Sunday, October 17, 2010

Networks: fragile to ubiquitous.
Users: stupid as ever.

In The Cuckoo's Egg, Cliff Stoll describes the Arpanet as a collection of fragile relationships built on trust. As the Arpanet has long since been superseded by the Internet, the fragile trust that networks were once built upon has been superseded by the need for information. No modern university could justify lacking internet access on grounds that a hacker might infiltrate their systems, and most homes and businesses find that the benefits of the internet well outweigh any risk of intrusion. However, the digital community has had a cultural revolution since Cliff tracked the KGB informant crawling his network. In the days of Cliff's hacker major security holes went unpatched for years, but now operating system and user software vendors distribute patches via the internet within days or even hours of discovering a vulnerability. Most vendors even bundle tools that automatically find, download and install updates for their products to simplify the process for users.
Although the issues of networks and trust have evolved since the days of The Cuckoo's Egg, issues of poor administration and careless users have not. Software, no matter how secure, can't protect a user who's stupid enough to download and execute an email attachment from a stranger. Security measures in an operating system are worthless if the systems manager does not understand how to use them. People still pick common words as their passwords despite decades of knowledge of the dictionary attack. Others use a pet's name, their birthdates, or other information available to anyone who reads their Facebook profiles. Software has yet to completely protect against user stupidity, and I doubt it ever will. Additional security measures will never make up for users' ignorance, so when will internet safety make its way into the education system? When elementary school children are trained to recognize suspicious emails, websites and files, those children will become the first generation of responsible computer users.

No comments:

Post a Comment