The EMEA director for Venafi says there's no point in throwing money at this problem and instead systematic change is needed
In spite of all the talk about tougher controls, entering the UK has never been easier. In the past month I have twice passed through immigration without showing a passport. I just simply gave the immigration officer a laminated ID card that I tend to use whenever I'm out and about which has a few words written in a certain foreign language. Let me point out, I do however, always have as backup my passport, just in case my ID card fails; it's just being in the IT security industry, I'm intrigued to see if it's accepted.
What may you ask does this have to do with cyber-terrorism? Simple – you don't solve a problem by just throwing money at it unless you really understand what the problem is. For example, how much has been spent on implementing biometric passports? I'm sure they're good things but if you don't even have to produce it then what's the point? My biometric passport didn't fail; it was the process that failed.
So in my opinion the issue is not so much about whether or not the government is spending enough on cyber-terrorism but is the money being spent effectively. Every time a new initiative is suggested, industry analysts and vendors rush to endorse the proposals, especially when they realise that this is going to mean easy selling of technology to the public sector. The IT industry is no different to any other.
For example I'm sure that tyre manufacturers would rush to endorse the enforcement of using winter tyres as a means to "improve road safety and save lives". Speed camera manufacturers are always going to endorse more speed cameras as a means to "improve road safety and save lives", and likewise IT companies are going to endorse tighter security as a means to tackle cyber-terrorism and protect key infrastructure and defense assets. After all every one of us heads of to work in the morning wondering what we can do to help the national interest.
Some time ago NIST (National Institute of Standards & Technology) issued the advisory that 1024-bit RSA keys will no longer be viable after 2010 and the recommendation, which has been broadly adopted, is to move to 2048-bit keys. But the question is whether doubling key sizes from 1024 to 2048 means that we are more secure. Now of course the industry absolutely endorses this recommendation. And the fact that doubling of the key size from 1024-bit to 2048-bit increases processing power requirements by anything up to eight times has nothing to do with this.
Am I being cynical – maybe, but the bottom line is that vendors are going to see a massive increase in sales of hardware without having to do anything other than wave a NIST recommendation in front of their clients; and since we all live in fear of being caught without proper "insurance", we'll rush out and do exactly that.
In May of this year an inter-governmental summit met to discuss the issues of cyber-terrorism. Some of the key speakers stated that cyber attacks were growing in intensity and sophistication. Concerns were raised about the vulnerability of systems and that potential attackers are gaining more skills. The director-general of the French network and information security agency, said he had nightmares about attacks on the electricity system, transport, water supplies, the financial sector and hospitals, which are dependent on computers.
But the problem is not solved by just beefing up encryption algorithms. Today my car has everything I could imagine to protect me, from anti theft systems, anti-locking brakes, you name it. But at the end of the day all this technology is not going to protect me or the pedestrian who is crossing the road while I'm pre-occupied answering emails on my mobile while driving. You don't address cyber-terrorism simply by technology. People and processes are the weak link.
Over the past few years what has become increasingly apparent when I talk to organisations is that in spite of all the technology thrown at systems to try to improve security, ultimately the failure to manage this which is still by and large a manual affair leads to potentially disastrous errors."
There is a breakdown in the chain of command. There is an over reliance on manual processes to manage encryption and security assets.
There are no effective systems in place to track where security assets such as certificates and keys are, what are their active lifetimes, how they were generated, who issued them, who approved them, who is responsible for them, etc. I recently talked with an organisation that had a security failure because the individual responsible for the system had left the organisation and no one had assumed control of what he was doing.
In other words it's not just about technology it's about management of the technology. According to a recent article in CSO magazine "the two most terrifying words to those involved in encryption are key management. Effective key management is as important as protecting the data itself".
So how does a typical organization secure and manage encryption assets – the keys required to encrypt data in transit? How are the keys protected against loss, misuse or theft? These become especially important questions given that, according to research firm Gartner, the majority of data breaches are executed from inside organisations. In most cases, these assets are not being protected.
These assets are, in essence, the keys to the UK. With them, an insider with privileged access can, working alone or with an outside hacker, gain access to the protected data and as long as this is not addressed then no one should sleep well at night.
So is the answer to my avoidance of having show my passport to improve the biometric key, or is it to improve the management process? Maybe the risk of cyber-terrorism could be significantly reduced with a smaller budget spent more effectively.
