An interesting request, one that I second. A lot of work will be required, along with a lot of cooperation and a lot of time.
It's Time for a Trustworthy Internet Initiative
Trustworthy Computing was a sea change for Microsoft. Remember that throughout the 1990s and early 2000s, Microsoft subscribed to the "more is always better" philosophy for software design. So when Windows 2000 popped up, the IIS web server wasn't just installed by default, it was also enabled by default, and it wasn't configured in a particularly safe way either. This was purposeful, as Microsoft wanted people to discover and use IIS. But it was insecure.
Today, of course, Microsoft is a different company with a different outlook on security. And the hacking landscape has changed with it: As Microsoft's dominant OS has become more hardened over time, hackers have moved to lower-hanging fruit, first with Microsoft's popular Office applications and then with third-party applications, especially those from Adobe.
And that's the problem: Despite Microsoft's high-profile switch to a more secure development process, and despite documenting the changes it's made so that others could make similar changes, most software makers, virtually all of them in fact, haven't caught on. And as we move into a new generation of ever-connected systems and cloud services, our exposure to vulnerabilities—or what Microsoft calls the attack surface—has grown exponentially.
I'm thinking of course of the recent high profile Anonymous/Lulzsec hack attacks on AT&T, Fox, Sony, various US and international governmental organizations, the Arizona State Police, and others. Suddenly, the world is being held virtual hostage by what appears to be a loose knit (if not totally disconnected) group of disaffected teenager and young adult loners. One perhaps imagines them sitting in their parents' basements, peering at their monitors over giant cups of Mountain Dew or whatever. But you can forget these outdated stereotypes: Today's hackers have a much richer, more connected, and more damaging set of computing resources to attack. And they're doing so with gusto.
It's time to stop them. And what's required, I think, is an industry-wide agreement to do for Internet- and cloud-based computing what Microsoft's Trustworthy initiative did for the software giant. That is, we need a Trustworthy Internet initiative.
The first hopeful sign in a new version of the Domain Naming System (DNS) called Secure DNS, or DNSSEC. This scheme, which is being tested in Singapore, is perhaps the model for the future Internet. It's based on three secure data centers, in Singapore, San Jose, and Zurich, which are protected by five layers of physical, electronic, and cryptographic security. According to a report in the New York Times, four of the five layers are now in place, with the fifth, the physical security, now being built.
And if your understanding of Internet history is up to date, you'll appreciate the irony here: The Internet was of course designed to ensure communication in the event of a nuclear disaster, so it was designed without a center, or core, and is instead distributed with a means for messages to continue seeking alternate routes until delivered. But this resiliency is what now makes the Internet so insecure, since it provides the bad guys with many ways in which to hide their identity and pose as others.
However it happens, I think it's time for mankind to step it up collectively, work together, and fix what is very clearly a broken patchwork built on an insecure foundation. As with a growing body of other issues—global warming, the food and water supply, and global nuclear security—this is a problem that increasingly affects us all.
