Your computer has been quarantined and cannot access the Internet
Introduction
A message similar to the one in this article's title may seem like a nightmare for most of us, as we have become increasingly dependent - some even addicted - to using resources available on the Internet for necessary as well as trivial tasks. Nevertheless this is what may happen if Microsoft's Scott Charney proposals are generally accepted.
In our security article, Handling an infected computer as an infected human being, we discussed Scott Charney's proposal as he presented them on the RSA conference earlier this year. His problem description, analysis, and suggested actions are now available in a special paper with contribution from many reviewers.
The problem
The number of Internet users has increased immensely since the 1990's. Around two billion are users of the Internet these days, and among them are close to 500 million broadband users. Critical systems are dependent on the Internet, and major parts of society's infrastructure rely on a functional Intranet structure.
However, there are actors with malicious intent that interfere with this functionality. Charney's paper lists several different reasons why cyber threats and attacks are difficult to handle sufficiently. The paper breaks cyber threats into four different categories:
- Cybercrime
- Economic espionage and similar activities
- Military espionage
- Cyber warfare
These threats may require different types of defense mechanisms and responses.
Types of response
Four different response types - with increasing complexity - are identified:
- Individual defense
- Collective defense
- Active defense
- Offense
Even though individual defense (e.g. antimalware software and personal firewalls) have been deployed to a greater extent these days than some years ago, experience shows that this does not suffice. As the number of users, devices and applications grow, and malicious activities increases in number as well as in complexity, defense mechanisms must change accordingly and new approaches to fight against cyber threats are needed.
Using the public health model
Charney's paper suggests that the public health model might be applied for "the cyber health".
One basis for using this model is that a sick person's behavior does not affect only that person, but also others. Society as a whole does therefore need to set rules for behavior that may harm others. Similar rules and regulations are used in other areas of our lives: It is for example illegal in most countries to drive a car that has no brakes (that function). If one attempts to drive such a car, penalties may be the result.
The public health model relies on some basic elements like personal hygiene, vaccination, voluntary isolation when ill, and quarantining by health authorities if ill with an infectious disease. This model might be adapted to Internet security:
To improve the security of the Internet, governments and industry could similarly engage in more methodical and systematic activities to improve and maintain the health of the population of devices in the computing ecosystem by promoting preventative measures, detecting infected devices, notifying affected users, enabling those users to treat devices that are infected with malware, and taking additional action to ensure that infected computers do not put other systems at risk.
Botnets are mentioned as a type of risk that it is particularly important to protect against, as these have the ability to disrupt essential parts of the Internet infrastructure.
Two complementary approaches to "healthy devices" are presented:
- bolstering efforts to identify infected devices
- promoting efforts to better demonstrate device health.
The paper advocates a model where a device must present a "health certificate" in order to be allowed access to the Internet. Such a health check might control if updated antivirus software is installed, if security patches are installed, if a firewall is installed and satisfactorily configured, and that the computer is not infected with known malware.
If the device does not meet the health requirements Internet access may be partially allowed or denied altogether depending on the gravity of the issue.
Challenges involved in the model
The paper goes on to discuss potential problems associated with such a model, as there are several.
To mention a few:
- Privacy issues
- Policy issues
- Legislative issues
- Security issues
- Issues related to abuse of the system by entities in control
Summary
There seems to be a growing acceptance that leaving Internet security to individual persons and organizations is a dangerous path to follow. More collective actions are needed in order to protect vital common interests from malicious attacks.
The model outlined by Microsoft's Scott Charney represents an interesting approach to the challenges, which needs to be investigated further.
It is however of utmost importance that the above mentioned challenges are addressed and resolved before such a model can be successfully implemented. Failing to do so may create subcultures, which will be able to circumvent the protection mechanisms. These cultures' motivation is not malicious, but the members feel that the system intolerably allows governments and industries to tamper with their privacy or other rights.
References
- Collective Defense - Applying Public Health Models to the Internet (Paper by Scott Charney, Corporate Vice President, Trustworthy Computing, Miscrosoft Corp.
- The Need for Global Collective Defense on the Internet (Blog item from Scott Charney on Microsoft on the Issues blog)
