Internet risks will drive users offline, researcher predicts
Connecting state and local government leaders
A focus on securing legacy architectures instead of new technologies has created an untrustworthy environment, says Purdue professor Eugene Spafford.
A focus on securing legacy IT architectures rather than on developing secure technology has created an untrustworthy environment that eventually will drive users offline, said Purdue University professor Eugene Spafford.
“Most of what we are doing today isn’t working,” Spafford said. “We aren’t stepping back to see that overall, things are getting worse. We will reach a tipping point where we won’t do online business because it isn’t trustworthy enough. People move out of neighborhoods when they are not safe.”
Related content:
Purdue forges top cyber research center
Cybersecurity consortium tackles problems of the future
Spafford, a professor of computer science and founding director of Purdue’s Center for Education and Research in Information Assurance and Security (CERIAS), said security research is being stifled by the need to keep bloated, bug-filled systems operating, which diverts resources from the vital task of discovering and developing better ways to do hardware and software. He advocates a grass-roots, blue-sky solution that would move security controls to the local level and enable basic research.
“We need a better understanding of risk” and of the best ways to manage it, he said. “Government can’t direct it from Washington. The problem is too far down, embedded in too many homes and businesses.”
Cyber extension service
Spafford said he envisions a system that would do for computer users what the Agriculture Department’s Cooperative Extension System does for farmers. It would take advantage of national resources at the local level, with extension agents who could field questions and provide advice.
The unprecedented growth of the Internet has made it a victim of its own success, he said. Operating systems are still being built on top of 1960s code, and our basic security tools such as firewalls and antivirus are two decades old or more. There has been some improvement, “but it’s not where it should be.”
Finding and exploiting vulnerabilities can be done more quickly than fixing them or replacing buggy products, which puts security at a disadvantage. “We’re not going to win that kind of battle,” Spafford said.
Cloudy forecast
But redefining the battle is not easy, even at a world-class security research center. “As a field, we have become an arm of industry rather than of research,” he said. Companies want to protect their installed bases rather than fund basic research, and users want fixes yesterday. “There is no funding in any serious quantity to do the kind of research we would like to do. It is very difficult to take the next step because there are not resources available. We have to go where the funding goes.”
This is not to say that no worthwhile work is being done in security. But it will take a long while before substantial changes are made in the infrastructure we are relying on.
In the meantime, the average user has little access to meaningful help in navigating an increasingly hostile cyber environment. The National Institute of Standards and Technology is producing standards and guidance for cybersecurity in government systems, but although this work is useful in the private sector, it is too technical for most users. A system of cybersecurity extension agents, available in each community, could help to bridge the gap between wonks and geeks at one end of the spectrum and users at the other end who see technology as a tool to get something done.
“There could be some central organization and standards-setting,” Spafford said. “But it doesn’t have to be strictly hierarchical. You want to have a lot of local control” in bringing advice and information to individuals.