The internet is not broken

Let us keep things that way, says Chris Gonsalves

In the rhythmic cycles of public discourse around almost any subject, there's always one in which activists and gadflies and tinfoil hats take the lead. Welcome to the internet in the era of: "Everything is broken."

Try to remain calm.

It's only been a few days since the hacking culture's premier embedded journo, Quinn Norton, blogged on Medium laying out a long, breezy case for the hopelessness of security on the internet, or in any computing environment, or any setting where two or more humans interact.

It's worth reading, if for no other reason but to understand the state of perception about the technology world we're all adrift in here. Tech providers with security practices are going to get related questions and need to have answers.

Norton, while she may have ties to the community she covers so well that make some folks uncomfortable about her objectivity, does a good job of outlining the questions, at least. There's no new information here, but it is nicely outlined.

And she can turn a phrase like nobody's business: "Your average piece-of-sh*t Windows desktop is so complex that no one person on Earth really knows what all of it is doing, or how."

And later: "The number of people whose job it is to make software secure can practically fit in a large bar, and I've watched them drink. It's not comforting. It isn't a matter of if you get owned, only a matter of when."

Not inaccurate. Also not news. Watchguard Technologies's own VP of sales Alex Thurber told us pretty much the same thing earlier this month.

The trouble with the mainstream popularity of Norton's piece - and the dozens of breathless, page view-seeking tributes it spawned - is that it buries the practical application and legitimate concerns of work-a-day business technology users in favour of more bracing vulnerabilities that are all the rage among the ITSEC-igentsia.

In fact, a significant portion of Norton's piece is dedicated to non-trivial matters of privacy and government surveillance.

While such things may indeed erode public confidence in emerging technologies like cloud to the detriment of service providers, they remain mostly the purview of activists and advocates fighting a religious battle that doesn't move the needle much in the technology channel.

Let's be clear: there are serious concerns about security on the networks and within the applications that are the engines of global commerce. Application developers have done themselves few favours by littering the cyber landscape with the detritus of failed ideas and lazy programming.

There will always be vulnerabilities, and they will grow in exact proportion to the expansion of the technology environment.

The Internet of Things, for example, is about to make that plainly evident.

We need better systems and safeguards, more individual understanding and responsibility for the technologies at our disposal, and much, much, much more diligence in the development of the tools we use to run our digital lives and businesses.

And perhaps most of all, we need sound strategies and management practices that are applied diligently and consistently.

The reality: the modern digital economy is not headed toward some desolate apocalypse.

Insecurity isn't the asteroid in the age of the dinosaurs. Quinn Norton, whether she knows it or not, is not John the Revelator chronicling the journey to an internet Rapture.

She's Upton Sinclair in the age of The Jungle, shining a harsh light on what's gone awry in our digital slaughterhouses. And we all know how that story ends, right? We cleaned up our act. And we still have potted meat to this very day.

As we've said before, the maths remains on the side of the good guys in the cyber war of attrition. Even as companies like US retailer Target get hammered over security breaches, the use of the internet as a commerce medium increases unabated, according to the US Department of Commerce.

Much has changed - and improved - since the days when security meant little more than firewalls and antivirus. We have layers of defences built on intrusion prevention, data loss prevention, application access control, identity management, et cetera.

None of these defences is 100 per cent impregnable, but security at its core is about cost on both sides of the ledger. A good security strategy manages risk and tries to make a successful attack too expensive for the bad guys while not spending so many resources that it unduly constrains the business.

The art of that balance is in the beauty - and value - security providers bring to the table.

In the coming weeks, partners will be peppered by more questions on the premise of the irreparably damaged internet. It's always challenging to explain that the sky is not falling in these periods when the activists and gadflies and tinfoil hats have the microphone.

The best advice for partners: stay true to your calling as objective, experienced professionals that can see the global security picture and help clients understand the threat landscape.

The channel opportunity here goes beyond the mere sale of more security technology; it's the trusted advisor's job to ensure the sound application of that technology. That's how we truly keep clients safe, no matter how bleak they think the world is.

For more US-focused channel coverage, see www.channelnomics.com