

Re: CSIS Report: Securing Cyberspace

Yea... I've got a great idea. Maybe we should create a newbie forum, all new members can be automatically subscribed and only those members who wish to view it can. Then we'll be able to save our PM's as well as the rest of the forum from being overrun by "teach me to hack" posts. And we might even be able to help a few n00bs why we're at it.

Ah well, that'll never happen. It's much easier for everyone to be elitist...

/me shrugs.

Hey! You could be the welcome wagon in /dev/random! You can set a sticky and let people know that you (and anyone else that volunteers) is ready and waiting to help people with with questions.

Sure! You could start a thread about that, and volunteers could respond to this thread stating their intention to also volunteer, and then you and anyone else that responds to that thread can all take such questions by PM! You and other volunteers can fight the system by volunteering your time to help new users with any kinds of questions they might have, and do it all by PM. If you really want to do this, I can make sure PM support is available to all users right when they sign up, with no waiting.

If you think I am joking about this, I am not. If you seriously want to see these changes, you can use the above to create a grass-roots movement to help the newbies, and new users through PM.

Moderators have finite time, and they have to contend with the following:
"Wants are infinite, but resources are finite."
"Actions speak louder than words."

Just because some mods don't have enough free time to support such a system doesn't mean that you and others shouldn't. Use of PM would make this possible,



It will be one more day before the mods have their decision on a newbie forum.

The results of adding a strictly, "Hi! I'm New!" forum just for people to introduce themselves was not supported by even a large minority of moderators, and without support from at least a few highly-available moderators to maintain a forum, any such forum would fail to disrepair.

The only items being discussed now by moderators are:
Converting /dev/random into a "Newbie Forum"
Making a new Newbie Forum which has the same rules as /dev/random
Having a "fake" forum called, "Hi! I'm New! This is my Introduction" (or something similar) which is really is link to each user's blog. This lets people introduce themselves in their blog and lets anyone interested enough in someone to read about them a place to go see any introduction they may have posted.
(These were based on items suggested in the other thread.)

I'll post the results to this last batch of items being discussed by mods tomorrow night.

(Want me to copy this and your reply over to the Newbie Forum discussion thread? I don't care if you want to fork this thread, as it is one you started. ]:> )

As for elitism: You're just saying that because you think you're better than us.

[HighWiz]

Re: CSIS Report: Securing Cyberspace

Hey! You could be the welcome wagon in /dev/random! You can set a sticky and let people know that you (and anyone else that volunteers) is ready and waiting to help people with with questions.

Sure! You could start a thread about that, and volunteers could respond to this thread stating their intention to also volunteer, and then you and anyone else that responds to that thread can all take such questions by PM! You and other volunteers can fight the system by volunteering your time to help new users with any kinds of questions they might have, and do it all by PM. If you really want to do this, I can make sure PM support is available to all users right when they sign up, with no waiting.

If you think I am joking about this, I am not. If you seriously want to see these changes, you can use the above to create a grass-roots movement to help the newbies, and new users through PM.

Moderators have finite time, and they have to contend with the following:
"Wants are infinite, but resources are finite."
"Actions speak louder than words."

Just because some mods don't have enough free time to support such a system doesn't mean that you and others shouldn't. Use of PM would make this possible,



It will be one more day before the mods have their decision on a newbie forum.

The results of adding a strictly, "Hi! I'm New!" forum just for people to introduce themselves was not supported by even a large minority of moderators, and without support from at least a few highly-available moderators to maintain a forum, any such forum would fail to disrepair.

The only items being discussed now by moderators are:
Converting /dev/random into a "Newbie Forum"
Making a new Newbie Forum which has the same rules as /dev/random
Having a "fake" forum called, "Hi! I'm New! This is my Introduction" (or something similar) which is really is link to each user's blog. This lets people introduce themselves in their blog and lets anyone interested enough in someone to read about them a place to go see any introduction they may have posted.
(These were based on items suggested in the other thread.)

I'll post the results to this last batch of items being discussed by mods tomorrow night.

I'm in the process of crafting a good post for a thread for /dev/random. I'll send you a /msg about it at some point in the near future.

(Want me to copy this and your reply over to the Newbie Forum discussion thread? I don't care if you want to fork this thread, as it is one you started. ]:> )

I don't think that's needed.

As for elitism: You're just saying that because you think [know] you're better than us.

Oh... I thought that was already understood?

[BackatchaBandit]

Re: CSIS Report: Securing Cyberspace

Apologies for grave-digging the thread, I only just read the article.

It appears that the conclusions drawn by the CSIS are broadly similar to those arrived at during a project that the UK Government ran a few years ago under their 'Foresight' program: Cyber Trust and Crime Prevention.

The conflict between 'security' and 'liberty' at the time concerned me, as the issue of authentication had huge implications for some of the community wireless networking stuff I was into at the time (see consume and SOWN).

This was before broadband penetration had reached much of the UK (and before I could get 2+Mbit out of my mobile for £5 pm ), so over time I've lost track/interest in the projects and the issues that arose, but the conflict clearly still exists.

There's a short paper on ethics that came out of that 'Foresight' project (here) that I thought summed it up well:

With regard to trust, these views have differing corollaries. The Luhmann view is that trust is the effect of good behaviour and, therefore, ensuring trust requires providing incentives for good behaviour. The Durkheim view is that trust is the cause of good behaviour, and that the best strategy to ensure that people behave well is to trust them and make it clear to them what behaviour is acceptable.

This argument is important in the context of the Internet in that it mirrors a major ethical debate about the purpose of the Internet and the limits of its regulation. On the one hand, there are people who consider that the Internet is just a new type of space that must develop its own limits and types of action (which will include, for example, commercial actions and surveillance). On the other, there are those who note that the Internet is the creation of scientists and hackers and that this historical fact is essential in planning the regulation of the net.

I see the 'economic' rationale for utilising public networks for infrastructure SCADA etc, but I never really understood why such traffic couldn't be routed through existing 'secure' channels, such as the UK Police TeTrRa system, or even utilise it's own dedicated network, as they did for the ANPR cameras. It's got to be easier and more effective than trying to lock down the entire net.