Yesterday, WIRED's Noah Shachtman reported that US Strategic Command--which oversees the armed forces' computer networks--is about to ban the entire military's access to social networking Web sites.
As someone who has spent the last few years telling the national security community to acquaint themselves with such tools, this is really frustrating.
A while back, I wrote here about the government's inability to hire cyber security experts. For those interested in this topic, the Partnership for Public Service just published a report on the government's progress on this front. In short: not well.
Here's the full report (PDF).
The United States was under attack over the July 4th holiday weekend. Didn't notice? That's because it was a cyber attack. According to reports, distributed denial-of-service attacks were launched against dozens of major American websites, including those of the White House, State Department, Nasdaq, New York Stock Exchange, Washington Post, Federal Trade Commission, Secret Service, Department of Transportation, and the Washington Post. More than a dozen high-profile South Korean websites were also targeted, and intelligence officials in that country are blaming North Korea for the DDOS offensive, which was said to have called into action more than 20,000 zombie computer in and out of South Korea. DDOS attacks are death by a thousand cuts; in bulk, repeated attempts to connect to a site block legitimate efforts to reach it. The White House is staying more or less mum on whether it was indeed a target. But the event is no doubt prompting some deserved Maalox moments in cyber security circles.
A massive computer takedown like the one being reported could be damaging to government and industry if it goes on for very long. And what's particularly troubling about this weekend's events is that the effects of the attacks seem to have persisted for at least three days. Big-name sites like WhiteHouse.gov are hosted on a plethora of redundant servers sprinkled all over the globe for just this reason, and the White House's limited response to the event has been to say 'We get slammed by cyber malice all the time. Just another day in the White House.' But lesser sites like the Department of Transportation's were indeed knocked out of service.
President Obama unveiled a revamped cyber security plan at the very end of May, but the U.S. is still awaiting the appointment of a cyber security chief.
Related coverage: AP, New York Times, and Washington Post.
Following yesterday's announcement about the Obama Administration's cyber security plans, Douglas Rushkoff has responded by expounding on his own idea (which I've mentioned here before) for a public-based distributed defense network. He writes in the Daily Beast,
the appointment of a czar to manage yet another highly centralized, top-down extension of the administration only betrays our chronic, almost constitutional inability to engage in distributed warfare by distributed means...Because of the 'Net's decentralized nature, cyberwarfare is less like an artillery battle than it is like hand-to-hand combat. We are all on the frontlines; each of our computers the potential weak spot in the network.
A few weeks ago, I wrote about the Pentagon's plan to hire more cyber security experts, and voiced skepticism that the most talented people would go to work for the government: such people love their independence, and would much rather continue working from their basements than from a cubicle. Plus, in order to become an expert, you sometimes must do things (ie, commit computer crimes) that disqualify you from the job.
According to Forbes, the White House will announce this week a new program that seeks out budding hackers at an early age, in order to hone their skills and draw them to government service:
"For $10 million, you can have your ship data back."
Now this is interesting. With both sea piracy and cyber security in the news lately, someone had an idea: combine the two. Last week, someone broke into a Virginia Web site that lets pharmacists track prescription drug abuse. But instead of just breaking in and stealing data, they are holding it hostage:
Rod Beckstrom, director of the Department of Homeland Security's National Cyber Security Center, resigned on Friday. He'd held the position for just under a year.
A few weeks ago, I posted here an excerpt from an upcoming book on coming national security threats. My own chapter deals with the place of IT in confronting those threats. The book--Threats In the Age of Obama (Amazon)--is now out.
In addition to my own, there is one other tech-related chapter from Bob Gourley, former CTO of the Defense Intelligence Agency. I recently mentioned on this site how cyber security gets little attention from both the cyber people and the security people. In his chapter, Bob explains why we need to spend more time on this issue: