Newton's Law

As "quantum dawn 2" concluded with little to no fanfare yesterday the thought of Newton's law came to mind, "For every action there is an equal an opposite reaction". We will never know what effort was exerted in the exercise or the methods used. We will not be informed of the security weaknesses found or the success and failures in defensive measures used. There will not be news reports exposing flaws in the communication sharing and information links that limited

response times and broke coordination controls.

Obviously, the fact that the results of the cyberattack simulation are not made public is good news and, additionally, this type of proactive security risk assessment is vital to combating cyberattacks. The only way to gauge the success of these types of tests for the average 
internet user is through what they experience by using the internet and by reports of what other users are experiencing, whether that user is a person, business, institution, or any other internet presence.

Good but not good enough

Quantum dawn 2 was the follow-up to the first quantum dawn test in 2011.  The tests primary concern was our financial infrastructure but it also gathers information that can be used in setting up defensive measures and procedures across critical internet targets. Banks see millions of attempted hacking attacks monthly and, for the most part, have successfully implemented measures to prevent major intrusions that would result in catastrophic take downs and infiltration of internet connected bank sites.

By observing Newton's law we can conclude that the efforts of the quantum dawn tests and the other security risk assessments undertaken across internet connected sites have been significant but have not yet matched the effort of the attackers.

Recently, Cyber-criminals targeted Nasdaq OMX Group's community forum website and gained access to the email usernames and passwords of the members of the site, which took two days to come back online. These types of reports are all too common place and one cannot help but have the feeling, building up with every victory the cyberattackers make, of an approaching internet born catastrophe.

The best defense is a good offense

A while back I wrote an article, Fighting DDoS with Virtualization, that briefly touched on an idea which would require the software of someone connecting to a site be able to negotiate that connection in a manner that would exclude zombie type connections, which are a vast majority of DDoS attacks.  Ideas like this and others need to be explored in order to get the upper hand the war against cyberattacks.

Another practical approach is the "follow the money" approach. Who is gaining the most from cyberattacks? Discovering the motivations and benefits of cybeattacks will lead to the monetary, religious, personal, and national, gains made by this activity and help in stopping it at its core. Investigating security assessment, virus, or other major computer security companies, may uncover duplicitous activities.

At some point we need to move from a defensive stance to an offensive one and start to stem the growth of cyberattacks.

by Jim Atkins 'thedosmann'

Memphis Web Programming