To think we should stop pretending that Internet Security is a thing?

I will say that AI voice impersonation is already being used in attacks.

Well it will serve everyone right for using 19th century technology, instead of 20th century technology then, won't it ?

Passcodes are really the thing here.

And password managers.

Yes, this.

Also for anyone reading this: for the love of God stop signing up to random sites using your work email address and password. It's not safe, it's not secure, and you probably aren't allowed to do it under your companies IT policy anyway. (A lot of companies will have people signing up to random sites using work emails to access free and cheap tools to do their jobs and not hammering it home that you SHOULD NEVER USE THE SAME PASSWORD YOU USE FOR WORK SYSTEMS, but that's another story...)

Agree with your final note, but I will say that AI voice impersonation is already being used in attacks. The average person isn't really at risk for this currently because of how many recordings you need to get something believable, but it is happening.
And I actually agree with you in general, that hype is being whipped up about AI in the public space to get them to invest, when what people should actually be worried about is how criminals are using it (and have been using it)

maybe we should go back to Pen and paper

Well certainly for elections. No way would I trust any election that was electronically counted.

I really wouldn't worry about "AI". All the "stories" about it at the moment are really (vey) thinly disguised pitches to scare people into investing. Like big data was a few years ago. And the Internet of Things before that. And "Web2.0" before that. Think of 3D TVs and you won't go wrong.

When someone flogging you "AI" can get their "AI" to comb through a few pages of Google search results and remove the crap and the ads, then I'll believe it's here. But since the direction of travel is the other way (companies using "AI" to shove as many ads into Google as possible) we'll have a long wait.

Worry far more about someone nicking your phone and your not setting a passcode and/or allowing messages on your lockscreen. That is a very clear and present danger.

Agree. I had a couple of emails recently from. Companies I'd used about problems they had with data.

Get a computer they say, maybe we should go back to Pen and paper.

It should also be built in from day one, not retrofitted because a bunch of sharp suits turned up and sprayed TLAs and "cost savings" around to kneecap the experts.

The thought that Artificial Intelligence is said to be advanced enough to accurately impersonate any human voice - a close relative for instance - makes my hair stand on end!

Makes me think twice about answering a call from ANYONE.

Good cyber security costs money. Some companies cut corners and don't invest in good security.

All of these systems use hashes of the data. You can't recreate a fingerprint or face from what is saved at the other end.

I can't speak for passwords (hence the advice about never repeating them), They may be stored in plaintext form. Amazingly there are no standards for user authentication to websites (hence the baffling different password rules outfits invent).

I said what I meant, thanks very much 🙂 (except where I wrote fingerprint and Touch ID - they are essentially one and the same of course, I meant Face ID but was too late to edit). I didn’t say anything about regular commerce. It was one example, iris recognition is obviously another example.

I work in cyber security. The system isn’t broken - humans are the biggest factor in security failures.
There’s also a phenomenal lack of understanding across all sectors (including digital services) on what their obligations are, what best practice is, what resources are out there to help them. There are people out there trying to improve awareness and compliance but it’s a long bloody road. It’s also worth noting that government wasn’t prioritising cybersec in any way until about two years ago!

@Caffeineneedednow I work in university IT. I can think of at least half a dozen reasons off the top of my head why you may have intermittent access to a number of servers over a few weeks. Problems with authentication, time synchronisation, flaky DNS, routing issues, buggy software updates, over-enthusiastic antivirus systems... I've seen all of those cause problems that have taken time to track down and finally fix.

I'm not saying it wasn't an attack - universities are definitely a target - but it's not the kind of response I'd expect. When we had a suspected intrusion we went scorched earth; we shut all access down, rebuilt from known-good backups and required everyone to reset passwords etc.

No-one in regular commerce is using retina ID as a biometric. You probably mean iris recognition. Retinal scans are quite intrusive and would take much longer.

Completely agree and I'm happy to take the risk in return for the fantastic convenience

What are you talking about - of course internet security is "a thing".

There is just a lack of awareness on how to do it well.

Good for you. Not everybody does.

It's a constant battle between what is secure and what human beings will actually do.

Exactly this. Good security gets in the way. Things that get in the way get complained about. You need a very strong and determined CTO who can nevertheless push through necessary changes to improve security in the face of a board who see it as an annoyance.

It's often only after a company gets hit that they start taking security seriously. But, inevitably, five years down the line people get complacent because, hey, they haven't been hit in years! Why bother?

just because some people (and companies) are bad at it doesn't mean it's "not a thing".

This is true and data protection principles are not understood or promoted, again seen as irritating detail.

It's a constant battle between what is secure and what human beings will actually do

A really determined attacker will stop at noting. When car security started being serious, all the criminals did was up their game and take people hostage and force them to hand over the keys at gunpoint. Once you are protecting yourself at that level, then all bets are off.

Generally security is like the campers against a lion paradigm. You don't need to outrun the lion. You only need to outrun your companion.

Thinking back to when I was a child in the 80s/90s, my mum was an accountant. There was no internet back then really, or at least very limited home internet until the mid 90s. She used to literally cart out boxes of client files to her car, drive them home, and then they'd sit around our lounge so she could work on them in the evenings and weekends. That was proper analogue work, nothing was digitised. Now as far as I know, nothing ever went wrong with that system. But if our house had been burgled or the car stolen or she lost a box because she was shifting stuff around to fit the shopping into the boot, that would have been a lot of client data lost to god only knows where.

So here's the problem with security:

It's a constant battle between what is secure and what human beings will actually do.
And what is 'safest' is also always changing, in response to attacks like this and general development/upgrading of security in systems, which also makes it hard to handle the human side, as they then need to learn something new. And people complain and dig their heels in, they want to use services AND have them never go down or be vulnerable to attack AND cheap and easy to use.

We are also still in a 'transition' phase in technology - making stuff actual secure as standard still isn't in every single organisation, and there's a lot of legacy systems knocking around that there isn't the right alternative for yet, or would be very expensive to replace. Councils are a great examples of this - they will quite often be on legacy systems, run largely by people who know how to use the system but aren't IT experts, and they might not actually have a dedicated 'security' person or team. 'Security' and 'IT' intersect but aren't exactly the same, and quite often 'IT' are seen as 'can fix everything and know everything' when that's just not the case. It's an industry where things are constantly changing and you are constantly having to learn, and often organisations don't understand that. IT and Security aren't departments that 'make' money, they only save you hypothetical money (or not hypothetical as we are coming to learn) and people are loathe to spend the money they need to on it.

I work in higher education and earlier this year we ( the lecturers so not IT) are fairly sure there was a targeted attack. Over the course of 2 weeks the servers across 4 campuses all intermittendly went offline then came online over and over again. IT told us it was a system fault but the couple people I know outside the uni that work in IT said the only reason the severs were acting like that was because they were trying to block a hack.

We didn't get hacked and no info was leaked and if a Russel group uni did get hacked it would absolutly have made the papers so fairly sure it didn't happen.

Internet security is definetly needed and not what I think your referring to. You are referring to storage of data.
So what's the alternative? Paper files? Surely if a thief wanted that information they could break into a room and get it. Also all my vaccination record were destroyed in a fire in the building where they were held so I have no idea what childhood vaccines I had as my mum can't remember ( I was born in the 80s). This is a problem with the old school approach.