U.S. to work with Big Tech, finance sector on new cybersecurity guidelines

The year is 2027. Power grids still go dark for ransom, but at least the internet has been turned back into TV. If you know how to use Linux, you might be able to pick up a fourth podcast!

> megabanks are offline for weeks at a time

Yeah not going to happen. Might happen to government, but not banks.

Banks are incentivized by profit, and being offline pose extreme risk to profit. Government are just mostly self promoting bureaucracy until something goes really wrong, and then it's still the same bureaucracy.

Sounds pretty bullish for decentralized systems

For many years retail stores didn't care about stolen credit card information being used to buy gift cards. The banking sector ate those fraud losses. Once the payment card oligopoly shifted the liability onto merchants, retailers had to eat way more fraud. Retailers immediately took down gift card displays, rushed to upgrade to chip terminals, and when they put the displays back they stopped selling $500 cards.

login.gov would be great for this, with the obvious caveat being that it ties a persistent user identifier to sites you login with.

Maybe there could be two login flows - one that generates a unique pseudo-identity for each service, and another that actually beams over your PII for identity verification purposes.

I think a regular national ID was attempted under the Obama administration but failed due to pushback, if I'm remembering correctly. The closest we got was Real ID, passed in 2005, which is barely being implemented fully now, over 15 years later.

It makes me wonder how long it would take a true national ID system with digital verification, maybe something similar to Estonia's, to take to actually implement. It would have to be something not left to each state to handle, or it'd suffer the length and per-state disparities of Real ID.

>* Send a surgical strike into a country that aside from having the presence of the bad actor had nothing to do with it?*

Here's the plan: invade Afganistan, and eventually find the guy years later in a compound in Pakistan.

This will be an unpopular opinion, but I would require all allied countries to enforce bcp38/rfc2827 to prevent spoofing. Any country not adopting this would be null routed by all other countries. When a country does not police it's own traffic to make a serious effort to stop known criminal entities, all other countries would null route or remove BGP advertising the IP space of that country until they got their act together. This would create some financial incentive to take out the trash. The null routes or filtered BGP advertisements would be temporary unless a country repeatedly violates policy. This puts the onus on each country to take crime seriously in their own jurisdictions. Side stepping the blocks would result in sanctions as a starting point. I do realize and acknowledge this could potentially lead to privacy issues, as countries would have to enforce identity to at least get internet transport level access. There is also the matter of corruption.

Within a country, the same methods would be enforced. If for example, T-Mobile allowed unfettered abuse of its pre-paid wireless cards as they do then the countries they reside in would de-list them from BGP advertisements. The government would have legal immunity in doing so. Or if AWS, DigitalOcean, Linode, OVH, etc... allowed people to abuse their VM's, same deal. De-listing might start with a region then become global depending on the level of abuse and how seriously the company responds and takes action to take out the trash.

In my humble opinion, anything short of this would just be meaningless political posturing and the problems would continue to grow and escalate.

> Send a surgical strike into a country that aside from having the presence of the bad actor had nothing to do with it?

Work with law enforcement agencies in those countries to apprehend the person. If the country won't cooperate or shields the attackers, then sure, a drone strike could work.

Well, yes and no. You can have liability on inputs or liability on outputs. For restaurants, liability on outputs would mean a restaurant being liable for any food poisoning that occurs within X hours of eating there. But, human health has many confounding factors, so the inputs are easier to measure and to impose liability on.

For computer security, I'd want to see liability on results, and not just on the methods and the checklists. If a company has a data breach, then that's something for which they can be held liable. That might mean that it becomes much more expensive to maintain large databases on users, which would be a good change.

I think HIPAA is a good example, especially the somewhat infectious nature of business agreements. There are serious penalties with leaks, and the BAs leave everyone liable (and very, very cautious). I do think the teeth of the law make a lot of HIPAA leaks go unreported. I imagine the almost crippling financial and reputational impact gets weighed heavily against the cost of getting caught.

The great thing about insurance is that we don't just get to create baselines our policyholders must adhere to, we also get to enforce them. A perfect example of this is anyone that has a policy with us must have RDP behind VPN/ whitelisted only to specific IPs. I spent years trying for free to convince orgs to do this and was ignored, here we convince all our policyholders to do it and everyday more and more companies as we onboard them.

For backups, not only do they need to have it, they need to be tested, kept offline and encrypted - this doesnt apply to all its split by revenue bands/industry/mix of other logic.

IoT devices - they get notified in Control if we find any on the internet and told to not have them directly exposed

Hey

Yes the group will continue to meet and I believe more will come out overtime as we start to better define how we as private entities can help the gov.

Ransomware and attacks on critical infra were the big ones - Joshua our CEO wrote a bit about it here https://www.coalitioninc.com/blog/coalition-meets-with-presi...

- our baseline is internal. We are with our customers end to end. From selling the policy to scanning them, notifying them and we have our own incident response team which means that we learn a lot with every claim. So when we add a vulnerability in critical state in Control you can assume it came from learnings of losses combined with our cybersecurity expertise.

In the 1980s we used to be able to buy "shareware" floppy disks for $3 at user group meetings. These things had all sorts of cool stuff on them. We didn't have to worry about our computers being permanently damaged, because back then, unlike now, our operating systems were on write protected, easily copied floppy disks. Our hardware wasn't smart enough to house any trojan horses, so you knew it wasn't at risk.

We had computer security. Not because MS-DOS was such an amazing piece of code, but rather the hardware was simple enough that you couldn't hide a trojan in it.

The job of an operating system is to protect the hardware, and allow the user(s) of a system to use the resources without risk. NONE of the current crop of operating systems we use 40 years later is suitable for the job, not Linux, Windows, MacOS, iOS, Android, the cloud.

Now that even the cheapest persistent storage is likely to have multiple levels of firmware, it's up to the operating systems to virtualize the hardware, and keep applications from directly touching it. NONE of our current crop of systems do that.

All this "cybersecurity" spending is just a grift if it doesn't deliver actual computer security.