{"id":2682,"date":"2022-10-28T07:32:38","date_gmt":"2022-10-28T06:32:38","guid":{"rendered":"https:\/\/toshareproject.it\/artmakerblog\/?p=2682"},"modified":"2022-10-28T07:32:38","modified_gmt":"2022-10-28T06:32:38","slug":"national-and-global-computer-security-issues-described-by-an-actual-expert","status":"publish","type":"post","link":"https:\/\/toshareproject.it\/artmakerblog\/national-and-global-computer-security-issues-described-by-an-actual-expert\/","title":{"rendered":"National and global computer security issues described by an actual expert"},"content":{"rendered":"

*Digital artists need to know more about these issues. \u00a0They’re a major part of the cultural landscape, especially in times of war.<\/p>\n

 <\/p>\n

https:\/\/www.ncsc.gov.uk\/blog-post\/so-long-thanks-for-all-the-bits<\/a><\/p>\n

(…)<\/p>\n

\n
\n
\n

In cyber security, we come up with exquisite solutions to incredibly hard problems, manage risks that would make most people\u2019s toes curl and get computers to do things nobody thought was possible (or in some cases desirable). But we also continue to place ridiculous demands on users (deep breath: must not mention clicking links in emails or password policies), implicitly expect arbitrarily complex implementations of technology to be perfect and vulnerability-free in the long term, and then berate those who build the stuff we use when they fail to properly defend themselves from everything a hostile state can throw at them.<\/p>\n

I\u2019ve always found this cognitive dissonance interesting, but I haven\u2019t found a way to reliably and easily work out when we\u2019re asking for daft things. The nearest I\u2019ve got is to try to determine where the security burden lies and whether it\u2019s reasonable to ask that party to shoulder it.<\/p>\n

Is it reasonable to ask a ten-person software company to defend themselves from the Russians?
\nNope.<\/p>\n

Is it reasonable to ask a critical infrastructure company to not have their management systems connected to the internet with a password of \u2018Super5ecre7P@ssw0rd!\u2019?
\nBloody right it is!<\/p>\n

The trick for making cyber security scalable in the long term is to get the various security burdens in the right place and incentivise the entities that need to manage those burdens properly. Sometimes the obvious person to manage a burden won\u2019t be the optimal one, so we may want to shift things around so they scale better. And let\u2019s be honest, we do suffer a lot from groupthink in cyber security. So, here\u2019s my plea. The cyber security community should:<\/p>\n