For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
|
|
|
|
December 01, 2003 (Computerworld) -- The October issue of Communications of the ACM featured papers about future robots capable of performing self-organizing tasks. The authors showed how acceleration in the processing power of computers means that machines could soon reach the capabilities of living creatures, at an affordable cost.
The table below, from the Association for Computing Machinery article, shows the "computing" capacity of organisms and illustrates when commercial computers had or are expected to have equivalent processing power.
Instead of thinking about the rising potential for robotic machines, it occurred to me that software with the intelligence of a mouse or a monkey would have the frightening capacity to launch a new form of network-based warfare.
So far, our approach to securing information networks has been static. The attackers write clever code that's then dispatched to potentially vulnerable apparatus on the Internet. The hostile code is designed to exploit the known weaknesses of millions of computers as well as those of other programmable devices connected to the global Web. The extent of the damage depends on the speed with which the corruption propagates and on the speed with which defenders can deploy countermeasures.
The Security Intelligence Products and Systems organization estimates the worldwide cost of damage from digital attacks from Jan. 1 to mid-November of this year to be between $170 billion and $203 billion—up from $110 billion to $130 billion for all of 2002. And that estimate doesn't include costs for installing increasingly burdensome defensive measures.
To place this figure into perspective, one must consider that the estimated total cost of information security failures is about 10% of the total global cost of business computing. In a year when the increases in budgets for business computing remain in the 1%-to-2% range, the net effect of the losses from attacks is a cut in available spending to support money-making business applications. From that point of view, the costs of software attacks can be seen as inflicting economic damage comparable to that of a major terrorist incident.
The question then arises of whether the current approaches to instituting defensive measures—as promised by software vendors, consultants and your own security personnel—will be sufficient to overcome steadily escalating security threats. This is a classic problem in waging defensive warfare, where the forces of attackers must be neutralized by the capabilities of the defenders. In force vs. counterforce war games, attackers can be defeated if the learning cycle of the defenders is faster and their resources are adequate to disable the aggressors.
Unfortunately, the outlook for information security from the standpoint of information warfare isn't encouraging. Current methods of blocking intruders aren't likely to be adequate to secure Internet commerce. When swarms of adaptively learning software attackers are launched, they will have the capacity to sense and learn the capabilities of the defenders and to modify their attack plans accordingly. The balance of power will shift in favor of the attackers. The cost of launching attacks will decrease and the expense for defenses will escalate until it becomes prohibitive for companies to pursue the current policy of adhering to static defensive measures.
The present methods for security assurance are as obsolete as Cold War military tactics. Regardless of how many firewalls you put up, a software "robot" with monkey-like intelligence will find ways to punch through and then inform other roaming attackers where to penetrate. Regardless of how frequently you patch your software or how often you download virus updates, self-aware mutant code will bypass defenses that were programmed for old patterns of attack.
In the new era of information warfare, network defenders must use new tactics. They will have to launch active countermeasures to disable the learning capabilities of the aggressors. Networks will have to be designed for initiating search-and-destroy software that will find attackers faster than the malevolent software can locate new vulnerabilities. International cooperation will be essential in identifying and neutralizing the sources of disruption. Punitive liability will have to be applied in cases where negligence fosters the proliferation of insecurity. Most important, the influence of CIOs will have to rise, because security has now become the primary impediment to further progress of a global information society.
Processing Power Accelerates ORGANISM NUMBER OF NEURONS EQUIVALENT MIPS COMPUTER PROCESSING AVAILABLE MIPS/$1,000 COMPUTING COSTS Bacterium 1 0.001 1975 0.001 $1,000 Worm 300 1 1990 1 $1,000 Guppy 100,000 100 1996 1,000 $100 Lizard 2,000,000 10,000 2000 10,000 $1,000 Mouse 60,000,000 100,000 2005 - 2010 100,000 $1,000 Monkey 3 billion 1,000,000 2010 - 2020 1 million $1,000 Human 100 billion 100,000,000 2020 - beyond 1 billion $100
Paul A. Strassmann (paul@strassmann.com) has studied and taught the subject of information warfare since 1993.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Microsoft promises four patches next week
- Google gives away home-cooked Web application security scanner
- Expect iPhone, Fourth of July scams, security firm says
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecuritySecurity's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied |
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
