Schneier on Security

Clive Robinson • July 3, 2011 4:21 PM

@ Doug,

The ARS article side steps the major problem and that is “reliable measurands”.

Although security is best thought of from the managment perspective as a “Quality Process” it has a tangable -v- intangable issue.

Quality systems started from a need on the factory floor, tangable raw goods go throough a manufacturing process to produce products. At all stages of the process an item or part goes through a process that has reliable measurands.

These measurands can be put through reliable transformations as they work their way up the managment stack to walnut corridor where they are presented in a manner the execs understand (ie in their language and work domain).

Not so security, firstly software is in effect a one off product that gets replicated n thousand times, as such it is like a watercolour original with thousands of prints. It is inherantly intangable and has currently no measurands that are meaningful in security terms.

In reality the only part of the process that can be measured is the duplication or copying process of product that goes out to customers, just like controling the print process for duplicating the water colour.

This means that we have to take a step back and look at how Quality measures effect the design process not the manufacturing process. And this is a real issue because software design is very much more art than science. Thus we have to look at the history of other industries such as early steam engines to see how their design was moved with the help of rational thought, science and law from art to artisan to engineering.

If you think about the history of engineering you can best see where software is by the example of the wheel wright making. wheels for coaches and waggons. After the initial discovery in unrecorded history of the discovery that round objects roll more easily than other easily made shapes not a lot realy happened to the basic design for hundreds of years. Each improvment was as a result of a minimal change and trial by customer. In Roman and medieval times waggon wheels were constructed of planks of wood cross placed and bolted or nailed together to form layers that were then cut into an aproximatly round shape around a central hole with additional cross bracing. Sturdy inefficient and with little or no give they could not be used at more than walking speed. Chariots in Egyptian and Roman chariots etc had the sort of spoked wheels that we think of today, but more than a cursory glance shows that the wheel was still rigid in construction. It was not until much later that it was found that putting an angle on the spokes that it was found the wheel would go faster and brake less. The secret of the angle was passed down from master to apprentice as a “pattern” that worked without any reason behind it. Significant change in wheel design did not happen untill wire spokes and vulcanised rubber came along in the early ninteen hundreds, but it was not untill the late ninteen hundreds and early twentieth century that science could explain why the “patterns” worked or how to improve upon them.

If you think about it software is in the early artisan “pattern” stage of development. The science of software is realy about algorithm comparison where there is the meaningfull measures of time and resources which can be repeatedly and reliably measured.

Not so security where the only measure you generaly get to hear about is the meaningless number of spam or virus detected at some point trivialy compared to some other meaningless measure to security such as the number of inbound emails.

Currently we talk about “best practice” which is realy a game of “follow the leader” where the leader is the winner of a crap shoot contest. They cann’t tell you why the dice rolled in their favour only that it did. So we employ “magic umbrella” thinking, that is it never rains when I carry my umbrella, but it occasionaly does when I don’t therefore my magic umbrella must be what stops it raining…

Thus legislating on carrying magic umbrellas might not be a good idea, but that does not stop people trying…

Have a look at the recently released update to the 2005 EBanking guidelines to banking security examiners,

http://www.fdic.gov/news/news/press/2011/pr11111a.pdf

and tell me how many “magic umbrellas” you can spot?

Do you actually see anything in there that can be reliably measured, appraised, and tested in a reliable fashion?

The one thing you can almost guarentee is that a lot of politicos are going to get fat on the largesse of the industry that want any kind of legislation like a hole in the head. What will result will be just like Sab-Ox, a bunch of hoops to make the institutional dog jump through but little else. And the hoops will be designed such that only the big dogs will be able to jump through them easily.

Clive Robinson • July 4, 2011 8:57 AM

@ Vles,

“As a Dutch person, I would like to answer ‘Law of the handicap of the head start'”

Agh ha, another “leading edge is the bleeding edge” observation.

I know from long experiance it is easier to “accomplish the known” than it is to “make the unknown possible”.

There are several factors behind this.

Firstly unless an individual is financialy independent beyond the norm, they will need the help of others (investors workers etc) to make a vision reality. Once the vison does become reality it is often stolen from the person with vision, either directly (see development of first metal type printing press) or indirectly by a number of means. One of the later is that others now know it works and thus can attract investors more easily.

Secondly once a technology is established it starts making a return in some way. It is only when the older technology becomes grossly inefficient compared to the new (seperate condenser on steam engines) or is far to dangerous does it get replaced (Davy Miners lamp). There are a number of reasons for this. The first is a vested interest fights the new commer initialy from a possition of strength, secondly is “sunk investment”, thirdly is installation cost.

If as in the gas-v-electric light issue you have a “virgin site” and you have decided to make the investment and thus a spending on the installation cost, you will almost invariably go for the system that offers the lowest longterm operating costs or is safer.

However if you already have a system in place, those that own and opperate it have a vested interest not least in that they will become redundant (see definition of the words Luddite and Sabotage) and thus will activly opose a change. Also it is a fairly easy argument to say replacing the system will cost ten times the annual costs of the current system. Thus a small annual cost/profit is seen as far better than a large sunk cost now compared to a marginal improvment in profit some ten years hence.

Then there is “the Law of the Known”, which is that people have a naturaly conservative outlook. In London the water supply was originaly “piped” in wooden logs with a hole bored down the middle. Fired china clay pipes became available shortly there after and metal pipes where known of. But compeating organisations carried on using wooden log pipes simply because they were a known technology, and those experianced in the use of wood were on hand.

There are some other reasons that explain it but I hope that helps.

Clive Robinson • July 5, 2011 1:31 PM

OFF Topic

@ Bruce,

I susspect you may be on the lookout for security stories with a “what were they thinking” angle.

If not this still might amuse,

http://www.theregister.co.uk/2011/07/05/suitcase_jailbreak/

However on a more serious note the article does not say why “Mr flexibility” was not discovered missing before his Girlfriend even left the building…