Schools and school districts traditionally have been attractive targets for computer hackers, but now there’s encouraging news from internet security researchers at Georgia Tech. “Neural networks,” or computer programs that can remember events and learn the trends and tendencies of intruders, might be the key to halting the hackers.
“It’s going to take a shift in the way people think about computers and how they operate before we are ever truly secure,” said Blaine Burnham, a former National Security Administration security specialist who now heads Georgia Tech’s Information Security Center. “But we’ve started that process.”
Even though Georgia Tech’s The Sentinel Project doesn’t literally “think,” the group of programs is set up in different “nodes” much like a human brain.
“They are much like neurons or synapses,” said Jim Cannady, a Security Center researcher.
Neurons in your brain learn from experiences, creating synapsesor connectionsbetween one part of the brain and another. The neural network works in a similar way, Cannady said, although it’s “just a rough emulation” of the brain.
The network is designed to recognize small increases in abnormal data, which could signal that someone has broken into the system. The neural networks also would update themselves to fight against new approaches hackers attempt.
Current systems require administrators to constantly update every possible attack option or system weakness. As hackers try new approaches, that list is continually growing, meaning administrators are always playing catch-up.
“(Neural networks) would work a little more mysteriously and mean you’d have to take a little more on faith, but they would streamline the process incredibly,” said Cannady, who projects a usable version within two years.
Sounds interesting, says JonnyX, a 31-year-old hacker who didn’t want his real name used. He admits it would take some serious work to break through a security system with a neural network, but JonnyX doubts the network would keep him out.
“Neural networks would be cool, if they worked,” he said. “But I don’t think any system will ever be truly secure.”
Finding weaknesses from within
One of the best security alternatives currently available also came from Georgia Tech.
Inspired by a 1983 science-fiction novel, former Georgia Tech student Chris Klaus invented a program that finds the weaknesses in a system from within. It allows system operators to see the network from a hacker’s point of view instead of relying on a standard firewall, which attempts to keep all unwanted traffic out of a school district’s network.
“Right now, we have about 2,000 threats and vulnerabilities on our database, and the list is continually growing,” said Klaus, 25, who initially released his Internet Security Scanner for free while he was a Georgia Tech student in 1992. He has since become a multimillionaire after starting a computer security company.
But even with the advances made by Klaus’ Internet Security Systems, researchers and hackers agree that internet security at most school districts is woeful. The same is true in corporate America, they added.
JonnyX, who works as a computer consultant in Nashville, Tenn., said most hackers break in just because they can.
During an Atlanta symposium on hacking earlier this month, JonnyX said organizations usually ignore security until its too late, thento avoid negative publicitydon’t press charges against the hackers they nab.
“There are CEOs out there [who] would rather admit to being a pedophile than admit to their shareholders that they’ve been hacked,” said Jim Butler, an Atlanta attorney specializing in internet and electronic privacy law.
But programmers and hackers agree that even companies and school districts that invest in advancements such as neural networks or other programs shouldn’t let their guard down.
“Are banks totally secure?” asked JonnyX. “They’ve been around a long time, and people still rob them. Until the computer and the internet stops being sexy and become an everyday household appliance, security will remain an issue.”
National Security Administration
Georgia Tech Information Security Center
Internet Security Systems Inc.