Meru’s announcement of secure guest access yesterday got me to thinking– why have we become so cavalier about information security? Why isn’t everything secret by default?
Meru Networks’ yesterday announced of a number of enhancements to their product line, mostly notably for our purposes here Smart Connect additions to their Identity Manager product. The key news is new facilities for dealing with the rapidly-increasing volume of users appearing as a result of BYOD, and in securing connections even for guest users. This means encryption, strong authentication, all of that, even for non-employees or potentially anyone using a Meru WLAN.
Which got me to thinking – what a great idea! And then, extrapolating just a little – everything should be secured, by default, all the time, for everyone. Why, for example, isn’t HTTPS always used? Oh, OK, I know the answer, cost. But what’s the cost of data compromised as it transits the air (or, for that matter, the wire)? Shouldn’t we be securing all links, all the time, just to be sure? I personally feel the same way about the data using those links, but every encrypted file system I’ve used takes a big performance hit. Such wouldn’t be the case if encryption were resident in disk drives and similar storage devices.
This is all part of what I have been calling a culture of security. Too many assume that no one is looking at their traffic – and, probably, most of the time, they’re right. But it’s far too easy to snoop on data on most networks, especially for professional information thieves with a mission, a budget, and a high degree of technical skill. We tend to worry about casual hackers and assorted troublemakers when our focus should be directed to those who get paid to steal data.
Is this occupation common? I really don’t know. But I have enough experience with this particular group of individuals of unique amorality that I worry about it. Meru is moving in the right direction here, and I think such will become common in WLANs over the next few years. As for the rest of the network – we have the technology., we have the tools, and we sort of have the consciousness. But, as yet, we lack the will. And someone, likely someone otherwise innocent, is likely going to pay for that.
