Shawn Henry, executive assistant director at the FBI, proposed the idea of a “secure Internet that was separate from the regular public Internet” as a way of protecting critical infrastructure and financial systems.
His reasons for this are:
⢠Offense is staying well ahead of defense.
⢠Companies are being told by law enforcement that they are owned all too often.
⢠Terrorists are interested in online attacks in addition to bombs, guns and the usual fare.
⢠Groups are offering Hacking as a Service (HaaS. Must have a random acronym) which could help out any technically challenged terrorists who happen to have money.
As I look at that list, I don’t have too much of an issue with any of them. I don’t know much about terrorists, but the others are fairly well accepted and information about them is widely available.
So how about the proposed solution? A secure and separate Internet. One that no one is anonymous on. That may sound safe, but would it ever happen?
Lack of anonymity might help to a point. People act differently when there’s a good chance that they’ll be held responsible for bad behavior.
A highly secure network? What does that mean in practice? Who is responsible for defining what is highly secure is? I’ve got my idea of what this would mean, as I’m sure you have yours. In practice, it sounds like it will end up being compliance.
Last there is “a separate Internet”. I interpret this as a network that never touches the Internet. Never shares a component or a connection. Didn’t we end up with these critical systems connected to the Internet to save money and facilitate access to information? So this would require businesses to reverse their direction and spend a lot of money to do so. Plus with client side attacks so prevalent, would any system really be separate? Someone’s got to manage this network and people will want to get data in and out of it. Own someone’s desktop and then pivot to the “separate and secure” network.
In the end it sounds nice, but I just don’t see it happening. And given how things get implemented, it probably wouldn’t end up separate or secure if it were tried.
A Separate, Highly Secure Internet
Paul Asadoorian
Paul Asadoorian is currently the Principal Security Evangelist for Eclypsium, focused on firmware and supply chain security awareness. Paul’s passion for firmware security extends back many years to the WRT54G hacking days and reverse engineering firmware on IoT devices for fun. Paul and his long-time podcast co-host Larry Pesce co-authored the book “WRTG54G Ultimate Hacking” in 2007, which fueled the firmware hacking fire even more. Paul has worked in technology and information security for over 20 years, holding various security and engineering roles in a lottery company, university, ISP, independent penetration tester, and security product companies such as Tenable. In 2005 Paul founded Security Weekly, a weekly podcast dedicated to hacking and information security. In 2020 Security Weekly was acquired by the Cyberrisk Alliance. Paul is still the host of one of the longest-running security podcasts, Paul’s Security Weekly, he enjoys coding in Python & telling everyone he uses Linux.
