President-elect Donald Trump has repeatedly questioned whether critical computer networks can ever be protected from intruders, alarming cybersecurity experts who say his comments could upend more than a decade of national cybersecurity policy and put both government and private data at risk.
Asked late Saturday about Russian hacking allegations and his cybersecurity plans, Trump told reporters that “no computer is safe” and that, for intelligence officials, “hacking is a very hard thing to prove.”
“You want something to really go without detection, write it out and have it sent by courier,” he said as he entered a New Year’s Eve party at Mar-a-Lago, his Florida resort.Wow! Everyone technical knows that the only way to secure a computer is to leave unconnected. And as Stuxnet demonstrated, leave no way to share data with other computers.
If you send it by courier, you're still relying on a computer: the one between someone's ears.
ReplyDeleteClayton, I beg to differ. Back in the old days of the 1980s the CIA did not worry about hacking because they were still using old obsolete IBM 3330 drivers and when they were not in use they removed the disks and placed them in a safe. It was hard to get anything of use off of those computers. Today with flash drives it would be simple to keep the data safe. Just remove the flash drive.
ReplyDeleteWithout 24/7 access, most computers dramatically lower their utility. I am sure CIA's computers were not on the Internet in the 1980s.
ReplyDeleteAnd plug all UDSB or other media ports.
ReplyDeletebut like the courier you come down to trusting people.
"Today with flash drives it would be simple to keep the data safe. Just remove the flash drive."
ReplyDeleteThat is how Stuxnet was disseminated: thumb drives salted into air-gapped computers. Human behavior engineering: find a thumbdrive>>>plug it in to find out what it contains>>>nothing that you immediately see as interesting, but damage now accomplished.
You also have to be sure there are no other computers in the room - air gap exploits have been demonstrated that can read other computers from their electronic emissions as they run programs. It's not easy - but it's possible.
ReplyDeleteAir gaps work really well. The air gap exploit "Unknown" described does not allow hacking - it allows, in very special circumstances, data stealing. If you can get your computer in the room with the target, or hack one that already is.
ReplyDeleteAir gaps fail due to human error - typically, someone plugging in a USB stick. I consider Microsoft to be criminally negligent for, among other things, automatically executing code on removable media without asking for permission. That started causing problems in the '80s and still does. Inexcusable!
Connected computers can be protected, very well protected. The cost is typical of any security system - the more security, the less function and the less flexibility.
But, the Snowden and other Wikileaks events show that most classified information is released by treasonous insiders (Snowden, Manning, etc), not by hacking.
In theory, computers can be made unhackable. They are hackable today because software development has been so fast, and because the economics were strongly against serious investment in security.
Provable algorithms are, literally, proved correct. One could base security on these. But, the cost is large. Someday, the systems will be secure - but who knows, by then all the code will be done by AI systems and we will be their pets.