this post was submitted on 26 Feb 2024
113 points (96.7% liked)
Technology
58306 readers
3209 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The United States is woefully behind in almost every area of cybersecurity both defensive and offensive. While the FBI is quoted here, the international cybersecurity community would most likely agree. China has more bodies than Russia and is able to field a larger presence. The NSA is a shell of what it once was and the ability of the US to pull of something like Stuxnet again would only be possible through allies like Israel.
While more money has been thrown at the problem, the US still lacks the people. Quantity has a benefit over quality here if you have 1 blue force for every 15 red forces. Cyber attackers only need to get an exploit running once for success. Defenders need to stop exploits every single time.
Add on to that very strict requirements for US persons to be able to legally conduct offensive cyber actions (clearances) and relatively low pay compared to security research or information security careers, you quickly get to a point where you take what you can get, especially when you're down to 76% of your ideal manpower
https://breakingdefense.com/2023/08/how-dod-is-thinking-outside-the-box-to-solve-its-cyber-workforce-challenges/
The DoD’s initiatives are coming way too late. Private industry is much more lucrative and without a pipeline like, say, Unit 8200, there’s no hook to pull people in. Thirty years ago when the NSA controlled the entire stack, math to hardware to code, it was a different story. In undergrad I regularly attended lectures by mathematicians who were finally able to talk about combinatorics problems that had been classified for 20+ yr. The genie is out of the bottle.
I’m in cybersecurity and voraciously consume everything related to it. I’d be really curious to know what you’re reading that says the US is capable of anything beyond social engineering.
Edit: really good example is the rampant infiltration of malware into critical infrastructure in the US, something that would have been unheard of until the late 90s/early 00s. Hell, the Silk Road was only taken down via social engineering and gross misconduct was completely missed.
That’s okay! The literature and the international cybersecurity community explicitly disagree with your naive assessment that “billions means we have capabilities” and the total lack of defense for critical infrastructure highlights how all of that is spent poorly. I don’t need to go out of my way to try and convince someone on a government contract doing nothing because neat attacks like the Colonial Pipeline and Pegasus prove my point!
NIST also pushed DES after it was known to have been broken. Granted NIST-800 does actually match industry standards but that’s only because the NSA can’t weaken it without raising eyebrows.
Since you bring up Sandworm, that’s a great example of proving my point. Not the US.
You can’t call Colonial “cherry-picking” and then say that critical infrastructure is a known vulnerability no one can defend. It’s a great example of, once again, my point because Russia has already taken out grids multiple times and we still have no response. If you say the feds got Volt Typhoon I’ll point to plenty of other attacks on US companies they didn’t foil.
Show me the equivalent US attacks on Chinese, North Korean, or Russian targets. Show me the constant prevention of not attacks on government targets but private targets. Show me the diversion of academic resources and constant publication pulled from universities because of its classified nature. Show me a government that pays more than private sector with its pick of the top. Show me a private sector known around the world for its cyber capabilities.