Partner Perspectives  Connecting marketers to our tech communities.
10/26/2016
02:55 PM
David O'Berry
David O'Berry
Partner Perspectives
50%
50%

Lets Clean Up The Internet By Taking Responsibility For Our Actions

Imagine an Internet with multiple levels of security that users need to earn.

Someone has to clean the house, shovel the walk, and mow the lawn. As we grow to adulthood, we realize that this person is us. We either do it ourselves, or we have to earn enough to pay someone else to do it. The Internet has reached a point where we need to take responsibility for our own actions to clean it up.

Many aspects of life present this onus of individual responsibility; there are benefits when we do our part, and consequences when we don’t. Drive responsibly and you can get a discount on your car insurance. Don’t mow your lawn, and in many communities you will get billed when the municipality does it for you.

The Internet if full of opportunities for us to affect others by our actions. Unsecured computers can be used as bots for spam and denial-of-service attacks. Downloaded malware can infect other systems nearby because we are inside a trusted environment. We have tried to educate people on the importance of protecting devices, not clicking on shiny but suspicious links, and other responsible behaviors, with limited effect. What if we took a different approach?

Imagine an Internet with multiple levels of security that users need to earn. Level zero means a person does nothing, and so has limited access to services because their computer is probably infected. Many corporations work this way on their internal networks, restricting access of devices that are unknown or do not have a minimum set of security defenses. Restrictions could be based on inexperience -- akin to what many countries do with driver’s licenses -- or personal habits, which often affect life insurance premiums.

The intriguing part is how do people earn their way to higher levels of trust and access? What mix of incentives and consequences will produce the best results?

Education is always a good start. Discounts on car insurance are commonly offered to people who take a certain amount of driver’s education, and driving a motorcycle, bus, or large truck requires additional tests and licensing. Similarly, gaining access to more secure levels of the Internet could require minimum levels of education and certification.

The downside of the education approach is it is either elitist, available only to those who can afford it, or it must be provided as a public service. Another option is behavioral, based on automated monitoring of your Internet habits. Huge potential privacy issues exist here, but most browsers are already monitoring where we go, so done carefully this could work.

Finally, there is the approach we take with personal health, which relies heavily on public service messages, advertising, and peer pressure to encourage healthy lifestyles, while still providing care for those who are ill. This is most similar to the model we use today.

What do you think? Should the Internet remain a Wild West, with few restrictions and enforcement? Or is it time to take some additional responsibility and accept the benefits and consequences that come with it?

David O'Berry is a reformed CxO/CIO currently working for the "Dark Side" in Worldwide Strategic Technologies within Intel Security Group's Office of the CTO. He spent 19 years on the enterprise side as a network manager, director of information technology systems and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
david.oberry@gmail.com
50%
50%
[email protected],
User Rank: Apprentice
11/3/2016 | 4:05:30 PM
Re: A bit like this you mean?
Hi James. I like that construct a lot. I believe that we have to start rebuilding the foundation of what we do in a way that utilizes the various mechanisms like the one you linked instead of trying to inefficiently re-invent the wheel. Thanks for the reply! D
jamesmcgeexerox
100%
0%
jamesmcgeexerox,
User Rank: Apprentice
10/26/2016 | 6:16:47 PM
A bit like this you mean?
https://www.nccgroup.trust/uk/our-services/domain-services/.trust-domains/ 

 

A .trust domain protects an organisation's brand, reputation and sensitive customer information with the highest level of security and reliability. For consumers, .trust gives a clear signal that a site is a safe place to do business and interact with.

 

.trust domains won't be given out to everyone. Those who wish to join this online gated community must commit to rigorous security policies and we'll work with applicants to help them achieve these standards.

The policies have been developed by our industry leading experts, and adhering to them provides comprehensive protection from both major and minor web vulnerabilities.

A continual process of security review and improvement ensures sites are in compliance with .trust requirements.

 

Note, I'm not affiliated with them (NCC Group), I just recall reading about this a while back, and saw them somewhat harrassed for it in various forums.
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Starwood Breach Reaction Focuses on 4-Year Dwell
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/5/2018
Symantec Intros USB Scanning Tool for ICS Operators
Jai Vijayan, Freelance writer,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I guess this answers the question: who's watching the watchers?
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3988
PUBLISHED: 2018-12-10
Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own cache directory, which is available to any application on the...
CVE-2018-10008
PUBLISHED: 2018-12-10
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended...
CVE-2018-10008
PUBLISHED: 2018-12-10
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace br...
CVE-2018-10008
PUBLISHED: 2018-12-10
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jen...
CVE-2018-10008
PUBLISHED: 2018-12-10
A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.