Steve Goodbarn

Safer Cyberspace = Safer World

And also a more prosperous world

President Obama addressed Cyber Security last week, announcing that the soon to be appointed cyber czar will sit on both the National Security Council and the National Economic Council. Membership on both boards highlights the relationship between security and prosperity. They go hand in hand.

A more secure Internet will bring an economic boost and, like the iPhone, spawn new businesses that are only dreamed of today.

But if our approach is the same as it has been in the past this effort will fail and we will end up with yet more regulation, cost, litigation and frustration from trying to manage the plethora of anti-virus, anti-SPAM, and anti-spyware applications and constant patching of architectures that can never be made secure by their very design.

As many have reported, there is a lot of money being thrown at cyber security. But without authentication, which costs very little to implement, we will never have real security. Only DNSSEC, which is ready to go, can provide the needed authentication. Lets get the root signed and DNSSEC implemented.

IPv6 - Who cares?

You should care if you are reading this blog.

Web Host Industry Review reported yesterday that RIPE has launched a site, IPv6 Act Now to promote usage of Internet Protocol version 6, or IPv6.

The overall reason for IPv6 is that we are running out of Internet addresses in the old protocol, IPv4, which maxes out at 4 billion addresses. Without a change to the new protocol we will run out of IP addresses by 2010 or 2011, less than 2 years time. There are already shortages in certain parts of the world that were unfortunate enough to be allocated few IPv4 address blocks.

Shortages create the potential of putting a value on IP addresses which could lead to markets and higher costs for everyone. A market for a number so you can plug into the Internet without providing any service is ridiculous.

IPv6 has a virtually unlimited number of addresses (2¹²⁸, for comparison there are 10⁸⁰ number of atoms in the Universe). Its a bunch, so no need to worry about running out of IP addresses forever.

There are also very positive effects for security and traffic routing (speeding things up) with IPv6 as explained on the IPv6 Act Now.org site.

Like any change in infrastructure there are a lot of laggards who are not ready for this change, but for the most part this should be transparent to Internet users. Nevertheless it is worth asking your service provider or network administrator where they stand on IPv6 readiness.

Google Web Sites Defaced Through DNS

InfoWorld reported that traffic to Google web sites in Africa has been redirected to defaced web sites. See: "Google blames DNS insecurity for Web site defacements".

This incident is a good illustration of the dependency on the DNS for Internet security. You are only secure as your weakest link: No matter how secure Google's infrastructure may be, and no matter how secure your PC or your corporate network may be you are not secure today because the DNS is not secure.

If you are redirected by the DNS you have no way of stopping it and probably no way or knowing it for sure. This can be fixed by deploying DNSSEC, as I have written about in earlier postings.

These attacks also point out how inadequate Internet security is in much of the world. Lower costs are essential in underdeveloped countries. A signed root, DNSSEC, and improved security would go a long way to keeping those costs down, but we probably need a sponsor to get this started.

RIPE and ICANN are dedicated to keeping the internet stable and they have discussed projects that could go a long way to addressing this problem, but they would be greatly helped by support from industry and/or government. 

Maybe Google and other major players and some local and worldwide government assistance could jointly attack this problem. We are not talking about a lot of money here and the benefits would be huge.

Software patches require diligence

This week I was unable to search on-line on 3 separate occasions. And yesterday I had trouble with Google's "slowdown" which prevented me from reaching some sites and had me running anti-virus because I thought the problem was on my laptop.

I also had a gigantic security patch from Apple (see Monster OSX Update) and one from Adobe (see Adobe Updates Acrobat to Fix Critical Vulnerability) on top of the big patches from Microsoft in April and a critical PowerPoint patch this week.

Security patches are becoming a constant occurrence for Internet users and each patch opens new holes that the hackers have foreseen and are exploiting, as noted by John Fontana: Microsoft's Patch Tuesday filled with zero-day exploits.  It is almost unmanageable.

If you poke around the Microsoft update sites or similar sites for Cisco, Adobe, Symantec or Apple you find an endless list of updates (note that you have to scroll down and possibly click through additional links to fully appreciate the magnitude of these lists).

So as a PC or Mac user you should make sure your live software updates are working. The Conficker virus (see my previous posts), among others, disables these updates. It's not foolproof and will not protect you from a Zero Day Threat, but failure to be diligent can get you into a lot of trouble.

Until customers demand DNSSEC we will continue to live with these threats.

I can see you naked

- and so can everyone else.

The surprising report in the San Jose Mercury News "Conficker worm found in hospital equipment" that found the conficker worm on 300 MRI machines and "similar devices" at hospitals set off some alarm bells for me.

This is a computer virus or worm on a medical device, not a PC. Could medical images be made public through this exploit? Are all of these hospitals in violation of HIPPA privacy rules? What sort of data could have been compromised? How does an MRI machine get connected to the web? Could this also be on cell phones, gathering information, including pictures of us?

This illustrates how risky and indeed futile it is to put medical records on-line using current technology. Imagine images, pictures and other data of an individual having a hysterectomy, vasectomy, or hemorrhoid surgery being displayed on the Internet. The fear that privacy could be compromised is the last thing someone should have when they are suffering a medical problem. We must be absolutely certain that cannot happen.

We don't think of a medical device as a computer but anything with an IP address (including a printer) can be connected to the Internet. And anything with an IP address also depends upon the currently insecure DNS.

Unless we make the DNS secure, we will continue to be plagued by these security breaches.