Schneier on Security

Clive Robinson • December 27, 2022 6:41 PM

@ Erdem Memisyazici, ALL,

Re : Nothing is 100%

“It’s not an unavoidable natural disaster to have bad code or configuration.”

No, likewise hardware that can not be replaced or upgraded. But acknowledging that and dealing with it sensibly are where it all goes horribly wrong..

Almost the first question I ask when getting involved is,

“What is the business case for this computer to be connected to external communications / Internet?”

I’ve had various hand wavery answers but next to none are actually a business case, let alone sensible or to be blunt responsible.

And it all kind of goes down hill from there security wise most places…

Few appear to understand the notion that you can not defend against every instance of an attack, but you can mitigate the class of attack it’s in.

The strongest mitigation from attack in the ICTsec toolbox is “Segregation” and it’s usually relatively simple to do, but often “It’s not convenient”.

To put it simply,

“If they can not reach it they can not attack it.”

Yes that still leaves “insider attacks” where reaching/using kit is SOP. And also as I know having developed one or two ways myself “air-gap crossing attacks” are not just possible they are practical to a certain extent.

However sensible segregation makes attacking from outside quite hard, thus lifts you several levels above the “low hanging fruit” that surrounds you in what is due to lack of segregation “a target rich environment”. Segregation thus removes all but “tatgeted attacks” that will get through unless different tactics are used[1].

I have to run software for mantainance development of upgrades purposes that I know has more holes than a string vest (the reason is ICS hardware that can not be replaced). So I run them strongly segregated and so far I’ve not had any issues, nor have the customers.

[1] In physical security you work on the idea that you can not stop attackers reaching their targets by passive means alone. Thus you go down the,

“Detect, Delay, respond.”

Route usually with the notion of,

“Capture and Eliminate threat”

As the end goal of effectively “banging the perps in jail” etc. For various reasons in information security “capture” is rarely viable, but threat elimination by changing defences proactively is.

Clive Robinson • December 28, 2022 1:37 PM

@ ALL,

Re : Blaim them all, not.

One of the problems with legislation is those that frame it get it wrong.

At it’s simplest either the legislation is too narrow in scope and does not cover all that people want it to, or it’s too broad in scope and things that should not be a crime are.

But there are other issues. Software is more complex than just about every other endevor mankind has put his hand to. But… People see software as a “single entity” which is very very unwise and legislators for the past four decades have fallen into this trap.

Think of it this way,

“Should the legislation that covers cars and other road vehicles cover knives?”

They are both made of machined materials that are then assembled into a finished product that is made available for purchase…

So they are the same right?

Common sense says no, so you have different legislation for them.

We need to relise that adding effective and usefull software legislation is going to atleast double the size of existing product law then have quite some more on top…

If you don’t immediately see why, then have a look around your home and ask “What does not have software in it?”

For software legislation very very little will be of the “one size covers all”. Otherwise there will be miscarrages of justice to put it mildly.

Clive Robinson • December 30, 2022 10:50 AM

@ Canis familiaris, ALL,

Re : Computer Systems Cost

“Holding software ‘engineers’ to the same standards as civil or electrical engineers is fine, so long as you are happy to pay the same for each computer as a bridge.”

Hmmm “software -v- civil/electrical” is not comparing apples with apples. Likewise the product costs,

Software ~= development/customers

Hardware ~= (developemt + production)/customers

From experience I know that untill more recent times, Software Developers could earn 3-10 times as much as civil/electrical engineers as well as electronics design engineers. For my sins I’ve done all of those jobs including being both a civil engineer/designer and when a lot younger my real passion the design of sporting / leisure marine craft[1].

The real issue is not the cost but,

“The time.”

I used to write embeded systems software for mask programmable microcontrolers used in “Fast Moving Consumer Electronics”(FMCE). You had to get it right, ie “Zero Defect” and that involves one heck of a lot of test, about 60-75% of the actual development time. But in modern software that would be up in the 90% range if just “done by hand”.

It’s why other shall we say more curious languages like Rust are of interest along with various types of formal methods.

But you also should consider about the most complicated mechanical engineered devices people are ever going to see. Which are the likes of 747 aircraft and some cruise ships that have a million pluss parts. Bridges may be large, but actually they are not that complex in terms of parts.

There are a lot of software projects that easily exceed those figures, in terms of effectively unique parts. Also those parts tend to be rather more “individually “unique rather than scaled” (think of engine parts that are not scaled unlike like nuts and bolts). Think of software being made with hundreds of thousands of different sub-assemblies rather than the likes of bridges and buildings that can and have been made with less than a thousand sub assemblies (you can actually build houses with less than a hundred different types of –not scaled– parts).

Which brings us to your second paragraph,

“Unfortunately, folk have become used to the ‘cheap and cheerful’ approach of things ‘sort of’ working most of the time. If you take away their toys, the children will complain.”

That is all true but missing “quick” or “untested”… The thing about commercial and consumer software, is mostly it is,

“Quick, dirty, and very much untested, and fails frequently (BSOD etc).”

And we get away with it because,

“It realy is mostly toy software.”

With toy cars, nobody realy cares “if the wheels come off” as you play with them, because you just put them back on again. With real cars people do very much care “if the wheels come off” as you drive them down the highway… Because that tends to result in body parts all over the highway, a few of which will be human…

[1] The design and construction of marine vessles was my passion and what I wanted to do as a career, electronics and computers were just a hobby to excercise the brain with. Then as a teenager I started to get ill from working with the chemicals involved and all over “dermatitis that weeps” is not a good look on anyone. So I had to jump career paths and my hobby that I was rather good at became the beginning of my proffession. For other reasons at some point or another my other hobbies have become my proffession. Lets just say I don’t recommend it as a career path, because you end up loosing one by one your hobbies and nobody should do that…