Security Experts Testify in Washington

September 10th, 2007

How worried should home PC users be about hackers? On a scale of 1 to 10, with 1 being carefree and 10 indicating paranoia, PC users should be a 6 or a 7, a security guru told a legislative panel.

They should exercise healthy caution, added Daniel Farmer, security consultant and co-author of SATAN software, used to test site security.

Farmer, one of six experts testifying before the House Science Subcommittee on Tuesday, said he broke into more than 70 percent of the 2200 Web sites he looked at last year. The sites contained services such as electronic mail, Internet news, and user accounts.

Using the most simple tasks, I could easily compromise systems, including
the White House Web site. If the CIA can’t keep security, who can? Farmer asked.

Panel members agreed that most people don’t realize how unsafe electronic information can be.

We’re becoming increasingly dependent on non-face-to-face technologies
and we misuse them, said Tsutomu Shimomura, a senior fellow at the San Diego Supercomputer Center and co-author of Takedown, a book chronicling his pursuit and the capture of computer criminal Kevin Mitnick.

Part of us wants to trust electronic mail because we say, ‘But it comes from my computer,’ Shimomura said. But it’s not trustable and we use it as if it were.

Fortunately for home PC users, the relatively low processing power of their systems
(compared to business networks) plus the use of larger Internet service providers can provide some security.

Most operating systems, such as Macintosh and IBM, don’t pose much of a
threat, Farmer said. But with Windows 95 and System 7, which are more network savvy, there is more danger.

Getting on the Web using a large Internet service provider also helps reduce the risk of personal data theft.

The larger ISPs often provide some of the best security, Farmer said. They devote enormous resources to protecting the user.

An America Online spokesperson said her company can definitely help keep Internet users safe. AOL’s network is unique in the way it assists members in security situations, she said.

Firewalls and encryption devices are other lines of defense. For example, companies offer programs for scrambling faxes and encrypting text sent by e-mail.

While technology is one salve, it won’t provide the cure. Instead, Shimomura said, people need to increase their awareness about online crime, and would-be hackers need to realize that traipsing into someone’s terminal is wrong, regardless of intent.

There is a necessity for ethics, he said. In the real world someone wouldn’t walk around naked in your room because it is wrong. But people don’t think twice of going into someone’s computer.

The physical world is just like the electronic world, Shimomura added. And like the real world, there will be criminals online.

Entry Filed under: How-To