Internet risks will drive users offline, researcher predicts

A focus on securing legacy IT architectures rather than on developing secure technology has created an untrustworthy environment that eventually will drive users offline, said Purdue University professor Eugene Spafford.

“Most of what we are doing today isn’t working,” Spafford said. “We aren’t stepping back to see that overall, things are getting worse. We will reach a tipping point where we won’t do online business because it isn’t trustworthy enough. People move out of neighborhoods when they are not safe.”

Related content:

Purdue forges top cyber research center

Cybersecurity consortium tackles problems of the future

Spafford, a professor of computer science and founding director of Purdue’s Center for Education and Research in Information Assurance and Security (CERIAS), said security research is being stifled by the need to keep bloated, bug-filled systems operating, which diverts resources from the vital task of discovering and developing better ways to do hardware and software. He advocates a grass-roots, blue-sky solution that would move security controls to the local level and enable basic research.

“We need a better understanding of risk” and of the best ways to manage it, he said. “Government can’t direct it from Washington. The problem is too far down, embedded in too many homes and businesses.”

Cyber extension service

Spafford said he envisions a system that would do for computer users what the Agriculture Department’s Cooperative Extension System does for farmers. It would take advantage of national resources at the local level, with extension agents who could field questions and provide advice.

The unprecedented growth of the Internet has made it a victim of its own success, he said. Operating systems are still being built on top of 1960s code, and our basic security tools such as firewalls and antivirus are two decades old or more. There has been some improvement, “but it’s not where it should be.”

Finding and exploiting vulnerabilities can be done more quickly than fixing them or replacing buggy products, which puts security at a disadvantage. “We’re not going to win that kind of battle,” Spafford said.

Cloudy forecast

But redefining the battle is not easy, even at a world-class security research center. “As a field, we have become an arm of industry rather than of research,” he said. Companies want to protect their installed bases rather than fund basic research, and users want fixes yesterday. “There is no funding in any serious quantity to do the kind of research we would like to do. It is very difficult to take the next step because there are not resources available. We have to go where the funding goes.”

This is not to say that no worthwhile work is being done in security. But it will take a long while before substantial changes are made in the infrastructure we are relying on.

In the meantime, the average user has little access to meaningful help in navigating an increasingly hostile cyber environment. The National Institute of Standards and Technology is producing standards and guidance for cybersecurity in government systems, but although this work is useful in the private sector, it is too technical for most users. A system of cybersecurity extension agents, available in each community, could help to bridge the gap between wonks and geeks at one end of the spectrum and users at the other end who see technology as a tool to get something done.

“There could be some central organization and standards-setting,” Spafford said. “But it doesn’t have to be strictly hierarchical. You want to have a lot of local control” in bringing advice and information to individuals.

inside gcn

  • When cybersecurity capabilities are paid for, but untapped

Reader Comments

Fri, Oct 7, 2011 DL

RE: "have to use physical token..." RSA site was hacked, tokens were compromised a few monthes ago, keystroke loggers can capture PINS, etc.. then your VPN idea starts to fall apart. This requires serious thinking and a major padigm shift which is what Spafford is advocating.

Thu, Oct 6, 2011 Mark

Are you serious? "Abandon all hope the end is near for the Internet" is a little extreme. I would say the push to get the fixes in and up in a more timely manner will be there but I'm not giving up online shopping and going back to the stores for many of my items anytime soon. Oh, and forget not using online banking ...

Wed, Oct 5, 2011 Prof Andrew A. Adams Tokyo, Japan

The quantum leap between the ofline and the online world is automation. Bad guys can automate just as much as good guys can. The same benefits that Amazon brings with its recommendation service apply to crackers attempting to break into your Amazon account and copy your personal data. One of the problems wth bringing this automation to bear on behal of the good guys is that corporations are stuck in a gutenberg model of funding for software and stuck in a competitive environment. So, anti-virus companies, for example, compete for users and they do that by sharing virus signatures only with their paying users. This is exactly te kind of work that should be government-funded to provide a standaradised format universally-free service. We need more cooperation not more competition, more FLOSS and less proprietary software and above all we need to get software patents abandoned to ensure that the rapi development of better impleentations of existing protocols and adaptations into more secure protocols happens quickly.

Wed, Oct 5, 2011

If current internet gets too useless, somebody will set up another one. Secure tunnel to a portal, and from there to vendor sites. Think a commercial-grade FB run by ex-NSA types. You will have to pay to play, and probably have to use a physical tokem (civilian CAC) with PIN and maybe biometric, for access.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group