Over twenty years ago, a friend of mine told me he was going to work for an anti-phishing company to help stop online social engineering, and phishing in particular. I told him that it was a dead-end job because it seemed likely that multiple vendors were creating solutions that were likely to make social engineering and phishing a thing of the past soon. I am glad he ignored my “great” advice because he went on to earn millions of dollars and has retired early. So much for my prognostication abilities.
Since the beginning of networked computers, social engineering and phishing have been involved in the vast majority of successful attacks. Current metrics put them responsible for 70% to 90% of all attacks ( Social Engineering Is the Number One Cybersecurity Problem by Far) . Different vendors give different percentages to social engineering’s responsibility, but they all agree it is the number one problem in cybersecurity, and has been for decades (followed by unpatched software and firmware).
In that same time, I have seen a ton of people and organizations say they will soon end phishing because of some great new technology or focus. I remember one Fortune 10 CSO telling me that phishing would end “by next year” because of his work with a favorite vendor. It did not work. We have seen the most massive cyber companies we know try to tackle the problem (I am talking about Google and Microsoft) and even their focus and incredible resources have not stopped social engineering and phishing. So it’s not a resource or money problem.
Phishing has gotten better in some respects and worse in others. No matter how you measure it, it is still pretty bad and no coming future technology (that I know of) seems likely to diminish it quickly anytime soon. And if we somehow got perfect at preventing email phishing, we still have all of the other channels where social engineering and phishing can be accomplished (e.g., websites, social media, SMS, voice calls, chat products, etc.) that are even harder to tackle. We are surrounded by things trying to socially engineer and phish us.
And it is not just traditional online threats. We also have a problem with physical attacks that use digital technology to accomplish their objectives, like swatting attacks and bomb threats. There are hundreds of these occurring around the world every day. And as long as technological defenses are not perfect, all people and organizations need to do great security awareness training. Everyone needs to be taught how to recognize social engineering, and how to mitigate and appropriately report it.
When will social engineering and phishing finally be defeated?
I have thought about this question for decades. I know the answer.
Online criminals commit crimes because they cannot be identified, arrested, and prosecuted. As long as that is true, we will not get rid of cybercrime. Not that the average person wants to commit a crime, but most of us do not commit significant crimes when tempted, say robbing a bank, at least partially, because we do not want to go to prison and have a prison record. I would like to say that we are all ethical, good people who would never commit a crime, but the thought of prosecution helps keep most of us honest and law-abiding over our lives. We don’t commit crimes in real life because we can be identified, arrested, and prosecuted.
This is not true online. The average cybercriminal can commit significant crimes over and over and over without threat of arrest. Imagine how our real-world society would be if anyone could rob a bank and never be caught. It would be chaos. We would not have banking or least pervasively like we do today. Well, we have a bank-robbing problem in the digital world that is hampering our ability to be more productive and successful.
The answer?
Pervasive, assured identity.
What I mean is that anyone who cares about making sure the person or company they are dealing with is actually that person or company should be able to confirm this single fact before communicating with them. In my future world, I would never communicate with anyone not willing to truthfully identify themselves. I would have my servers and services reject every anonymous email and network connection. I think a lot of people would be that way. For example, over my career, I’ve gotten a lot of hate mail from people who disagree with what I write. I wouldn’t mind getting it from people who don’t mind identifying themselves, but most of it comes from anonymous people with randomly named accounts and that anonymity seems to make them meaner than if I met them in real life.
The Internet is mostly pervasive anonymity right now. Anyone can be anonymous or claim to be anyone far too easily. We need to replace the Internet’s pervasive anonymity with pervasive, verified identity. Now, there is a huge segment of the Internet that wants complete anonymity (or pseudo-anonymity, where at least one mutually trusted source knows the person’s real identity, but not everyone). I get it. There are plenty of scenarios, like addiction counseling, cryptocurrency transactions, protesting, politics, escaping violence, etc., where the parties involved desire anonymity. If you want anonymity you should be able to have it.
But we need an Internet system that guarantees verified identities if we want to confirm who we are connecting to. In that world, we may not be able to arrest someone because they live in a different country and don’t fall under our legal system, but we could block their email, phone call, or text message if they were not willing to identify their true selves. Right now, we are in the Wild, Wild West form of the Internet where anyone can claim to be anyone from anywhere. That’s how cybercrime thrives.
I would like to see the Internet become a civilized, mostly trusted, society with better default manners. Any solution that gives us a better identity is a way to “fix” the Internet. It is not an easy thing to solve. Again, we have all sorts of parties that enjoy anonymity and do not want to make the whole Internet ONLY verified identities. These parties range from privacy advocates and victims to law enforcement. Governments and law enforcement cannot as readily spy on their targets if they are truthfully identified every time.
How do you give verified identities to those who want it (like me) and anonymity to those who want it, and every scenario in between?
My solution, in summary, is to allow anyone on a per-connection basis to decide what minimum level of identity assurance they would like to require in order to begin communications with that person or connection. In many cases, a person would choose a verified, trusted identity. In others, they might want complete anonymity or pseudo-anonymity. My solution allows anyone to choose what level of identity they want for each connection. And if they do not want any change from how things operate today, they can just keep doing what they are doing today without any changes. It is just that they cannot connect with other people and companies who might require a trusted, verified identity.
I do not want to go into the technical details of how my solution accomplishes this, but you can read more about it here: Wanna Fix the Internet? .
My solution can be done by developing a few new protocols using existing technologies, with people, organizations, device manufacturers, software, and cloud vendors opting to participate however they like. Central to this idea of being able to require particular identity levels on a per-connection basis is an operating system, like Cubes OS ( https://www.qubes-os.org/ ), that allows all of this to happen on one seamless desktop. The user is just clicking on an icon or link, and the OS and Internet handle the rest of the behind-the-scenes technical part.
If you do not like my solution, that is alright. I am open to any solution that will solve the problem. I do think any solution will include verified, trusted identities. It’s the only way to defeat most cybercrime. The only solution I do not want to accept is one where we just keep the current status quo, doing what we have always been doing, because it is a world full of unlimited social engineering and phishing.
How Likely Is My Solution To Be Selected to “Fix” The Internet?
Well, I have been promoting my specific “Fix the Internet” solution for at least a decade and a half. It has been shared with top-level universities (e.g., Harvard, Princeton, etc.), industry luminaries (e.g., Bruce Schneier, Loren Kohnfelder, etc.), and Internet authorities (e.g., CISA, etc.) and has not gone anywhere. But I have not seen any possible good solution to fixing social engineering and phishing go anywhere. None of the good solutions go anywhere. So, I think the likelihood of my solution or any other good solution going anywhere anytime soon is very remote to impossible.
What would make a good solution be quickly adopted? Perhaps an Internet “tipping point” event. A 9/11-level event, but on the Internet, might make things happen. What would that look like? I do not know…a disruption of a significant portion of the Internet for a day or days. Maybe some massive online financial threat. The stock market going down? Email not working? DNS down? Airlines and EMS systems down? I do not know.
But I have been thinking that some massive tipping point event was going to happen to the Internet for 20 years and it has not. So, perhaps we are destined to just keep muddling along in this very broken version of the Internet and life where social engineers and scammers just keep on surviving, thriving, and making our lives a living hell…or at least a little less productive than it would otherwise be if we did not all have to be on a constant lookout for scams.
In summary, the Internet is very broken and has been since the beginning. Scammers, social engineers, swatters, and phishers abound. Nothing in the near future is going to significantly diminish the amount of cybercrime we have today. In fact, AI and deepfakes are just going to make it worse. So, until then, make sure you, your family, your friends, and your organizations are getting great security awareness training, because they are all going to need it. But we have solutions that can make the Internet a significantly safer place to compute. We’re just not implementing them.
