Schneier on Security

Orclev • January 2, 2008 12:30 PM

Why even bother with a bond? If the users system is compromised, disconnect their service and require it pass a screening before it’s allowed back on the internet. Until they get certified as clean just redirect any requests to a page that says something like “Your system has been compromised by a virus, trojan, or worm and your internet connection has been disabled. Please call for more information.”

Personally I think the solution is a mix of social and technological. We need a new OS. Period. End of story. Everything out there fails to go far enough with security, while at the same time committing various other sins. A balance must be maintained between usability, and security. And by security I mean real security, not just nagging the user constantly, all that does is lead people to click “Allow” constantly without actually reading anything. The user should only get a security warning if something out of the ordinary is happening, not every time they do anything. At the same time though, the system should not assume the user knows what they’re doing.

I’m envisioning the next generation of OS, and I think one of the key things is going to be a variable interface. Essentially it asks you a series of questions when you install it, and then recommends one of several interfaces you can use based on your answers. The simplest idiot box setting would be the most paranoid in disabling everything, but would also require virtually no user interaction to remain secure. On the extreme other end would be the one that is totally configurable (would still default to locked down though) and doesn’t hide any of the gory details from the user (there would also be several levels in between these two). I think this would be the best way to please everyone. Those that want a “toaster oven” experience for checking e-mail can have it, and the IT professionals that want to tinker in the guts of the OS are happy as well.

Ultimately our current problems come down to two things. First, it’s far to easy to either directly get malware into the OS, or indirectly trick users into installing malware. This is the failure of the OS to provide enough information and security checks to allow the user to distinguish actual risks from normal behaviors. Second, users need to be educated to recognize shady sites and e-mails. To a certain extent this goes back to the first point, but even then as the phone scams you see occasionally show users themselves or often the source of the problem (I particularly liked the article a little while ago where British office workers gave away their passwords for candy bars).

Orclev • January 2, 2008 2:49 PM

You’re close to what I envision. I think as a default though, particularly in the simplest brain-dead case, yes the system should have features axed to protect the user. These sort of people don’t need the advanced features anyway, they only get in the way. Do you really need something like ActiveX when all you do is check your e-mail and browse eBay? At the same time though, the system needs to be flexible enough to allow experienced users the control they want, which is why I think multiple interfaces are the key. The simple one protects the people who don’t know what they’re doing, and the advanced one lets you get your hands dirty so to speak.

As to the fine grained sandboxing, that would be part of it of course. I envision several levels of this. First, each installation of the OS would create a private key that’s inaccessible outside the kernel (unless you access the HD from another system or OS, but physical security is beyond the power of the OS) and sign all user approved applications with that key. If the program is modified (say by a virus) the signature would no longer be valid and the OS could warn the user. Second, companies (or individuals) would be expected to sign their applications so you could verify that the copy of the application you have hadn’t been tampered with at some point and that different applications came from the same author or company. Lastly applications would be sandboxed and different behaviors could be “trained” as normal, so that the first time an application accesses a network resource for instance the user is prompted and can choose to deny always, deny once, allow once, or allow always from that application. In addition it would need more technical security measures of course, such as non-fixed memory locations, and buffer checking, but from the users standpoint it should be relatively simple to maintain strong control of all the applications. One important feature would also be strong sandboxing, so even if a user didn’t trust and application it could still be run in a minimal permissions environment without any danger of it doing anything dangerous (no or limited access to local resources as permitted by the user).

I’d really really love to work on an OS (I recently ordered Andrew Tanenbaum’s classic book on OS design [the one with the raccoons that talks about minix]), but as it stands now virtually all of my time goes towards my job that pays the bills, with my little extra time spent mostly on my family.

Orclev • January 3, 2008 8:49 AM

@RonK:

It’s not illegal to post a bounty for something illegal. Similarly it’s not illegal to make a contract for something illegal, but the contract itself is unenforceable (or at least the portion pertaining to the illegal act is). Seeing as a bounty is essentially a contract all it would mean is that the contract is void and there’s no obligation to pay it out. However, because the contract doesn’t specify that you need to perform an illegal act to fulfill the requirements it’s not itself illegal as it’s up to the person accepting the contract as to how they execute the requirements of the contract.

@MikeA:
The system should be secure by default. That’s a basic premise that everyone should be able to agree on. I should be able to take a fresh install of the OS, hook it up to the internet with no firewall, and be completely safe.

As for the scripting, there should be strong sandboxing as has already been mentioned. Installing some script should not allow the attacker access to anything but the attackers site. Cross site scripting attacks are well understood and rely on existing flaws with the security of browser scripting, a ground up implementation should be able to avoid those flaws. Furthermore, prevention of a compromise of a users online accounts although unfortunate isn’t really the goal of the OS, its purpose is to protect the users system. Beyond that it should provide the tools the user needs to differentiate between legitimate content, and malware content. If the user, even after being advised that something is dangerous continues to do so anyway, that’s beyond the control of the software. One of the key failures with Vista is that it doesn’t do enough to determine appropriate risk levels associated with different activities (this is partially due to wanting to maintain backwards compatibility with insecure XP applications) and the user is then unable to gain any meaningful information from the warning it does provide. Essentially the user is conditioned that any positives in Vista are false positives.