Schneier on Security

Blatrog Seriousness • February 12, 2016 12:09 PM

Corporate-wise, I am not sure that there is a realistic agenda here. IT Security groups in corporations normally are deeply underfunded and regulations are very poor. Most of what gets done is because of PCI-DSS, and that is deeply incomplete. They do not seem to have taken into stock the major hacks over the past ten years.

Government wise, it is far more disorganized, and under funded (for the right things).

I do mean here by “disorganized” and “regulations are poor”, ‘flying by the seat of their pants’. Or, ‘they don’t know WTF they are doing’. And usually this means, “they aren’t doing it”.

One thing I see, even here, are critics are often entirely outside of the industry and do not understand the realities of it.

With government, you can see their arrogance on full display: private sector security experts already said back door schemes will not work. They are lobbying anyway, as if they know better. That is literally taking a stance of enmity against one of America’s most powerful strengths: the technology sector.

There are government security experts. Fact is, most private sector security experts, have worked in government. Or a really damned good portion. Government sector security experts, in general, can not speak out.

Some may be biased. There is such a thing as sticking to your organization’s company line.

Actually, we have had the head of the NSA speak out. So, who knows tech security better? Clapper? Or Michael Rogers?

I am perfectly willing to perform heart surgery or brain surgery on anyone, because I stayed at a Hilton last night. Not my field sure, but I am generally a competent person and a quick learner. That is the kind of attitude Clapper is showing here.

The major “todo” the FBI (and USSS — United States Secret Service) need to do is provide government and corporations data.

We need to see as much data as possible. Who is hacking. How. Where from? Whom are they hacking? Now? Historically?

Data sets are required for funding and for defense strategies.

Instead, we rely on the “good will” of consultancies and other vendors. Their data is deeply incomplete and only summary.

Some of you may be aware of the time before seatbelts were mandated. That is what this is like, and worse. How many are dying? In what sort of accidents? How many could have been saved by seatbelts? Such things are not known.

Better, dig into car insurance, life insurance, and look at the data sets they have to work with. There is cyberinsurance, but they are working in the dark.

It is true, you can sign up with infragard and get some details. That is very weak methodology. No offense to the FBI on that, their agent here is very good and networks with corporate very well. The problem is the entire attitude. AV firms were wrong when they worked in a cabalistic manner. They were doing that not for security, but because of illusionary proprietary, selfish interests.

The ‘full disclosure’ approach hit hard in the late 90s and early 2000s and worked. It still works. And FYI, if you are wondering, look at some of the leaders resumes, and notice many came from government. They were not spies, they simply cared and were smart. It was and is a bit of a daring tactic, but it was well planned and works perfectly.

Script kiddies remain script kiddies. You can’t teach that sort even if they wanted to be better. Criminal hackers with skills will continue.

For domestic abuse by authorities, well, that is another thing. Practically zero regulations and authority. The US has OK counterintelligence, but nothing remotely like that for investigating and enforcing compliance across federal, state, and local. That is where the FBI should be taking the lead. They are not.

You saw this same attitude with Robert Hanssen, the mole. The FBI refused to believe ‘one of their own’ could be doing that. Often books and shows depict him as a mastermind, a stealth monster. Bzzt. Wrong. Read from the desk of a counterintelligence analyst. The guy was clearly criminal. Coworkers knew it, no one could do anything.

Criminals hate “rats”. That is not the sort of attitude cops should take.

Kind of fits in with the contrast of intel outperforming law. CIA calls “CIs” “agents”. They respect and value them.