A group of pioneers in the security field, whose work in encryption is used to protect internet data and communications every day, spoke about the state of security at a cryptographer's panel at the RSA security conference in San Francisco on Tuesday.
They tackled various questions about cybersecurity in general, but the topic that dominated was cloud computing.
"Cloud computing is a challenge to security, but one that can be overcome," said Whitfield Diffie, chief security officer at Sun. "I believe cloud computing will get to [the point] where no real program... will be done anymore on the computers of the company that's doing it," he said.
"I'm worried about cloud computing," said Adi Shamir, a computer science professor at the Weizmann Institute of Science in Israel. He explained that while a virus or other problem on a desktop computer can be a big annoyance, computation centres in hosted computing could spread problems more widely.
Bruce Schneier, chief security technology officer at BT Counterpane, said: "I'm kind of bored with it." Scneier said that although cloud computing is presented as a new paradigm, fundamentally he did not see a lot of differences between it and client-server and dumb terminals. "It's still all about trust," he added.
Ronald Rivest, a computer science professor at MIT, predicted that cloud computing "will really be a focal point in our work in security." "I'm optimistic about cloud computing," Rivest said. "I think a lot of us have hard work to do."
Asked about their thoughts on the likelihood of a 'Digital Pearl Harbor', the researchers concurred that the threat is hyped.
The talk about risks of a cyberattack on the magnitude of a Pearl Harbor strike is overblown, said Schneier. The real threat "will be boring things" such as viruses, identity theft and buffer overflows. "We're better as an industry if... we look at the more common risks... that cost [people] money."
"We're more likely to suffer a digital 9/11," said Diffie. Pearl Harbor was an attack by a known entity as opposed to an unknown threat from a mysterious source, as cyberattacks tend to be, he said. "I think we could suffer some astounding event," he added, noting that there was an electricity blackout in the 1990s and a severe telephone outage in the 1980s due to a bug.
Shamir said cyberattacks should be put in perspective and compared with other events that can have even more serious consequences. "If the government has extra money to spend they should spend it on regulating the financial markets and not spend it on regulating cybersecurity," he said.
Martin Hellman, professor emeritus at Stanford, said he has been focusing on nuclear weapons security lately and looking at how risky nuclear deterrence is with his NuclearRisk.org site. It is "at least 1,000 times riskier than having a nuclear power plant located near your home", he said.
Technology "has given human beings power that has historically been reserved for the gods; the ability to create new life forms, the ability to destroy civilization, and the potential for creating unbelievable co-operation or unbelievable chaos," Hellman said.
"Our species is like a 16-year-old with a new driver's licence who somehow gets his hands on a 500-horsepower Ferrari," Hellman said, adding that people need to learn to control their impulses or risk destroying everything.
Talkback
The Internet was designed as a high resiliency system built out of strategically disposable components. Each element was envisaged as a self contained, autonomous unit that could look after itself, and/or talk to as many of the rest of the elements as possible. The Cloud however, as an approach, is exactly the opposite.
99.9......% of the time there will be no national outages or wars, and the majority of the time there will be no outages of any kind. Under these circumstances either system can be as functional as the other. That's not the point. If you design computer systems with the assumption that nothing will ever go wrong, you will design systems that will probably get you sued!
We now have the technology to extend the Internet system resiliency approach up to the application layer in a high quality, low cost way. We've been able to do this for a while, but only more recently has the cost come down to the point that households and SMEs can afford it.
The question is Self Hosting vs. The Cloud.
I see no good reason to trust the usual big boys with my private and business information. They have no overwhelming reason to treat my case as anything other than a nuisance if something goes wrong.
The choice is your I guess folks :-)