Equilibrium Networks

There’s been some buzz (see here and here) over the deputy SECDEF’s comments last week:

“Individual users who do not want to enroll could stay in the ‘wild, wild west’ of the unprotected internet…I think it’s gonna have to be voluntary…People could opt into protection – or choose to stay out. Individual users may well choose to stay out…But it’s the vulnerability of certain critical infrastructure – power, transportation, finance. This starts to give you an angle at doing that.”

The idea that deploying Einstein more widely is anything more than a step towards a government-sponsored security monoculture escapes me. There is no way that this will get any real traction because it’s not like the USG can credibly claim that its own networks are secure. If Einstein is free, then companies might use it. But that’s about as far as that goes.

Other stuff:

“the vast majority of vulnerabilities, both client-side and server-side, are being sold for less than $5,000″

Point: “some of the most alluring approaches to assuring information security [and] why they fail to make a difference to regular users and businesses alike”

Counterpoint: “blaming security engineering for the impact of targeted attacks is a herring as red as they come”