Computer security story

Clearly, except for a tiny minority of super-conscientious experts, humans aren't capable of maintaining the level of knowledge and especially discipline necessary to keep the computers they operate reliably secure. On several occasions, I've seen hilarious instances of super-smart people with advanced degrees in computing, some of them even security experts, leaving their machines or data wide open to intrusion by some petty accidental oversight.

This isn't limited to computers, of course. For example, Richard Feynman's stories of his hobbyist safe-cracking provide some amusing examples from a previous era. The only way to force people to maintain discipline in security are the old-fashioned military methods, but this requires draconian penalties (up to and including death penalty) for petty negligence.

On the other hand, it can be argued that most people's negligence in computer security is quite rational, in that additional marginal benefit from added security effort wouldn't be worth the (internalized) cost. See e.g. C. Herley, "So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users." (Ungated link here.)

If you think that's terrifying, you should see how easy it is to steal, rape and murder.

I had no idea human-generated computer networks were this insecure. Maybe I should try hacking instead of debating apes.

If even professional security firms are this vulnerable, I hate to think what will happen when the cyber war really starts.

I thought it already had...

HBGary did confess to firing the CMS company that created the vulnerabilities. Apparently they didn't do it themselves.

At a very high level, the problem is almost intrinsic; it is very difficult to stop a determined attacker given the current balance between defensive and offensive capabilities. A strong focus on hardening only makes it expensive, not impossible.

That said, most security breaches like the above are the result of incompetence, negligence, ignorance, or misplaced trust. In other words, human factors. Humans will continue to be a weak link across all of the components involved in security. There comes a point where systems are sufficiently hardened at a technical level that it is almost always easiest to attack the people that have access to them rather than the systems themselves.

How come nobody has pointed out the absurd ignorance of how Anonymous works evident in this? Anonymous isn't a coherent group with a leadership or shared goals it's just a Smart Mob.

The constant small-scale break-ins and attacks, like this one, serve to constantly drive up security on the internet as every tiny new exploit is immediately valuable, and the results are widely publicised. This makes it less likely that a single big attack could have a very large impact.

This is the opposite to what happens when someone builds a damn that can hold back 99% of floods, so people get lazy, then when a top-1% flood comes along it is much more catastrophic than if the damn had never existed.

I'd just like to point out that "anonymous" is a pre-existing term for all people who choose not to identify themselves, so any time a journalist says "anonymous" did something they are merely professing their own ignorance, regardless of whether the A is capitalized or not. That said, the term seems to have become popular among a particularly low-status sort of person, so I advise everyone to use pen names and explain their unidentifiability in complete sentences.