IT security for real

.

Imagine your country's economy can be switched off by another country. Further imagine that also much of private life can be switched off by another country. Let's say that other country has half the voters flirting with fascism. Would you feel that this is an existential threat to your country and its sovereignty?

Well, we're de facto living this nightmare already.

- - - - -

Every autoupdater for software is technically a backdoor through which the software company can change software on your computer.

Every operating system with an autoupdater function (hidden or overt) can take over the entire computer with ease, unstoppable by all security features. The same applies to server software.

Example: Microsoft could - compelled by the U.S. government or on its own - switch off the economy of Europe with malicious non-optional updates for the Windows operating system and the Windows server operating system. The latter could even erase most backup data. Operating systems can also permanently damage the computer hardware, turning a data loss into a catastrophic nationwide loss of computers.

I consider this an unacceptable vulnerability for government and economy, and very undesirable for the private sector.

To increase the robustness of a nation against such an attack is simple; move from trusted software to trustworthy software.

It would be easy to mandate that no federal government institution is permitted to purchase or install software that's not on a whitelist without a temporary waiver by a properly staffed and competent agency. The whitelisted software would all be certain open source software. Open source (source code visible to the public) alone is not good enough. You also need proper audits of the open source code, timely audits for patches, a regime how to handle extremely urgent hotfix patches and the audited and later not manipulated source code either has to be compiled directly or the installation-ready version has to be available from a secure and trustworthy source. For-profit software providers (this is feasible with open source software in some ways) would have to pay for the thorough security audits. This would incentivise them to create lean code (for cheaper audits), and lean code can more easily be kept safe than bloated code anyway.

This would effectively lead to offices running Linux and OpenOffice rather than MS Windows and MS Office. Both are available for free and would even save the government much money.

This IT security regime could diffuse to state governments and be extended (with enforcement) to selected businesses such as hospitals, infrastructure providers and arms industry. Further incentives to harden the economy against catastrophic IT sabotage could be non-mandatory and still effective, such as making companies liable in court for damages caused to others by their non-secure IT. This also includes liability for damages when you use outdated software commercially.

The multinational level (EU) can go even further, and force suppliers of software that runs on non-secure operating systems to offer a no higher-priced and no worse version of their software for a whitelisted operating system. This would help private users to migrate to secure operating systems and secure applications.

Likewise, hardware may be extremely insecure. It's very difficult (=expensive) to look into the logic of chips. Yet chips and other electronics components (which may include chips without seeming to do so) are a severe security hazard themselves. They may have non-removable functions that compromise security.

To increase the robustness of a nation against such an attack is simple; move from trusted hardware to trustworthy hardware.

This is less practical than with software, but at least critical government departments (including the military) and critical businesses (especially infrastructure providers) could move to whitelisted hardware, for which design plans are known and which has been produced in a trusted place (for Germany this would be Germany, for Luxembourg this would be most EU countries) based on those design plans. It's acceptable to lag behind in performance by a few years, most government computers do so anyway. The trusted production facility would thus not require the newest chip manufacturing technology. Again, a 100% implementation of such a security regime would be impossible. There would again be a need for an authority that can and does give temporary waivers, but not too liberally so.

- - - - -

Next, encryption should be mandated for many activities, and this encryption should be based on a preferably quantum-proof encryption developed without interference by government spy agencies and their helpers. I mean encryption without intentional weaknesses. Furthermore, certain particularly sensitive communication (and archives) should feature one-time-pad encryption, which simply cannot be broken if done right. To establish such encryption standards and to enforce them through outlawing products that are in violation (with sellers forced to reimburse buyers fully), through inspections and fines and through legal liabilities would be feasible on the nation-state level.

- - - - -

The EU's talk about digital sovereignty is largely bollocks. They do so very little about security issues (and in fact multiple governments in the EU keep weakening security in order to be able to spy more easily themselves) that I have but one conclusion; their real motivation is not "digital sovereignty" or IT security, it's to deny the rent-seeking American software companies dozens of billions of turnover and profits. It's more of a transatlantic economic policy wrestling than an IT security initiative.

The EU might achieve all it wants to achieve with its "digital sovereignty" stuff and in the end MS could still switch the European economy off, and not just for a few days or weeks.

 

No invisible hand of markets establishes satisfactory IT security. We would require decisive action by politicians, and this is very largely (the software & encryption facets) feasible on the national level.

 

S O

defence_and_freedom@gmx.de

.