Stuxnet malware is 'weapon' out to destroy

[localhost127]

at a defensive layer, at a military level the US is a golden mile ahead of anyone. again, bear in mind that military high networks are deliberately isolated from the common networks and what data diodes in place are usually established as simplex one way (hi-lo traffic and never lo-hi traffic)

as are private corp/organizational ip networks...they are leased line, private fiber, etc --- intranets *off* the public internet.

im not sure why he is attempting to draw capabilities from a host country perspective based on residential deployments --- which are then based off socialist infrastructure.

what does residential access have to do with intellectual property in the field, capability, knowledge-base, etc of private or public organizations?

 

[gf0012-aust]

what does residential access have to do with intellectual property in the field, capability, knowledge-base, etc of private or public organizations?

not a lot when you consider that the defensive hardware layers are invariably american product sets. Ironically most of the mainland chinese defensive hardware abstracts are also american.

at a security abstract level, NATO systems are baselined against US standards. I'd argue that there is not one extant EU national (military or civil) net that has the same degree of protection as SIPRNET (eg)

 

[Beatmaster]

not a lot when you consider that the defensive hardware layers are invariably american product sets. Ironically most of the mainland chinese defensive hardware abstracts are also american.

at a security abstract level, NATO systems are baselined against US standards. I'd argue that there is not one extant EU national (military or civil) net that has the same degree of protection as SIPRNET (eg)

This is true, 80% of the worlds defencive hardware is US based, however the software applications are to a large degree custom build wich in some cases are absolutly 2 differend worlds compared to the original software packages that come with the hardware.
Besides that NATO uses CRONOS & NORCCIS wich has not a single connection to the US SIPRNET.
Wich are both in a class of their own, as they are used for many things wich require custom software and hardware configurations and both cannot be compared with eachother, while they are similair to eachother.
While NORCCIS is considered more capable or better according to field testing and use in the past years.
Maybe better is the wrong word, lets say it has more options.
However the general hardware configurations are US based, but as i said the software and tasks/options and future innovations and applications that come with custom coding is totally differend.
So you are saying that there is not a extant EU system that matches or SIPRNET its just not true as CRONOS & NORCCIS proves, as both systems are build to work with MIP and C2IS.
CRONOS Network and the NORCCIS extention are both EU build and unique.

But for this i refer to:

1
The NATO Policy for C3 Interoperability [NC3B Sub-Committee AC/322 SC/2-WP/72 (Revised) Version 4.3]:
“Seamless Sharing of Information: Common Information Exchange.”
2
The NATO Policy for C3 Interoperability [NC3B Sub-Committee AC/322 SC/2-WP/72 (Revised) Version 4.3]:
“Structured Data Exchange: Data Object Exchange”
3
STANAG 5048 - The Minimum Scale of Connectivity for Communications and Information Systems for NATO Land
Forces (Edition 5. Promulgated 16 February 2000 by NC3B Sub-Committee AC/322 SC/1). “Two systems which are open
to each other, and which conform to minimum standards for information definition and transfer such that there are no fixed
constraints on the extent of access by users of one system to the other, but dynamic constraints are applied to each system, in MEM and the DEM will be in-service during the period 2003 – 2005 and followed thereafter
with biennial capability enhancements.

*I suggest you read those pieces.

And again iam not saying that the US military ICT structure is not secured.
As you said that they are a "golden mile" ahead that is something we can dispute to the fullest.
I know for a fact that US military peepz come to EU to learn and see how we are useing our systems and applications.
Wich is good as we come to US as well to learn, so sharing knowlegd is only for the better don't you agree?
The basic rule or fact atm is: if you want to learn everything about the most adanced rockets or so ( just an example) then you study in the US.
When you need certain special computer skills you go to the EU.
And keep also in mind i left out asia in my post as they provide some pretty sweet skills and knowlegd them selfs.
So from my own exp and that of many others i work with i just can tell you there is no golden mile ahead, at least not in ICT, any other computer geek or proffesional programmer can tell you this its just aint true.
This is not a line i draw or a personal opinion but this is a fact that has been publicly proven.

On a side note some of you said that i fail to make a difference between civil and goverment networks, well let me say this: There is a difference true however both are connected in so many way that you cannot rule out any of them.
As both affect eachother. Unless a network does not have external input or output.
So a closed circuit (With not a single way to reach the outside world and vice versa) CAN be ruled out.
But as long civil and goverment networks meet eachother at some node then the whole "difference" goes out of the window.
However let me stress this the US military systems are not the most advanced overall as the software and coding skills are multinational and the knowlegd and skill is often borrowed from other countries who have in some cases more expertise.
Also i have to agree with the previous posters that i should draw a line between private/ civil networks and "goverment" networks as they are both completly differend thats true no argue from my side there.
But what i was trying to say is that both go hand in hand when it comes to security, for example banking systems they are in most cases better secured then the regular goverment networks.
If you are in ICT as myself then you will learn this pretty quick as we are doing alot of high level programming and stuff for both goverment/ industrial and civil contractors.
Some of the guys in our team travel worldwide to do the stuff others can't.
And its not only our own company that does this, here in the netherlands and in other EU nations around us there are alot more companies who work with the same clients we work with just because the client itself does not have the inhouse knowlegd to do it them selfs.

 

[gf0012-aust]

If you are in ICT as myself then you will learn this pretty quick as we are doing alot of high level programming and stuff for both goverment/ industrial and civil contractors.

I spent 10 years in ICT working across various networks, including the 1st and 2nd largest in the southern hemisphere.

my current job deals with high systems - and interaction between them

I am functionally familiar (out of operational necessity) with the systems you're talking about. (and incl the UN)

There is a limit to what I would say about the security and architectural issues of any of those systems.

its a fast way to get my balls cut off.

 

[Beatmaster]

I spent 10 years in ICT working across various networks, including the 1st and 2nd largest in the southern hemisphere.

my current job deals with high systems - and interaction between them

I am functionally familiar (out of operational necessity) with the systems you're talking about. (and incl the UN)

There is a limit to what I would say about the security and architectural issues of any of those systems.

its a fast way to get my balls cut off.

Yeah we gone offtopic a bit.
And i agree talking about this is kinda hard to explain as many of those systems have so mutch in common but then again they are totally differend.

So lets get back at the main topic, what does the US plan to counter future malware / cyber attacks? and what does NATO plan to counter this?
Because we can both agree that cybercrime is a major issue and has alot of potential to become a huge problem or is already
Afterall virtually everything we do is done by computers.
As far as i know the US has a special team that is dedicated to track and counter cybercrime but it seems to me that the efforts that are being made by many goverments is atm just not enough to be effective.

EDIT:
Btw you said you know the systems iam talking about, well then you know what iam talking about.

 

[localhost127]

EU Nations specificly: Norway, Sweden, Germany, Netherlands, Danmark, Finland are regarded as the worlds top IT nations based upon their levels of IT and knowlegd wich is undisputed for the last 10 years.

This is not a line i draw or a personal opinion but this is a fact that has been publicly proven..

please provide references for the above statements.

you attempted to introduce socialized infrastructure and residential access speeds on the public internet as some sort of proof of knowledge-base and capabilities. i called you out on it, as it's entirely meaningless in the context of the discussion.

you attempted to bring in ams-ix, and also use that as proof of outside capabilities of host nation(s)...and compare sheer size / single entity of peering exchange as proof. i suggest you look at the US coastline geographic areas, including trans-at cabling, and add up all of the smaller PoPs and then see how that compares to ams-ix --- since you are so focused on size. if anything, ams-ix could be seen as a single physical point of failure / eggs in one basket. again, please explain yourself how ams-ix as a peering exchange (due to geographical location) is relevant in the context of your quote at the beginning of my post.

So lets get back at the main topic, what does the US plan to counter future malware / cyber attacks? and what does NATO plan to counter this?
Because we can both agree that cybercrime is a major issue and has alot of potential to become a huge problem or is already
Afterall virtually everything we do is done by computers.

again, you are attempting to lump public networks, private networks (owned by private entities), darknets, etc into one logical group as if under control from one entity. this is not the case. and you disregard government policies, as you seem to think US gov has carte blanche capability to police private nodes on the public internet

 

[Beatmaster]

@ localhost

Just for the record, private networks, industrial networks, and goverment networks share alot more then you think, and are not that differend from eachother and often co-exist and support eachother.
You seem to forget that private networks and industrial networks are major components to the internet itself and to the security of a closed network.
As 75% of all the data traffic worldwide is being done by private and industrial owned networks.
Wich means that the biggest online dangers come from those networks.
Agree?
Having that said, the security of a closed network does depend on the level of security and the tier levels of sub networks and public networks.
Because as i said leaks happen at the weakest point, i think we all can agree upon that.
So a closed network that has a switching server with a seperate datacenter can enable a closed network to maintain contact with other closed networks so called sub nets.
However those subnets are linked to eachother by private owned networks wich might be not as secure as we would like.
And there you got one of those weak links. just an example ok?
My point here is in order to secure your "closed" network and to ensure a safe enviroment you will have to upgrade and secure, datacenters, Nodes, Switches hubs and so on.
Some by monitoring, some by tapping, and some by software or hardware based applications.
And here lies it biggest problem, goverment networks secure, open, hybrid or monitored are being transported NOT only by advanced security based and closed networks with hyper secure datacenters and servers, but its also transported by privat owned network with a ISP who has a 2 dollar 50 crappy datacenter...thats just the way it is.

And here you got your connection between Private, Industrial, and goverment networks because no matter how they are secured they are transported by the same internet.
So in order for you to understand what iam talking about i suggest you start looking at the internet as a meduim as a whole instead of putting each section in boxes.
Afterall the internet can be seen as a frame and the applications and server running at it as extentions.
Because there are certain laws and rules that MUST apply to every single pc, network and server/ internet (Incl: Protocols, certificates and so on) and those "cyber criminals" exploit those laws and rules in such way that they can bend them so they can be used for "rogue things"

Why would a cyber criminal want to attack a closed and secured network, and probably get caught in the act as he can hack and manipulate second level servers and private networks who have combined more computing power then thousands of pc's and servers together?
Making his life so mutch easier and raises the odds to effective penetrate a closed network significant, as NASA and other goverment organisations have found out when they got hacked by a 14 year old kid.
This kid is not directly a cybercriminal, but if a kid can do it that easy? then you might be suprised what a person with a full MIT degree could do.

The main differences between EU and US is that the US has still many lower level tier networks while the standards in the EU when it comes to Private and industrial networks are alot higher, and thus effective eleminating or minimizing the exploiting of lower level networks, wich eventually benefit important networks like for example the goverments property.
You cannot secure a network unless you secure and upgrade everything, this applies both regionally, nationally and internationally.
And 15 years ago they started in the EU with upgrading those networks according to EU agreed standards, and with succes if i might add.
If you need references just hit google, no fansy links needed.

you wrote:
You disregard government policies, as you seem to think US gov has carte blanche capability to police private nodes on the public internet

No iam not disregarding that, infact the US Gov has more Carte Blache capability then you know.
You would be suprised how mutch CB they have.
Iam not sure but clinton did sign some kind of law where the GOV does get CB to fight off cybercrime. (Just cannot remember what it called maybe other members can fill this in)
And this law has a really big impact on how internet protocols and systems/data are being handled specially in the western world.

And last but not least before you have critic's upon my posts and replies i kindly request that you readup as you clearly do not understand the 1 o 1 internet basic's.
NO this is not a offence and iam not meaning this in a bad way.
What iam trying to point out, Private, Industrial, Dark, Goverment networks, servers and so on they might run and be operated in a differend matter but they are all working accoording to the IBM Bible wich state that every single meduim must be able to comminucate with eachother by protocols and so on...these are the same world wide this applies to linux and all the other OS's out there. These are the foundations of the internet itself everyone knows this.
This also directly means there are no seperated sections in the internet as the internet is on big massive meduim (or massive network) wich transports ALL the data available controlled or not controlled.
Leaving open the first basic of every network and pc, the weakest spot will point out how good your security is. No matter if its a closed network or not.
This might raise another discussion but lets focus on this generally otherwise we have to go talking about subnets, multinets and the protocols wich go along with that making this topic, at least a 100 times bigger then it already is.

In short there is no easy way or short way to explain this, as there are so many factors.

Cheers

Edit seems you are lucky.

The DAI combines eight variables, covering five areas, to provide an overall country score. The areas are availability of infrastructure, affordability of access, educational level, quality of ICT services, and Internet usage. The results of the Index point to potential stumbling blocks in ICT adoption and can help countries identify their relative strengths and weaknesses.

Ranking list ICT

This is one online rank list dates back to 2003, but its by far the only one online as other rankings are done by specific organisations.
So its not totally complete however it does nice you a credible view.
And it does provide a wealth of info.

 

[gf0012-aust]

The main issue here is "what networks.?"

eg Beatmaster is correct when he refers to the percentile of private networks and the architecture associated with them being a high ratio contributor to the overall architecture of military networks.

at a military network level though those that are allowed to "see" public networks have very different security abstracts in place.

its why the majority of breaches on trusted networks are compromised internally - not system failures.

its the quality of the security, prospective firewalls, protective/defensive software probes/crawlers thats the ultimate issue.

its what is allowed onto the public architecture that counts - eg, even though some pipes are commercial satellites, those satellites have embargoed channels etc....

 

[gf0012-aust]

Interesting to note that Stuxnet has been identified in Indonesia, India, Australia, UK, malaysia, Pakistan and the US

(DefenseNews)