How do we adapt to the insecure internet?

The past year “presented” us with the largest DDoS attacks in history and an unprecedented amount of leaks of various user passwords and bank card numbers. Despite the hundreds of millions of dollars spent on cybersecurity around the world, the quantity and "quality" of stolen data and organized attacks continues to grow. And it is quite obvious that so far there is no solution that would help to guarantee the security situation in the network. The situation is aggravated by the fact that the world economy every year becomes more and more dependent on the Internet and computer networks. And we need to somehow adapt to the new conditions. Moreover, the steps taken are unlikely to be, let's say, popular.

Convenience in exchange for safety

By itself, the Internet and computer networks are an incredibly useful tool, technology that allows you to keep in touch and instantly exchange digital information with the whole world. Alas, the Internet is no less convenient for attackers to use, which makes it as dangerous as it is useful. As a result, today many companies and entire countries are forced to turn their own networks into peculiar fortresses, and in general face a rather difficult and unpleasant choice. As a vivid analogy, this can be compared with such a dilemma: should cars be banned if they are sometimes broken down in accidents and robbed by banks?

For example, the US National Security Agency (NSA) introduced a rule according to which two different people must enter their passwords to download a file. Just imagine how inconvenient it is: in order for you to download something, you need to ask someone else to enter your password with you. This measure was intended to prevent the emergence of future incidents a la Edward Snowden, who one person downloaded about 1.7 million documents related to the activities of intelligence services in many countries. Now the NSA will not pass such a focus, but for this it was necessary to pay a significant inconvenience for all employees who have to download some documents for work. This was the price of cyber security.
')
One gigantic problem is also the control and protection of the astronomical number of chips contained in many devices, from servers to smartphones. According to rough estimates, as part of various microcircuits in the world, about 8 trillion transistors are produced every second . In recent years, many companies have moved from mainframes to personal computers and mobile systems. Cloud services and the Internet of things are booming. As a result, a huge number of potential cyber threats now pervade the computer networks of the financial and industrial sector, not to mention others.

My network is my castle

How to ensure security in this electronic universe? One solution is an isolation policy, where individual networks and computers have no connection to the Internet. This method of protection is used in some organizations and companies working with VERY important and secret data, but it is quite obvious that this is not for everyone.

Another option for enhancing cybersecurity is the introduction of analog components and intermediary people into the systems. For example, in order to allow sending some kind of data packet further on the network, or to confirm some other operation. Roughly speaking, the control and controlling elements in the form of living operators need to be “embedded” into the network. But this approach is also appropriate only in a few cases. An example of implementation is the military systems, in which the command to launch a ballistic missile sent over the network from the command post must be confirmed by a human operator.

The more complex the system, the more possibilities it has itself and its components, the more potential vulnerabilities it contains. From this postulate the idea grew, according to which it is possible to increase the security of computer networks by rejecting a number of functions and capabilities. Thus, the spectrum of possible threats is simply reduced. For example, you can install workstations in your company that have no USB ports at all. Also, as a measure to prevent leaks, you can store information in anonymous databases, jointly managed by groups of companies and government agencies.

Virtual physical threats

In addition to the financial and private sector, cyber attacks can cause enormous harm of a completely different kind. We are talking about the deliberate decommissioning of networks and systems of critical industrial facilities and transport systems. And this is fraught not with password leaks and stolen money, but with catastrophes and major accidents. That is, the consequences of such virtual attacks are manifested in the very physical form.

We all know about the attack of Stuxnet on Iranian uranium enrichment centrifuges, which remained undetected for about three years. Alas, all means are good in the struggle for world domination, and therefore "under the gun" are nuclear power plants, chemical enterprises, control systems of air and rail transport, large hydroelectric power plants, etc. And even if it sounds a bit strange, one of the ways to protect all these objects is to sign the relevant non-aggression treaties between different countries. An example of such an approach is the treaty on the elimination of medium and short-range missiles, signed in 1987 between the USSR and the USA, which is still in force. This method of ensuring cyber security will be effective for the simple reason that breach of a contract by one of the parties will entail similar actions against it. Attacking such important objects is a double-edged sword.

Virtual physical attacks are becoming more accessible. Computer networks are taking over unite more and more devices, machines and systems that previously had no relation to IT. The Internet of Things is rapidly engaging cars, industrial equipment and home appliances. So, be sure that the day when you become afraid that hackers would not break into your home appliances and do not cause real troubles, or disable your car while driving, or ... well, a lot of things we will start to fear, are not far off. After all, now the majority of devices that are not connected to the network have vulnerabilities that no one is aware of yet. Therefore, the Internet of Things promises to be a real Pandora's box in terms of cyber security.

Human factor

This is another single big problem. Alas, in most cases, the attackers are lucky because of the negligence or illiteracy of employees of the organization who came under attack, as well as users who have fallen victim to the next Trojan or virus. It would seem that the 21st century is long gone, and for many people, computer literacy remains something boring and optional. And here it is unlikely to offer miraculous schemes and solutions. Only systematic and persistent training and a reminder of basic cybersecurity rules. Many security experts overlook this and overly rely on all sorts of hardware and software solutions. This is probably a peculiar occupational disease - an excessive belief in technical methods of solving a problem. However, in each particular case, it is also necessary to pay special attention to people who are most likely to become the gap through which penetration will be made.