CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Cyber War / Cyber Security

Cybersecurity Is Not Just About The Tech

Cybersecurity may well be the most important function in the modern world. Without it, nothing else can be trusted, in any sector of the economy.
hacking-detected-shutterstock_188832089Cyber Security is far more than just protecting data. Security is about protecting the functionality of IT. It involves confidentiality, availability and integrity of resources. This higher order approach to cyber security requires vision, leadership, and actions in dimensions of people, process and technology.
 We also need to draw your attention to the higher order concept of Cyber War. This is, unfortunately, something all technologists should be familiar with now. The most critical piece to read on that topic now is Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases followed by: Main Street Cybersecurity: Can Email Be Safe? and Time for Transformational Cybersecurity!

Stay In The Loop: Sign Up To The CTOvision Daily

When it it time to research the great providers of Cybersecurity Solutions, kick off  your search in the CTOvision Disruptive Technology Finder. Pay particular attention to the sections on Cybersecurity, CASB, Cyber Threat Intelligence, and VPN.

For help putting all this information into context for your business, consider tapping into Crucial Point's CTO-as-a-Service or Technology Due Diligence offerings, both are ways to quickly leverage the technical talents of experienced enterprise technology professionals.

CTOs, Global Cyberwar and Our Collective Future

Ccis If you are a technologist, please take a moment to download the PDF of the report by the U.S. Commission on Cybersecurity.  This report, titled Securing Cyberspace for the 44th Presidency, is the best proclamation of the challenges of cyber I have read.  It is also a roadmap that will help any trying to navigate these very tough issues.

I’ve been involved in things cyber for a long time.  My deepest
involvement began in December 1998, almost 10 years ago to the day.  In all that time I’ve seen lots of studies and lots of papers and many treatments of the issues.  But I’ve never seen one that captures the complexities and the need for specific actions as well as this one.

I’d really recommend you read every word, if you want to be considered literate in this field.   But if it will be a little while till you get to it, here are some key points:

The three major findings are:  1) Cybersecurity is now a major national security problem for the U.S., 2) Decisions and actins must respect privacy and civil liberties, and 3) only a comprehensive national security strategy that embraces both the domestic and international  aspects of cybersecurity will make us more secure.

The report makes a few points about the Bush Administration’s Comprehensive National Cybersecurity Initiative (CNCI).  In general the give credit to that initiative, and call it good.  I agree, it is a great activity I’ve previously written about that is led by one of the most effective people in government today and has done great work.  But as the commission points out, the work of the CNCI is good but not sufficient.

The biggest shock for me in this study:  The amount of funding on R&D for cyber security.  I have been looking into the many activities underway, and maybe that look made me deceive myself into thinking it was a well funded effort.  According to the commission, however, they estimate that the total R&D funding in the federal government for cybersecurity is about $300million.  Less than two-tenths of one percent of the total federal R&D.

The report has a great section on identity management.

I am convinced the organizational approaches outlined in the study are the right ones as well.  There is only one place in our government where we can lead solutions to this challenge.  Where is that?  Hey read the report!

What else do I recommend CTOs do besides read the report?  I think one way we can all help the cybersecurity effort is to think through which standards bodies are the most important to engage with regarding security.

For more on these topics see the CTOvision Guide to National Security Technology and

The Future of Cyberspace Security: The Law of The Rodeo

This is an update of my now annual assessment of the future of technology associated with good and evil in cyberspace which was first posted here.

Cyberspace is our interconnected information technology.

Predictions of the future of technology are increasingly starting to sound like science fiction, with powerful computing grids giving incredible computational power to users and with autonomous robots becoming closer and closer to being in our daily lives vice just in computer science departments. Infotech, nanotech and biotech are fueling each other and each of those three dominate fields are generating more and more benefits that impact the other, propelling us even faster into a new world.   Depending on your point of view the increasing pace of science and technology can be good or bad.  As for me, I’m an optimist, and I know we humans will find a way to ensure technology serves our best interests.

But a sad fact of the human condition is that bad people will likely be with us long into the future.  And sometimes good people can be tempted to do bad things, so we really need to engineer solutions that
keep the bad guys from benefiting from technology and keep those who can sometimes be tempted from giving in to their darker side.

So is is possible to engineer perfectly secure systems?  Consider the law of the rodeo:  “There’s not a horse that’s never been rode, and not a rider that’s never been throwed.”  I like the analogy since it reminds us that all computer evil can be mitigated.  But it always fights back.  Good and evil will continue a fast paced rodeo dance long into the future.

To engineer secure systems for the future we need to continually assess where we are and what the near term future holds for our technologies.  Here is a couple short predictions that could be useful
in this discussion.

  • Remote power is here today and will soon be widely distributed.  This will allow small power consumption devices (like keyboards, mice, bluetooth headsets, hearing aides, small sensors) to be provided power by RF energy.

– Power generation from motion is almost ready for prime time.  This will allow devices to gain energy from vibrations, like the vibrations in a bridge when a car passes over it, or the vibrations in a wall of a
building when the wind blows past it, or the vibrations caused by a person’s movement through the day.

– Communication capability (bandwidth) between fixed facilities will increase 1000 fold over the next five years. Cellular systems are on a dramatic improvement slope.  My view: AT&T seems to lead in speed this year.  Verizon will probably lead next year.

– More users will be on the net.  There are about 1.3Billion PC’s connected to the Internet today.  There are about 3.3Billion active cell phone subscriber accounts today.  Those numbers will grow.

– Storage, especially flash storage technologies, is decreasing in price so much we can afford to store data anywhere on almost anything.

– Chips are being designed in ways that actually beat the old Moore’s Law projections.  This is being done by placing many cores on one chip.  Very high data rate capabilities are being connected directly to the cores on these chips.

– RFID is becoming so widespread we can place devices on everything that allows devices to report back what they are and what they are for and where they have been.

– All this capabilities are being networked together, including increasingly direct device to device connections via capabilities provided by enhanced protocols (especially IPv6).

– Consumer devices, especially consumer communication devices, are becoming increasingly capable.  What used to be called a cell phone is now a phone/video recorder/video editor/entertainment/mobile office device with location aware data (GPS).

– Web2.0 and Social networking sites/tools such as Facebook will expand till one day 100% of the population will have active, up to date, authoratative online profiles.

– Cloud computing capabilities are not only being delivered to companies, but to end users.  Google leads the pack in this space, but Microsoft and Adobe are up and comers.

There are many other elements of the future relevant to security discussions, but the projections above lead to some interesting conclusions on their own.   So lets think through some of the impacts
of the above.

– Bad actors who want to exploit systems will increasingly not have to worry about them being powered off.  They will be on all the time.

– Bad actors will increasinly be able to expoit social systems to gather data pre-attack.  However, the powerful trust models of social networks may offer a counter to some of these attacks.

– Many paths into devices will be available for unauthorized users to exploit.   And if they are compromised by people or code that intend on generating denial of service attacks, huge amounts of bandwidth will exist for them to attack from.

– When a bad actor gets through defenses into data stores, they will likely find a wide range of data to exploit, since it is becoming so easy and low cost for us to store everything.

– Having things networked together means it can be easier to penetrate a target by finding one weak link that is connected to the infrastructure.

– Areas of people’s lives they once thought private, especially their cell phones and the data on their cell phones, are increasingly becoming attractive targets to hackers.

What is needed in an environment like this?  I can’t pretend to know all the solutions but here are a few points I support:

– Enhanced firewalls and intrusion detection devices.

– Better configuration control, for all devices.  When a device is out of configuration is must be brought back into compliance immediately.

– Better laws and treaties concerning cyberspace. Deterrence policies by governments.

– More attention to standards and to industry organizations (including supply chain quality  organizations) is a must.

– Better training and education for all (I mean ALL) humans connected to the grid.

– Better, continuous upgraded anti-virus solutions.

– Automated response to attacks.

– Enhanced, easier to use encryption.

– Enhanced, more secure identity and authorization technologies.

More Reading:

For more on these topics see the CTOvision Guide to National Security Technology and

An Enterprise CTO’s View of Cyberspace: Cyberspace is our Interconnected IT

The Definition of Cyberspace:

Cyberspace is our Interconnected IT

I heard yet another definition of cyberspace today.  I won’t repeat it here, I’ll just say it was an academic’s definition and it was somewhat useful to the particular conversation we were having.  But it pointed to an enduring problem for those who try to study these concepts.  If everyone everywhere can create their own definition of cyberspace, then how can we study this field?
At the risk of clouding things even further, I’ll propose a solution.

The term cyberspace is primarily used in two ways:

1) As a metaphor and

2) As a description of the modern IT environment.

Depending on which of those two usages is required, there are two easy definitions.  They follow:

When used as a metaphor, the term cyberspace must convey the full complexity and elegance of a new environment that is man made but seems alive. When a definition is required for this usage, there is none better than that written by the man who coined the term. William Gibson wrote about it in 1984 in his book Neuromancer. He defined cyberspace as “A consensual hallucination experienced daily by billions of legitimate operators, in every nation… A graphical representation of data abstracted from the banks of every computer in the human system. Unthinkable complexity.”  For me that terms puts you in the frame of mind to creatively explore the realm of the possible and is still very much of use.

When the term is used in the context of real world actions and infrastructure, we can now use a very simple definition.  Cyberspace = The Information Technology in operation today (including hardware, software and data).

Said an even shorter/simpler way: Cyberspace is our interconnected information technology.

Is there any need for any other definition of the term “cyberspace”?

Cyberspace Is Our Interconnected Information Technology

For more on these topics see the CTOvision Guide to National Security Technology and

Good and Evil in the Future of Cyberspace

michaelPredictions of the future of technology are increasingly starting to sound like science fiction.   Depending on your point of view that can be good or bad.  As for me, I’m an optimist, and I know we humans will find a way to ensure technology serves our best interests.

But a sad fact of the human condition is that bad people will likely be with us long into the future.  And sometimes good people can be tempted to do bad things, so we really need to engineer solutions that keep the bad guys from benefiting from technology and keep those who can sometimes be tempted from giving in to their darker side.

To engineer secure systems for the future we need to continually assess where we are and what the near term future holds for our technologies.  Here is a couple short predictions that could be useful in this discussion.

First, a definition: Cyberspace is our interconnected information technology.

  • Remote power is here today and will soon be widely distributed.  This will allow small power consumption devices (like keyboards, mice, bluetooth headsets, hearing aides, small sensors) to be provided power by RF energy.
  • Power generation from motion is almost ready for prime time.  This will allow devices to gain energy from vibrations, like the vibrations in a bridge when a car passes over it, or the vibrations in a wall of a building when the wind blows past it, or the vibrations caused by a person’s movement through the day.
  • Communication capability (bandwidth) between fixed facilities will increase 1000 fold over the next five years.
  • Storage, especially flash storage technologies, is decreasing in price so much we can afford to store data anywhere on almost anything.
  • Chips are being designed in ways that actually beat the old Moore’s Law projections.  This is being done by placing many cores on one chip.  Very high data rate capabilities are being connected directly to the cores on these chips.
  • RFID is becoming so widespread we can place devices on everything that allows devices to report back what they are and what they are for and where they have been.
  • All these capabilities are being networked together, including increasingly direct device to device connections via capabilities provided by enhanced protocols (especially IPv6).
  • Consumer devices, especially consumer communication devices, are becoming increasingly capable.  What used to be called a cell phone is now a phone/video recorder/video editor/entertainment/mobile office device with location aware data (GPS).
  • Cloud Computing and the rise of web2.0 and web enabled service delivery is a trend as powerful as any force of nature.  Increasingly we will get our computational power from the grid.

There are many other elements of the future relevant to security discussions, but the projections above lead to some interesting conclusions on their own.   So lets think through some of the impacts of the above.

  • Bad actors who want to exploit systems will increasingly not have to worry about them being powered off.  They will be on all the time.
  • Many paths into devices will be available for unauthorized users to exploit.  And if they are compromised by people or code that intend on generating denial of service attacks, huge amounts of bandwidth will exist for them to attack from.
  • When a bad actor gets through defenses into data stores, they will likely find a wide range of data to exploit, since it is becoming so easy and low cost for us to store everything.
  • Having things networked together means it can be easier to penetrate a target by finding one weak link that is connected to the infrastructure.
  • Areas of people’s lives they once thought private, especially their cell phones and the data on their cell phones, are increasingly becoming attractive targets to hackers.

What is needed in an environment like this?  I can’t pretend to know all the solutions but here are a few points I support:

  • Enhanced firewalls and intrusion detection devices.
  • Better configuration control, for all devices.  When a device is out of configuration is must be brought back into compliance immediately.
  • Better laws and treaties concerning cyberspace.
  • Better training and education for all (I mean ALL) humans connected to the grid.
  • Better, continuous upgraded anti-virus solutions.
  • Enhanced, easier to use encryption.
  • Enhanced, more secure identity and authorization technologies.

 

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]