Obama Wants Big Hike In Cybersecurity Research
dcblogs writes "The White House 2012 budget seeks a 35% increase to $548 million in cybersecurity research and development, including funds to help DARPA mitigate the risk of insider threats. Think WikiLeaks. Improving control system security, post Stuxnet, was also cited as priority. Overall, the budget seeks $66.1 billion for basic and applied research across all areas, an 11.6% increase. Some areas called out for special focus by the White House include robotics. The feds have already started offering grants for developing of 'co-robots,' which are 'systems that can safely co-exist in close proximity to or in physical contact with humans in the pursuit of mundane, dangerous, precise or expensive tasks.' The US also wants to focus research on nanomanufacturing, 'and the merging of self-assembly with lithography to achieve large-scale predictable placement of nanoscale components.'"
Instead of increasing defense funding, how about we stop making people mad enough to attack us? That way, we can spend our money on more important things.
in the proposed budget?
Partisianism aside, this is a good thing. Security initiatives are not going to be coming from the business sector because security has no ROI [1]. So, the only real origin of more robust tools to keep the blackhats out are going to have to come from governments.
Of course, my fear is that this security initiative (meant to keep data safe from being exposed, or worse, tampered with), may turn into funding for nastier DRM. Mainly because DRM does seem to have a ROI attached to it while security in general doesn't.
[1]: Of course, security saves money, but to a PHB, they don't really know or care that expanded security means that trade secrets keeping a competitive edge are safe. Couple this with the attitude of a lot of SMBs that "gee, if I get hacked, I can call Geek Squad 24/7 and they can fend off the hackers", and it is just shameful for a lot of the private sector. Not all, there are a few companies who actually keep their flies zipped up, but unless a regulation forces a company to keep data secure, it just won't be done.
ka-ching
If only they had seen this: http://www.youtube.com/watch?v=u6XAPnuFjJc
Note that a large portion of the money for DARPA is going to cybersecurity research with Mudge of the L0pht as the DARPA Program Manager.
[1] http://www.pcworld.com/businesscenter/article/219725/government_employs_hackers_in_brave_new_scheme.html
[2] http://www.wired.com/dangerroom/2010/08/darpas-star-hacker-looks-to-wikileak-proof-the-pentagon/
[3] http://www.foxnews.com/scitech/2011/02/07/internet-creators-ask-hackers-help/
[1]: Of course, good security saves money,
FTFY. Two examples why this is important:
1. how much security the TSA scanners bring? how much do they cost?
2. a very recent case showed a group of 3 companies trying to get a contact for 6 months at 2 mils/month. Turned out that one of them wasn't even able to secure its digital assets.
I admit, I didn't say what good security mean. Well, that's let as homework.. for extra points, see how much of what Obama wants is indeed good security.
Questions raise, answers kill. Raise questions to stay alive.
What's with the 'cyber' prefix anyway? It doesn't mean anything.
http://www.pcworld.com/businesscenter/article/219725/government_employs_hackers_in_brave_new_scheme.html
"...harness those within the hacking community who typically present research at black or white hat conventions but whose work flies under the radar of DARPA."
"hacker incubators" and made it clear that the DoD would not request commercial rights to any innovations discovered.
" a new type of Windows rootkit that was undetectable and almost impossible to remove." http://crowdleaks.org/hbgary-inc-working-on-secret-rootkit-project-codename-magenta/
Domestic spying is now "Benign Information Gathering"
If it's really important, don't put it on the Internet. If routing over another physical network is too expensive, encrypt it.
There. Problem solved. All I ask is 10% of what they are planning to spend on this problem. I think that's reasonable. I'll be by the Treasury to pick up my money on Tuesday. I'll be the one in the Bugatti Veyron, which the dealers will happily front me when I explain to them what I've done.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Let's repost on Fox News' site and see what happens ;-)
All that fancy stuff is useful in theory, but in reality will pale in comparison with boots on the ground, from both the practical and economic standpoint. A fully automated Big Brother security system sounds impressive, but you still have to keep it working and up to date over time, even if there aren't any exploitable bugs in it.
Techno P. T. Barnums are plentiful, and always ready to collect your money. And in this case, there's a politician looking for an easy answer born every minuite.
Most attacks have nothing to do with being mad, Most are organized crime, doing it to make a buck. The next largest subset are simply vandal type hackers doing it to amuse themselves. Very few are politically motivated.
(If at first you don't succeed, do it different next time!)
who else does he think is going to build all the new locks? everything's going to plan gentlemen.
Korma: Good
just like the rest of his budget, a complete joke.
This is funding research on self assembling nano technology and everyone is whining about the defense budget? Budgets won't matter once we develop a nano-scale widget that can re-create itself to infinity. Nasty.
The way to a solid economy is to MAKE THINGS. Real things you can hold in your hand. IP is cool and is important, but ultimately a society based on intangible things and service will always be at the mercy of those who make tangible items.
Why do we need R&D on how to secure computers. What exactly is "unknown" about the existing protocols we use to send and receive data?
It seems to be more of a competence issue with the current people implementing the security measures and a lack of accountability for their superiors who's job it is to ensure properly qualified people are hired to secure the systems in the first place. So we do some research and create new protocols etc... ok, great... we still cant implement what we have now, why would we be able to implement whatever else we come up with?
Here's an idea. How about we actually hire people who already know and understand said protocols and security models. Have them secure the systems. Hold their bosses accountable if the proper people are not hired and social protocols are not followed, and so forth.
And then if you want to invest in "R&D" for "cybersecurity" go ahead.
Just means more money to scam artists like HBGary. Bye bye tax dollars!
then you wont have to plug the leaks because there will be nothing to leak about...
spend spend spend, indeed keep messing up your nation i love it.
Doesn't all of this really break down into information farming, creation, analysis, and execution?
I know there's big money in paranoia and uncertainty, but unless they're trying to reshape the entire information infrastructure of the world, something which is largely uncontrollable, thesee measures appear to be glossy pipe dreams for Big-Gov. contractors. Unless you have a mole or source in every nook and cranny of the world, which goes against the very concept of reliable secrecy, you can't control the information generator that is human conscioussness.
often i see threads dissappear... angry admins?
Not that I have anything against cybersecurity, but I'd like to see more moolah devoted to the DoE, DoD and NASA led research on supercomputing, EE, computer science, telecom, biomed/biocomputing and anything related to pharma.
Obama is hardly a nerd that cares directly about these things... he's just listening to his cabinet.
I ask once again, that you check out InZeroSystems and as a 1961 grad of USAF radar/computer repair school and one of the original founders of this DARPA + confirmed security device company, I KNOW it is the ONLY device, in the world, that can solve this problem of info theft and any form of virus introduction plus much more. btw, Phil Zimmermann, inventor of PGP confirms these comments on the website!!! Check it out before you respond...
china granite http://www.stoneorz.com
I've dealt with the NIST FIPS 140-2 standard, but it (shockingly) has no requirements for protection against keys leaking. The U.S. government's crypto gear for sensitive applications is required to have opaque epoxy layers and other extensive physical measures to keep people out, but it's fine if the keys can be picked up with a cheap radio or oscilloscope.
Does anyone know of any standards that define protection measures for keys leaking?
Give him a call or shoot him a text, let him know we're broke.. Thanks.
Make them earn there budget, print more dept is no solution
I guess fixing the existing infrastructure in the US is not a sexy headline making theme for politicians but the existing problems should be addressed before we start spending money on random things just to create jobs.
http://www.popularmechanics.com/technology/engineering/rebuilding-america/4301459
http://knowledge.wharton.upenn.edu/article.cfm?articleid=2627
http://usgovinfo.about.com/b/2009/02/04/americas-bridges-are-falling-down.htm
http://www.msnbc.msn.com/id/20095291/ns/business-eye_on_the_economy/
Is robots.