Authored by: Tony Cole, CTO – Recently, I had the opportunity to join Marjorie Censer on Government Matters to discuss the idea of a “Big Red Button” to cut the United States off from the global internet ecosystem. It’s a conversation that echoed a recent panel discussion I participated in at RSAC 2020, and one that was kicked off (and fueled) by recent events, including the breach of the Defense Information Systems Agency that exposed the personal data of over 200,000 people. With other major breaches still fresh in people’s minds, the idea of isolating the “American internet” from the rest of the world has been discussed in certain circles.
Although it is extremely unlikely to ever actually happen, this concept is an interesting thought exercise to participate in. What is the attraction of the idea, and are there better ways to address the problem than completely pulling the plug? What are the drawbacks or the possible advantages? It’s always thought-provoking to discuss such big ideas with other cybersecurity professionals, and I wanted to share a few of our takeaways.
Hitting the Big Red Button Would Be Following a Questionable Example
Russia and China each already have something similar to the Big Red Button (though if the United States were to take this drastic step, the reason behind it would likely be different). When China first instituted the “Great Firewall,” it was about controlling the flow of information into the general population, policing what ideas they could and could not access. With Russia, the idea is similar but more difficult: China was largely able to implement its controls before the population as a whole was connected to the internet, but Russia has been connected for some time. Large amounts of traffic already flowed into and out of the country, and although the Russians profess to be taking these steps to protect their citizens, their motivation is similar to that of China: to control information dissemination to the public.
Conversely, the U.S.’s motivations would be more geared toward protecting the rights of Americans and ensuring that those rights aren’t being infringed upon by malicious actors abroad. We’ve seen plenty of breaches that originated from outside of the U.S. cause significant damage to individuals within the country, and the goal of a Big Red Button would almost certainly be centered around preventing such incidents from happening in the future. But the fact remains that Russia has struggled to implement its protections, and the U.S. is even more integrated into the wider internet ecosystem than Russia. Even the most die-hard supporter of the Big Red Button would have to admit that it simply isn’t a feasible option as things stand now.
A Big Red Button Would Have Widespread Consequences
Let’s talk specifics. Cutting the U.S. off from the internet would strike a significant blow to much of the functionality we enjoy today. Across countless industries, our systems are so integrated, with so many applications tied into the cloud, that implementing a cutoff switch would cause a massive set of issues. And while there are certain areas where such an idea might make sense—government functions and public utilities, for instance—the effect on most industries would be catastrophic. Overcoming the effect that it would have on our ability to conduct basic financial transactions alone would be a borderline insurmountable challenge, and even the Federal Reserve, which processes transactions across the global financial market infrastructure, would be seriously impacted. Simply put, the U.S is too widely integrated with the rest of the world to cut itself off cleanly with the press of a button.
On a practical level, the government would also spend the next several decades being sued by those affected by the change. The litigious nature of American society is sometimes made light of, but, in this case, it serves as an effective deterrent and protection against the government, making this sort of sweeping change that would affect anything that touches the internet. The government would have to be prepared to spend years in court defending the decision, which means it would have to have an extremely good justification for doing so—something it just doesn’t have right now.
So, why is this conversation happening in the first place? With so many drawbacks, why is the idea of a Big Red Button so attractive to certain people? Well, Gartner estimates that companies currently spend more than $130 billion on cybersecurity, with most of that money directed at preventative tools, which are insufficient on their own. We have continued to see attacks rise in severity and sophistication as attackers armed with better, more effective tools also improve their ability to identify soft targets. As nation-states also continue to back groups of attackers, keeping them funded and moving espionage into the cyber realm, concerns over these attacks are increasingly well-founded. And while a Big Red Button would certainly address the issue, the damage it would cause is analogous to curing the disease by killing the patient.
Rather than take the nuclear option, hitting the Big Red Button to wall ourselves off from the rest of the world, there are simpler steps that can be taken. Helping businesses understand the true nature of a threat is critical, as many have a difficult time accepting the fact that it could happen to them—if they haven’t seen a sophisticated attack target their network, they aren’t worried. Because of this, many organizations rely too heavily on traditional prevention security controls to stop attackers from infiltrating their networks and neglect implementing advanced threat detection tools in anticipation of the more sophisticated attacks that are likely coming, and possibly soon.
Bolstering perimeter defenses with in-network defenses such as those offered by deception-based threat detection technology can help these organizations quickly identify threats and better understand what they are up against. The fact that cyberattacks today are both common and damaging enough to make the concept of a Big Red Button appealing to some is a clear indication that action and a new approach is necessary—but taking steps to level the playing field make a lot more sense than knocking the whole arena to the ground.