Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:30 AM
Tsion Gonen
Tsion Gonen
Connect Directly
E-Mail vvv

Cyber Security Needs Its Ralph Nader

It took thousands of unnecessary traffic fatalities to create an environment for radical transformation of the auto industry. What will it take for a similar change to occur in data security?

By every metric, driving an automobile is far safer today than it was in 1965, due to a combination of factors including government regulations and legislation, consumer awareness, and technology advances. The catalyst for all of this was one man: Ralph Nader.

Prior to 1965, car manufacturers had no real motivation to make safe cars because the cost of doing so did not justify the business benefits. But then Ralph Nader published Unsafe at Any Speed, a critique of the safety record of American automobile manufacturers. His advocacy injected the traffic fatality epidemic into the headlines, and a nation changed.

Congress unanimously passed the 1966 National Traffic and Motor Vehicle Safety Act and established the National Highway Traffic Safety Administration (NHTSA). Manufacturers responded by putting seatbelts, headrests, and other mandated equipment in their cars, and some started making safety a competitive differentiator. And consumers… well, they never really got the memo. Many (if not most) still didn’t use seatbelts, even though they knew the risks. It took subsequent legislation at the state level in the 1980s to enforce seatbelt use among drivers.

What does this have to do with cyber security? Well, the current data breach epidemic feeds off a delicious broth of consumer apathy, corporate incrementalism, and flawed federal regulations -- exactly the conditions that existed in 1965 with automobiles. Clearly, things need to change if we are to curb the data breach epidemic… but who will be cyber security’s Ralph Nader?

Who will be the security industry's Cyber Ralph?
Who will be the security industry's Cyber Ralph?

With automobiles, Ralph Nader exposed a hidden crisis and called on government to change the rules of the game for manufacturers. This resulted in rapid, comprehensive legislation that required manufacturers to design safety equipment into their automobiles. These requirements were not an option: If you didn’t meet them, you could not sell cars in the US. Smart companies used this new focus on highway safety to their advantage.

Despite today’s fire-and-brimstone headlines about data breaches, the problem with cyber security is that nobody is feeling the pain of the problem. Consumers know their credit cards will be replaced and they will not be responsible for financial losses. Breached companies know their stock prices will bounce right back and consumers will continue shopping at their stores, and at worst they may have to throw an executive under the bus to meet the bar for “we’ve done something about this.” And government regulations speak for themselves: They simply are not a prescription for security, and at this point, breach disclosure requirements do more to breed public apathy than outrage.

Some themes for Cyber Ralph to consider include:

Make citizens aware of their entire risk exposure. They may not care about having passwords, account numbers, or credit card numbers compromised, but they likely would care about their healthcare records, tax returns, or travel plans being stolen and used for fraud, blackmail, or burglary. And they probably would care if they knew that this information may already be compromised -- the breaches just haven’t been discovered yet. The need for seatbelt laws demonstrates that consumers likely will not change their behavior based on this knowledge, but it will create a political environment where elected officials will want to do more to protect their constituents.

Make breach disclosure laws more intelligent. Not all breaches are alike, and yet reach disclosure laws treat them that way. A breach of customer data that cannot be used to harm those customers is different from a breach of unencrypted Social Security numbers. And yet, current regulations do not make this distinction, and the media simply fixate on the “number of records stolen,” not the potential damage that could be done with what was stolen. (The Breach Level Index is an interesting approach to shedding light on this problem.) As a result, all breaches are treated the same, and consumers have stopped caring because they are never materially affected by the “8 billion records stolen” headlines.

Adopt modern, practical technology. The most obvious example of this is chip-and-PIN credit cards. Europe has used them for years and also adopted complementary technologies like wireless point-of-sale in restaurants to improve credit card security. (Meanwhile, we in the US continue to hand our cards to strangers.) President Obama’s recent executive order promoting the adoption of chip-and-PIN is a promising start, but there really is no reason the US should lag so far behind its overseas peers in adopting sensible technology and processes.

Create an NHTSA for cyber security. Automobile safety improved only after the establishment of the NHTSA, an agency with authority to mandate safety standards nationwide. Cyber security needs the same type of organization. Implementing national standards will be good for consumers and businesses, because it will eliminate the complexity and variability in today’s state-level standards. This agency should have authority to implement standards across all areas of risk, including credit cards. (Chip-and-PIN would likely already be deployed in the US were this type of organization in place.)

Do away with “shades of gray” penalties. The National Traffic and Motor Vehicle Safety Act made things very simple for automobile manufacturers: Conform to national safety standards for automobiles, or don’t sell cars in the US. The “NHTSA for Cyber Security” should have a similar approach. Once we have effectively categorized breaches, we can separate out “secure” breaches (where the information stolen cannot be used to foment damage) from insecure ones. In cases where companies have done what they should to protect customer data (according to national standards), they can continue doing business unimpeded. Those that have not conformed to standards and experienced an insecure breach will have a grace period to bring themselves up to standards before they must cease operations.

This might seem Draconian -- except the automotive industry experience shows us it creates a level playing field, and when we reduce things to a simple binary situation (you’re either in business or you’re not), all companies will choose to conform.

The tragedy of the automobile industry is that it took thousands of unnecessary traffic fatalities to create an environment where Ralph Nader could bring about radical change. One hopes that we do not need to reach a similar state of disaster in the data breach epidemic to spur similar change. Will we act now? Or do we have to wait until millions of us are being bribed, defrauded, burgled, or worse?

Tsion Gonen serves as Chief Strategy Officer for Gemalto's Identity and Data Protection Division. He is responsible for developing global business and product strategies, and identifying and capitalizing on emerging market trends within the information security market. Prior ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
User Rank: Ninja
11/25/2014 | 9:49:59 AM
Auto vs. computer
I know we had to go through regulations around auto industry, I am not sure it made us more secure or it made whole product more expensive and not high tech. I do not really want to compare auto industry to computer/information industry. I am basically in favor of secure and advanced automobiles, not only secure. You still have to user your arms, legs and head to drive a car. There must be an easier way to do it.
User Rank: Ninja
11/24/2014 | 8:32:03 PM
Re: Who will be the Cyber Ralph for data security?
That is a good guess. I think retail is more on the minds of consumers/voters though. I think slowly but surely things are changing as awareness is growing. We've already seen attempts to improve data breach laws all over the country.
User Rank: Apprentice
11/24/2014 | 4:32:50 PM
This is not just a consumer problem
Data security goes beyond a consumer arena. Nation-states are hacking into banks, utilities, companies, military and this threatens our existence. We need more than Ralph Nader. We need someone like Eisenhower to run cyber security. It needs a military grade solution because in a war, this country could be brought to its knees by a small power that could never match us on the battlefield. The cyber-field is a different story.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
11/24/2014 | 3:15:55 PM
Who will be the Cyber Ralph for data security?
My guess is the whisteblower will come out of financial services. It's doubtful that anyone will ever die from a data breach, but the idea of millions of people getting bribed, defrauded or burgled is something that is not seem particularly far-fetched. Thought anyone?
<<   <   Page 2 / 2
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-20
The Quiz And Survey Master &Atilde;&cent;&acirc;&sbquo;&not;&acirc;&euro;&oelig; Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This c...
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.