Schneier on Security

Clive Robinson • February 22, 2022 10:04 AM

@ Bruce, ALL,

With regards,

“Still, its contours are already clear: the private sector must prioritize long-term investments in a digital ecosystem that equitably distributes the burden of cyberdefense.”

We know this is not going to happen.

1, Real Cyberdefense is a cost no shareholder is going to pay.
2, Nearly all the profit in the financial sector is based on deliberately created volatility and hidden information.
3, Shareholders will move capital abroad if you try to tie them in to longterm, as there is no short term profit to be made.

A look at history might be instructive. The Bretton-woods agrement made most financiers “spare t1t5 on a bull”. It was not untill Euro/junk bonds came along that we got the highly unstable financial markets we know have that are effectively “rigged” to suit a very very tiny number of people who control most of the liquid wealth.

Every time governments try legislation or regulation, to get stability and longterm growth, the finance industry comes up with a new scheme, to break it.

Thus the problem needs to be fixed earlier in the finance “supply chain”.

Clive Robinson • February 22, 2022 3:08 PM

@ Ted, ALL,

I appreciate that he sees the absurdity of placing small entities in the royal hot seat for cyber-incidents, and is instead looking to government and large firms to take on more responsibility in organizing this environment.

Rhe problem with “cyber-attacks” is the political desire to bring them into the politicians domain. Which with central government that the guard labour given the job,

1, The military (and Intel Com).
2, The centralised Law Enforcment.

They in turn make “a big thing of it” instead of being pragmatic.

Nearly all cyber incidents are “criminal” and that is best handled by the same people that deal with criminal activity. That is the ordinary Police.

If you listen to the cyber-assesments, they are not about cyber-crime, untill ransomware finally went over the top.

But even now those assesments are agency “Empire building” not getting the actual job done of “policing”.

Because of this moronic machismo by central government agencies, the little crimes that need to be solved don’t even get looked at…

The result is a cautious cyber-criminal keeping the value of individual crimes down, will get almost entirely uninvestigated. So it’s not surprising traditional crime the police deal with is falling but cyber-crime has grown at an astounding rate.

Whilst central government agencies hardly communicate with each other at the base operational level, and swagger and act macho, and annoy just about every one they come in contact with, ordinary police forces tend to communicate better when given the opportunity.

Importantly not just within their own country but with other countries.

And that’s important because cyber-crime works better across international borders than it works locally unlike more conventional crime.

So if we want to stop cyber-crime which is actually more important than solving fake-news we need ordinary police agencies working across borders just as the cyber-criminals do.

Opening this up with careful legislation would make the biggest real term societal gains.

Clive Robinson • February 23, 2022 11:25 AM

@ Petra Peter,

Regulation in the tech industry is coming. The only question in my mind is if it will happen before a cyber catastrophe.

In the US and other places “Regulation is in place” already.

The dominant feature being “business must snitch” to authorities BUT… Must not “tip off the user” in any way.

So I realy do not think further regulation will make the harvesting of data any more difficult, in fact I think it will make not snitching almost impossible with the way most use communications these days.

That so far failed Child Exploitation system Apple was going to put on everyone’s iPhone being just the visable edge of what the likes of the FBI / DoJ and other tyranical psychopaths want…

There is only one solutuon to that which is “move the security end point” not just “Off Device” but well beyond any communications path end point, and preferably with the human in the loop to act as a “tripwire come firewall”… That is compleatly the opposite of what those Three Leter Agencies want. So expect any future legislation contain legal requirments to “attempt” to combat that.