Let’s Clean Up The Internet By Taking Responsibility For Our Actions

Imagine an Internet with multiple levels of security that users need to earn.

David O'Berry, vCISO Cyber Resiliency and Enterprise Converged OT/IT/IIoT Cyber, North America Cybersecurity Practice, Capgemini

October 27, 2016

3 Min Read

Someone has to clean the house, shovel the walk, and mow the lawn. As we grow to adulthood, we realize that this person is us. We either do it ourselves, or we have to earn enough to pay someone else to do it. The Internet has reached a point where we need to take responsibility for our own actions to clean it up.

Many aspects of life present this onus of individual responsibility; there are benefits when we do our part, and consequences when we don’t. Drive responsibly and you can get a discount on your car insurance. Don’t mow your lawn, and in many communities you will get billed when the municipality does it for you.

The Internet if full of opportunities for us to affect others by our actions. Unsecured computers can be used as bots for spam and denial-of-service attacks. Downloaded malware can infect other systems nearby because we are inside a trusted environment. We have tried to educate people on the importance of protecting devices, not clicking on shiny but suspicious links, and other responsible behaviors, with limited effect. What if we took a different approach?

Imagine an Internet with multiple levels of security that users need to earn. Level zero means a person does nothing, and so has limited access to services because their computer is probably infected. Many corporations work this way on their internal networks, restricting access of devices that are unknown or do not have a minimum set of security defenses. Restrictions could be based on inexperience -- akin to what many countries do with driver’s licenses -- or personal habits, which often affect life insurance premiums.

The intriguing part is how do people earn their way to higher levels of trust and access? What mix of incentives and consequences will produce the best results?

Education is always a good start. Discounts on car insurance are commonly offered to people who take a certain amount of driver’s education, and driving a motorcycle, bus, or large truck requires additional tests and licensing. Similarly, gaining access to more secure levels of the Internet could require minimum levels of education and certification.

The downside of the education approach is it is either elitist, available only to those who can afford it, or it must be provided as a public service. Another option is behavioral, based on automated monitoring of your Internet habits. Huge potential privacy issues exist here, but most browsers are already monitoring where we go, so done carefully this could work.

Finally, there is the approach we take with personal health, which relies heavily on public service messages, advertising, and peer pressure to encourage healthy lifestyles, while still providing care for those who are ill. This is most similar to the model we use today.

What do you think? Should the Internet remain a Wild West, with few restrictions and enforcement? Or is it time to take some additional responsibility and accept the benefits and consequences that come with it?

About the Author

David O'Berry

vCISO Cyber Resiliency and Enterprise Converged OT/IT/IIoT Cyber, North America Cybersecurity Practice, Capgemini

David currently leads the vCISO Practice for the Converged OT/IT, Enterprise, and Cyber Resilience Towers for the North America Cybersecurity Practice at Capgemini. In this role, David also works on the creation of Capgemini’s Cybersecurity Delivery Center of Excellence in North America. Most recently, David served as the chief architect for a large North American utility, helping to lead a $100 million-plus cybersecurity transformation initiative. David has more than 30 years of experience in IT, OT, converged IT/OT, network security, and consulting services.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights