Gardener's Question Time is a popular BBC radio program which, in addressing such pressing topics as powdery mildew on honeysuckle, takes its listeners back to the halcyon days that Rupert Brooke, on the cusp of the Great War and “sweating, sick and hot” in Berlin, evokes so perfectly in his poem The Old Vicarage, Grantchester:
“Stands the Church clock at ten to three?
And is there honey still for tea?”
Brooke, who would be dead a mere three years after writing these words, knew well that war would forever change our relationship both with the past, and with the machines that we had built to serve us and which now had the potential to kill us.
Now, almost exactly a century from his untimely death, we stand at the cusp of another Great War. Not, this time, a war of tanks and guns, but a war of invisible energies, malevolent bit patterns ricocheting across threads of optical fiber, flickering out across oceans at the speed of light.
The early days of computing, and of the personal computer, were days of hope and excitement. The advent of the internet, with its genesis in academia, seemed to promise a benevolent future where all the knowledge of the world might be available to those who sought it.
But the personal computer, and the Windows operating system that came to dominate the market, had never been designed for a world in which your neighbor might not be your friend. In fact, many Microsoft initiatives, such as evangelizing the use of ActiveX components from within the web browser, now look quite naïve.
Now it's certainly true that Microsoft has worked very hard to improve Windows security over the years. Still, we won't keep powdery mildew off our honeysuckle unless we seriously think about the walls around our gardens. Consider the following:
- Are you ensuring that only digitally signed applications can run on your devices? Recall this is not an absolute protection, as the Petya outbreak initial vector was a compromised software update from a legitimate vendor, who may well have signed their code.
- Are all your storage devices encrypted at rest? Modern hardware is powerful enough that the overhead of encryption is rapidly decreasing. Not encrypting storage is like leaving your private correspondence on a seat in the train and then hoping no one picks it up and reads it.
- Are you segregating your network into islands of connectivity? Does everything really have to be able to reach everything? Can you organize your network so that connectivity is controlled, yet software updates can still be deployed effectively?
- In sharing information, does it really make sense to place vital documents on file shares, with general user access, no audit trails and no control over what gets read and written? Or can you move documentation to dedicated web-based content management systems and control other corporate resources via appropriate access control mechanisms?
- Are your staff trained in cybersecurity basics? It doesn't take a huge effort to engage and inform staff so that they behave responsibly. For example, the FBI found that by training staff in the responsible use of USB storage devices and installing software that reminded the staff of their responsibilities when a device was plugged in, consequently far less information was moved around using insecure portable storage devices.
- Can you exploit virtualization to augment your defences? Modern hardware is powerful enough that the overhead of virtualization is minimal in most cases – so should even your corporate laptops run virtualized? In the event of an attack, a virtualized environment need only be rolled back to the last good snapshot, not rebuilt from scratch. And malware can't escape from the virtualized sandbox and attack the host device.
Recall that Achilles died from a small overlooked vulnerability. We tend to see cybersecurity as some kind of magic armour that would guard our own heels. But we are trying to protect our army, not a single warrior.
The recent Petya attacks compromised a small number of initial ‘beachhead' devices. But it was the interconnected vulnerabilities of the compromised corporate networks that ultimately lead to, in the worst cases, not mere battalions, regiments or divisions, but tens of thousands of machines – an entire corps, in military terms - rendered inoperable.
So plan your defenses at army level. Your attackers may, in a skirmish, compromise a platoon of devices – 15 or so – but your defenses should stop the attack at that level. Engineers understand the concept of ‘crack stoppers' – a method of ensuring that fatigue cracks in material can't propagate to the point where the entire structure is endangered, or circuit breakers that trip to protect wiring and devices from damage.
Your defenses must therefore be elastic and resilient. Your gardens need walls. Then, at last, you can stroll through them, safe in the knowledge that, yes, there is honey still for tea.
