Secure the Homeland

In March 2022, the Biden administration announced that cyber attacks from Russia were imminent. Although this is untrue, it shines a light on how unprepared the federal government and the rest of the country are for a nation state attack.

A nation state attack is exponentially more serious than ransomware. Unlike ransomware, a nation attack does not attempt to extort a fee to restore operations. It simply destroys without regard to consequence.

More importantly, a nation attack accelerates the frequency and sophistication of the attacks. For over a decade, the United States, Russia, China, North Korea and Iran have been stockpiling vulnerabilities in the event of a cyber war. This is the reason why a cyber attack is NOT imminent, because Russia knows that America likely has a larger stockpile with more severe consequences.

When the Americans shut down 3 Iranian nuclear reactors and Russia shut down the Ukrainian electric grid, each of these attacks were accomplished through one vulnerability. The WannaCry virus infected 250K computers in one day through one vulnerability.

Any nation state, and most certainly Russia, has dozens if not hundreds of these vulnerabilities. Rather than one vulnerability, a nation state attack would deploy numerous vulnerabilities simultaneously entering unobstructed into every server and endpoint and any other device that contained critical information in the nation.

The first line of defense is patch management but this is wholly ineffective because patch management works with known vulnerabilities and these vulnerabilities are unknown by design.

The next line of defense is the antivirus which has not functioned against modern threats for almost a decade yet consumers and businesses and even the federal government blindly throw money at this obsolete vestige from a prior era of computing. So the attack continues.

The last line of defense is EDR / XDR / Zero Trust, which attempts to detect and respond to the full frontal onslaught nation state attack. Unlike ransomware, a nation attack would overwhelm the SOC (Security Operations Center) and it would quickly fall down.

This exposes the largest flaw in the nation’s defense. EDR / XDR / Zero Trust / SOC cannot scale to meet a spike in attacks. For a SOC to double in size, would take months, and a nation state can increase its attack level in seconds.

As stated earlier, this is not going to happen due to a respect for America’s vulnerability stockpile, however our defense frameworks should consider the possibility of a nation state attack. Unfortunately, none of the popular frameworks including NIST, MITRE and even Jack Voltaic comprehend the possibility of a nation state attack.

The first nation to contemplate in its national defensive cyber strategy the impact of a nation attack will win the cyber war. The first nation to effectively create cyber defenses that negate a flood of vulnerabilities attacks from a nation state will rise to the top of the world order, because it is no longer exposed to a cyber counter strike.

There is a solution and that is application whitelisting, AKA allow listing or software asset management. As NIST has been recommending for the last 7 years, application whitelisting should reside between the patch management and the antivirus layers. In this way, during a nation state cyber attack, the application whitelisting will strictly allow authorized applications to run. During this scenario, the volume on the network is substantial and network performance may deteriorate but it will not fall down. Some new good programs may not run properly until the attacks abate, but the goal is resilience, to withstand the attack.

This resilience gives patch management time to identify the vulnerability and remediate the vulnerability so the attacks abate. The nation state will likely deploy more of its stock of vulnerabilities which should also prove futile. At this point, the nation is deploying vulnerabilities faster than it can replenish, until the stockpile falls to zero. Then America wins.

Secure the Homeland.

Can the Government Control the Weather?

I believe that the temperature is getting hotter. It is not hard to figure out, and this year was quite hot and had many months the hottest on record. About a decade ago, the Koch brothers of Koch Industries, perhaps the largest polluters in the country, realized that climate change and subsequent government regulations were a threat to their business. They began pouring their profits into politicians that would deny that climate change was even occurring. When you hear a politician ranting against the existence of climate change, it is not what they really believe. It means that they are being compensated for publicly stating an opinion different than what they hold. Two great examples are Mitch McConnell and Mitt Romney.

This is unfortunate because it hurts the Republican party and the country. There is essentially world wide consensus that the climate is changing and that it is man made. It just makes everyone look stupid. It also precludes the more important debate, “Can the government control the weather?”

There’s a lot of people that think so, but I do not. The idea is that if the government can regulate and police people and businesses, that temperatures will go down. There is no evidence that this is even close to being true. Many countries have implemented some regulations and there has been no impact on global warming. Either the necessary regulations need to be so totalitarian that no one would implement them, or the entire premise should be invalidated that the government can regulate and police its way to changing the weather.

Don’t believe me? We have another great example staring right in front of us. Think about the war on drugs. It seems like a good idea. Drugs are harmful to the productivity of society. We can make the consumption and sale of these drugs illegal and the government will police it. Richard Nixon did this in the early 70’s, over 40 years ago. Today, we have more people in jail than all the nations on earth combined. Illegal drug use is common place, and the price of these drugs are amazingly affordable. Plus, the drug lords in Colombia and Mexico run rampant and outside of the law, wreaking havoc on these societies. We are stuck in this harmful infinite loop, where we don’t have the conviction to stop the war. So we just keep on going harming our very own citizens and the countries around us.

This is exactly what will happen with global warming if we begin to introduce regulation. It will fail and temperatures will continue to rise. So what do we do? We will have more regulation, still with no success. And then we will have another expensive and harmful federal policy that we will be unable to admit failure.

The war on drugs should be a lesson to all of us. There are limits to what the government can accomplish no matter how good the intentions.