Many are defending an "attack first" strategy in cybersecurity, or a military approach. Based on dozens of years of experience, we disagree. In cybersecurity, the best defense is not having to defend oneself.
See paper at https://www.linkedin.com/feed/update/urn:li:activity:6439854748941250561
Interesting paper, but I think it places too great an emphasis on the power of the attacker, and the helplessness of the defender.
My ResearchGate project ' IDaaS with secure data-at-rest ' goes a long way towards redressing that balance.
I'd like to use yet another war analogy, by suggesting that reducing any success that an attacker enjoys to a Pyrrhic victory partly offsets some of that enjoyment, as well as empowering the defender.
Our philosophy is that any hack attempt is followed immediately by dropping the connection and adding a firewall rule to block the source IP address. Simultaneously, the ISP responsible for the address is notified of the incident, and supplied with the relevant system log entries. Additionally, the report is copied to the host country's CERT office.
This approach has led to the neutralisation of over 40,000 botnet zombies, and the cancellation of internet accounts for thousands of hackers. This may be a reactive, rather than proactive approach, but it runs in a fully 'hands-free' mode, and guarantees that any would-be attacker will need to replace every zombie that is pointed at us.
On the subject of passwords etc, I think that my aforementioned project can answer a few of your concerns. There are papers describing a Three-factor authentication system, which requires no more effort of the user, than entering a single password would have required, but a password is never entered. The second and third factors are user-transparent, so there is no loss of usability.
Also, the database containing the credentials can be read, copied or stolen, by The Enemy Within, or The Barbarians At The Gates, but the encrypted data remains secure, as there are no encryption keys to steal.
All in all, I think the security picture is not really all that gloomy.
Unfortunately, the classic comment from a manager of one of the Detroit automobile companies also applies to us:
"The only loose nut in our cars, is the one driving it".
Hello all: This thread arrived, in the past, at a conclusion, which is stated in the initial text. There is no room to refuse to notice an obvious thing, or to re-explain here, the reasoning and references are available above, to anyone.
We are now ready to move to non-mathematical and non-physical aspects. We are talking about the historical and intersubjective aspects, which are important to us qua humans. Finding a humanly acceptable answer is difficult in physics or maths today, and, pretty soon, in all natural sciences. Therefore, this very thread is important.
We suggest, as in physics, that facts are what you were willing to bbelieve. A bias, preventing a more complete vision. That is another motivation here, to abandon bias. It has no place going forward, and may prevent us from seeing what is plain to see.
IY and all: New conclusions, on the same line, are available using the need for privacy in the medical section:
Privacy of medical and psychological information is of extraordinary importance. In the USA, it is regulated by HIPAA laws. The most common method of communication between health care and mental health practitioners is via faxes. Faxes have changed from the ‘paper fax’ to electronic faxes (‘modern faxes’). There are advantages but numerous potential problems in ensuring compliance with HIPAA. This is even more so when recognizing that faxes are often delivered electronically to emails (electronic mails) which have traditionally been regarded as not complying with HIPAA. Solutions are suggested. The most obvious is delivery of private medical and psychological information by HIPAA compliant secure email. The various options are briefly outlined. Based on direct comparisons, the most logical is to use one that is usable and secure. The ZSentry technology which preceded the well-known blockchain technology fits that requirement because of the secure encryption, date and time stamps and user authentications.
Read more at https://medcraveonline.com/JPCPY/JPCPY-10-00661.pdf