I came across this line in a scifi novel I was reading a while back. It got me thinking about the way we have become so dependent on information systems, even though we haven't entirely wrapped our brain around how to protect them.
People have been defending physical entities for thousands of years. We've got a pretty good idea how to do it (walls, locks, undisclosed locations, etc). But not so much when it comes to IT. Our need for it continues to expand, and our ability to protect it is scrambling to keep up.
Not quite sure what to do about that. Surely the answer is not to avoid being so dependent on IT systems.
4 comments:
Hi Dan...enjoy your posts. I think improving cycbersecurity is similar to dealing with pandemic flu. You know there are serious consequences if you do not take precautions, but you're not exactly sure what precautions to take (for example, avoiding crowded places is not possible for many of us). There's a current discussion on the IT security group url on linkedin (http://www.linkedin.com/groupAnswers?viewQuestionAndAnswers=&discussionID=4172262&gid=46315&trk=EML_anet_qa_ttle-cDhOon0JumNFomgJt7dBpSBA) that asks Can anything protect against Social Engineering? The gist of the comments are that it's now so prevalent that it's tough to establish effective control over employees who are enmeshed in the social media experience. However once your system has been taken down Heartland-style, employee wishes will be the last thing you're thinking about. So why do we have to wait for the horse to bolt before we close the barn door? Human nature, I guess.
Thanks for the note! I wonder if the ultimate security answer is not so much about how to prevent but how to recover (& limit collateral damage)
We've been involved with a company whose technology simulates USAF Red Team exercises, without having to have the sophisticated personnel on board to carry out the exercise. You plug into the network, run the analytics (with minimum intrusion), and start processing the resulting reports and recommendations. This can become a continuous routine that really does keep your system more secure. So it can be done!
Dan,
I think you're on to something.
I think, to your original musing, that the answer lies in: 1. accepting that there will be some losses and 2. supporting a diverse and richly interconnected technology ecology. Note that #2 is going to be "inefficient" by some measures. And that gov't is extra exposed because it's more likely to a IT mono-culture.
Post a Comment