ShadowGeek

Net-Security.org had a story on a recent exercise regarding the US’s ability to detect and defend against a cyber attack.  The article starts with:

The inability to deflect even a simulated cyber attack or mitigate its effects shown in the exercise that took place some six days ago at Washington’s Mandarin Oriental Hotel doesn’t bode well for the US.

It begs the question, does the US Government have an obligation to defend the US from cyber attack?  I don’t think… maybe I’m wrong, but I don’t think there is anything in the Constitution stating that the Government has an obligation to defend against cyber attack.  If the US Government took the necessary steps to detect and defeat a cyber attack, then Government would be accused of interfering in business and spying on its own people.  To detect a cyber attack, you must have a way to monitor internet traffic.  The Government would have to instrument the internet, including the servers at your ISP.  If they did so, there would be a public outcry that it is an invasion of privacy to monitor everyone’s internet traffic.  As a nation we will have to choose either privacy or cyber security, you technically can’t have both.  And I’m not sure if it is even the role of the Government to protect individual citizens or corporate networks.  I agree that they should protect government networks, but beyond that it gets very difficult to justify that the benefit outweighs the risks.  It should be a corporate or individual obligation to protect your own computer.

So the exercise demonstrated that we can’t survive a cyber attack.  Not really a surprise, now is it.  It is a real threat that we should not ignore it, and it makes sense that private businesses should combine their efforts to defend the corporate networks of the US.  I suspect that much of this is actually happening behind the scenes.  Let’s hope that they do, and we can sleep soundly… on a mattress stuffed with money (just in case).