Ten years after Stuxnet/Flame saga, USA is experiencing a same kind of attack and their stated preparedness has not improved from the levels stated in that book.
It’s fascinating.
Edit: No. I’m not enjoying this. There’s no schadenfreude.
Ten years after Stuxnet/Flame saga, USA is experiencing a same kind of attack and their stated preparedness has not improved from the levels stated in that book.
It’s fascinating.
Edit: No. I’m not enjoying this. There’s no schadenfreude.
It also layers this assumption with “we can prevent it at the firewall level so we can actually patch it while they can’t” idea.
As we all know, it’s an absolutely brilliant(!) idea.
Often the answer this group offers is yet another third party solution that is popular at the time. Then they give these tools the high level of permissions they need to function. Cycle repeats.
That book contains no corporate backing/advertising.
How do you think governments find these vulnerabilities? Accidentally, under the couch cushions?
What you actually seem to be proposing- in practice- is a ban on government-funded vulnerability research.
To be completely honest, I don't have a concrete answer to this question yet because I haven't finished the book and didn't give the hard think it requires.
However, I can see and both parties' perspective and reasoning. I just need to give these perspectives a good rub with my own views.
On the cybersecurity side, its effectiveness inherently reduced because any person with a laptop can conduct the same research in principle. So, other parties can find breakthroughs or leapfrog each other with relatively minimal effort.
On the other hand, NOBUS has an inherent ego attached. It considers other parties to be inferior permanently. It considers other parties are unable and will be unable forever unless we leak something. This is a flawed thinking in computer science / programming research.
The core of the irony has two layers. First the personal one: The timing of reading the book and how the events unfold.
Second irony is in the US government. They were aware that they're not ready to defend if someone uses the same weapon against them, however they were so focused to improve their offensive capabilities and failed to secure themselves. Moreover, the attack came via a national software company. They've hit from inside. It's like adding insult to injury.