<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 10, 2014 at 11:41 AM, ianG <span dir="ltr"><<a href="mailto:iang@iang.org" target="_blank">iang@iang.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 10/12/2014 15:49 pm, John Ioannidis wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
<br>
<br>
On Tue, Dec 9, 2014 at 2:55 PM, <<a href="mailto:dan@geer.org" target="_blank">dan@geer.org</a> <mailto:<a href="mailto:dan@geer.org" target="_blank">dan@geer.org</a>>> wrote:<br>
<br>
"Banks Dreading Computer Hacks Call for Cyber War Council"<br>
Bloomberg, July 8, 2014<br>
<br>
<a href="http://www.bloomberg.com/news/print/2014-07-08/banks-dreading-computer-hacks-call-for-cyber-war-council.html" target="_blank">www.bloomberg.com/news/print/<u></u>2014-07-08/banks-dreading-<u></u>computer-hacks-call-for-cyber-<u></u>war-council.html</a><br></span>
<<a href="http://www.bloomberg.com/news/print/2014-07-08/banks-dreading-computer-hacks-call-for-cyber-war-council.html" target="_blank">http://www.bloomberg.com/<u></u>news/print/2014-07-08/banks-<u></u>dreading-computer-hacks-call-<u></u>for-cyber-war-council.html</a>><span class=""><br>
<br>
<br>
Are these people that clueless (which makes me even more worried about<br>
the vulnerability of our financial systems), or are they trying to<br>
accomplish something else?<br>
</span></blockquote>
<br>
<br>
This is a real development. Large IT companies (I'm referring to the banks here, who are by majority vote are IT orgs at this stage in their evolution) are unable to secure themselves. This is a gathering trend.<br>
<br>
The number of large groups that find themselves unable to deal with the increasing number of serious attacks is an indication on the security industry.<br>
<br>
E.g., Did we not predict this? Did we not prepare? Did we not know how to prepare? Was it considered an acceptable risk?<br>
<br>
It's probably OK to say, we got the risk wrong, now we'll just do some re-work, add some stuff and get back to business. That will just cost hard money, no hard thing for banks at least.<br>
<br>
But that might not be what is happening. If these orgs are demanding state representation, that looks awfully like going to the USG and saying we need NSA help. Google and others have also in the past cut deals with the NSA to get their help, before backing off in realisation that the NSA isn't exactly going to help them.<br>
<br>
The point here is if google can make this choice, even for a short time, what hope Sony?<br></blockquote><div><br></div><div>I am not aware of any deal between Google and the NSA. Quite the contrary. What are you referring to?</div><div><br></div><div>/ji</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Does the security industry actually know enough to deal with this?<br>
<br>
The implications of this question are pretty severe. If the security industry has the smarts to deal with it, then there are institutions (NSA, companies, etc) that can do the Sony makeover and turn the story into one that will sell.<br>
<br>
If not, then not. What does the world look like when no-one can save Sony? Or the banks? Or...<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
<br>
iang<br>
</font></span><br>
<br>
<br>
ps; long term readers will know that what is being tested today is the hypothesis that security is a market in lemons, or the alternate, a market in silver bullets.<br>
</blockquote></div><br></div></div>