Schneier on Security

Clive Robinson • October 21, 2012 5:59 AM

OFF Topic:

As some of you are aware I take an interest in the security (or lack there of,) of medical equipment both implantable and diagnostic.

What some of you might also be aware of is the civilian trauma expression of “the golden hour”, which bassicaly says in major trauma actions carried out within the hour have significantly better outcomes for patients than if done after that hour. Some people might even have heard of “the platinum five minutes” talked about with battlefield injuries where soldiers can bleed to death in less than five minutes or be brain dead from respritory failure etc etc etc.

The whole point is that the faster you take actions the much higher the probability is of success for the patient. So fast and reliable diagnostic equipment is vital for trauma and other kinds of patient.

So as a patient you realy realy do not need diagnostic equipment that is slow or inaccurate because it’s bogged down by malware…

Which is sadly happening all to frequently these days not just in the hospital but all the way back into the design stage,

http://www.technologyreview.com/news/429616/computer-viruses-are-rampant-on-medical-devices/

Clive Robinson • October 24, 2012 1:38 AM

OFF Topic:

Has one of the senior members of the DHS lost the plot?

Well apparently so if an article in Computer World is to be believed,

Apparently DHS deputy undersecretary for cybersecurity Mark Weatherford gave a speech at a cybersecurity awareness conference in Santa Clara, California a few days ago, which is not unusual (it’s part of the job description).

However what was unusuall for some one who is in his position is he apparently prefaced his speech with,

“I have no idea if this is legal or conceptually even possible, but it’s something to think about.”

Before going on to talk about the problems some US banks have had for more than a couple of weeks with DDoS attacks claimed to be out of Iran.
Of which he said,

“It’s got a lot of people’s attention. Not just the banks, but the ISPs and some of the other third-party providers as well.”

And reinforced it with,

“I can tell you, because these big banks have just gone through it, they did not have enough capacity, or they barely had enough capacity, no one was hurt too bad over the last couple of weeks, but we need to think about different ways of sharing resources among like minded organizations,”

And dropped in his little idea of,

“How about developing a co-op kind of a model for these Web content delivery providers, like an Akamai or Prolexic or some of those folks, where you buy a bunch of servers more than any one company might need at one time, but you co-op that for like-minded organizations and when someone needs that kind of service you point it at them and they have it available to them,”

If this is representative of senior DHS cybersecurity level thinking then perhaps they should give the money back and quickly.

http://www.computerworld.com/s/article/9232614/DHS_official_suggests_sharing_resources_to_mitigate_cyberattacks

Clive Robinson • October 24, 2012 2:28 AM

OFF Topic:

Here is an interesting one thats poped up on the Federal Register,

NIST are looking for you to give them your resources (if you are a US Company) to assist in filling their National Cybersecurity Ceneter of Excelence (NCCoE).

http://www.gpo.gov/fdsys/pkg/FR-2012-10-19/html/2012-25826.htm

Or have a look at the NCCoE website,

http://csrc.nist.gov/nccoe

Sadly I get the feeling NIST are looking for specific soloutions as opposed to generic frameworks. Although specific soloutions are nice it’s a case of “giving a man a fish” where as generic frameworks are “teaching him to fish”.

Clive Robinson • October 25, 2012 5:46 PM

@ figureitout,

What he is saying is that my generation is intellectually incapable of designing a “cathedral”

Hmm whilst I agree that many if not most of the 90% increase due to DotCon were and may still be incapable for various reasons I would only put it down to lack of intellectuall capacity in some.

It’s like a motor mechanic who changes tyres on wheels and swaps parts of damaged exhast systems being called an “engineer” which we see in the UK a lot (it does not happen so much in other northern EU countries due to “official” as opposed to “unofficial” proffesionalism whereby you have to prove yoursel by examination to be worthy of holding the title by law, much as Doctors etc have to).

If you are not required by law to be qualified before you practice then anybody can hang up a shingle and advertise for work, if demand outstrips supply as it did in DotCon then the price rises and this attracts in chancers who to an inexperianced ear “talk the talk” but instead of “walking the walk” take the cash and run with it.

The reality is it takes between five and fifteen years to theory and practicaly train a top flight engineer, there are no real short cuts except for the very few who can concentrate for more than the norm of five hours a day and have the ability agin to a photographic memory to soak in and process vast amounts of information.

Another issue that I’ve mentioned in the past is the various forms of “code cutter” ills. There are two basic parts to writing code, and to understand this you need to think in terms of spoken languages, there is the basic mechanics of speaking and other rules that are common to many languages and then there is the specific language it’s self. A person may be very fluent in a single language but totaly incapable of speaking any other language, because their whole understanding is from the top level of the language downwards carrying all the languages foibals with it. However a person who speaks several languages well if not fluantly has usually learned the basics or fundementals well and then sees the foibals of any given language as what it is just a mear gloss or shine that is fairly irrelevant.

You see this with code cutters they never learn the language independent fundementals and foundations such as ADT’s etc, what they have learnt is all the little foibals of the specific language that allows some modicum of improvment in run time or other metric. Thus they are only capable of making small incremental improvments that are usually lost in the Moore’s Law improvment before the code even get out the door. An engineer on the other hand knows how to make the fundemental changes that make the big scalable improvments that carry on well past Moore’s Law time scales. Further they also don’t care what the programing language is because they design their programs at the fundemental level not the superficial “froth on top” level, and usually they apply actuall engineering scientific/mathmatical processes rather than the “brush strokes” of the artisanal approch of your code shop code cutter.

A major area that shows this up is code reuse, this is the “holy Grail” of managment. Whilst a sound engineering approach tempered by much practical but varied experiance will alow this, a single language code cutter is only going to deliver useful reuse by chance.

This carries forwards from programing through the maintanence phase and the general result of code cutting is not maintainable code but a jumbled assortment of “go faster hacks” on ill conceived design with little or no uniformaty in interface design and often many hidden assumptions built into base code instead of being abstracted out to a much higher level.

One of the biggest hold backs on secure programing language design is down to edge cases on objects and data types especialy where inheritance is involved. Although it should not be these edge cases are used as the norm not the exception by everyday coders for the perceived (but usually slight at best) speed or other advantages. Thus the bulk of code in existance cannot be carried forward to a secure programing language, the inbuilt language assumptions have to be reworked out, and they usually extend down so far into “code cutter” produced code that it would actually take longer than a complete rewrite from scratch… Saddly the issues appear to have become “formalised” into “standard libraries” with the likes of C++ and Java and endemicaly so with “web” languages.

So yes there are many code cutters who can only Bazaar “code cut” “market stalls” from the detritus of previous Bazaar code cutters failures. They have never ever started with the raw building block materials and produced an engineered product of simple but elegant functionality such as a “house”. So they totaly lack the skills to properly design and manage a project where you take the raw minerals and forge and carve them into the building blocks, that if they could also properly design or manage the work, turn them into a thing of majesty and beauty such as a “Cathedral”. Sadly for some they actually lack the intellectual ability and imagination to do so, and if they were ever to visit a Cathedral would be incapable of learning from what they would experiance.

As I’ve said before there are way to few people capable of doing secure design at the OS or App level, we need to have some method by which we can leverage their skills so that everyday code cutters can use their “off the peg” items safely. Look at it this way materials scientists and product design engineers design such things as nuts and bolts and other base parts and specify them in such a way that other design engineers can engineer them into a new bridge or building etc with the confidence that the parts will not fail them, can we say the same for software?

Hardly… we don’t have an engineering methodology is software design we work with “patterns” which is what pre-victorian crafstmen used to make coach and waggon wheels, there was no science involved just the “break it and bodge it” mentality of “bolt a bit on” to fix a problem where it fails not where it originates which is the same as putting a Band Aid on a broken bone.