|
| Information Security This Week (EU-IST) | ||
| Published | 06 June 2006 | |
| Editor | Urs. E. Gattiker | |
| ISSN | 1600-1869 | |
| Related Links |
Cyberthreat alerts are coming too late for citizens and SMEs to protect themselves |
|
| National alert systems - too little & too late for citizens and SMEs | ||
| As the OECD's 2005 report suggests (see 2nd related story), broadband usage is increasing rapidly across industrialized countries. Moreover, IPv6 will further increase the use of IP addresses ranging from your computer, stove, fridge to your mobile and so on. But how are citizens and Small and Medium-Sized Enterprises (SMEs) supposed to protect their home networks and information assets against these attacks? Put differently, do current alerting mechanisms warn them early enough? |
||
| To answer these questions it is necessare to point out and as discussed further in the brief: 1) the number of zero-day exploits that could severely damage affected systems appears to be on rise, and 2) early warning systems helping home users and SMEs appear to be late in responding, especially on long weekends, and 3) it is not always clear why certain alerts are being released and about others nothing is being said (or who is the target audience and why?) Not helpful is, most certainly, if alerting systems funded by public moneys appear to duplicate vendors (e.g., providing virus alerts). In other cases, agencies to not seem to provide warnings with a clear logic behind it such as who do we serve and if 90% use this software we must warn them quickly. Instead, one does sometimes fear that agencies may issue warnings if the event happens during working hours and pretty much ignore it if its outside these hours, at least if they feel they can get away with it... otherwise the laert is late, see above. |
||
| Unfortunately, hackers and malicious users do not have weekends nor do they necessarily take vacations. Moreover, while larger organizations do get their warnings, citizens and SMEs are often left to their own devices. This unsatisfactory situation does neither improve trust nor confidence nor creat a culture of security. Neither may huge cross-national efforts help here very much. Instead, nationally targeted alerts for specific user groups must be issued quickly and without much political baggage (remain vendor neutral but issue an alert even if some groups may not appreciate it) nor technical language. This brief outlines the difficulties and suggest to European citizens what they should demand from their governments to get this situation rectified. A lack of such a system for citizens and SMEs that function properly as discussed in this brief is a diaster in the making unless we improve preventive measures (see related Link Cyberthreat alerts are coming too late for citizens and SMEs to protect themselves). |
||
| TIDBIT Several countries have alerting systems but it is not clear whom they serve (large users or citizens). Even if they are supposedly serving citizens and SMEs, during weekends or non-business hours things do not seem to work properly. How else can we explain that zero-day exploits are either not reported about or days late. With certain attacks spreading around the globe within hours, can such a not too well functioning system be acceptable? National disaster management deserves a better effort to prevent a cyber Tsunami effectively for the benefit of citizens. Because once such a Tsunami happens, restoring trust will be time-consuming and costly while jeopardizing future use by a large part of the population of e-goverment and e-health type of servides. |
||