Cybersecurity is not very important [pdf]

> HN: This paper is the antivax argument, but for tech. If there was no major digital disaster that does not means that it cannot happen.

No, it's not what the author was saying. I found the paper is advocating a different position.

> Paper: This essay does not claim that a “digital Pearl Harbor” will not take place. One, or more, almost surely will. But that has to be viewed in perspective. Given our inability to build secure system, such events are bound happen in any case. So all we can affect is their frequency and severity, just as with large physical dangers. Further, the likelihood of a“digital Pearl Harbor” has to be considered in comparison to all the other threats we face. The issue is risk management, deciding how much resources to devote to various areas.

I completely disagree with the main thesis of the paper, but I think this perspective is interesting.

It seems the author is using an approach towards network security similar to, say, industrial safety or terrorist attacks: I think everyone at here is familiar with the criticism from cryptographers like Bruce Schneier on terrorist attacks: locking down the streets or putting armed forces and increasingly ridiculous lists of banned goods at airports is mainly a security theater. If a terrorist decided to destroy something, literally everything, from a bus, a market, a train station, an airplane or a park, etc, can be a target. Imagining a movie plot of terrorists attacking a particular target, and putting that target under a ton of superficial security measures is not meaningful for security in the real world.

It seems the author thinks most online attacks work in a similar way.

I think it's an interesting, debatable perspective.

What do you think about it?

Totalitarian states manipulating the political processes of democratic states for their own gain is a giant digital catastrophe.

This is not revolutionary, it's just not an idea that's been applied on a widespread basis in the cybersecurity realm until fairly recently.

Equifax?

"All along, the constant refrain has been that we need to take security seriously, and engineer our systems from the ground up to be truly secure." The author argues that attention to network security will be and has been growing as proportionally needed. The author compares to cars killing large numbers of people and Hurricane Maria. These are the types of tradeoffs that society has made in the past and continues to make in other areas as well, and if you rank them in terms of the negative aspects it is easy to argue that network security issues are well down the list. The paper does not directly discuss the issue of targeted harassement on the internet and how the various online and offline systems have not really adjusted to this yet (some people saying "crisis" are arguing for such changes, although they might not be the particular people saying "crisis" discussed here). I would argue that a major and general failing of capitialism is that many value jugements end up being made by economically self interested parties rather than society as a whole and that pushing against this tendency wherever it appears is not a bad thing.

"The critics of the standard “business as usual” approach have been presenting to the public both a promise and a threat. The promise was that with enough resources and control over system development, truly secure information technologies systems would be built. The threat was that a gigantic disaster, a “digital Pearl Harbor,” would occur otherwise." I don't see this argument much so maybe I am missing the context of the paper. I do see things like "connecting power plant control systems to the internet could cause big problems", however my sense is that the author would also argue against doing that. The main arguments I see are around individually smaller scale issues (and sometimes the possibility that they will happen many times).

The author doesn't really cover the issue of needed physical proximity, which is much lower on the internet and can make it easy to cross legal boundries and avoid many potential physical consequences. It isn't a pure difference since people can and do pay people in other parts of the world to conduct physical attacks, however it is still a difference and I think it somewhat undermines the argument that "through incremental steps, we have in effect learned to adopt techniques from the physical world to compensate for the deficiencies of cyberspace". Relatedly, falures of different systems can cascade more easily on the internet, although this can certainly also happen in other types of security (e.g. Kevin Mitnick style attacks seem communication system related rather than information network security). The author does touch this issue when discussing how slowing things down can be important for security but doesn't discuss how that is supposed to be implemented in a complex but not that secure world. It seems like there are some potential issues mostly due to wider communication networks and some due to networked information systems, but this isn't discussed. There is currently a lot of pressure for things done on the internet to happen quickly and awareness of the risks might help change that.

Setting priorities can involve both analysis of the tradeoffs and value judgements of what positive and negative options are preferrable. It is the value judgement aspect where I particularly disagree with the paper. While network security isn't a particularly large aspect of my overall value disagreement, I think attitudes toward network security can entrench particular tradeoffs even when those making the value judgements have interests at odd with society in general. Additionally, to the extent that exposure to the internet is becoming required in many contexts (in the US at least) and IoT exposes more of physical reality to internet control, information security issues can make it impossible to make good choices even if well informed and increase the number of uninformed people subject to direct attack from almost anywhere in the world (again, this is not only an issue with information security). Similarly, to the extent that lack of privacy can improve security in some ways, those who are interested in privacy should and do argue for stronger information security in other ways.

The costs and benefits of current global systems (in general, not just information systems) are unevenly distributed and the overall arguement seems made to appeal to those who get more of the benefits and fewer of the costs. One good short argument (not information security related) about this general situation is:

https://www.theguardian.com/global-development-professionals...

So I agree that information security is in many ways in better shape than other types of security and basic social tradeoffs, but I don't think this means it is in good shape on an absolute scale or that society as a whole, particularly on a global scale, has actually agreed to those changes. I think most people saying "crisis" are arguing for different value judgements and often do so in other areas as well as network security. The internet is a more recent development than many other issues and hasn't been as strongly integrated into society yet, another reason for greater attention.

I'll end with my favorite quote from the paper:

"We do not know how to build secure systems of substantial complexity. But we can build very secure systems of limited functionality. Those can be deployed for specialized purposes, such as monitoring large systems for signs of penetrations or corruptions, or ensuring integrity of backups."