Tech Gets Easy

Blame a seemingly never-ending arms race between hackers and defenders and the fact that attackers are--for now--much more motivated to break in than companies are to keep them out.

SAN FRANCISCO--Every year, security vendors gather at the RSA conference here to reaffirm their commitment to fencing out hackers and keeping data safe. And every year, corporate and government Web sites continue to fall victim to basic attacks. Heck, ubersecurity firm RSA itself was compromised not that long ago, as was digital certificate heavyweight VeriSign, even if it didn't admit it for two years.

In other words, very little changes from year to year beyond the buzzwords du jour bruited about by security vendors. "It's Groundhog Day," says Josh Corman, director of security intelligence at Akamai.

Art Coviello, executive chairman of RSA, at least had the presence of mind to be humble, acknowledging in his keynote that current "security models" are inadequate. Yet he couldn't help but lapse into rah-rah boosterism by the end of his speech. "Never have so many companies been under attack, including RSA," he said. "Together we can learn from these experiences and emerge from this hell, smarter and stronger than we were before."

Really? History would suggest otherwise. Instead of finally locking down our data and fencing out the shadowy forces who want to steal our identities, the security industry is almost certain to present us with more warnings of newer and scarier threats and bigger, more dangerous break-ins and data compromises and new products that are quickly outdated. Lather, rinse, repeat.

"The cybersecurity cycle will go on for the rest of our lives," predicts Rod Beckstrom, president and CEO of ICANN and former director of the U.S. National Cybersecurity Center. "The industry takes a long time to evolve."

Of course, while it's evolving, the rest of us are still coming to grips with existing vulnerabilities--to say nothing of trying to figure out which future problems are going to pose us the biggest headaches. This is a world, after all, with keyloggers that record bank account information. With "advanced persistent threats," or APTs, that conduct long-term industrial espionage. With government secrets left on unencrypted laptops and malware like Stuxnet apparently designed to sabotage national nuclear-arms programs.

The industry's sluggishness is enough to breed pervasive cynicism in some quarters. Critics like Corman are quick to note that if security vendors really could do what they promise, they'd simply put themselves out of business. "The security industry is not about securing you; it's about making money," Corman says. "Minimum investment to get maximum revenue."

Even if you're not quite as jaded as Corman, there are still two big--maybe insuperable--obstacles lying between us and security Nirvana. First, there's the seemingly endless arms race between hackers and defenders, one that shows no sign of slowing anytime soon.

Second, there's the fact that attackers are--at least for now--much more motivated to get in than companies are to keep them out.

Put together, it's enough to make almost anyone despair. One executive at a top security firm who asked not to be identified admitted that technology innovation is lagging behind the criminal hackers, whose motivation is greater than the level of risk corporations feel they face.

"Never before have so many spent so much and accomplished so little," he said.

And the attackers are fast learners, able to devise new methods for getting into computer systems even when strong defenses are in place. When antivirus software blocked malware, lurking villains came up with cunning social engineering tricks to lure you to the malware.

Making matters worse is the fact that the white hats are riding lame stallions and firing rusty revolvers. Models like antivirus signature updating--which protects only against known threats--are fundamentally broken, yet many companies still rely on them. The promises of Public Key Infrastructure have not materialized. Some hope that analysis of Big Data--the tons of log and network information housed within corporate systems--can identify points of weakness and block hackers. We'll see.

"We're fighting the problems, but they're not solvable," said David Perry, president of G Data Software North America. "Everyone has expected the magic bullet forever, but there is none."

Companies and consumers still want an easy fix, though--and that often plays right into the hands of hackers. When you see headlines about identity fraud and data breaches, it's much easier to buy a new antimalware package than to really analyze the problem and switch gears. "There's a mentality that we can solve the problem with another product," said Mary Landesman, senior security researcher at Cisco. If only it were true.

Getting companies to devote time and money to adequately address their security issues is particularly difficult because they often don't think there's a problem until they've been compromised. And for some, too much knowledge can be a bad thing. "Part of the problem might be plausible deniability, that if the company finds something, there will be an SEC filing requirement," Landesman said.

Of course, it would help if software in general was less buggy. Some security experts are pushing for a more proactive approach to security much like preventative medicine can help keep you healthy. The more secure the software code, the fewer bugs and the less chance of attackers getting in.

"Most of RSA, especially on the trade show floor, is reactive security and the idea behind that is protect broken stuff from the bad people," said Gary McGraw, chief technology officer at Cigital. "But that hasn't been working very well. It's like a hamster wheel."

This concept helped Microsoft improve its battered image 10 years ago after being hammered by viruses that infected tons of computers by exploiting holes in Windows. Microsoft launched its Software Development Lifecycle program to focus on building software with security in mind and it has been a success, making its products some of the most secure in the industry.

That sort of solution, though, isn't particularly scalable, especially not with coders churning out apps and applications to meet the demand for new apps on new devices. "We know how to build software with fewer bugs per square inch and we are getting much better at that," McGraw said. "The problem is we're building more square miles of code than ever before."

There is no easy answer, because there are so many aspects to security, said Bruce Schneier, chief security technology officer at BT.

"The fundamental problems are about using technology, implementation, user interface, installations, updates, all of those ancillary things," he said. "And there are economic barriers that people who deploy the technology don't have financial motivations to do so.... The person in charge of the problem doesn't have the ability to fix it and the person with the ability to fix it isn't in charge."

And no one wants to pay money to provide security for anyone else. Like pollution, security incidents are something everyone potentially contributes to and suffers as a result of. "This might be a fundamental mismatch that the market cannot resolve," without government intervention, Schneier said.

With the Start button disappeared, shutting down Windows 8 can be a challenge. Here's how to coax the OS into turning itself off.

Shutting off Windows used to be a simple matter of clicking the Start button and choosing the "Shut down" option. But the Windows 8 beta has no Start button. So how do you shut it down?

Microsoft has concocted a series of manuevers and keyboard shortcuts to shut down the new OS. Though slower and clumsier than going through the Start button, the new steps at least let you fully turn Windows 8 off.

The most basic way to shut down Windows 8 is through the Charms bar.

In the Metro interface, hover your mouse over the Zoom icon that appears in the lower right corner of the screen. The Charms bar should then pop up displaying several icons. Moving your mouse up the screen will reveal the names of each icon, including Search, Share, Start, Devices, and Settings. Click the Settings icon and then the Power Icon. You should see three options: Sleep, Restart, and Shut down. Clicking Shut down will close Windows 8 and turn off your PC.

You can more quickly reach the settings screen by pressing the Windows key and the i key. From there, clicking the Power button will give you access to the same three options mentioned above.

Another alternative is to sign out of your account and then shut down. You can either click your account photo or image at the top or press Ctrl/Alt/Del. Click the option to sign out. That will bring you to the opening screen for Windows 8 which you then need to pull up to access your login screen. The Shut down icon will be in the lower right corner. Click it to reveal the options for Sleep, Restart, and Shut down.

One more option is to switch to the Desktop and press Alt/F4. That will bring up a dedicated Shut down screen where you can choose to put the PC to sleep, restart, or shut down completely. You just need to make sure to save all your work and close all your applications first before you shut down using this method.

Laptop users have yet another way to shut down Windows 8 through the Power settings. Right-click on the hot corner that appears in the lower left of your screen--you can access this from the Metro UI or the Desktop. You should see a popup menu appear with a variety of Windows features, such as Network Connections, System, Device Manager, and Control Panel. Click the option for Control Panel.

Click the category for Hardware and Sound and then click the link for Power Options. From here you can set Windows to shut down if you press the power button or simply close the lid of your laptop.

Though you have several ways of shutting down Windows 8, none of them are quick or convenient. Even with the Start button gone, why didn't Microsoft include a more user-friendly way to close Windows 8?

With the new OS, Microsoft has set up a new hybrid boot-up process that lets you boot up more quickly. But to achieve this faster speed, Windows 8 actually needs to go into hibernation mode rather than a full shut down.

By moving the Shut down option to a more remote spot, Microsoft may be assuming that people will let their PCs hibernate instead of shutting them down completely. But I think users will be thrown by the lack of an out-in-the-open Shut down button.

There's still plenty of time for Microsoft to tweak Windows 8 between now and its final release. Let's hope that a more direct Shut down option is one of the beneficiaries.