Juniper Security Chief Takes Swipe At Security Apathy

RSA CONFERENCE 2014 -- San Francisco -- Yesterday at RSA, Juniper Network's security honcho urged security professionals to be bolder in their outrage for what was happening to their information and to take risks on approaches that challenge current conventions.

"Our privacy is being invaded, or IP is being stolen, the public trust is at an all-time low, and the attack on our information is outrageous," said Nawaf Bitar, senior vice president and general manager of the security business unit at Juniper. "But you know what? I don't think we give a damn. I'm fed up with talking about outrage."

In his keynote at the show, Bitar pointed out that American society in general suffers from what he calls First World Outrage, an ill that has most people throwing up only mild, token signs of caring about circumstances that they truly think little about and act not at all to change. Compared to true acts of outrage, acts of resistance like Tibetan self-immolation and the Tiananmen Square protests, First World Outrage looks meaningless.

"'Liking' a cause on Facebook is not outrage. Retweeting a link is not outrage. Posting a bad review is not outrage. Not showing up at a conference is not outrage," he said, specifically taking a swipe at those boycotting the RSA Conference over RSA's cooperation with the NSA.

Most people don't take true action from outrage unless family or income is threatened by circumstances, he told the audience. But he believes a third major concern should spur more of us to true action: threats to our information.

"We should be outraged. Nation-state attacks against our companies are putting our jobs and our economy at risk. Cyberattacks that steal our personal information are a daily occurrence," he said. "Our information is one of our most important possessions and we should treat it as such."

What is happening to information today should have the security industry up in arms and willing to respond meaningfully and radically, he urged.

"In cybersecurity we continue to cling to old ideas even in the face of obvious deficiencies and limitations," he explained. "For example, we espouse the signature approach to eradicate known viruses. Today, we all know that approach is far from perfect."

In business, meaningful response doesn't just mean doing the same thing we always have done. Instead, he advocated for more revolutionary approaches and some calculated risk taking, explaining that as things stand today, even in an industry of innovators, innovation is often met with harsh skepticism.

"How can we stifle innovation? Don't get me wrong -- every new technique deserves scrutiny. Every bad idea needs to be challenged," Bitar said. "But we must be careful not to dismiss too quickly, for it is the incomplete and partial solutions today that will lead to the breakthroughs of the future."

In particular, active defense, something juniper has advocated for some time now, should be something considered and tried, he told the audience.

"We should be truly outraged, not first-world outraged. The time for apathy is over," he urged. "We cannot go on the offensive and hack back, but we can no longer remain passive. It's time for a new type of offense -- a type of active defense that disrupts the economics of hacking and challenges convention. It's time for all of us to turn the tables on the attackers."

However, for as much rhetoric as Bitar espoused, there weren't many details of exactly how he hoped the industry would carry it all out. Some analysts were skeptical.

"He draws these great parallels with all these other people who are being killed, imprisoned and oppressed in daily life, but what are we supposed to do? Are we supposed to set fire to our ones and zeros?" said Wendy Nather, research director for security at 451 Research. "It's great to say we should all be outraged. [But] he didn't really say what we should be doing."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.