Schneier on Security

Clive Robinson • May 29, 2013 5:27 AM

@ JeffH,

Yes the comparison between the immun system and security systems has some distinct problems [1].

However you can take a step backwards to get a more generalized overview of attacks against security systems. That is attacks are both specific in their methods but also fall into general classes of attacks.

Most AV systems and work arounds deal with specifics not classes, so they fail with only slight variations in the specifics.

What I’ve advocated for a very long time is security solutions that deal with classes of attack not the specifics of a single attack. This way you do get lasting improvments in security.

So Taleb’s idea is far from original as is the case for many of his pronouncments.

For those who don’t quite see the difference between a specific and a class look at it this way,

A fire drill is an evacuation procedure through a designated (likely) safe route to a designated muster point where a roll call establishes if there are people left in the at risk area. It should be practiced on a sufficiently regular basis such that personnel regularly in the area know what to do without hesitation or panic etc.

We call it a “fire drill” but it’s actually an “evacuation procedure” that is much more general and deals with many more emergancy situations than just the specific of “fire” so works for “bomb threat”, “Chemical spill”, “earth quake”, “gas leak”, “power loss” and all sorts of other “specific emergancies” which fall into the “class of emergancies” for which evacuation is the first sensible response.

You would have a hard time convincing anybody to have “specific evacuation plans” for all the specific emergancies that might arise unless there is a very clear and reasonable reason (as seen in some chemical plants). What generaly happens is the procedure is put in place for the most common risk (fire) and then modified slightly to cover other risks that would not otherwise be covered.

Thus a fire drill in most cases is “anti-fragil” and will probably work for as yet unexpected or unknown risks.

BUT and it’s a big but, when you are dealing with “natural emergancies” such systems wil more than likely work, not so with planned attacks. A planned attack will usually take the prevention procedures into account and use them against the people in a given risk area.

Such attacks have been seen with “two bombs” where the attacker places a small bomb to cause the evacuation procedure to be invoked. The second bomb is placed at the muster point which is usually an area in the open such as a carpark etc where a larger bomb can be concealed and thus cause significantly more damage.

It is for this reason that “anti-fragile” is a nice meme but is unlikely to work.

To get it to work against an inteligent adversary it needs to be even more generalised and importantly rapidly adaptable. This requires an inteligent or learning system which can respond almost as rapidly as the attack. Currently we don’t have automated systems with the required inteligence or humans with the required response time.

This means falling back on a defensive system where you only alow which must be alowed and disalow all else. Whilst this might be made to work in a high security environment such as the NSA etc it is grossly inefficient and could not realisticaly survive in a modern business environment. This is simply because the lack of responsivness means it can be out manovered in any sensible market place by smaller more adaptable organisations.

In fact we see this currently with many large organisations that cannot respond quickly they only survive by having secondary protections such as patents and copyright they can exploit to in effect close the market to competition. However this has it’s own disadvantages, it generaly relies on “equity of arms” in the major players and a beliefe in “mutualy assured destruction” if “any major player resorts to arms against another major player”. In this respect it is going to be interesting to see what happens to Apple over mobile phones (although it appears to be quietening down currently).

[1] The most awkward problem being that of the mutation of existing disease into new forms. That is a new disease is a mutation not compleatly new, thus a generalised immune response will give protection to other as yet unseen disease simply because it’s mutated from a seen disease. Mostly this is not true for new attack vectors in security systems.

Clive Robinson • May 30, 2013 8:45 AM

@ Danny Moules,

Many don’t even go so far as to get their information from multiple sources; again, the reasons for this are myriad

In the case of many of the more recent and younger journalists the reasons are fairly predictable,

1, What’s the slant the owner wants?
2, What’s the puffery the editor wants?
3, Who is going to give me opinion / quote compliant with 1&2?
4, How do I use 3 on those who’s opinion is contrary to 1&2?
5, Will an Internet search cut out either 3 or 4?
6, Can I not bother with 3-5 and just make it up and get away with it?

We are increasingly seeing less and less of 3&4 in print and virtually none at all in OnLine pubs, where 5 and more frequently 6 are seen as if there are complaints the OnLine article eithe disappears or gets edited without comment.

For those credulous at this consult the Way Back machine or search engine caches. One Serial Offender in this area is the UK’s Daily Mail online version where even at their best they fail to acknowledge their “Cut-n-Paste” from other web sites…

Oh and I’ve been told they only pay 40GBP per article irrespective of length or quality of journalism such as basic research…

Thus to make a basic living you’ld have to turn out 8-10 articles a day before anyone else does the same story before you and takes the money.

Under such “incentive” what do people expect to get?