Schneier on Security

Clive Robinson • October 29, 2010 1:58 PM

Not being funny but Militarization is an old fashioned concept, it goes back to the time of full time paid militia acting as a standing defence of a Nations integrity.

People tack the word Cyber on the front of exisiting words in the hope of transfering some meaning to others. In reality mostly what it does is to confuse ordinary mortals and most definatly persons of a purely Political bent.

First off the Internet does not unlike a plot of land have physical boarders. What it does have in some places are “choke points”. However these are one heck of a sight more difficult to maintain than borders are.

The Internet is not tangable in that it does not really have a physical actuality the addresses of it’s data sources and sinks have no physical location constraints and can be moved almost at will. The only physical part is simply a vast collection of communications channels, relays and switches that move the almost ephemeral data around.

Thus anybody can change the intangable internet topology at any time simply by plugging another relay in between any two points of their chosing, or by changing a single entry in a router table, with care it will go undetected almost indefinatly.

The point needs making that unlike the physical world the Internet is a world of information that is effectivly unconstrained by energy costs to an attacker. Thus as a conciquence a single person can have with a modicum of skill an effectivly infinate force multiplier and can raise and control a hugh array of attacking automata that can pass almost undetected for months (think Stunex and other APT ideas).

Again unlike the physical world the Internet currently does not have a realistic distance cost metric. That is all places are effectivly local to each other.

Because of this even “choke points” do not represent any realistic limitation to an attacker. Likewise neither does the “big off switch” idea have any credability.

For instance I can place a malware seed in any location either by time delay or by providing my own comms bridge to the other side of the any “choke point” any athority is likely to put in place.

With any large or public network you are deluding yourself when it comes to “access security” by “physical measure” it almost always can be trivialy negated and as such just cann’t be made to work.

People need to remember that working around faults of all kinds was one of the original design requirments and is very much “built in” to the protocols the Internet works on.

Then when you consider what vectors are available it is apparent the OS has been a major source of vectors (less so currently). Basicaly when it comes to OS security we talk a good game but… lets be honest Stunex had atleast four zero days and a stolen signing certificate. As has been said in a song about a goat that head butted a dam “he had high hopes” and “opps there goes another….”

Yes we do know how to make things more secure BUT it’s the weakest links that generaly defines the strength of the overal chain, and we all know or aware of a great number of “failed to patch” or “can’t patch systems directly or indirectly connected to the Internet…

Thus personaly I will not be holding my breath over this Militarization idea acheiving anything helpful. But who knows maybe a rabbit can magicaly appear in a hat, rather than just giving the illusion it has.