Impact of Sony Pictures hack on the future of security

hmmm wrote: »

Despite all our technologies and policies and mailing lists and patches and protocols and encryption and whatever, most security people will tell you that the world is full of security holes, and the situation is only getting worse. Not only do security teams have problems inside their own networks, they also have to deal with the increasing proliferation of "cloud" services that are largely uncontrollable, most of which have absolutely terrible security.

We won't fix security the way we are going because most company management & Boards see security as something that's important but nothing too critical - I've long thought that it would take something major to make us change direction.

Is the Sony hack that "something major"? Sony Pictures is a multi billion dollar company and it will struggle to survive. This hack isn't an inconvenience or an embarrassment like all the others we've seen, it's a material event that has the potential to end the company.

I can't see the US standing by and letting their companies be wiped out by what is more than likely a cyber-war attack from a country they consider an adversary. I also can't see the US allowing companies to continue on the way they have been to date, with each company having a small group of well intentioned and dedicated security staff being overwhelmed by outsiders with greater resources. Something will have to change, and the change I foresee is an effective forced withdrawal inside a perimeter that is patrolled by resources provided by a government.

Until it hits hard at home nobody will take it as "critical". Data Protection isn't taken seriously in the majority of cases.

The impact on Sony won't change the minds of management over here. "Why would anyone want our data anyway?" Is always the question asked. Simply put, a company could potentially hold very confidential info that ends up on pastebin. Or face blackmail and forced to pay up. Or computer systems disrupted business and loss of profits. It's very real, they just don't see it.

I'd hope not to see a perimeter walled by resources provided by a Government. They do that in China- It's called the great "firewall"of China and you can see how well that worked. There will never be a perfect solution, but people need to take responsibility and I wouldn't rely on the Govt to take care of it. They can barely keep roads in good condition, let alone protect our internet activity. There is also the issue of what happens our data when it's transmitted over the internet. What is done with it? It gives them more power for censorship etc.

Furthermore, the only way to do it would be through individual ISPs as there are several undersea cables connecting Ireland to the rest of the world and the Govt don't control the ISPs network. ISPs have so much data passing that they just can't sift through it all. It's very difficult also due to emerging technologies like Tor etc. and increasing encryption on data transmission to do this. You can of course see patterns, but they can only tell so much.

It's certainly a scary world out there and worse to come most definitely.