Friday, August 8, 2014

Two and two is four... by the moment

"Freedom is the freedom to say that two plus two make four," says a desperate Winston in one of the most famous 'dystopias' of literature: '1984' by George Orwell. Nobody in his right mind would deny that two and two make four, right? And it would even sound like a joke that it was a law intended to change it, right?

A few years ago, it was just as ridiculous the thought of Western and democratic states developing malware and exploiting system backdoors. Maybe in science fiction... Mikko Hypponen, chief research officer at F-Secure, has expressed that with a combination of indignation and complaint: "The idea of a democratic western government backdooring systems to spy on another democratic government? But that is where we are." These are words from the Black Hat 2014 conference, which has just finished in Las Vegas, occupying the covers of all technological media and even some more generic.

Almost all popular computer security people have visit Black Hat this week. This is also the case of the "guru" Bruce Schneier who has formulated the trends regarding incident response, and proposed a four-step model: observe, in real time and with proper tools; context, a task that can not be done without analytics; decide, not only what but who; and finally, act. An approach that can evoke us to some classic professional environments such as Deming Circle (Plan, Do, Check, Act - PDCA), but that it is not always appropriately translatable to situations such as a computer emergency.

Dan Geer, security officer of In-Q-Tel, is not as well-known as Mr. Schneier, but a remarkable professional anyway. He is also "responsible" of one of the most notorious headlines of the conference about the routers of most homes and small businesses. In his point of view, they are very clear and present danger because it is possible to build a botnet with them using the proper techniques and such event could "shut down the Internet." And when Ars Technica asks him whether this matter should be treated with the same priority as if it were a critical infrastructure, Geer clearly answer, "yes, it should."

Beyond the routers, in the bowels of the computer centers that allow them to understand each other, we find the "hypervisor" or virtual machine monitors, which have accompanied us since the early 70s. An expert from Bromium, Rafal Wojtzuck, has also urged for more and better awareness of the risks that they involved at the Black Hat. “Serious hypervisor vulnerabilities are relatively rare, but they do exist." Better safe than sorry.
The Black Hat, far from being a fair for security freaks, hacker, or geeks, is basically a business meeting. It is security business per se, the sector that demands more and more professionals, as we have told you here in countless times. Expert Maurice Uenuma addressed in TripWire the growing needs of specialization and professionalization of the industry since, in his opinion, it exists a gap between what is demanded and what the market offers.

Anyway, it seems clear that the security industry will continue to pull while someone is able to infect half a million devices in six hours. It was achieved by some Chinese cyber criminals who took advantage of the Chinese Valentine's Day (August 2) and passionately spread a SMS worm across 500,000 Android devices.

Do find ridiculous that two plus two can not be four? Well imagine if someone told George Orwell in 1949 (the edition year of ‘1984’), what we actually see here everyday. If you do not want security to catch you out of place, shared, disseminated, rate, comment. We wait for you every day - weekends included - here and on our social networks. Find the links, as always, at the sidebar.


Post a Comment