Lets look at the failures...
First off the firewall. While still essential for protecting against legacy Internet worms, it is ineffective at preventing an attacker from obtaining access to a network. Not only are there now tools for circumventing firewalls, but the bad guys have gotten smart enough to use common open ports (http, https, etc) when redirecting out of a network. Conficker is a recent easy example of a worm which received updates over http. Additionally criminals have broken Google. It is now impossible to make one of the top Internet searches without being directed to malware by one of the links. By using automating techniques for Google trends and Search Engine Optimization (SEO) cyber criminals have been successful at breaking the most popular search engine. Tactics of social engineering have now circumvented the protection that a firewall is able to provide. 30 years after their development we have reached the limits of what firewalls can protect us from.
This problem of defense though is not only limited to deficient technology, it also lies in the global nature of the Internet. Criminals can not easily be found or apprehended when they commit cyber crimes in one country and are located on the other side of the globe (often in a country which doesn't recognize their actions as a computer crime). So while headlines will tell of hackers being brought to justice, most cyber criminals are still at large. Additionally arresting people doesn't solve the problem, it only delays it, as others can easily take up their place within the internet. Even taking down ISP's, a new tactic by security professionals, has shown to have only a limited short term effect when stopping the bad guys. Essentially we are now fighting a battle with swords and metal armor against enemies who have Inter Continental Ballistic Missiles (ICMB). Is it any wonder that we're losing?
Next lets look at anti-virus. Signature based anti-virus (which is to say most kinds) is failing. Malware signatures within the past couple years have been in the millions. The bad guys have perfected polymorphic code which automates and obfuscates a malicious program so that each time it spreads it becomes a different virus (or at least a different signature). On top of that malware developers test their programs against antivirus just to make sure it isn't detected. Most Anti-Virus products now protect against less than half of malware. That is to say even the most up to date system with full patches and recent AV definitions is still over 50% vulnerable. Needless to say, anti-virus has been successfully emasculated in the current cyber conflict.
Finally lets talk about user education. There is one main problem with this approach, most users don't care about security until something breaks. Unfortunately many users across the net, find it either too cumbersome to pay for anti-virus products or update their software. This is often what causes the success of worms or viruses many months after a patch was released to stop them. Not caring about security is also why compliance is the driving force for information security in business. It comes down to a simple fact: if businesses don't have to spend money on security they won't. So much information security spending comes only after a breach has happened or when a company has to abide by the law. Companies have learned to fear the auditor more than the cyber criminal. So while security education is good in theory, it is definitely not the silver bullet and may even be the wrong approach to take. Most users don't want to know about security they just want something to work.
This problem of defense though is not only limited to deficient technology, it also lies in the global nature of the Internet. Criminals can not easily be found or apprehended when they commit cyber crimes in one country and are located on the other side of the globe (often in a country which doesn't recognize their actions as a computer crime). So while headlines will tell of hackers being brought to justice, most cyber criminals are still at large. Additionally arresting people doesn't solve the problem, it only delays it, as others can easily take up their place within the internet. Even taking down ISP's, a new tactic by security professionals, has shown to have only a limited short term effect when stopping the bad guys. Essentially we are now fighting a battle with swords and metal armor against enemies who have Inter Continental Ballistic Missiles (ICMB). Is it any wonder that we're losing?
So the question comes up, what do we do now? Do we hack the attackers? While, this is the fantasy of every security professional, it is unfortunately illegal and not a viable solution. You can't stop crime by causing it. Stealing from thieves doesn't prevent theft, it just adds to it.
Clearly we need to rethink defense. To make an analogy in chess, the bad guys have better position and tempo than the good guys. However there still may be ways to give the defense a upper hand. Rather than relying on international laws to finally catch up with technology (which lets be honest that probably won't happen soon), technology can be used to fight technological threats.
To continue with the analogy of chess, instead of just blocking our opponent what if we protected our pieces. What if we made it so they had to lose a piece in order to take one of ours. What if instead of building walls to block intruders we put up barbwire, land-mines, and set booby traps? To come back to technology, what if every time an attacker tried to automate a password attack, execute some shell code or do a web attack, they essentially DOS'd themselves? What if we could make it so the cost of an attack was so technologically expensive that it would eclipse the amount of money gained from its success? If we could do this for every computer attack there is, it would essentially kill the current thriving black market. We are already familiar with the ways computers can be compromised, it is now a matter of developing the technology which makes this disadvantageous for the attacker.
Some of this technology has already been created. So what would happen if we took Liston's genius and combined it with an IDS or AV? The idea being that every time this new Frankenstein contraption detected an attack, instead of only making an alert or blocking an attack it would instead slow the attacker, essentially increasing their CPU cycles and causing their attack to not only fail but bog down their system(s). Implemented in the right locations throughout the internet this technology could have devastating effects on automated attacks that are currently happening every day.
To help facilitate this idea and test my hypothesis I've began a new project called BarbWire. It is an effort to combine the two products mentioned above and create a new type of defensive technology. I definitely invite anyone who would like to contribute on this project to contact me. Defense should no longer be only about blocking attack, it should also be about preventing part of the motivation and ease behind them. As defenders we need to rethink how we engage our enemies and what weapons will actually cause them to stop attacking. By understanding our enemies and adapting our tactics to theirs we should be able to tip the scales and bring about a safer cyberspace for everyone.
