This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.
You can find the current article at its original source at http://www.theguardian.com/world/2015/aug/05/cybersecurity-cisa-bill-hackers-privacy-surveillance
The article has changed 4 times. There is an RSS feed of changes available.
| Version 0 | Version 1 |
|---|---|
| Controversial cybersecurity bill would do little to stop hackers, experts say | Controversial cybersecurity bill would do little to stop hackers, experts say |
| (about 2 hours later) | |
| Security experts warned on Wednesday that controversial cybersecurity legislation endorsed by the White House this week will do little to prevent hacking attacks. | Security experts warned on Wednesday that controversial cybersecurity legislation endorsed by the White House this week will do little to prevent hacking attacks. |
| The Cybersecurity Information Sharing Act (Cisa) would allow everyone from banks to data brokers to Facebook to secretly share the information of private citizens with the federal government in a move the bill’s proponents have characterized as a tradeoff for greater security. | The Cybersecurity Information Sharing Act (Cisa) would allow everyone from banks to data brokers to Facebook to secretly share the information of private citizens with the federal government in a move the bill’s proponents have characterized as a tradeoff for greater security. |
| But the approach comes at the cost of defense, said Dan Kaminsky, co-founder of cybersecurity firm White Ops and keynote speaker at Black Hat, the annual conference of information security experts happening in Las Vegas this week. | But the approach comes at the cost of defense, said Dan Kaminsky, co-founder of cybersecurity firm White Ops and keynote speaker at Black Hat, the annual conference of information security experts happening in Las Vegas this week. |
| Related: Cybersecurity bill could 'sweep away' internet users' privacy, agency warns | Related: Cybersecurity bill could 'sweep away' internet users' privacy, agency warns |
| “My feeling is that all of this stuff is really a distraction,” said Kaminsky. The government’s focus on collecting the data of people who might be hackers and testing established problems diverts valuable resources from fixing those problems and keeping hackers out, he said. | “My feeling is that all of this stuff is really a distraction,” said Kaminsky. The government’s focus on collecting the data of people who might be hackers and testing established problems diverts valuable resources from fixing those problems and keeping hackers out, he said. |
| “There’s only so much oxygen,” said Kaminsky. “The dual approach of ‘let’s hack more things’ and ‘let’s analyze more data’ is a distraction from ‘let’s build secure systems’. We need funding and attention on that. We need people working on systems that don’t leak data. I don’t know how else to say it. People are saying: ‘Things are on fire – let’s get better cameras to take photos of it!’ No, let’s put out the fire.” | “There’s only so much oxygen,” said Kaminsky. “The dual approach of ‘let’s hack more things’ and ‘let’s analyze more data’ is a distraction from ‘let’s build secure systems’. We need funding and attention on that. We need people working on systems that don’t leak data. I don’t know how else to say it. People are saying: ‘Things are on fire – let’s get better cameras to take photos of it!’ No, let’s put out the fire.” |
| The bill continues to meet with opposition: its co-sponsor, North Carolina Republican senator Richard Burr, said the Senate might not be able to vote on the bill before its summer recess, as planned. “Cybersecurity is an important national security issue and the Senate should take up this bill as soon as possible and pass it,” said a White House official earlier this week. | The bill continues to meet with opposition: its co-sponsor, North Carolina Republican senator Richard Burr, said the Senate might not be able to vote on the bill before its summer recess, as planned. “Cybersecurity is an important national security issue and the Senate should take up this bill as soon as possible and pass it,” said a White House official earlier this week. |
| Lauren Weinstein, co-founder of Privacy Forum, pointed out that after a series of high-profile failures, the federal government’s data security track record could use some work before the public hands over vast quantities of personal information. Cisa, he said, doesn’t address the way the data would be handled as rigorously as necessary. | Lauren Weinstein, co-founder of Privacy Forum, pointed out that after a series of high-profile failures, the federal government’s data security track record could use some work before the public hands over vast quantities of personal information. Cisa, he said, doesn’t address the way the data would be handled as rigorously as necessary. |
| “Details are absolutely crucial especially when it comes to the sordid history the federal government has had protecting the kind of stuff you’d expect them to protect,” Weinstein said. “I mean, how many examples do you need to have of the basic inability of the government to protect what you’d think would be the most sensitive information out there? We had a young guy clean out NSA with a thumb drive. Then they say they’re going to ask for all this additional information and we’re supposed to believe they’re going to protect that.” | “Details are absolutely crucial especially when it comes to the sordid history the federal government has had protecting the kind of stuff you’d expect them to protect,” Weinstein said. “I mean, how many examples do you need to have of the basic inability of the government to protect what you’d think would be the most sensitive information out there? We had a young guy clean out NSA with a thumb drive. Then they say they’re going to ask for all this additional information and we’re supposed to believe they’re going to protect that.” |
| Hackers, said Weinstein, are easy to misidentify by nature. “The whole structure of cyberattacks is that you never know where they’re coming from,” he said. “We’re still largely at a point where it’s hard to tell if a particular cyberattack is a result of a state-sponsored military operation or a 13-year-old in a basement in Cleveland.” | Hackers, said Weinstein, are easy to misidentify by nature. “The whole structure of cyberattacks is that you never know where they’re coming from,” he said. “We’re still largely at a point where it’s hard to tell if a particular cyberattack is a result of a state-sponsored military operation or a 13-year-old in a basement in Cleveland.” |
| Collecting the browsing data of of every teenager in Cleveland would seem to be the wrong solution, but Steve Ward, of security company iSight Partners, said that knowledge of multiple cyberattacks is sometimes the best way to determine who exactly is behind any one of them. “One thing that can often help us ... would be the source of domains used in attacks,” Ward said. “You see a specific email address connected to six different server infrastructures. You see that in one attack and then you see it another, and then you know you’ve got a single adversary that’s hitting, say, oil, gas, and healthcare.” | Collecting the browsing data of of every teenager in Cleveland would seem to be the wrong solution, but Steve Ward, of security company iSight Partners, said that knowledge of multiple cyberattacks is sometimes the best way to determine who exactly is behind any one of them. “One thing that can often help us ... would be the source of domains used in attacks,” Ward said. “You see a specific email address connected to six different server infrastructures. You see that in one attack and then you see it another, and then you know you’ve got a single adversary that’s hitting, say, oil, gas, and healthcare.” |
| Of course, that’s the problem in a nutshell: Hackers – perhaps nation-states, perhaps individuals – have stolen troves of info from the US government’s Office of Personnel Management, schematics for the F-35 fighter jet from Lockheed-Martin, and sundry credit card numbers from Target customers, PlayStation users and many, many others, often posted on easy-to-find blogs that simply list one set of personal data after another. | Of course, that’s the problem in a nutshell: Hackers – perhaps nation-states, perhaps individuals – have stolen troves of info from the US government’s Office of Personnel Management, schematics for the F-35 fighter jet from Lockheed-Martin, and sundry credit card numbers from Target customers, PlayStation users and many, many others, often posted on easy-to-find blogs that simply list one set of personal data after another. |
| Dave Levine, a fellow at Princeton’s Center for Information Technology Policy, said that information-sharing is hard to improve, given the reticence of companies to share (or admit the existence of) trade secrets. A major trouble with Cisa is “the interest in government in trying to solve problems that do not have much of a legal solution”, Levine said. “It’s better for the government to encourage the private sector to be more robust in increasing cybersecurity standards within corporations.” | Dave Levine, a fellow at Princeton’s Center for Information Technology Policy, said that information-sharing is hard to improve, given the reticence of companies to share (or admit the existence of) trade secrets. A major trouble with Cisa is “the interest in government in trying to solve problems that do not have much of a legal solution”, Levine said. “It’s better for the government to encourage the private sector to be more robust in increasing cybersecurity standards within corporations.” |
| Both Levine and Kaminsky praised US government efforts to make networks harder to break into. Levine noted a recent push by federal agencies for multifactor authentication during the White House’s “cyber sprint”; Kaminsky said government agencies had been “a lantern in the darkness” when the National Institute of Standards and Technology developed standards to avoid “cache poisoning attack” – better known (after its discoverer) as the Kaminsky Bug. | Both Levine and Kaminsky praised US government efforts to make networks harder to break into. Levine noted a recent push by federal agencies for multifactor authentication during the White House’s “cyber sprint”; Kaminsky said government agencies had been “a lantern in the darkness” when the National Institute of Standards and Technology developed standards to avoid “cache poisoning attack” – better known (after its discoverer) as the Kaminsky Bug. |
| Kaminsky said the solution must be to make more secure systems. “We’re not gonna hack our way into networks that can’t be hacked, we’re not gonna get leaks from networks that leak less,” he said. “The government’s role is not to be the biggest, baddest hacker in the room.” | Kaminsky said the solution must be to make more secure systems. “We’re not gonna hack our way into networks that can’t be hacked, we’re not gonna get leaks from networks that leak less,” he said. “The government’s role is not to be the biggest, baddest hacker in the room.” |
| Those networks, he said, may need to be built by government employees, because there’s not sufficient profit motive for the public sector to generate them quickly enough for Kaminsky’s taste. “When does someone ever tell you there’s not enough bureaucracy?” he sighed. “But there’s no a bureaucracy that’s focused on making more secure technology. Wouldn’t it be nice if there was some sort of department? Of defense?” | Those networks, he said, may need to be built by government employees, because there’s not sufficient profit motive for the public sector to generate them quickly enough for Kaminsky’s taste. “When does someone ever tell you there’s not enough bureaucracy?” he sighed. “But there’s no a bureaucracy that’s focused on making more secure technology. Wouldn’t it be nice if there was some sort of department? Of defense?” |
| Even Ward, who is much more enthusiastic about information sharing that Kaminsky, said that the wide variety of information supplied by so many different companies covered by Cisa means that cross-referencing becomes very difficult. “Let’s say Cisa passed,” said Ward. “Google gives up all their data, Facebook gives up all their data. OK, great! That’s not information, that’s just data.” | Even Ward, who is much more enthusiastic about information sharing that Kaminsky, said that the wide variety of information supplied by so many different companies covered by Cisa means that cross-referencing becomes very difficult. “Let’s say Cisa passed,” said Ward. “Google gives up all their data, Facebook gives up all their data. OK, great! That’s not information, that’s just data.” |
| Not everybody loves government-sponsored security protocols, but they at least keep citizen data private. “I’d rather have the government running security technology than fighting encryption tooth and nail,” said Kaminsky. “That’s the weirdest thing. We’re in a world that needs more security and we’ve got people saying: ‘Perhaps the internet is too secure!’ Only in DC could that happen.” |