A new report from the Departments of Commerce (DoC) and Homeland Security (DHS) suggests that the proliferation of botnets and the automated, distributed cyber attacks they generate will cause greater problems for Federal agencies absent a robust government response to the problem that includes a proper mix of funding, policies, and public-private collaboration.
The report outlines six principal themes that summarize the increasing prevalence and implications of botnets and automated, distributed attacks: they are a global problem; tools to mitigate them exist, but aren’t widely used; products aren’t secured during all stages of their lifecycle, making exploits easier; more awareness and education on the subject are needed; market incentives don’t prompt developers to build in better security; and no stakeholder community can address the attacks in isolation.
One of the report’s chief areas of concern appears to be IoT.
“With new botnets that capitalize on the sheer number of ‘Internet of Things’ (IoT) devices, DDoS [distributed denial of service] attacks have grown in size to more than one terabit per second, far outstripping expected size and excess capacity,” the report states.
As IoT-connected devices proliferate exponentially and give cybercriminals more potential capital for exploitation, the report calls on the Federal government to partner with industry to establish minimum security baselines for IoT devices in commercial, industrial and government environments.
In practical application, though, the report says consumer IoT products “should be easy to understand and simple to use securely,” so that individual users don’t unknowingly contribute to distributed attacks when their systems are compromised.
The report describes numerous collaborative efforts–between Internet service providers and the Federal government, or regulatory agencies and private industry, for example–that promote shared security responsibility when attacks span jurisdictional borders.
“To enhance the resilience of the Internet and communications infrastructure, coordinated actions that cross geopolitical, public-private, industrial sector, and technical boundaries must become easier to implement,” the report states.
Other aspirational goals include greater information-sharing between stakeholders, public awareness campaigns so users know the risks of botnet attacks, and new programs in academia to foster security innovation.
Acknowledging that government may not have all the answers, DoC and DHS are still calling upon the Federal government to lead the charge.
“The Federal government should lead by example and demonstrate practicality of technologies, creating market incentives for early adopters,” the report says. “The federal government is also uniquely positioned to lead the international engagement required to establish broadly accepted policies and best practices and will enhance coordination with stakeholders on these efforts.”
