Tales of Ordinary Madness

When I was at SANS Orlando, I realized that the gap between GREAT Information security and good Information security people is big. Recently, I learned that the gap between good security people and bad security people is GIGANTIC.

Thank you, that is all.

From the 2004 Sourcefire calendar.

The intelligence community has publicly stated its assessment that nations, including Russia and China, have the technical capabilities to target and disrupt elements of the U.S. information infrastructure, or to use that infrastructure to collect intelligence and other kinds of information. Nation states and criminal groups target our government and private sector information networks in order to gain competitive advantage in the commercial sector, as well as in the area of security. Terrorist groups, including Al Qaeda, Hamas, and Hezbollah have expressed the desire to use cyber means to target the United States. Criminal elements continue to show a growing and alarming sophistication in technical capability and targeting, and today operate a pervasive, mature economy in illicit cyber capabilities and services that are made available to anybody who is willing to pay.

The reality is that cyber attacks aren’t decreasing. They are increasing in frequency, sophistication, and scope and this has major implications for our national and economic security. So, how do we protect ourselves from malicious activity whether it is criminal in nature, whether it is an extension of state power, whether it is government or commercial espionage, or whether it is routine hacking by people who are interested in showing their cyber hacking skills to their friends. The answer is a comprehensive cybersecurity initiative.

Remarks by Homeland Security Secretary Michael Chertoff at the Chamber of Commerce on Cybersecurity October 14th 2008.