Schneier on Security

Clive Robinson • April 1, 2024 11:58 AM

@ Prefer Not To, ALL,

Re : Escalation just increases the fall.

“What would you have us do except ask our security experts to “nerd harder” so the bad guys don’t succeed the next time?”

Well it rather depends on what you mean by “nerd harder”…

But your question to me suggests you are fairly new here as I’ve given quite lengthy discourse in the past indicating why what is done in the West is not the right way to do things.

So as a recap, for crimes to be committed there needs to be some some things in place first,

1, Legislation to establishing illegal behaviour.
2, Ability to show a crime has been committed.
3, Ability to bring an alleged perpetrator to account.
4, Ability to, where harms have been shown to be committed, have commensurate punishment.

In the West due to the “influence of industry” the first two steps have been brought into significant disrepute.

Likewise the third due to political posturing in the West, and in the US mainly misuse of the first two steps for political or business reasons is counter productive at best.

As for punishments that are “fines or sanctions” they are mostly pointless. They sound very grand but they can rarely be enforced, thus nebulous charges against third or fourth parties are announced, but not exactly enacted otherwise all the major Western Banks leaders would be in the dock.

As far as the ICT Industry is concerned the reason crime is so high is because,

“There is neither lock or bolt on the stable door or paddock gate.”

Thus the data effectively just gets led out into the night…

So first step would be deal with the root of the problem such as Microsoft and Google, we know their products are,

“Not fit to be put on the market”

Yet we don’t do anything about it.

If we did the level of crime would drop significantly.

Back at the beginning of this Century, I said in front of an audience of people who now have significant names in academia that we were going about things wrongly.

We were in effect “educating the enemy” because it could easily be shown that we were at best just reactive, and then not enough to stop anyone.

Yes we fix vulnerabilities when they become embarrassing or are going to become so. But only to the point of stopping “a specific instance of attack” and next to never do we close “a class of attack”.

Thus the attackers just find another of thousands of vulnerabilities to just “carry on as normal”.

Mostly the ICTsec Industry efforts do not stop a problem / attacker, just give them a reason to mutate into a different attack.

The standard “evolution model” tells you where that is going to go.

Another problem is treating petty crimes as warfare, it’s just plain silly. Few nations teach military personnel to deal with common crimes. So things legally have to stop at boarders.

I could go on, but by now you should be asking yourself,

“Why are we doing things the wrong way, that we know does not work?”

The answer is the wrong way is not only cheap for the Mega-Corps, but it also allows tax money to be put in certain “right” Mega-Corp pockets in return for political funding. Whilst giving politicians another pointless “tough on crime” drum and flag to goose step to…