Problems with Extending EINSTEIN 3 to Critical Infrastructure1
Can It Really Work? Problems with Extending EINSTEIN 3 to Critical Infrastructure1 Steven M. Bellovin2, Scott O. Bradner3, Whitfield Diffie4, Susan Landau5, Jennifer Rexford6 1 Introduction Effectiveness should be the measure of any deployed technology. Does the solution actually solve the problem? Does it do so in a cost-efficient manner? If the solution creates new problems, are these easier and less problematic to handle than the original issue? In short, is the solution effective? In the rush to protect the U.S. after the 9/11 attacks, effectiveness was not always the primary driver in determining the value of the systems being proposed. In this context we consider the potential extension to the private sector of EINSTEIN 3, a federal program to detect and prevent cyber intrusions. Providing services to the public is a fundamental role for U.S. federal civilian agencies, and beginning in the mid 1990s, many agencies turned to the Internet. This shift was not without problems. While confidentiality, integrity, and authentication dominated early federal thinking about computer and Internet security, the threats agencies faced included phishing, IP spoofing, botnets, denials of service (DoS), distributed denials of service, and man-in-the-middle attacks. Some exploits were done purely for the publicity, but others had serious purpose behind them. By the early 2000s, the growing number of attacks on U.S. civilian agency systems could not be ignored, and in 2004 the U.S. began an active effort to protect federal civilian agencies against cyber intrusions7. This 1 The authors would like to thank Matt Blaze and John Treichler for various insights and suggestions in the writing of this paper, and we would also like to acknowledge multiple useful conversations with Sandy Bacik, Tahir El Gamal, and Vern Paxson.
[Show full text]