CYBERSPACE WILL NEVER be completely secure. The threats posed by what Sir David Omand, an academic and former head of Britain’s GCHQ intelligence agency, calls “the cesspit of modernity”—online crime, espionage, sabotage and subversion—are not going to disappear. Nor is the temptation for governments to treat the internet as a new combat zone, alongside land, sea, air and space.
In 1996 John Perry Barlow, a cyber-libertarian, issued a “Declaration of the Independence of Cyberspace” addressed to governments, insisting: “You have no moral right to rule us, nor do you possess any methods of enforcement we have true reason to fear.” He turned out to be wrong. Governments have shown in a variety of ways—from the theft of industrial secrets by Chinese spies to the mass surveillance conducted by Western ones—that they are determined to make cyberspace their own.
Defending the digital frontier
- Hackers Inc
- Zero-day game
- Digital disease control
- Crashing the system
- Not my problem
- Home, hacked home
- Prevention is better than cure
Political leaders are fond of saying that they want their citizens to benefit from the huge opportunities that a secure and reliable internet can offer, and that they are determined to protect them from crime and terrorism online. Yet they do not hesitate to use the web for their own purposes, be it by exploiting vulnerabilities in software or launching cyber-weapons such as Stuxnet, without worrying too much about the collateral damage done to companies and individuals. Some of the trends pinpointed in this special report, including the rise of organised crime on the internet and the imminent arrival of the internet of things, will only increase concerns about a widening security gap.
A plain man’s guide
So what can be done? The first thing is to change the tone of the debate about cyber-security, which is typically peppered with military metaphors. These tend to suggest that companies and individuals are powerless to help themselves, giving governments latitude to infringe their citizens’ privacy. “The internet is the most transformative innovation since Gutenberg and the printing press,” says Jason Healey of the Atlantic Council, an American think-tank. “Yet we’re treating it as a war zone.”
Bruce Schneier, a security expert, has suggested that crime-fighting is a better analogy than warfare. This is a useful idea. Police are needed to go after criminals, but people can help prevent crimes in the first place by taking sensible precautions. And although extraordinary powers of investigation and arrest are sometimes needed to apprehend wrongdoers, they are subject to robust legal protections for citizens.
Applied to cyberspace, this means that, far from being powerless against hackers, companies can do a lot to help themselves. Simply ensuring that only approved programs can run on their systems, regularly patching all software, educating employees about cyber-risks and constantly monitoring networks would help keep most intruders out. Yet too many companies fail to do these things, or do them consistently.
Tackling cybercrime often requires international co-operation. In recent years this has been getting better, partly thanks to agreements such as the Council of Europe’s Convention on Cybercrime, whose members assist each other in international investigations. More resources for crime-fighting outfits, including teams on secondment from the private sector, would clear out more crooks.
That still leaves the job of dealing with the most sophisticated hackers, whose motives often have nothing to do with money. Getting broader agreement on norms of behaviour in cyberspace is crucial, but it will not be easy. Forging a consensus on what bits of critical infrastructure should be off-limits to a cyber-attack would be an excellent start.
Making sure that fewer bugs crop up in software in the first place would also be helpful, particularly as the internet of things is about to take off and opportunities for breaches will multiply manifold. The best method would be for companies to come up with robust proposals of their own for securing the new connected devices. In March a group of firms including Cisco, IBM and GE set up the Industrial Internet Consortium, which among other things will look at innovative approaches to security in web-connected industrial gear. Something similar is needed in the consumer field.
The internet has turned out to be one of the biggest forces for progress in the history of mankind. Having started life as a gathering place for a small bunch of geeks and academics in the early 1970s, it is now at the heart of the global economy. Mr Gibson’s “consensual hallucination” has become a worldwide success story. It must be kept in good working order.
Powered by Facebook Comments