Digital Security Is Like Water for US

Digital security is what which will effect all of
us in some how. We start to learn more and
more about it, we see that without it, we are
dead. There are some dishonest person that
make this just harder and harder for every
body. Digital security is in some how like
water for us, we have to defend it as hard as
we can. There are some out there that
poisoning this water.

Digital security is at a crossroads. The old ideas are not working, and none of the new ideas has rushed in to
shore up the breach. This either will change, or people and businesses will abandon cyberspace for all but the
most frivolous pursuits. I believe it will change, and that the change will involve people.
Traditionally, computer security has been viewed as a technological problem, with technological solutions. The
idea is that technology can "solve" the computer security problem. Over the years, different technologies have
promised us just that: encryption, firewalls, intrusion detection systems, vulnerability scanners, virtual private
networks, public-key infrastructures, biometrics, etc. The belief behind this idea is that technology can counter the
threats, and that technology can make us secure. And, by extension, more technology can make us more secure.
Unfortunately, the traditional approach is not working. The threats are not being countered. We are not secure. In
fact, computer and network security is steadily getting worse. Attacks and attackers are getting more
sophisticated, and the overall environment is getting riskier. Sure, defensive technologies are getting better, but
so are attack technologies. There are more users on the Internet. There are more applications on the Internet.
There are more critical applications on the Internet.
Computer security is a 40-year-old academic discipline. Every year there are new developments, new products,
new ideas, new research. And every year the problem gets worse: there are more attacks, more losses, more
damage.
The problem with the traditional approach is that it is static. It involves putting up defenses and hoping they work.
It involves reacting to new threats by putting up new defenses, and again hoping they work. The traditional
approach fails because it is static and automatic. In the face of human attackers, it just isn't effective.
Look around yourself. Notice how safe you feel. Also notice that you don't wear body armor, drive around in a
tank, or live in a fortress. Your security doesn't come from ever increasing numbers of preventive technologies.
Your security comes from processes. Maybe your office has a guard in its lobby. Your office almost certainly has
an alarm system, and maybe your home does. Certainly the legal system—police and prosecutors—add to your
security. There are three processes at work here—prevention, detection and response—and they're what make
you safe and secure.
The next twenty years will see that same kind of thinking brought to the cyberspace. And it will have a greater
impact on computer and network security than anything done in the past twenty years.
We have no choice. If the prevention mechanisms were perfect, you wouldn't need detection and response. But
no prevention mechanism is perfect. This is especially true for computer networks. All software products have
security bugs, most network devices are misconfigured, and users make all sorts of mistakes. Without detection
and response, the prevention mechanisms only have limited value. They're fragile. And detection and response
are not only more cost effective, but also more effective, than piling on more prevention.
On the Internet, this translates to monitoring. In October 2000, Microsoft discovered that an attacker had
penetrated its corporate network weeks before, and might have viewed or even altered the source code for some
of its products. Administrators discovered this breach when they noticed twenty new accounts being created on a
server. Then they went back through their network's audit logs and pieced together how the attacker got in and
what he did. If someone had been monitoring those audit logs—automatically generated by the firewalls, servers,
routers, etc.—in real time, the attacker could have been detected and repelled at the point of entry.
That's real security. It doesn't matter how the attacker gets in, or what he is doing. If there are enough motion
sensors, electric eyes, and pressure plates in your house, you'll catch the burglar regardless of how he got in. If
you are monitoring your network carefully enough, you'll catch a hacker regardless of what vulnerability he
exploited to gain access. And if you can respond quickly and effectively, you can repel the attacker before he
does any damage. Good detection and response can make up for imperfect prevention.
This kind of security requires people. Automatic security doesn't work in the real world, and it doesn't work in
cyberspace. Good detection and response systems always include experts: policemen, firemen, soldiers, etc.
These experts are tasked with intelligent detection—determining whether an attack is real or a false alarm—and in
providing response: determining what kind of response is appropriate and then carrying it out. Things are no
different in cyberspace. Good detection and response will always involve people, because people are the best
decision makers, are the most adaptable, and are more creative thinkers than anything we could build.
I see the next twenty years as a move away from automatic cyberspace security and towards human cyberspace
security. This will be a good thing, and will result in a higher level of security than we've ever seen before. The
change won't come easily; there are many security sellers that have invested in the idea that their technologies
will solve computer security problems, and there are many buyers who want to believe that they can simply install
a product to make their problems go away. But the change will happen. It will be assisted by the insurance
industry, which will push for higher levels of security as it writes more and more cyberinsurance policies. It will be
assisted by government, which will itself push for more and more security for our nation's critical infrastructure.
And it will also be assisted by corporate buyers, who are slowly learning that computer security is critical to their
business.
Prevention systems are never perfect. No bank ever says: "Our safe is so good, we don't need an alarm system."
No museum ever says: "Our door and window locks are so good, we don't need night watchmen." Detection and
response are how we get security in the real world, and they're the only way we can possibly get security in the
cyberspace world. The next twenty years will prove that.