Every day someone (or... something) with 218 dot et dot cet dot era out of China intently checks my TCP port connectivity. Relentless, time after time, again and again it seeks what I do not know, just that it signifies.
Cut us a break? Not likely.
Good old 218 (we're on a first octet basis) and his kin know that the herd, large and lacking vaccine, eases the pursuit of new zombies and kindred grift keep those who are far, far, more than "script kiddies" hard at work.
More than to get through spam filters (v149ra, 'frinstance or his sister of ill repute, C. Alice) or help to facilitate commercial dealings involving so often the sad demise of the spouse, uncle, client, former ambassador... tragedies all. I never knew how much wealth sloshes around as the result of corpses. Ambulance chasing seems quite profitable.
"Make Money Fast" now like a Madeline evokes the time and place of a 14.4 "golden age" before a simple "delete" command would be replaced with protocols that put a Level 4 Biohazard facility to shame (and this hinkey mess o code just for a desktop!)
Nothing to see here, move along!
Richard A. Clarke, of US National Security fame, describes in his new book "Your Government Has Failed You", the results of a security exercise with Department of Defense systems. White hats commenced to do that hoo doo that they do so well... and pretty much it was "game over" in a trice: penetration aptly describes what happened.
The guvment got Intrusion monitors installed. They lit up like Bay Ridge Brooklyn on Christmas Eve with all sorts of dubious packets from UnKn0wn U53r types. Clarke quotes managers telling him that until the hoods started setting off the intrusion alarms there had never been any putative bad guys. Somehow the security tech now attracted the bums, etc. Familiar story that I'm inclined to believe.
He also advocates a partitioned Internet, hardening part of the services for secure transactions and communications.
I've been there philosophically myself; and nonetheless am avidly in favor of an unrestrained Internet as well. No hobgoblins here.
The company I was with in 2001/2002 had a trusted client server implementation that did very serious authentication (non repudiation, yadda yadda rather like Moody Blues lyrics, those shalts and shants in them there specs ballyhoo optional). Pretty much good 2 go, add Series A and shake. Well, we had the hip but not the audience.
But the big deal was that our technology needed a pretty well suborned geek to break it (it wasn't open source, and in that I now trust it less but I'm just sayin'). It kept things nice and shiny and very private as an overlay to the Big I at large. Other Big Problem though comes from oceans of distributed data.
In a world: Queue Don LaFontaine
In a world where everything moves to an emergent ad hoc architecture of networked promiscuous storage services, where devices (picture frame, 1Gb wrist bracelet, virtualized server storage complexes, distributed p2p/p4p, DRM, TiVo, and even instrumentation motes reporting on movement of RFID tags and small area hydrology and nitrogen measures, etc.etc. containing massive amounts of data) often in surprisingly readable formats.
In a world... where consumers have started to put health records within the uberplexes of Microsoft and Google (getting the providers en masse to adopt it, different problem) and the concept of insurance moves from shared risk to, well, greed seems a good word.
In a world... where the laptops of one government are targeted and tossed (usage as in noir cant) for records of another government's dissidents and the bon mots of "gentlemen do not read each others mail" have no standing...
In a world where the retiring Secretary of Health and Human Services says "For the life of me, I cannot understand why the terrorists have not attacked our food supply because it is so easy to do." (NYTimes, December 2004)
In a world where a friend takes an extended business trip, returns to find that his kids have made five movies and posted them on YouTube from his Mac.
In a world where cameras come free with the printer, and a postage stamp of silicon tells me I'm on shot one of eighteen hundred.
Trusted Infrastructure Elements
So, here's where it goes, maybe. I have two things: things one and thing two.
Ubiquitous One Time Pads: All private, all the time.
Perhaps standing the security and privacy on end makes sense. Processing cycles and (good grief I actually typed core but stet!) core become pretty inexpensive, so running an algorithm to encode everything might not be a bad way to go. Heck, with some of the new word processing file formats alleging "open" protocols we seem to be half way there already; I can't open the attachments. We already see the unit costs of solid state "drives" precipitously dropping; headroom for small processing to encrypt onchip data could be a value added feature. The great thing is that these solid state devices are so small and hold so much data. The problem is that these solid state devices are so small and hold so much data.
Distributed Spread Spectrum Storage Service
Pseudorandom multi channel information paths, with a "big enough" local store to allow for unreliable networked service. The signal (information) hides in the noise. A form of this unreliable network appears as "The Byzantine Generals" problem, specifically Byzantine fault tolerance, wherein unreliable communications mechanisms become designed "around". Reason for this part of the puzzle is that there's so much data in so many places (cheap, dense, ubiquitous) that the use case for managed services around security and recovery needs to account for mobility, and placement of user data in many places. Key point though, is that a number of public and private researchers have been going at the reliability from unreliable infrastructure for a good while now (like, even ARPANET embodied this meme) and those wacky folks at Bittorrent (for example) have large amounts of distributed secure services in their beginning gene pool plus the understanding of how to reliably place data all over whilst maintaining service levels. If the Bit folks seem too edgy, then take a look at the Akamai technology model, and throw in a dose of Meraki Networks or perhaps Spain's FON.
Point is, seems that "the industry" has a pretty solid base of knowledge in sundry places that can be applied to the secure distributed data problem, and that the notional risks to private data help to monetize the innovation's value. The architects/designers Ray and Charles Eames explored the concept of "kit of parts" for building; I think that much of that "kit of parts" exists in the public domain and will be amended with patent expiries over the next several years.
Your Mileage May Vary
That vision above, if it merits that moniker, ignores some Big Problems like distributed key management for starters, twenty volumes of USENET rants about Pretty Good Privacy (PGP), in band versus out of band control, and a whole lot of other things. I believe the joke ends with the physicist saying "we've solved the problem for a sphere." Managing distributed data "in a world" of ubiquitous storage seems the next grand challenge.
Good hunting.
