Schneier on Security

Clive Robinson • August 24, 2012 12:22 AM

First off, the artical is an interesting read but the comments make for a much more interesting and enlightening read and links.

However I did like the comment by Prof. Julie Ryan D.Sci in the article,

“From what I’ve seen of the big commercial surveys, they all suffer from major weaknesses, which means the data is worthless, scientificaly…

As a professor of engineering management and systems engineering from George Washington University, Julie Ryan should be fairly well qualified to make the statment due to similar work in the area [1].

However what the artical neglects to mention is that the problems run way way deeper than just “gut feelings on losses dressed up as scientific papers”. Those gut feelings are likewise shams lacking in any scientific credability because the “industry” lacks metrics, measurands and methods of any form that are of use to suppport scientific investigation.

Or to put it another way, when you see a report from the ITSec division in a company and it’s measurands consist of statments such as,

“The Firewall software reports indicate it stopped XXX intrusion attempts in the last month”

or

“The AV Software reports indicate it scanned YYY emails and stopped ZZZ attachments in Q3”

Of what use is such information?

It’s why the idea of “Industry Collaboration” to fight “Cyber-crime” as envisaged by Governments is unlikely to be anything other than an “administrative success”, and just one of the reasons “Cyber-crime Initiatives” are only ever going to succeed as tax money black holes.

[1] Julie J.C.H. Ryan D.Sci & Theresa I. Jefferson D.Sci “The Use, Misuse and Abuse of Statistics in Information Security Research” which analyses 14 of the major reports in the 1995-2000 period. ( http://attrition.org/archive/misc/use_misuse_abuse_stats_infosec_research.doc )

Clive Robinson • August 24, 2012 5:13 AM

@ AC2,

Dammit how can you sell silver bullets without convincing people of the existence of vampires??

Easy make them “must have” fashion accessories, then you don’t have to muck around with all those unstable chemicals, so you can make them in any old third world sweat shop not worry about arms limitations export controls.

Best of all as we know “must have fashion” is way way over priced so you could be looking at a nice safe profit of anything up to $100 / bullet 😉

Clive Robinson • August 24, 2012 10:42 PM

@ Booker,

When .mil receives delivery on a $100 billion contract, do you think that jet is really worth only 100 b

Not a good choice to use as Mil Contractors have “previous” with what has been variously described as the “$600 Hammer Problem”. Some estimates of the “secrecy cost multiplier” range from x10 to x1000 depending on just how secret a project is.

From a certain perspective “secrecy costs” are sunk costs especialy when facilities are “one offs” specific to a project and then abandoned or bulldozed. Thus such projects have little or no legacy benifit.

As for an accumulative benifit from previous R&D this is debatable. Much of the R&D is not carried out in a vacuum of a specific Mil Project, but by companies that do broad base R&D for mainly commercial reasons. Even “bleeding edge” R&D is usually carried out with the intent of industrial exploitation. Now something that most engineers know but few investors seem to realize is that “ideas come of age”. That is most of the fundemental work has been done long long ago and any “primary patents” issued on it have expired by the time the market is ready for them. It is thus the secondary pattents that apply the fundemental work to specific products that earn the money. Now the problem is in many cases it’s not the holders of the primary patents that get the secondary patents.

Further “bleading edge research” is about making the unknown known and this is a very expensive process. However once something is known to be possible it is usually comparitively inexpensive to re-invent it. Thus it is usually secondary research that pays dividends not primary research.

Another issue is monopolies stifle markets in many ways, where as competition usually develops markets. One aspect of this is that having invested money in R&D your investors want it back with significant profit. Thus the products will with a monopoly be priced very high to provide the return to investors. However this usually results in the product being to expensive for all but a few so sales are low. Without competition there is no incentive to change this. However with competition the price drops to a point where considerably more items are sold and a as part of this process profits actuall increase for all who chose to participate effectivly.

It is this that creates the top part of the product value S-Curve. The trick is to maximise this before other inovation starts to make the product type obsolescent. Thus all products have in effect a finite life and competition actually increases the total economic benifit for all participents in that limited time period.

A good example of such a market place was stand alone “Fax Machines” where they went through several stages of development and now don’t realy exist any more as their function is in effect just a “software add on” in other more generalised products.

Whilst I’m not arguing IP theft is good I am saying that the argument about the value of “Secret IP” is actually seriously flawed and very over inflated and should not be projected in the way it currently is to make “loss estimates”.