Schneier on Security

Clive Robinson • January 10, 2010 3:48 AM

@ John Langlois,

‘The current approach to airport security is “defense in depth,” i.e. reacting to and every new threat as it surfaces…”

Hmm No I’m not sure what you are trying to say but “defense in depth” is not what you are describing with,

“i.e. reacting to [each] and every new threat as it surfaces by buying…”

That is reactive security which has nothing to do with defence in depth, the concepts are compleatly different.

The whole point about defense in depth is to stop (amongst other things” reactive security.

As Bruce knows but rarely says these days (time for an OpEd me thinks 😉 defence in depth consists of “broad overlaping” defences that are desigend in such a way that the gaps between orthagonal defenses are covered and importantly the individual defences lock together.

We often talk about defense in depth as being like the “layers of an onion”, “leaves on a cabbage” or “filo pastery” when trying to describe it by analogy.

That is each defence layer is very broad but thin and may have imperfections and holes in it. However multiple such layers provide an overal depth that can be quite flexible. But importantly the result is that small weaknesses or holes in one layer get covered by other layers.

However this is insufficient in of it’s self,

Firstly if the individual layers or defences are not broad but specific they actualy accomplish little. As Bruce has noted in the past “overly specific” defences are like “50ft spikes in the ground, that are easy to walk around”

Likewise a mismatch in the capabilities of an individual defence causes issues. Hence the comment Bruce has repeated often about “safe doors on a tent”. Or the much older “strong posts alone do not strong fences make”.

You started your post by giving three examples,

You present all three of these are “reactive measures” caused by a specific threat. In atleast one case the measure was already in place (metal detectors) and although they worked for 9/11 they failed to stop the attack due to “no penalties”. (yeah you’ve got a cheap knife in your pocket, so what, on you go).

However some of them are good and some are bad you need to consider if each defence is,

1, Broad or Specific and in what way.
2, Orthagonal to other defences in use.
3, Interlocking to other defences in use.
4, Defence is not mismatched to other defences in use.
5, Defence is not mismatched to known threats.
6, If a defence mitigates issues with other defences and how.
7, If each defence produces appropriate responses.
8, If the actual defence (not it’s type) is appropriate to where/how it is being used.

Before you can argue if it is as part of “defense in depth” or not.

The first example you give,

“Box cutters = metal detectors.”

The metal detectors worked and did pick up the “box cutters”.

However it’s defence potential was negated by the “so what” threat evaluation. Which arguably was a failing of point 5.

The 9/11 terorists had actualy tested the systems on a number of occasions and realised that there was no penelty with carrying a box cutter. Thus it failed on Point 7 above.

Your second example,

“Bomb in sneaker = everybody take your shoes off.”

This is a prime example of failing at point 1 above. The threat “bomb in sneaker” was a specific sub class of the more general “bomb in apparal” which is a sub class of “person has hidden explosives” which inturn is a sub class of “person has a prohibited item” which in turn is a subclass of “person has a dangerous item” which in turn is a sub class of “person has an item”.

We saw atleast one publicaly known examle (Ass Bomber) of a higher class (person has hidden explosives) threat, but it was not taken on board. So within a couple of days we have “Capt Underpants” and “Dr Blowup” so “shoes off” also failed on point 5.

Arguably the problem was that after 9/11 working at the “person has an item” class was considered but the issue of point 8 came up (we half joke about getting through the screening “butt naked with a black rubber glove hanging out of a bodily oraface”).

Which brings us onto your third example,

“Bombs in underwear = full body search.”

We are not yet, nor are we even close to a full body search even for the external body surface (thank god)

Arguably it is currently going to fail point 8 in the way our “mass transport” systems are organised…

We then get onto your analysis/complaint of,

“by buying new equipment and implementing new procedures. This just adds layers on top of layers of complexity and increases the cost of air travel.”

Yes it does but these acts are not indicative of “defense in depth” they are just as indicative of the last moments of a chicken after it’s head has been choped off. It runs around and flaps it’s wings so appears to be “multi-tasking” but provably there is no “directing mind” in charge.

Thus it is what we more often call a “Knee jerk reaction” that is it is unavoidably and mindlessly reacting to a previous “insult”.

Please note I’m not saying your actual analysis above or conclusion,

“Defense in depth is eventually going to cripple the air travel industry as it results in excessive cost and inconvenience. We’re spending billions of dollars to protect against a few bad guys. Let’s think about a different approach.”

is wrong (they are quite close to being correct) just that you have incorrectly labled it “defense in depth” which it is not.

The sad thing is the current POTUS is reputed to be an analytical thinker not a “knee jerker”. What we needed to stop the stupidity was for POTUS to stand up and say “Yes we missed this one and we cannot avoid missing future ones unless we make radical fundemental changes” then ask the people to think long and hard about how the rest of the world view the US and why and what they want to do about it.

Because it must have dawned on quite a few Americans by now that the “why us” question is not just about how the terrorists see the US but how a rapidly increasing percentage of the worlds population sees the US and it’s policies since the 1950’s.

Instead POTUS sucumbed to the “beat up a burecrat to protect the status quo” merchants and their “talking heads” who are happily profiting from this irrational and blinkered view point that lines their pockets one way or another at the worlds expense (not just that of the US tax payer and consumer).

And before I get the “red card” from the “Moderator” for “politics” not “security” let me put it this way,

We are talking about trade offs in “National Security” which need to,

A, have a chance of working, and

B, be acceptable /equitable to those they effect not just in the US but world wide.

That is if the US want other countries to pay for the “US border defence” then they had better come up with a real good argument as to why, and none fielded so far are anything but laughable to many outside of the US.

And saddly that is where the “National Security” of all Nations hits the reality of “International Politics” you can not have one without the other…

And thus you have occasionaly to acknowledge “politics” when discussing “security”.