Tuesday, February 17, 2015

Digital Vulnerabilities: Dawn of the Cyber-Industrial Complex?

It feels like lately all the tech news is negative. We’re hearing a lot about the dangers of technology – I think perhaps the bubble is starting to burst and everyone is starting to realize just how seriously technology is changing our lives. We’re starting to reach a point where we can’t go back. Or maybe we reached that point a long time ago.

The headlines for the past couple of months have often been filled with stories of large corporations being hacked. To name a few: Target, Home Depot, Google Mail, Yahoo! Mail, Michaels, eBay, Evernote, Apple iCloud, JP Morgan Chase, and of course, Sony. Usernames, credit card information, addresses, and more have all been stolen. The director of the FBI said “There are two kinds of big companies in the United States. There are those who’ve been hacked…and those who don’t know they’ve been hacked.” Considering many of us essentially have our entire lives online, that’s a pretty scary thought. The most recent hack(s) was done on around 100 banks, in various countries, with an estimated $1 billion stolen. It was only discovered because money started coming out of an ATM in Ukraine with no one there to claim it. Imagine if they hadn’t messed up, how long this would have continued for?

Geographical distribution of targets according to C2 data (image by Kaspersky Lab)In the debate about governments spying on their people for ‘national security’, I’ve put myself firmly on the side of privacy. I believe that a citizen’s right to privacy over rides any security issues, especially when it’s been determined that the mass collection of data has not helped to stop any terrorist attacks. The irony is that it has been shown that the NSA’s surveillance has actually weakened most internet systems because they opened backdoors, especially into the tech companies involved in PRISM (Google, Facebook, Apple, Skype, Yahoo!). While the government spying on its own people is a disturbing thought, even more disturbing is the idea of other governments or organizations spying on people and stealing their information and money. 

For the average person, like myself, I find it hard to get nervous about this sometimes. Why would anyone want to hack me? What’s the worst that happens? They use one of my credit cards – well hey, my limit isn’t that high. They email all my contacts something terrible – unfortunate, but easily explained. They steal my identity - okay, well that could prove problematic but still resolvable. Invade my privacy in various ways (log your keystrokes, see what you’re watching, watch you through your webcam, etc) – all awkward and unfortunate but hey, I don’t do anything I wouldn’t do if other people were around. I think the problem comes when the hacking is done by a group with a truly malicious intent, on a large scale. Now we know these systems are vulnerable, what happens if someone hacks in and steals top secret data from the government? What if they shut down the power to a large area? What if they render all hacked computers useless? The problem stems from our immense dependence on technology. How many businesses would struggle to function without their technology? How many companies would cease to exist without technology? You want one idea of what could happen - go watch Live Free or Die Hard.

Now they’re saying that almost all cars with wireless technologies are able to be hacked. For now that means someone can hack your GPS and find out all the places you’ve been. They can potentially hack your mobile communications, meaning who you’re calling/texting. What happens when we transition to smart cars? Imagine someone hacks into your car and controls it. Not good. It looks like the ‘military-industrial complex’ bubble might be soon ending, and a new ‘cyber-industrial complex’ may be dawning. The companies that will benefit the most will be those focused on cyber-security, which means companies like Symantec, Intel, Cisco Systems, Fortinet, Palo Alto Networks, etc.

The U.S. government recently announced plans to set up a national Cyber Threat Intelligence Integration Center. Its goal will be to integrate data from all government agencies AND the private sector, and to distribute it appropriately. I find this particularly interesting because they are relying on the help of the private sector, which I believe will be very reluctant indeed. After the whole PRISM revelation, it was easy to see that the public does not appreciate companies sharing their information with the government, without their awareness. Companies do not help their image by working with the government. Adding another layer to this is the report that the NSA knew in advance about the attack on Sony but didn’t do anything because its job is to protect national security, not the private sector. What incentive do these companies have to help? It will take a huge incentive (i.e. throwing tax payer dollars their way) or legislation forcing their cooperation.

What can the average person do? I think the biggest thing we can do is push the companies we like and trust to spend their money on protecting our information. Realistically, consumers speak with their wallets. Going one step further, I would say be wary of being completely dependent on technology. Make sure you still know how to function without your smartphone. Have a face to face conversation with a real person – just to make sure you still know how. We will have to wait and see what happens.