“If nothing else, perhaps the frequency, audacity and harmfulness of
these attacks will help encourage Congress to enact new legislation to
make the Internet a safer place for everyone,” the Sony executive said.
“By working together to enact meaningful cybersecurity legislation we
can limit the threat posed to U.S. all,” he said.
It seems that this legislation focuses on the 3rd and not the first.
It might even be seen to discourage the second.
- Sony backs U.S. cybersecurity legislation (canada.com)
- DOD Website Sells Public On Cybersecurity Strategy (informationweek.com)
- Companies To Spend $130 Billion On Cybersecurity In 2011 (teamshatter.com)
- Obama to Introduce Cybersecurity Proposal (circleid.com)
- White House to unveil cybersecurity proposal (theglobeandmail.com)
- What do we need to do to reach “cybersecurity awareness”? (nakedsecurity.sophos.com)
- White House Cybersecurity Plan: What You Need To Know (huffingtonpost.com)
- Microsoft Endorses White House Cybersecurity Plan (blogs.wsj.com)
It seems that to make better cybersecurity-related decisions a senior FBI official recommends considering a simple algebraic equation:
rather than solely focusing on threat vectors and actors.
To be honest, I sometimes wonder why people obsess about threat vectors in the first place. There seems to be a beleive that the more threats you face, the higher your risk, regardless of your controls and regardless of the classification of the threats.
Look at it this way: what do you have control over?
Why do you think that people like auditors refer to the protective and detective mechanisms as “controls”?
Yes, if you’re a 600,000 lb gorilla like Microsoft you can take down one – insignificant – botnet, but the rest of us don’t have control over the threat vectors and threat actors.
What do we have control over?
Vulnerabilities, to some extent. We can patch; we can choose to run alternative software; we can mask off access by the threats to the vulnerabilities. We can do things to reduce the the “vulnerability surface” such as partitioning our networks, restricting access, not exposing more than is absolutely necessary to the Internet (why oh why is your SqlServer visible to the net, why isn’t it behind the web server, which in turn is behind a firewall).
Asset to a large extent. Document them. Identify who should be using them and implement IAM.
And very import: we have control over RESPONSE.
Did the FBI equation mention response? I suppose you could say that ‘awareness’ is a part of a response package. Personally I think that response is a very, very important part of this equation, and its the one you have MOST control over.
And response is – or should be – totally independent of the threats
since it focuses on preserving and recovering the assets.
I think they have it very, very confused and this isn’t the most productive, most effective way of going about it. But then the FBI’s view of policing is to go after the criminals, and if you consider the criminals to be the threat then that makes sense.
But lest face it, most corporations and are not in the business of policing. neither are home users.
Which is why I focus on the issue of “what you have control over”.
Related articles by Zemanta
- School Spy Program Used on Students Contains Hacker-Friendly Security Hole (wired.com)
- The Top 10 Reports For Managing Vulnerabilities (lockergnome.com)
- FBI searching for ‘Flavor Flav Bandit’ (seattlepi.com)
- Why Security Vendors are loosing (tech.bl0x.info)
- Editorial: Flawed F.B.I. Background Checks (nytimes.com)
- FBI details surge in death threats against lawmakers (americablog.com)
People occasionally ask about InfoSec courses that cover law and cyberlaw and about schools that offer cyberlaw programs.
I’m curious about this whole thing for a slightly tangential reason.
On the one hand there’s the idea of Cyberlaw as part of a general law school curriculum.
On the other, there’s cyberlaw for InfoSec people and managers and executives.
The former will already have covered issues like criminal law, contract law, rules of evidence an so forth. Would all that be necessary for the latter group?
An in general, we do have a domain of the CISSP CBK that covers ‘law an ethics’, but I get the impression that in the effort to “internationalize” it has been gutted; the rationale being that many laws are so regional that the exam can’t address them without being very biased.
Well, I disagree. For a number of reasons.
First, there is a lot of law that is about principles.
I think its important to cover basics like CONTRACTS and LIABILITY, which I have seen one in a way that covers the variety of the western European legal codes.
Second, there is a fair bit of international or internationally recognised law. How else could trade and commerce go on? In addition there are many laws that are being applied or recognized cross-border in
one way or another, especially in the areas of cyber-related crimes such as fraud and extortion. Some of these may only be the basis for extradition, but they are examples of what happens in practice.
Finally the study of law in other jurisdictions is valuable as is the study of history; it gives us examples of the goo and the bad, how they were applied and what their successes, pitfalls and limits were.
This is more relevant that it seems at first. The impact of Sarbines-Oxley (SOX) applies to many of us outside the USA because we deal with companies in our own nation that have offices registered and trading inside the USA. On top of that, SOX has been the basis for – often better thought out – similar legislation in other countries. The same reasoning applies to things like the DMCA, CAN-SPAM and the like.
I ought to mention things like PCI as well, even though they are not “laws” in the same sense. PCI *IS* international, just as other banking standards that those of us who deal with finance InfoSec have to deal
with – BASEL, FFIEC and others.
Purely as a side issue, I think all of us need to know about matters like employment law, many of us are ‘consultants’ and need to know about contract law. Many of us are in situations where InfoSec deals with HR and that justifies knowing about employment law. We my also need to know about matters such as copyright and non-disclosure, and what contracts can and cannot bin one to.
Speaking as a “consultant”, I’d add that I’m very glad of my grounding as part of the management electives of my undergraduate degree in engineering that covered contract law. Many of the contracts I have been offered by small firms where they were drawn up by the owner (often an ‘entrepreneur’ with no business or legal background and often without guidance of a lawyer or even a CMA/accountant) were inequitable, unreasonable and full of ‘traps’ because of poor wording.
I think an understanding of the basics of criminal law, contract law and law pertaining to international trade are essential to members of our profession, regardless of their role. The CBK and exam may avoid them but as individuals we should each recognise the relevance of these and other legal and quasi-legal ‘standards’ and make them part of our ongoing education.
My collegue Sami O. Koskinen said “I always felt like the new biometric passport is just a show” and I have to agree with him. He also has reservations about the idea of building a national fingerprint database covering all citizen, and I would think visitors to a country. He points out that the justification for this in his home country of Finland is that fingerprints are already taken for ID and passports.
The normal justification for such a policy, which seems to exceed those of even the most represive times at Stalinist Russia, is that it would ease solving crimes and help in crime prevention.
Well, for a start, I see from discussions in other forums that many people in IT and security don’t understand the difference between preventive and detective controls, or even that detective controls are part of an effective security profile, so why should tech-ignorant (and proud of it) politicians see that point.
Fingerprinting is a baseline detective method in law enforcement, at least with serious crimes of violence. But then again, this has been well publicized and is only really of use in impulsive crimes where the perpetrator has not had the time or foresight to wear gloves.
A few years ago I went through a stage of reading a lot of detective novels. Lets face it, these are ‘entertainment’, not true crime’. As such, twisted plots are common. Never the less, there are no shortage of plots whereby fingerprint and DNA evidence is spoofed and subverted. There are no laws or controls that prevent criminals or potential criminals from reading these books, and nothing what so ever to stop them from coming up with even more creative and ingenious methods.
According to my database of quotes, John Tandervold said:
“Each new law makes only a single guarantee. It will create new
A similar thing can be said about security controls in general. Each will have have people who will find ways to bypass or subvert it.
Related articles by Zemanta
- E-Passports ‘can be cloned’
- New E-Passports Cloned
- Biometric passport chips ‘can be cloned in an hour’
- Post Office aims to collect ID card fingerprints?
- Newer Forensic Techniques Help Solve Cases
- ID Cards cost cut to £5.6bn
- Cost of ID card and passport rises to £100
- Airport fingerprint plan sparks a domestic dispute
- Weighing Fingerprints As Forensic Evidence