Diplomats, 'Net greybeards work to disarm USA, China and Russias cyber-weapons
Because when state attacks blow back, the taxpayers who paid to have them developed pay again
By Simon Sharwood, APAC Editor 22 Mar 2018 at 08:30 8
Black Hat Asia The USA, China and Russia are doing all that they can to avoid development of a treaty that would make it hard for them to conduct cyber-war, but an effort led by the governments of The Netherlands, France and Singapore, together with Microsoft and The Internet Society, is using diplomacy to find another way to stop state-sponsored online warfare.
The group making the diplomatic push is called the Global Commission on the Stability of Cyberspace (GCSC).
One of the group’s motivations is that state-sponsored attacks nearly always have commercial and/or human consequences well beyond their intended targets.
As explained today in a keynote at Black Hat Asia by GCSC commissioner and executive director of Packet Clearing House Bill Woodcock, those behind state-sponsored attacks are usually either hopelessly optimistic, or indifferent, to the notion that their exploits will be re-used. The results of that faulty thinking are history: the likes of Stuxnet, Flame, Petya and NotPetya did huge damage well beyond their intended targets, imposing massive costs on businesses.
“Where that leaves us is having to spend a lot to money to defend ourselves,” Woodcock said, describing his role at the Clearing House, which operates internet exchanges, provides DNS services and consults in internet regulation. Woodcock helped to develop some basic elements of the DNS. He is therefore rather testy that money the Clearing House spends on security “… is not going on making the internet faster, bigger or better, or more available to more people.”
“So the networks that I run, because we have a lot of critical infrastructure on them, we have to try to defend against as much of this stuff as we can. And so we have to overbuild a thousand to one.”
Users of all sizes have different investment ratios, but Woodock said they are still “over-investing, maybe five to one, maybe ten to one. But it is all money they could be putting into other things.”
And ironically, businesses that have to over-invest in security to defend against state-sourced attacks paid for the development of those attacks with their taxes.
http://www.theregister.co.uk/2018/03/22/global_commission_on_the_stability_of_cyberspace/
