Partner Perspectives  Connecting marketers to our tech communities.
10/26/2016
02:55 PM
David O'Berry
David O'Berry
Partner Perspectives
50%
50%

Lets Clean Up The Internet By Taking Responsibility For Our Actions

Imagine an Internet with multiple levels of security that users need to earn.

Someone has to clean the house, shovel the walk, and mow the lawn. As we grow to adulthood, we realize that this person is us. We either do it ourselves, or we have to earn enough to pay someone else to do it. The Internet has reached a point where we need to take responsibility for our own actions to clean it up.

Many aspects of life present this onus of individual responsibility; there are benefits when we do our part, and consequences when we don’t. Drive responsibly and you can get a discount on your car insurance. Don’t mow your lawn, and in many communities you will get billed when the municipality does it for you.

The Internet if full of opportunities for us to affect others by our actions. Unsecured computers can be used as bots for spam and denial-of-service attacks. Downloaded malware can infect other systems nearby because we are inside a trusted environment. We have tried to educate people on the importance of protecting devices, not clicking on shiny but suspicious links, and other responsible behaviors, with limited effect. What if we took a different approach?

Imagine an Internet with multiple levels of security that users need to earn. Level zero means a person does nothing, and so has limited access to services because their computer is probably infected. Many corporations work this way on their internal networks, restricting access of devices that are unknown or do not have a minimum set of security defenses. Restrictions could be based on inexperience -- akin to what many countries do with driver’s licenses -- or personal habits, which often affect life insurance premiums.

The intriguing part is how do people earn their way to higher levels of trust and access? What mix of incentives and consequences will produce the best results?

Education is always a good start. Discounts on car insurance are commonly offered to people who take a certain amount of driver’s education, and driving a motorcycle, bus, or large truck requires additional tests and licensing. Similarly, gaining access to more secure levels of the Internet could require minimum levels of education and certification.

The downside of the education approach is it is either elitist, available only to those who can afford it, or it must be provided as a public service. Another option is behavioral, based on automated monitoring of your Internet habits. Huge potential privacy issues exist here, but most browsers are already monitoring where we go, so done carefully this could work.

Finally, there is the approach we take with personal health, which relies heavily on public service messages, advertising, and peer pressure to encourage healthy lifestyles, while still providing care for those who are ill. This is most similar to the model we use today.

What do you think? Should the Internet remain a Wild West, with few restrictions and enforcement? Or is it time to take some additional responsibility and accept the benefits and consequences that come with it?

David O'Berry is a reformed CxO/CIO currently working for the "Dark Side" in Worldwide Strategic Technologies within Intel Security Group's Office of the CTO. He spent 19 years on the enterprise side as a network manager, director of information technology systems and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
david.oberry@gmail.com
50%
50%
[email protected],
User Rank: Apprentice
11/3/2016 | 4:05:30 PM
Re: A bit like this you mean?
Hi James. I like that construct a lot. I believe that we have to start rebuilding the foundation of what we do in a way that utilizes the various mechanisms like the one you linked instead of trying to inefficiently re-invent the wheel. Thanks for the reply! D
jamesmcgeexerox
100%
0%
jamesmcgeexerox,
User Rank: Apprentice
10/26/2016 | 6:16:47 PM
A bit like this you mean?
https://www.nccgroup.trust/uk/our-services/domain-services/.trust-domains/ 

 

A .trust domain protects an organisation's brand, reputation and sensitive customer information with the highest level of security and reliability. For consumers, .trust gives a clear signal that a site is a safe place to do business and interact with.

 

.trust domains won't be given out to everyone. Those who wish to join this online gated community must commit to rigorous security policies and we'll work with applicants to help them achieve these standards.

The policies have been developed by our industry leading experts, and adhering to them provides comprehensive protection from both major and minor web vulnerabilities.

A continual process of security review and improvement ensures sites are in compliance with .trust requirements.

 

Note, I'm not affiliated with them (NCC Group), I just recall reading about this a while back, and saw them somewhat harrassed for it in various forums.
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11378
PUBLISHED: 2019-04-20
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2019-11372
PUBLISHED: 2019-04-20
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11373
PUBLISHED: 2019-04-20
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11374
PUBLISHED: 2019-04-20
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-11375
PUBLISHED: 2019-04-20
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.