America unable to win Cyberwar?

[Antithesis]

http://it.slashdot.org/story/10/02/2...in-a-Cyber-War

"The inability to deflect even a simulated cyber attack or mitigate its effects shown in the exercise that took place some six days ago at Washington's Mandarin Oriental Hotel doesn't bode well for the US. Mike McConnell, the former Director of National Intelligence, said to the US Senate Commerce, Science, and Transportation Committee yesterday that if the US got involved in a cyber war at this moment, they would surely lose. 'We're the most vulnerable. We're the most connected. We have the most to lose,' he stated. Three years ago, McConnell referred to cybersecurity as the 'soft underbelly of this country' and it's clear that he thinks things haven't changed much since then."

I apologize for the multiple threads on the front page I have made but this one kind of caught my eye and I wanted to know what everyone else though.

[kuronosan]

I think we need to stop exposing our weaknesses.

THIS JUST IN! YOU CAN FLY STRAIGHT INTO THE WHITE HOUSE AND NO ONE WOULD KNOW YOU WERE COMING BECAUSE OF THIS LOOPHOLE IN RADAR SECURITY!

[Not not Mattaru]

There was a very good podcast on this a little while ago (a couple weeks ago maybe) on NPR's Fresh Air. I'll see if I can find it.

Here:
http://www.npr.org/templates/rundown...Date=2-10-2010

[Zilong]

I think we need to stop exposing our weaknesses.

THIS JUST IN! YOU CAN FLY STRAIGHT INTO THE WHITE HOUSE AND NO ONE WOULD KNOW YOU WERE COMING BECAUSE OF THIS LOOPHOLE IN RADAR SECURITY!

one would think with the american mass media, it would be beyond easy to spread misinformation and distraction in order to hide important shit.

[*Shinzon*]

one would think with the american mass media, it would be beyond easy to spread misinformation and distraction in order to hide important shit.

This reminds me of the time ABC 7 in NYC thought it would be an excellent idea to broadcast an investigation they did into the security of the Indian point nuclear power plant showing and providing explicit directions on what sections of the plant were most vulnerable. I mean really? Why don't you just build a nuclear bomb and hand it some terrorist yourself.

[Priran]

oh noes a cyber war!!!1


wtf is a cyber war anyway? whoever puts on the most robes and wizard hats wins? what do they win?

[Darus Grey]

oh noes a cyber war!!!1


wtf is a cyber war anyway? whoever puts on the most robes and wizard hats wins? what do they win?

The goal of a cyber war is mostly to shut down electrical power in the defending nation in preparation for a physical assault.

Everything before that is like a cyber cold war, where every side is trying to make sure they can do the above to each other on a moments notice, whether they intend to or not.

What this doesn't say is that countries like China are even MORE vulnerable to this shit.

[Foof]

From the military side of things, they're at least increasing manning when it comes to this. Last year when I was trying to get into the military's digital network security job field, they told me they were looking to double/triple the amount of people they have trained. NSA HQ just opened up a USMC cyber command this year (and I think the Navy did too), so someone important out there at least realizes we're vulnerable.

[Priran]

physical assault

United States

http://img24.imageshack.us/img24/4508/1236458848175.png

[Not not Mattaru]

What this doesn't say is that countries like China are even MORE vulnerable to this shit.

Yeah, in that podcast I posted they also mentioned that any sort of cyber attack towards the US financial system would be fucking themselves obviously.

Right now it is not cyber warfare. It is cyber espionage more than anything. Its hard to say because so much data has been taken at certain points from different sources to nail exactly what the motive is outside of very particular incidents like China v Google.

There just is no impetus for cyber warfare instead of cyber espionage. This may change in the next decade if terrorist groups got the necessary capability as their goal is more just wreaking havoc.

Espionage on the other hand gives you a heads up on new technology and simply what other officials etc. think of you.

People should listen to that podcast, gives a nice little primer.

[willriker]

oh noes a cyber war!!!1


wtf is a cyber war anyway? whoever puts on the most robes and wizard hats wins? what do they win?

you know how much havok a single person can do to another with just one 9 digit number? Think about that but on a much larger scale. It is really something to be worried about. Its not like their attacks would be something as simple as tinckering with someones myspace page.

nowadays nearly every computer is connected to the internet. and if you know the correct information, can find the correct information, you can do pretty much anything.


back to the OP:

short of unpluging critical systems from the internet... i really do not have any idea how you could possibly deny someone access to the PC/MAC/whatever. Its due to the whole arms vs armor dilema. someone comes up with a fancy slashing sword, the responce was chainmail. now the sword is mute. someone comes up with a rapier to stab through the chainmail, the armorer develops plate maile to protect against the stabbing of the rapier. the weaponsmith comes up with a maul to break the bones of the plat wearer without the need to penetrate the armor. the armorer adds additional padding beneith the plates and changes the plates to deflect more of the force away from the body.

It goes on and on.

the problem with the point of veiw that is expresses in the OP is that you are on the defensive. the offense, given time, will always develop a way to conquer/circumnavigate a defense. In this situation, a mutualy assured destruction would be the best course of action. investing in additional defenses will be wasted money.

just ask microsoft.

[Kyreth]

There's also the fact that virtually all defenses are passive.

There is no "black ICE" that counterattacks intrusion efforts in most cases. At worst, the system being attacked can attempt to track things back to the source of the attempt.

IMHO, the only effective defense will be one that acts in an offensive fashion- that is, make a security system that will attempt to destroy anything that connects with it, and only systems rendered properly immune will survive the results and proceed.

[Kerberoz]

IMHO, the only effective defense will be one that acts in an offensive fashion- that is, make a security system that will attempt to destroy anything that connects with it, and only systems rendered properly immune will survive the results and proceed.

Been watching GitS?

[liggy 0]

Just takes the kids from the porn addiction thread and have them do cyber security for premium status porn. They seem to know more about cyberspace than adults do.

[Not not Mattaru]

Been watching GitS?

Nah dude, obviously prime ladder climbing material at the NSA going to waste.

[Takedown3]

i thought this was something about japenese online sex dominating the US market

[Kyreth]

Been watching GitS?

Nah. I just think that the best defense would be a machine being "toxic"- that is, anything coming into contact with it would end up infected with hostile programming of various kinds. You have the appropriate ways to block it, you're OK. Otherwise, whatever you used to connect with it gets fucked over. That is, access to the important portions of the system in question would require you to give the connecting system six or seven different ways to fuck you over.

And no, I don't think it'd happen. Too many stupid people out there would end up wrecking their systems because they forgot to load the proper "antidotes" before logging in on their laptop from home and end up with nothing but goat.se images replacing every file on their hard drive or the friendly federal equivalent of "take a seat over there" material. Just because it might be the most effective doesn't mean it's smart.

[arus2001]

Seeing how I'll never believe computers can be 100% safe, I'm a bit stumped on how some pivotal computerized systems are actually given internet access. If it's a matter of remotely checking the status of, say, a power plant generator, fine, but why take it a step further in removing the physical human element that'd have to be there to flip a switch and all the crap needed to (safely) do it?

So, instead of some cyberterrorist acting from the safety and comfort of their computer desk, they'd need to be able to physically overpower human/structural security and know the layout of locations and of the machinery. More than likely they'll need multiple people to pull this off, as well as more time to do it without reinforcements capping their asses instead of turning off the PC and finding a new hideout if the heat's on.

I'm sure the ultimate reason is money, or spending as little of it as possible, but at what point is potentially compromised safety acceptable? I guess this kind of reminds me of the recent airport scanner crap, but that's also more a matter of physical security than digital.

[Kuya]

Who do we have to invade to win this cyberwar?

[Not not Mattaru]

Who do we have to invade to win this cyberwar?

Agent Smith duh.