Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:30 AM
Tsion Gonen
Tsion Gonen
Connect Directly
E-Mail vvv

Cyber Security Needs Its Ralph Nader

It took thousands of unnecessary traffic fatalities to create an environment for radical transformation of the auto industry. What will it take for a similar change to occur in data security?

By every metric, driving an automobile is far safer today than it was in 1965, due to a combination of factors including government regulations and legislation, consumer awareness, and technology advances. The catalyst for all of this was one man: Ralph Nader.

Prior to 1965, car manufacturers had no real motivation to make safe cars because the cost of doing so did not justify the business benefits. But then Ralph Nader published Unsafe at Any Speed, a critique of the safety record of American automobile manufacturers. His advocacy injected the traffic fatality epidemic into the headlines, and a nation changed.

Congress unanimously passed the 1966 National Traffic and Motor Vehicle Safety Act and established the National Highway Traffic Safety Administration (NHTSA). Manufacturers responded by putting seatbelts, headrests, and other mandated equipment in their cars, and some started making safety a competitive differentiator. And consumers… well, they never really got the memo. Many (if not most) still didn’t use seatbelts, even though they knew the risks. It took subsequent legislation at the state level in the 1980s to enforce seatbelt use among drivers.

What does this have to do with cyber security? Well, the current data breach epidemic feeds off a delicious broth of consumer apathy, corporate incrementalism, and flawed federal regulations -- exactly the conditions that existed in 1965 with automobiles. Clearly, things need to change if we are to curb the data breach epidemic… but who will be cyber security’s Ralph Nader?

Who will be the security industry's Cyber Ralph?
Who will be the security industry's Cyber Ralph?

With automobiles, Ralph Nader exposed a hidden crisis and called on government to change the rules of the game for manufacturers. This resulted in rapid, comprehensive legislation that required manufacturers to design safety equipment into their automobiles. These requirements were not an option: If you didn’t meet them, you could not sell cars in the US. Smart companies used this new focus on highway safety to their advantage.

Despite today’s fire-and-brimstone headlines about data breaches, the problem with cyber security is that nobody is feeling the pain of the problem. Consumers know their credit cards will be replaced and they will not be responsible for financial losses. Breached companies know their stock prices will bounce right back and consumers will continue shopping at their stores, and at worst they may have to throw an executive under the bus to meet the bar for “we’ve done something about this.” And government regulations speak for themselves: They simply are not a prescription for security, and at this point, breach disclosure requirements do more to breed public apathy than outrage.

Some themes for Cyber Ralph to consider include:

Make citizens aware of their entire risk exposure. They may not care about having passwords, account numbers, or credit card numbers compromised, but they likely would care about their healthcare records, tax returns, or travel plans being stolen and used for fraud, blackmail, or burglary. And they probably would care if they knew that this information may already be compromised -- the breaches just haven’t been discovered yet. The need for seatbelt laws demonstrates that consumers likely will not change their behavior based on this knowledge, but it will create a political environment where elected officials will want to do more to protect their constituents.

Make breach disclosure laws more intelligent. Not all breaches are alike, and yet reach disclosure laws treat them that way. A breach of customer data that cannot be used to harm those customers is different from a breach of unencrypted Social Security numbers. And yet, current regulations do not make this distinction, and the media simply fixate on the “number of records stolen,” not the potential damage that could be done with what was stolen. (The Breach Level Index is an interesting approach to shedding light on this problem.) As a result, all breaches are treated the same, and consumers have stopped caring because they are never materially affected by the “8 billion records stolen” headlines.

Adopt modern, practical technology. The most obvious example of this is chip-and-PIN credit cards. Europe has used them for years and also adopted complementary technologies like wireless point-of-sale in restaurants to improve credit card security. (Meanwhile, we in the US continue to hand our cards to strangers.) President Obama’s recent executive order promoting the adoption of chip-and-PIN is a promising start, but there really is no reason the US should lag so far behind its overseas peers in adopting sensible technology and processes.

Create an NHTSA for cyber security. Automobile safety improved only after the establishment of the NHTSA, an agency with authority to mandate safety standards nationwide. Cyber security needs the same type of organization. Implementing national standards will be good for consumers and businesses, because it will eliminate the complexity and variability in today’s state-level standards. This agency should have authority to implement standards across all areas of risk, including credit cards. (Chip-and-PIN would likely already be deployed in the US were this type of organization in place.)

Do away with “shades of gray” penalties. The National Traffic and Motor Vehicle Safety Act made things very simple for automobile manufacturers: Conform to national safety standards for automobiles, or don’t sell cars in the US. The “NHTSA for Cyber Security” should have a similar approach. Once we have effectively categorized breaches, we can separate out “secure” breaches (where the information stolen cannot be used to foment damage) from insecure ones. In cases where companies have done what they should to protect customer data (according to national standards), they can continue doing business unimpeded. Those that have not conformed to standards and experienced an insecure breach will have a grace period to bring themselves up to standards before they must cease operations.

This might seem Draconian -- except the automotive industry experience shows us it creates a level playing field, and when we reduce things to a simple binary situation (you’re either in business or you’re not), all companies will choose to conform.

The tragedy of the automobile industry is that it took thousands of unnecessary traffic fatalities to create an environment where Ralph Nader could bring about radical change. One hopes that we do not need to reach a similar state of disaster in the data breach epidemic to spur similar change. Will we act now? Or do we have to wait until millions of us are being bribed, defrauded, burgled, or worse?

Tsion Gonen serves as Chief Strategy Officer for Gemalto's Identity and Data Protection Division. He is responsible for developing global business and product strategies, and identifying and capitalizing on emerging market trends within the information security market. Prior ... View Full Bio
Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
<<   <   Page 2 / 2
User Rank: Apprentice
11/25/2014 | 5:54:31 PM
Re: Who will be the Cyber Ralph for data security?
I agree! I think the question has always been 'how big should the goverment role be?'. I personally think the goverment should get more involved. And put down regulations that really push companies to do more than what they'd like to. Just like the goverment did other things to save lives...I remember when I was forced to put on a seat belt... I didn't like that first also. 
Keith Graham
Keith Graham,
User Rank: Author
12/2/2014 | 11:48:28 AM
Re: This is not just a consumer problem
Further to tjgkg's point, it really does go beyond the consumer arena. One concern we should have IS the loss of life as a result of a breach, and I don't just mean in terms of damage to public infrastructure (like nuclear power facilities, or natural gas processing plants), which I think is much less likely, but at time of war. As a basic example, some nation state actor with the capability of compromising military and government systems could prevent the use of kinetic weapons in response to a kinetic attack, and entirely undermine our defenses. We shouldnt kid ourselves that these capabilities do not exist, or are not being developed. 
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
12/2/2014 | 1:20:42 PM
Re: This is not just a consumer problem > Vs time of war r
@Keith Graham, I would assume that our military has a strategy in place against the kinetic attacks that you mention. At least I hope so. Am I being naive? 

Keith Graham
Keith Graham,
User Rank: Author
12/2/2014 | 1:42:35 PM
Re: This is not just a consumer problem > Vs time of war r
@Marilyn Cohodas, I would hope so too! I guess we're beyond the realms there of what is known in the public domain.
<<   <   Page 2 / 2
COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/10/2020
Zscaler to Buy Cloudneeti
Dark Reading Staff 4/9/2020
The Coronavirus & Cybersecurity: 3 Areas of Exploitation
Robert R. Ackerman Jr., Founder & Managing Director, Allegis Capital,  4/7/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Yes, I do have virus protection on my system, now what?
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-04-10
An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd.
PUBLISHED: 2020-04-10
There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro vers...
PUBLISHED: 2020-04-10
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
PUBLISHED: 2020-04-10
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. IBM X-Force ID: 178929.
PUBLISHED: 2020-04-10
There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in certain loading processes, successful exploit could allow the attacker to load a crafted file to the device through USB.Affected product version...