Limits to Everything

One current conversation in infosec is that the US military and intelligence organizations can help the private sector deal with their current infosec woes. There may be some areas where those organizations are more advanced than the private sector, but as always in security there is the question of context. How applicable is the military and intel domain expertise to the private sector? Here is a good example from Edward Luce of that from another ongoing saga BP's oil spill:

Mr Obama is already under pressure to “just do something” – even if it sometimes seems it is merely to give the impression of doing something. At the weekend, Colin Powell, the former secretary of state and supporter of Mr Obama, even suggested applying what sounded like the wartime “Powell doctrine” of defeating your enemy with overwhelming force.

Without specifying what precisely he had in mind, Gen Powell urged Mr Obama to launch a “comprehensive total attack” on the spill with “decisive force”. But as Mike Mullen, the chairman of the joint chiefs of staff, hinted on Monday, militarising the response would raise expectations beyond the capacity of the US military to meet them. Incarcerate all BP personnel, perhaps? Nuke the well?

Sure the Navy has much more experience in undersea operations than oil majors, but how much will carry over? As the Chinese say "talk doesn't cook rice", the only experience that's going to matter now is ability to operate at 5,000 feet *and* capping the well. Of course, its not a binary thing there's plenty of places to imagine public/private joint efforts. The current attempts are using robots which is an area that's a great example. A company like iRobot does about 2/3 of its works for DoD and 1/3 making Roombas and Scoobas that consumers love. Of course, I like Luce's conclusion

There is another avenue available. While straining every sinew to contain this disaster, Mr Obama could seize the chance to overhaul America’s energy debate.

In the same way, why limit our thinking on infosec to existing capabilities of public and private sector? Why not treat the infosec issues we are seeing as an opportunity to build a better system? Why be constrained by a design well past its sell by date?

Comments

[btraven]

It is not just a matter of technology. It is a matter of governance and decision making processes. It would have gone a long way to have had genuine US Gov command and control as this unfolded. If Obama knew how bad the spill really was he should have stepped into the room, so to speak, where BP was figuring out the response much sooner and with much greater public transparency.