Schneier on Security

b • March 23, 2009 10:50 AM

Many of the comments here are thinking on internet-scale instead of the real world, much like that post a long while back about gunshot detectors. These don't need to be perfect. Things in the real world rarely are. It just needs to be good enough, and it could be especially useful at checkpoints. You're not going to put these everywhere, but an extremely sensitive explosive detector would be nice for mass transit points, for instance, where no, you we aren't going to be letting you on the train/plain/cruise ship carrying those cans of gasoline.

b • March 23, 2009 10:56 AM

@Kyle Wilson: "This does seem to also open up the possibility of a huge denial of service atttack by simply seeding the sidewalk outside an airport (or many airports) with small amounts of some known explosive."

This is simply absurd. You're thinking internet-scale, not the real world. You're talking about someone doing something that's just shy of getting them sent to gitmo for what? To get his jollies off? Should we not use house alarms, since someone with a bb gun can be driven down the street and with a bit of aim, shoot every house window and set off all the alarms?

This is why you have layered security. Even if the explosive detector wasn't being used, you'd still have security guards, x-rays, etc. To completely toss out a security device simply because it is possible to interfere with it is absurd.

b • March 23, 2009 11:59 AM

"(presumably using disposable minions if needed)"

I'm sorry, I thought we were talking about the real world. My mistake. Clearly, this security device is entirely worthless in the face of the threat coming from Ming the Merciless.

News Flash: EVERY SINGLE SECURITY DEVICE EVER DEVISED CAN BE OVERCOME!

Should we then do nothing? Just throw up our hands and not bother? Of course not. Every security device can be overcome, so you layer them. Security device emitting false alarms? Find out why. Perhaps adjust it down? Perhaps beef up other types? This device can detect as little as 600 picograms. Do you think the people who invented it are so stupid that they can't put a dial on it to change its sensitivity? Or even put different thresholds for different substances? Or have different settings for different locations that have different levels of security?

Not to mention that the device isn't tied to a laser beam to immediately incinerate anyone that sets off its detector. For instance, did the guy just fill up his tank or his backpack filled with gasoline? Have the security people nearby check. Problem solved.

Anyone suggesting that this is a panacea is absurd, but equally, anyone suggesting a device to detect chemicals used in explosives is being equally absurd.

b • March 23, 2009 2:10 PM

@Eric: "Are you implying the internet is larger or smaller then the real world?"

I'm implying that they are very different. The speed, distance, and prevalence of attacks on the internet are much greater than in the real world. Additionally, virtually all security measures on the internet must be automated. My servers are on the receiving end of ssh dictionary attacks almost continuously. However, to get into the data center where my servers are, you need a card, my thumbprint, and get past the security guard. Each of those, by themselves, is almost trivial. Combined, they're really annoying. Why? If you fail more than a couple of times to get your spoofed fingerprint past the reader (most of the methods of spoofing don't get it to work on the first try, heck, it doesn't always get my real finger on the first try), the guard will notice, even though the guard probably doesn't know my face. The layers of security are stronger than the sum of their parts in the real world.

On the internet, the layers are effectively atomic. You get past my ssh key, then you're at a login, but you'll need to break the sudo password next. The ssh breakin doesn't slow down the sudo password searching, since it has already bypassed it. Each layer is relatively atomic.

Internet attacks are widespread and thoroughly automated and can be done from half a world away. Real world attacks require that the perpetrators be on premise, massively increasing their risk. The attacker, for instance, can't stand there at a door using a dictionary attack on the keypad the way the internet attack keep knocking on my ssh door from china. The guard will see him on a security camera. Even attempting to break the door code can land the attacker in prison. The internet attackers from across the globe are quite safe; the attempt itself carries little to no risk, so they can keep trying.

Denial-of-service attacks are also quite different between the two. If I was paged every time someone tried to break through ssh on my servers, I'd never get any sleep. Again, because the attempts are remote and anonymous and there is nothing I can do to punish the attackers. A denial-of-service attack against the real world protections is more difficult, elaborate, and require much greater risk. Planting explosive chemicals into the ice-salt, as mentioned above, would get the attacker jail time, even without an actual attack on the facility.

The human element, as much as we go on about the stupidity of the bulk of homeland security personnell, would make most of the attacks that you see on the internet unworkable in the real world. Even stupid humans are more adaptable than automated computer systems.

Many people here are viewing this device akin to a system that will page me every time someone fails an ssh password. That's completely the wrong way to look at it. Look at it, instead, as giving every security guard the nose of a trained bomb dog.

b • March 24, 2009 2:39 PM

By the logic of many people I'm reading here, we'd never use metal detectors. Tons of false positives, human operated, pain in the rear, but used damn ubiquitously in high security public areas. Just rename this device "chemical detector" instead of "bomb detector" just as we call them "metal detectors" instead of "weapons detectors", which is really what we use them for.

Moreover, I get the sense that many posters here would install nagios with the deault settings, then whine that it's so annoying. For a device like this, you don't just haul it in, set it to default, and call the swat team every time it beeps. You install it with notification turned off, let it collect data for a month or so, and you'll have a very good baseline.