Home Insecurity

I came upon an article entitled: "Shifting cyber threats menace factory floors". It's about security, or the lack there of, for plant floors. Now I think the article is a little sensationalized (FUD) but it does point out one of the biggest problems computers and the Internet are facing everyday, security (or the lack there of). OK, now a quick history lesson (with lots of details dropped).

• 1950's - 1970's, Years ago mainframe and mini computers were built with security in mind. These systems tended to be more secure to protect the investment and keep accurate billing.
• 1970's - 1980's, The initial PCs didn't need billing because it was meant to be used by only one user. Nothing in the way of security was added. Getting a virus becomes a problem. Mini's shrink to the desktop, Unix becomes popular and we start to see Trojans and root kits.
• 1980's, Industrial Automation takes off and with it networking the factory. Security wasn't needed because you needed physical access to the network and special equipment. The network wasn't connected to the outside world.
• 1990's, The Internet (as we currently know it) is born. Everyone and their brother is getting on the Internet. They don't practice Safe Hex and continue to get viruses and other nasties. TCP/IP is the network of choice. The corporate world begins to heavily network everything they have. Security is still not much of an issue with Microsoft but starts to become more of a concern as they move away from the single user, single process mentality.
• Late 1990's - Today, Microsoft is try bring security to Windows and though they have steadily improved they fail because too many applications have their programs tied into the OS (IE for example). Today we need to contend with viruses, Adware, Trojans, and zombie machines. And to make matters worse your can go anywhere and gain access to anything because everything is networked (even secure networks experience these problems).

So what does this have to do with HA? Plenty! Much of today's HA software runs insecurely across TCP/IP networks. Even some of my own HA software is configured to only accept connections from certain hosts but doesn't require the user to present any valid authorization. The software that does require authorization uses plain text passwords (easily sniffed on the network).

The worst problem of all, end users who think they don't need security. Their usual response is: 'I don't have anything of value for someone to steal.'. My response: 'Yes, you do! Access to your machine.'. It's those very idiots who have the zombies and Trojans on their machines. Which, in turn, help send out the SPAM email, run as porn servers, help distribute pirate & Trojan/Zombie software, and are used in a DDOS to further infect other poorly administered machines.

So what can we do? Well each of us will have to work on our own little portion of the HA equation. Hardware developers need to add more security to their controllers, software developers better authorization, system designers need to change their design mindset, administrators better system maintenance, users less blase attitude. And OS vendors need to do a better job of providing a more secure product (that goes for *nix vendors too, not just Microsoft).

We need to keep up with the attack methods, we need to correctly build our home networks. The first line of defense, an external Firewall router, a good switch, PC's that are up-to-date with their system patches, virus & adware software (Windows), software firewall (correctly administered) and unneeded services disabled. And end users that actually pay attention to the EUL before they install 'that great game'.

As homes require more administrative work I think we'll see more people purchasing administrative services to maintain their PC's. For the rest of us, we have a lot of work to do. And maybe we shouldn't dump it all on the end user!