Back to the Future

Part 3: Back to the Future

(Did you miss Part 1 and/or 2? Click here for part 1 and here for part 2 to catch up!)

I apologize for this, but I have to jump back to the beginning again. You see, the Internet was designed during the cold war, and a prime driver was the ability to sustain communication in the event of a nuclear attack. Back then, communication was usually point-to-point. DARPA and many smart people gave us “packet-switched networks.” It meant that a piece of data could flow through different paths and reassemble on the receiving side. This meant if communication hubs were taken out of service between you and where you were trying to communicate, due to, say, a nuclear bomb being dropped, your packets could now travel a different route and your Twitter post about the latte you purchased this morning would stick.

The lesson here is age-old; bolting on security after the fact is always more costly, time-consuming and less effective than baking it in from the start. The first email servers on the Internet were open relay by design. That meant anyone could send email through your email server to someone else. After all, the idea was sustained communications, so if my email server went down, why not use one of the other available email servers?

Unfortunately, as with many well-intentioned plans, it fails to account for bad people. Soon spam became a well-known term to define something other than the delicious food of previous association. Domain Name Services (which translates the web sites we type into IP addresses) is not secure. It has suffered from numerous attacks. The weakness of this core protocol has been known for a very long time and a secure DNS (DNSSEC) was proposed in 2005 via RFC 4033. You can go here to see how that has been going.

In general, the US Root DNS servers were operational in 2010. DNSSEC does not in any way totally fix DNS, as in recent months there has been a rash of DNS Amplification Denial of Services attacks. DNS is just one small area of vulnerability; the list of protocol weaknesses and associated attack vectors is legion.

In short, what we have put in place are insecure computing devices connected together using insecure protocols over a fabric connected to support some of our most critical dependencies and let anyone in the world – good or bad – have access to them.

I remember watching a video with one of the engineers that worked on the initial Internet design and protocols. He stated that, “If you would have told us that we would be putting critical infrastructure on a public network, we would have just laughed – that will never happen.” There was a completely different mindset back in those days. Business standards existed beyond the “want of the moment.” Thought was given to business risk, mostly driven top-down. Today, one could argue business risk is driven bottom-up and in the Information Security world, I would posit that 80-90% of InfoSec programs are driven in exactly that same direction.

About the Author

Martin Zinaich is the information security officer for the City of Tampa’s Technology and Innovation department. The insights in this article were shared at a Wisegate member event, where senior IT professionals discussed these pressing security issues.

Featured

  • AI Is Now the Leading Cybersecurity Concern for Security, IT Leaders

    Arctic Wolf recently published findings from its State of Cybersecurity: 2025 Trends Report, offering insights from a global survey of more than 1,200 senior IT and cybersecurity decision-makers across 15 countries. Conducted by Sapio Research, the report captures the realities, risks, and readiness strategies shaping the modern security landscape. Read Now

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

  • Motorola Solutions Named Official Safety Technology Supplier of the Ryder Cup through 2027

    Motorola Solutions has today been named the Official Safety Technology Supplier of the 2025 and 2027 Ryder Cup, professional golf’s renowned biennial team competition between the United States and Europe. Read Now

  • Evolving Cybersecurity Strategies

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.