Slashdot Mirror
US DOJ Lays Out Cybersecurity Basics Every Company Should Practice
coondoggie writes "The mantra is old, grant you, but worth repeating since it's obvious from the amount of cybersecurity breaches that not everyone is listening. Speaking at the Georgetown Cybersecurity Law Institute this week, Deputy Attorney General of the United States James Cole said there are a ton of things companies can do to help government and vice-versa, to combat cyber threats through better prevention, preparedness, and incidence response."
Making a book of "best practices" is a good first step, but incentives are also needed.
For example, suppose the government set penalties for security breaches which result from not following best practices. The penalties would not trigger until an actual breach, but if one *does* happen then the company is fined for breach of trust.
The fines should be structured to encourage businesses to reduce risk, by artificially creating proportional risk.
If someone steals CC numbers because the company kept them in the clear, and kept them beyond the time necessary to complete a transaction, the company is fined $5 each number. If passwords are not encrypted and salted, $1 for each stolen password. If web form data is not sanitized and customer information is stolen, $3 for each record. If the power station control computers are on the net with default passwords - half a mil.
The government could also set up incentives and rewards for white-hat hackers who find vulnerabilities. If 1/10 of the potential fine goes to the white-hat hacker who discovers it, security practices would come into line very quickly. Perhaps with a cap of $50,000: enough for incentive to the hacker and the company, but not enough to affect the business.
(... tempered by common sense. The company can argue that a different action is just as secure as "best practice" - but this should be done in court as response to a data breach investigation. Also, security breaches which are the result of something not covered by "best practices" are exempt.)
Government can tweak and tune things for the betterment of society, but it has to be structured in the manner of game theory. People have to want to follow procedures.
The article advocates more passwords, and stronger passwords, saying it is less of a pain than having everything stolen by hackers.
But....
When your password rules are too onerous, people start rebelling against them out of practical necessity. People write them down on post-its or store them in files on the hard drive because there are too many to remember (and they are too hard to remember). The few people who don't do this suffer frequent lock-outs, costing the company time and money (over and over again) in password resets. And, invariably, your CEOs exclude themselves from the policies. These same CEOs tend to have way more access than they actually need, and as such are the primary targets for hackers.
So, rather than requiring a few more special characters in the min of 20 character passwords that lock out after the second failed attempt, must be changed every 10 days, have an infinite history to prevent re-use, and each of which grants you access to between five and ten percent of the subsystems you use on a daily basis...perhaps we should work smarter instead of harder.
Use two factor authentication for the core systems (everyone has a cell phone these days, and good systems can work on the employee's office landline anyway). Passwords lock out after 10 attempts (seriously, those extra 7 attempts are NOT what will give a dictionary attack its edge). Require long passwords with a minimum "variety factor" in the letters rather than specific number and special character minimums (the variety factor and length are far more cryptographically strong than adding a 123 at the end). Train employees to recognize phish. And, of course, don't give people access to stuff they don't need.
Do I secure my network or backdoor it to comply with the demans of the Surveillance State?
The DOJ, which illegally seizes domains from foreign holders? The DOJ which orchestrates illegal raids in New Zealand? The DOJ which is the bully of the Content Mafia?
It seems that these are not really the most technical-minded people, and you expect them to advise on Computer Security?
I'd rather follow the NSA Guidelines http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml
"The more prohibitions there are, The poorer the people will be" -- Lao Tse
How about making it illegal to hack into my property; and then why don't you go about aresting and prosecuting criminals?
It is, and they do... But there is also only so much they can do to arrest and prosecute foreigners.
Do you have locks on your doors at home? Do you use them, or do you expect the government to make trespassing illegal and to arrest and prosecute criminals?
The article advocates more passwords, and stronger passwords,
Why do companies have archaic password limitations? Must be less than 12 characters (or 16 or some other arbitrary short length) Must NOT be the following characters... Why is there a limit on the characters I use? Whenever I see boneheaded rules like this, I assume someone is incompetent, and I wonder what other security holes there are.