2010: The Future of Security
Since then, the phrase has become bromidic to the point that former cybersecurity czar Richard Clarke declared that "digital Pearl Harbors are happening every day."
Whether conceived of as rare or quotidian, the digital Pearl Harbor’s definition has remained constant: It’s a computer outage, a big one, a physically and financially damaging one. More recently, it has become a shorthand way to say, "Terrorists will take down the Internet."
In either case, this definition is wrong. Not only is it wrong, it’s not even useful.
"I hesitate to even use the term," says Jeff Schmidt, an elected member of the FBI’s InfraGard national executive board. "It’s come to mean any attack that’s massively inconvenient. But I don’t think they merit the term digital Pearl Harbor."
"We need to distinguish between the mischievous and the malicious," says Darwin John, who served recently (albeit briefly) as CIO of the FBI and is considered one of the godfathers of the CIO profession. "We’ve tolerated the attacks until now because they’re mischievous. The malicious attack will be the one that moves the public consciousness, and it’s so much harder to know what that attack will be."
It’s much easier to know what a digital Pearl Harbor won’t be. Taking down the Internet or ATM networks, compromising the Social Security database, even hacking into the electric grid?Schmidt and others argue that while each event may be part of a digital Pearl Harbor, none qualifies in and of itself. None would galvanize society, spurring it to action.
And it needn’t be a terrorist attack. Open networks coupled with vulnerable software make it more likely that a transformational event will arise from a more banal source, like a motivated group of computer experts, a common thief or, most fickle of all, an accident.
The coming digital Pearl Harbor doesn’t even have to be a single event. Thinking about the nature of disasters, Software Engineering Institute fellow Watts Humphrey consulted nuclear power people. "I talked to one guy who did nothing but review incidents," Humphrey says. "And typically, these kinds of disasters result from a combination of many smaller events that each seem highly unlikely. But they all happen at once to create unforeseeable consequences."
That’s the "Perfect Storm" theory, and what makes an event perfect (in a negative sense) is the apparent lack of relationship between systems in a complex environment. The blackout last August was a Perfect Storm. Random, seemingly unrelated factors?an aging power grid, certain corporate decisions, a heat wave, a history of deregulation and some human errors?all came together to darken a significant chunk of the northern hemisphere.
$firstKeyword



