To: David O'Berry who wrote (29939 ) 1/17/2000 12:14:00 PM From: PJ Strifas Respond to of 42771
Computer System security can not be bound within ONE program or ONE component. If you look at security outside of cyberspace, you will notice there is NO vault that is completely secure, no fortress unpenetrable either. In fact, it's not ONE component that makes any place "safe" from unauthorized access but rather a composite approach. What makes Fort Knox so secure is the layer upon layer of security sub-systems interwoven with detection systems. We know what the response will be, the consequences of being caught and that combines to create something called deterance. Cyberspace needs to develop the same culture if you will. Products and services need to be created in layers to provide trips/alerts/alarms which then bring a concerted response. Once caught, there needs to be consequences severe enough to deter others from doing the same. Of course there's one HUGE caveat to this "theory" of mine - what jurisidiction would all this occur in? Until there is a global awareness and cooperation in enforcing "rules of access" if you will, there is very little hope that you can create a system which can be considered totally "safe". Anyone who wants to argue that the connectionless nature of IP can mask someone's ID and location needs to remember that the most prolific tool used to combat this are honey pot systems (systems created with less security where "hackers" are contained, observed and their MO is documented for intrusion detection). It's my opinion that combining honey pot systems with a powerful disinformation plan can be a very powerful combination in taking an active approach to computer security. "Hackers" depend on newsgroups, websites and other sources to gather INFORMATION on systems (weaknesses, workarounds, hacks etc). If you can contaminate that information source, it becomes less reliable. That will eliminate the "casual hacker" - people who do it for the fun, excitement, etc. The professional hacker - one who gets paid to break into systems - that's a different animal all together. Just like the professional thief, you need some luck to catch that one. Regards, Peter J Strifas