Greg Oslan | The new war machine

How close are we to cyberwarfare? Pretty close, said Greg Oslan, chief executive officer and president at Narus, a provider of traffic analysis software for carrier networks. The company helps large IP networks see, analyze and manage traffic from a growing number of dynamic applications. Knowing what traffic is on a network and understanding it is essential to providing adequate security because security cannot be achieved today at the endpoint, he said. Not surprisingly, Oslan has a front-row view of malicious traffic passing through the Internet and efforts to ward off full-scale warfare via the network. This is my opinion only, but I think that what would constitute an act of war over the Internet would be something that maliciously, directly cripples a country's ability to function. If somebody brought down our electrical infrastructure and crippled our economy, I think that would be an act of war. How we could treat that, government to government, is a policy question. You are not using guns and bullets anymore. What is the appropriate response as your armies move from physical entities to virtual entities? It was the volume and coordination of the attacks that distinguished them. It wasn't just one computer or one Web site that was targeted; this was spread across the entire country from the libraries to government institutions.We have information in this country of other countries trying to gain access to our machines. It's kind of a new Cold War. In the 1950s and '60s, [the Soviets] would send fighters into the Alaskan airspace and see how fast we'd respond ' and of course, we'd do the same. The same thing is now occurring on the Internet. One country says, 'How many different sites can I break into in the U.S.?' And then the United States responds, and they want to know how quickly we fill those holes. The bigger global issue is [that information technology] as a service medium rather than as a transport medium is in its infancy so far as being understood on a global scale. People are protecting their small pieces, but there are no stand-alone pieces. They are all connected to everything else in the world. Having a firewall is not good enough, or having an intrusion-detection system is not good enough. Having both is not good enough. Systems that manage and protect on a more holistic scale are what are going to be required. There are just too many holes. There are so many institutions that people have already penetrated. The [Navy] War College Web site was down for two or three weeks, and that was pretty embarrassing because they are the ones who are being taught to protect against cybercrime. It's a safe assumption that we're pretty much all in the same boat, and our infrastructure is absolutely susceptible. There is debate over how big of a threat that is. There is no question there are isolated threats, and there are component systems that could be penetrated and brought down. But there is no one who believes they could bring down the entire electrical infrastructure or gain access to nuclear power plants. Whether that is true or not, I don't know. This is a huge problem and one that is not well understood. Some 70 percent of the world's Internet traffic now flows through the United States. That's going to change over the next several years. Other foreign countries are not comfortable with all of that traffic flowing through the United States, and you're going to see major distribution points being set up overseas ' and then it gets really complicated. This is going to give rise to a whole new thought process about protecting the borders. It is going to be a fine balance between the carrier's requirements to protect their own infrastructure because they need to make money and the government's involvement to provide security. When the telephone networks were originally set up by AT&T 100 years ago, the government clearly stated this is critical, this is how it is going to be used and protected. That doesn't exist on the Internet today. We are going to have to think differently. One of the proposals that came out of the [Group of Eight summit] was for a trusted entity, a kind of [United Nations] of the Internet, that is responsible for making sure that the traffic moving from one country to another is protected and can be trusted. It is never too late. I think that we have to acknowledge at a public level that it is a problem. Unfortunately, in most cases it requires a major event to galvanize people and get them to change. The Internet is a commercial means of making money and is also critical national infrastructure. It is hard to go to carriers that are not owned by the government and tell them to invest millions of dollars to protect it. It is an interesting challenge. We went through it with lawful intercept in the United States, when the carriers were mandated to provide to government the ability to tap IP traffic under a court order. There is not a huge motivation for the carriers to do this because they are not making any money off that service. We are going to have this same kind of discussion around security. To get this to happen quickly rather than over the next 40 years, I think it will have to be crippling. Another country brings down the stock market for five days: That would probably get everybody interested in making sure that never happens again. Bringing down air traffic control systems to major airports. Whether that is practical or not still is a question. But if it is connected to the Internet, it is technically possible regardless of how many protections you have in place. Far from easy, but technically possible. The more sophisticated we get and more pieces of equipment you put on the network, the more vulnerable you become. The more things you have to manage and the more endpoints, the more openings you have.