Schneier on Security

Clive Robinson • December 5, 2022 5:06 AM

@ Mike D., ALL,

Re : The perversity of bureaucracy.

“Passwords on a USB drive doesn’t work for me since they’ve banned… …part of NIST SP800.171 compliance required it.”

Yup that’s the way it gets…

It’s not the USB Drive that’s the actual problem, but,

1, The dumb design of certain consumer grade OS’s.
2, Certain people not upto the job.

So you end up with a,

“Security Fundemental Anti-Pattern”

Akin to tying peoples shoe laces together as a requirment.

The problem arises due to a trade between,

1, Password insecurity
2, File insecurity

Both are “human failing issues”.

Humans in general are usless at precision, but supprisingly to many good at patterns. Hence bank cards still use 4digit pins, and we can tell dogs from cats and mostly people we know from those we don’t.

On the other hand computers, or more correctly computer memory, can easily and accurately store integers so large they can encode entire films in HD without a problem on something smaller than your finger nail. As for pattern recognition even babies that are not yet able to talk are better than computers that still have trouble with telling cats from furniture.

So human mind/brain is realy realy bad at passwords which is probably the most fundemental security failing of all time. And it’s a failing you can not fix, as it’s the human mind or brain which evolution saw no advantage in making “accurate or precise” as that’s not been on the “How to avoid being lunch” list.

So if you can not fix it, you can only mitigate it, with something else.

Humans have been described as “Monkeys that invent” which is a little unfair on monkeys, and way to generous towards most humans. Who lets face it have the bad habit of thinking “deep fried twinkie” or similar is a good idea, then adding icing and sprinkles on top is going to make it the veritable summit of achievement (hence Cronuts)…

But “levers and springs do make fun things” to play with so occasionally useful things have happened and we now have technology… As a result of which along with early successes of gunpowder and adding machines, we have after a couple of thousand years “improvment” progressed to nukes and computers… Both of which are requiring “Security” that few can actually understand.

So what do humans do when they have no understanding but don’t want to admit to it?

Well historically they get all bureaucratic, blaim the “Gods” or both… and in more recent times they just blaim technology. All on the rather stupid notion of if they don’t understand it, but they go all martinet over it, then other people won’t realise they are clueless… Hence the joys of lower managment being likened to baboons climbing trees and showing way to much of their undesirable features in the process.

So back in the days before computer networking was affordable because a network card cost more than the computer it was put in. People used to carry “Magnetic Media” from machine to machine. Back then such things were large, to large to put in a pocket and in many cases a briefcase either and cost a weeks wages. So security wise they were fairly secure due to value and size.

But as with all things and age, they shrunk and got more numerous so cheaper. With the advent of the “8 inch floppy” data started to get about. As a floppy was sufficiently portable that “hand carry” or even “posting” became possible, so the advent of what later became known as “Sneaker-net” started. So named not because people “sneaked from place to place” with them, but “nerds” being students or equivalent wore “sneakers on their feet” (or “Chucky Red Tops” as seen on the “Chucky doll” for the younger readers who think “If it ain’t got no swoosh…”).

The thing about magnetic media, was unlike “Core Memory” or RAM, it was semi-mutable, thus ideal as a way to boot a computer with… Then some one who had progressed beyond levers and springs realised that as you can not see data on disks you realy could get sneaky and then it quickly became what got called a “Computer virus”. Officially the first “PC Virus” seen in the wild was “Elk Cloner” in 1982 that got around on Apple DOS 3.3 disks. It was the work of Richard Skrenta who wrote it the year before as a ninth grader in High School where Apple computers were “the nerd toys” of the day. Seven years before NSA Scientist Bob Morris’s son who is a couple of years older than Richard gained notoriety and a criminal conviction for the first wild Network Worm.

So, long ago, both “removable media” and “networks” were known to be vulnerable to “malware” run by “inside” users. But what many don’t actually think about is that “active attacking” by non users or “outsiders” is nearly always a “network attack” (though there are the so called “parking lot” attacks occasionally happening). But whilst removable media can help mitigate the insider user security issue networks can not.

So we have the oddity of removable media being banned, yet the far worse networks being OK…

The reasons for which as I’ve indicated are laziness or bureaucratic idiocy.

But as also noted humans are mostly incapable of remembering with precision much above a few digits, so can not be secure unless considerable mitigations to assist then are used.

But that bureaucratic mantra is “removable media bad, networking good” even though the evidence is very different…

I could go on in depth about this, but let’s just stick with calling it what it is a,

“Security fundemental anti-pattern”.