Stone Aged Security

Humans have been stealing from each other since we first chose to pile rocks up in a cave.  The current media frenzy might make us think of cybercrime as a new issue, but it is really just the most recent incarnation of what is the probably the second oldest profession.

The same societies, defences, attacks and innovations that were created in the physical world have all been rediscovered and recreated in the online world.  No-one seems to have noticed this before now.

Stone Age Society (10,000 BC)

The stone age is generally considered to be the advent of agriculture at the end of the last ice age.  Before this everything was done manually and just-in-time.  Society developed towns, and people started to develop specialised skills, but each skill replaced a manual process from before.  There were very few defences and very little interconnectivity.

Stone Age IT (1940)

The IT stone age is generally considered to be the advent of programmable digital computers at the end of the last world war.  Before this everything was done manually and just-in-time.  Engineers developed computers, and people started to develop specialised skills, but each skill replaced a manual process from before.  There were very few defences and very little interconnectivity.

Bronze Age Society (3,000 BC)

The bronze age is defined by the advent of the use of bronze as the primary material for tools and weapons.  It took nearly 7,000 years.  Society developed cities, and the primary government was the city state.  Improvements in efficient trade and commerce were limited by slow communication and lack of coordination.  When necessary armies were raised from farmers.

Bronze Age IT (1975)

The IT bronze age is defined by the advent of the use of microprocessors as the primary building block for computers.  It was 200x faster, and took only 35 years.  Engineers developed CPU designs, and the primary way of using them were via open documentation.  Improvements in efficient trade and commerce were limited by slow communication and lack of coordination.  When necessary armies were raised from enthusiasts.

Iron Age Society (1,000 BC)

The iron age is defined by the advent of the use of steel.  It took about 2,000 years.  Society developed global empires and the first gamers.  The empires were defended by standing armies, but eventually failed as the God-given right to rule crumbled, and plagues ravaged the land.

Iron Age IT (1985)

The IT iron age is defined by the advent of the use of desktop computers.  It was also 200x faster, and took only 10 years.  Engineers developed Microsoft and the first gamers.  The companies were defended by standing armies of lawyers, but eventually failed as the monopoly abuse caused them to crumble, and computer viruses ravaged the land.

Middle Ages Society (500 AD)

After 1500 years, feudalism replaced nation-states and monarchs ruled.  Knowledge was democratised, and the first open universities and printing technologies were created.  Pillage and piracy became a real source of income.  Walled castles were built to keep the enemies out, but weren't effective because trade became more important than protection.

Middle Ages IT (1993)

After 8 years, feudalism replaced monopolies and ideas ruled.  Computing was democratised, and the public Internet was created.  Pillage and piracy became a real source of income.  Firewalls were created to keep the enemies out, but weren't effective because commerce became more important than protection.

Industrial Age Society (1800 AD)

After 1300 years, coal and steam were developed as a new source of power.  Society moved from monarchies to republics.  Laws replaced swords as the way of settling differences, and defences moved out to the state, and in to the building level.

Industrial Age IT (1999)

After 6 years, high-speed broadband was developed as a new source of power.  Innovation moved from established companies to start-ups.  EULAs replaced dongles as the way of protecting software, and defences moved out to the ISP, and in to the host level.

We are now in the Social Stone Age.  It seems unlikely that anyone will look back to IT to see how it will turn out, so I'm sure that we will develop the same societies, defences, attacks and innovations all over again!

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com 

Staking a Claim in Social Media

This week I had a call from a lawyer who said that social media accounts in the name of one of their clients had been created and were being used for malicious purposes.  They wanted to know what they could do about it.

When deploying security controls we need to consider prevention, detection and response, and this case is no different.

Prevention.

There are a significant number of people - many of them in very senior roles - who wear as a badge of honour that they don't have any social media accounts.  Saying "I don't understand this new-fangled social media" may sound reasonable today, but 100 years ago the same people would have been saying "I don't understand this new-fangled electricity", and then gone on to sink their fortunes into steam power.

I'm not suggesting that everyone become Facebook addicts.  However I am definitely recommending that all companies and anyone with a senior role go out and register accounts on all of the major social media sites, as a prevention against anyone else doing it in their name.  There is no validation of who registers an account, and due to an interesting bootstrapping problem it really is impossible for the social media providers to confirm the identities.  Twitter's blue tick isn't the answer.

We did this with domain names a decade ago, and we have to do it all over again with social media now.

Detection.

Search for yourself on the search engine of your choice.  While it might be vanity, it also will allow you to determine if anyone else is pretending to be you.  Most of the major search engines allow you to set up alerts on new pages that they find with a given term, and you can use this as a detection mechanism against imposters.

This may be practical if you have a distinctive name, but is going to be quite difficult for the John Smiths of the world.  Even my name isn't unique in my own city, so getting in first and registering early becomes very important.

Response.

If and when someone does register a social media account in your name, there are a limited number of things that can be done about it.  It is always possible that they really do have the same name as you, and you got in late, in which case unless they are committing fraud by pretending to be you specifically you have no comeback.  Consult your lawyer on defamation laws in your jurisdiction as your only response.

Just like the domain squatters of the last decade, we now have social media squatters.  They can be dealt with in similar ways: (a) pay them what they ask to get the identity back; (b) raise a complaint with the social media provider; or (c) call the lawyers.  The difference here is that the social media providers are for profit companies, rather than not for profit organisations, and they don't have the same social responsibilities.

Ironic, isn't it.

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com 

War on War on Cybercrime

Be afraid.  Be very afraid.  The UK has just announced that it is losing the war on cybercrime, and needs to consolidate cybercrime policing into a new unified structure as part of a shakeup of the country's policing.

Any time a government declares a “war on something”, it costs money, achieves nothing, and distracts from the real issues.  For recent examples consider the total failure of the “war on drugs”, “war on terror”, and “war on poverty”, just to name a few.  War on cybercrime will be no different.

All of these wars are justified by the belief that the government needs to be seen to be doing something, combined with the unshakeable assertion that they are better at protecting us than we are at protecting ourselves.  I disagree with both sides of the argument.

We live in a world with a higher standard of living, with more freedoms and less crime than ever before.  There is no public outcry to protect us.  The only outcry is that generated by the media and the government themselves.

What we need is better education and the tools to protect ourselves.  We are all being attacked all the time, and we can protect ourselves without relying on an ineffective government oversight body that in the end does nothing but serve platitudes.

We need to declare a war on the war on cybercrime.

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com