ANONYMOUS / LULZSEC /ANTI-SEC ARE DOING MORE GOOD THAN HARM !


I know,   I know – I hear the howls of protest even before finishing this first sentence.  

“What about all the innocent lives exposed by the irresponsible publication of peoples names in positions of authority or in sensitive roles. ?”   

But where does the fault lie ?  With those doing the breaking and entering?   Or those not providing adequate protection??  It is liked leaving your house locked without an alarm system, going on holiday, and coming back and finding it broken into.  

Don’t be surprised.  You have no one to blame but yourself. 

“ But these are criminals ! “  – I hear the sounds of self righteous chest thumping.   

Maybe, but what they have done – I hope – is scare the s**t out of anyone who has anything (data) that is accessible via the Web  - and into ensuring that their ‘security’ ( if any ) - is rapidly upgraded.    This ranges from personal users who have Gmail accounts to corporations and Governments who are custodians over much of your and my personal data. 

Who today has not heard of the hacking of SONY (and other gaming companies),  RSA,  IMF,  Citi-Group,  Lockheed Martin and myriad government agencies (particularly local police forces.)   ??  (http://www.cio.com/article/687364/AntiSec_Hackers_Dump_Data_After_Hacking_Police_Websites?source=rss_security)   

There must be millions of tweets every day carrying a story or an angle of yet more hacks / breaches,  of yet more venerable institutions – by, invariably,  the Anonymous/Lulzsec/AntiSec ( ALA) contingent (or their pretenders).    Even the mainstream media is replete with such stories.     Perhaps the exposure has been a little excessive and we are starting to suffer from ‘hacker’ fatigue.   It is becoming a little tiresome.   

Therein lies the danger. 

Is the good ( yes – I think on balance the awareness raising is good ) not going to be diminished through the excessive exposure, the desensitization ( boiling frog syndrome ) and the resultant complacency?

 That is my main concern.    These ‘hacktivists’  are not the best marketers in the world and they have the habit of rubbing everyone up the wrong way.    But their cause has merit.

Yes I believe that security practitioners and their clients should be raising their game or else run the risk of  :
a) being embarrassed (largely the damage that has been caused) by the ALA’s; or
b) of actually being hacked by some serious bad guys and thereby incurring considerable economic damage.  

What the ALA’s have shown is that the millions spent on security by Governments and Corporations has been spent badly.   The security solutions out there particularly the so-called two-factor authentication solutions whether token or dongle based (OTP),  java-script based,  SMS based or even just password based are fundamentally flawed and it is time for a new evolution of authentication solutions.   If your website is ‘protected’ by a user name and password or SSO / Open ID  (or even one of the aforementioned) then you owe it to your customers and shareholders (citizens  - in the case of Government agencies)  to review your security.

Lest you becoming the laughing stock of Lulzsec. 


Comments

Post a Comment

Popular posts from this blog

The End of Passwords

Finally it seems … the penny has dropped.   Passwords are a poor substitute for real online security.   There is more and more ‘chatter’ about it.    Robin Henry writing in the Sunday Times on New Years Day talks of the end of ‘password hell’ invoking solutions in the pipeline from the Web Gods – Apple and Google.  The talk is of new biometric solutions such as facial and hand movement recognition.  Even IBM is talking this way.  ( http://www.forbes.com/sites/thestreet/2011/12/20/ibms-tech-predictions-for-the-next-5-years/ )  I agree with the notion that passwords are a dying breed but not that biometrics will become vogue.   They are fraught with problems of their own such as reliability, accuracy and the need for referencing of data-bases ( fail !) .    Why are passwords defunct?   Basically they are difficult to remember and they are easy to steal.    The solutions needed are those that require no cognitive load for the user ( the most unreliable participant in this enterprise
Read more

WIKILEAKS - the fuss?

Why all the fuss ? Why the ‘outrage’ at this ‘threat to national security’ ?   Are we really worried that nuclear war is going to break out because of these ‘dirty’ secrets getting out.  As if the North Koreans are going to up the ante any more than their mock charge of last week because of the abuse and scorn heaped upon them by US Diplomats.  ? !    Come on. To me the irony of this bluster is that it is (largely) from the right wing establishment in the US - calling it treason!     Any party that parades a half wit like Palin as a presidential hopeful hardly holds any moral high ground when it comes to protecting the USA.   Her appointment as the ‘leader of the free World’ will be enough to send any level headed American ( let alone any one of their Allies ) into a panicky tailspin at the thought of what she may stumble into ( by accident or design) . So how did these documents get out there?   Poor security.  Plain and simple.   If the US is so worried about this incident su
Read more

SPOOKS - CYBER ATTACK

Well I’ll be damned – if the subject of my last blog wasn’t the central theme to last nights episode of Spooks – CYBERWAR.    (To those who live outside the UK – Spooks is a very popular TV series about the goings on of a key team inside MI5 who spend their time thwarting terrorist attacks on the UK – while engaging in risqué amorous trysts on the side ).   And so last night we had the Russians and the Chinese –(working together !!) – ganging up on MI5 by infiltrating ( hacking ) their ‘secure’ internal network.     Whether the events portrayed were within the bounds of possibility or credibility who knows?     But if teenagers can break into the Pentagon – then I am sure that Russian/Chinese expert hackers can probably do something along the lines of infiltrating a UK Govt ‘Spooks’ departments network.      Either way it constituted an attack on British soil by foreign ‘combatants’ – which ( if it were true ) would have been a first since the Normans in 1066.   So we saw how vulner
Read more