Solving Cybersecurity - Breaking the Mitigation Loop

Cybersecurity has compromised security protocols leading to mis-configured technology architecture that facilitates cyber attacks. Cybersecurity is a program, like any software, and it is riddled with bugs. The solution is debugging not mitigation!

The move from coding to components meant the underlying binary science did not need to be taught. When a science is not taught, is cannot be applied!

Programming has become a matter of assembling components to provide a process and cybersecurity assembles mitigation solutions “making something [exploits] less severe, dangerous, painful, harsh, or damaging”. Programming and cybersecurity require knowledge of the underlying science.

The bug in cybersecurity is an endless loop to a website portal. There is no requirement to grant unrestricted access to “Secure” activity. In fact, unrestricted access is not secure. Every cybersecurity exploit originates from the choice to open a “secure” website portal. Every cybersecurity solution is mitigating an exploit introduced by website portals.

To compound the mistake of a website portal open 24/7 to 50B devices, browsers are used for secure interaction. Browser providers generate revenues from content-mining (spying). Loading secure data into a browser shares what you deem secure. Inputting credentials into a browser shares them as well. Sharing “secure” data is not secure!

Authentication using a browser from a website portal collects data and transfers that data for authentication to be performed someplace else. When authentication is being performed, the browser data and other data points are matched to stored data. On a match, access is granted. This is Single-Factor Authentication by scientific and regulatory definition.

Without exception cybersecurity authentication uses data with multiple attributes claiming an attribute and a factor are the same thing. This is like saying a pie made with Baldwin apples and Delicious apples has two unique ingredient categories while they are in fact both apples with different attributes.

Secure Internet Class of access and interaction on the World Wide Web is missing. A Sensitive Compartmented Information Facility (SCIF) security model applied to secure digital activity maps the processes, procedures, and protocols to control digitally data custody. A Digital SCIF (d-SCIF) model is the foundation a Secure Internet Class’s security model.

A SCIF assures that secret (secure) information in maintained, accessed, and interacted with in a secure environment. If secret documents are necessary, the documents are securely transferred from secure storage to the SCIF for review and securely transferred back to storage. Every aspect of this model uses identified authorized individuals who take responsibility for their actions.

The first and most important thing a d-SCIF brings to Internet security is responsibility on the part of users. With responsibility comes accountability. A d-SCIF is a serialized digital facility assigned to a specific user and the only method to securely interact with the organization. If a d-SICF is connected and nefarious activity is performed, there are indisputable facts:

An authorized user’s serialized d-SCIF existed on the Internet and the user’s credential was authenticated for access. Therefore, all activity including nefarious activity can be traced to a specific person using a specific Existence ID with a single related credential. A safe assumption: the authorized user was the nefarious actor, or they shared their Existence ID and credential with the nefarious actor.

A d-SCIF security model applies security procedures and classifications directly from SCIF procedures and classifications. Access to a SCIF requires identification. A d-SCIF is created from identification. Historically, the unwillingness to provision digital identification is the reason every breach is permitted. Without identification, a user cannot directly assert identity, leaving only data to gain secure access.

Secure digital activity has been driven by convenient friction-less access. Walk into any secure office building, identification and an appointment are verified, yet this is too much friction digitally.

The Internet is nothing more than a giant hard drive providing data from remote directories. Really, what we call the Internet is an application (browser) that loads data locally for processing and stores it on the Internet. Keeping this high level, a browser is an Internet operating system. The system reads a directory and loads data for execution (rendering code).

From this interpretation of the Internet as a starting point, an Internet Security model is a few configuration changes away from being achieved. First, the WWW application is loaded from one URL directory and WWW data is maintained in another URL directory. It is a matter of setting and securing a path. Outside applications can be loaded from an outside location and data maintained within the organization's secure Internet facility, private cloud.

A “Secure” Internet operating environment does not need to be installed on a local device or loaded from the WWW. A d-SCIF created and maintained by an Existence ID is invisible to the Internet until it is in use. Asserting a d-SCIF’s absence when not in use is a technology configuration making it possible to directly assert presence when the Existence ID is connected. Presence, by definition, is a state of existence.

Taking control of the organization’s secure activity and data is the single action that begins to solve most of today’s cybersecurity problems. Existence technology is not a silver bullet, it is a correction to the first incorrect binary choice in Internet Security. Internet security is a process of identifying “Secure” activity in the current commingled environment and migrating it into a “Secure” private Internet facility.

Existence Technologies Inc.