The Next Generation's Take On Cybersecurity

[#1]

The first Worldwide Cybersecurity Summit, organized by the EastWest Institute, wrapped up in Dallas this week.  This unique gathering of internet security experts, private sector executives, and public sector leaders generated wide-ranging recommendations to push Cybersecurity efforts forward, transcending the usual dividing lines.  Breakthrough groups charted next steps on many fronts: to enable governments to jointly solve internet crimes, to ensure widespread sharing of threat information (like a Cybersecurity Center For Disease Control), to prevent tainted technology supply chains, and to equip our power user children of the Internet to be better netizens (net citizens).

I noted that we really have to start these dialogues with a fundamental internet truth: your insecurity is my insecurity. 

While a few participants gravitated to Geneva Convention-inspired 20^th century constructs of treaties, protocols, and détente…others noted that cyberspace is the ultimate “shared commons” that the next generation already relies upon ubiquitously for daily commerce and collaboration.  Rather than negotiating borders, new models more akin to sharing oceans or space are appropriate here. 

And yes, participants unanimously proclaimed, we need to build more trusted international relationships to better govern ourselves and build the new Internet of the next decade.  Sure, “trust and check” is appropriate, but we need to think creatively about new norms of behavior to enable porn-free, crime intolerant, economically friendly shared cyberspace. With less than 50 of the 200+ countries participating in nation-state oversight bodies for the Internet, we have work to do!

As we welcome netizens and digital immigrants to the new network, we’ll have to deal with the reality that we must secure our shared Internet “commons” at every layer. Our global workforce will require safe, cross-device access to networks.  Our network service providers will require security at massive scale.  Clouds will have be safe-guarded from inside and out.  Remote locations and visiting netizens will need integrated security.  And innovators in all sectors will need to build the next killer apps on an open network platform with security built in.

It’s time for a new approach to securing networks and devices around the world. It’s time for new thinking about network security.  That’s why I am more motivated than ever to keep fielding new network security innovations from Juniper Networks.  Rather than adding ineffective 20^th century perimeters as a bolted-on afterthought to the network, security needs to be embedded at every level to ensure the scale, reliability, flexibility and manageability of human kind’s new network for the decades ahead.

Now saying all this, one other item is clear.  We must collaborate on security.  What do you think is necessary for our next generation of cybersecurity?  I’ll be checking back here frequently and sharing my thoughts.  But, I want to hear from you.  Let me know what you think needs to be done to secure the new network.  Look forward to hearing from you and let’s keep this conversation moving forward in the weeks ahead. 

[#2]

Hi, much of this seems like hyperbole. Self selected folks meeting and declaring the world is an insecure place. Just today there was an article in WSJ that lays out why much of such talk is without substance:

http://online.wsj.com/article/SB10001424052748704370704575228653351323986.html

Excerpt:

Perfect security—in cyberspace or in the real world—has huge political and social costs, and most democratic societies would find it undesirable. There may be no petty crime in North Korea, but achieving such "security" requires accepting all other demands of living in an Orwellian police state. Just like we don't put up armed guards to protect every city wall from graffiti, we should not overreact in cyberspace.

[#3]

It's easy to dismiss any discussion of cyber war as hype, but as Mark points out, "we need to build more trusted international relationships to better govern ourselves and build the new Internet of the next decade."

A number of the important conversations are not about the network technology, but the processes which customers, governments, CERTs and vendors should follow in a genuine crisis.

While inter-goverment collaboration might be strong between the 'Usual 5' (US, UK, Australia, Canada and New Zealand) there remain open questions on how best to share awareness of, and respond to international cyber events. For example, If a new form of attack is detected in Europe, how will operators in Asia be made aware of the need to protect themselves?

As they say, If you want peace you must prepare for war.

[#4]

The WSJ article posted in one of the above posts takes a stance that I believe has needed to be taken for a long time; but let's not stop there, I would highlight to mention that the article simply makes some suggestions that we don't over react to all the fear mongering. Face it, in any society there will be beneficiaries in times of need. Some people sold snake oil and sugar tablets, and others studied bacteria in milk until they revolutionized the way that dairy products are processed across the world, and thus prevented a lot of people from becoming ill.

The security industry is a necessity because there are dangers when you join the Internet. I recommend the Marcus J. Ranum TED talk to fully understand some of the hilarious nature on how some of the security industry was created, basically due to the FTP protocol. It's a really good plain-talking perspective on what happened, and that a lot of technologies and businesses have been driven to take some interesting roads because someone was lazy or didn't make the most elegant protocol.

Now about the concerns on the Internet; yes they are real, and the attacks are now very sophisticated. Have all attacks become sophisticated? No, it's even worse than that; we still have all the background noise of the common sweep scans, banners scans, malformed packets, brute force attacks on SSH and HTTP auth; but now we even have attacks on SIP, attacks that target voice mail systems by faking caller ID as a means of authentication, and covert channels across onion routers (TOR) that carry control channels for bot nets, click jacking, XSS, to name a few. And yes, a lot of money is fueling this industry but the profiteers this time are not the vendors, it's the other team.

Mark is spot on, we need to collaborate on security, we need to understand how security is changing all together. Take for example IPv6 adoption in service providers. Today we block SPAM and malware distribution sites with real time black lists, and this works with IPv4; can you imagine how hard this will be when a single network has more addresses than the entire Internet does today?