Schneier on Security

Clive Robinson • December 18, 2018 4:45 PM

@ wumpus, phaete,

I think our best hope is that the red flags of “this company is controlled by idiots” become more well known.

Whilst that and “the human condition” are certainly part of the ICT Security problem they are also the part of most other endevors in life, many of which despite the apparent odds succeed.

Thus the question is why are they effectively negated in other endevors including physical security, but not in ICT Security?

As I’ve mentioned before ICT Security trys to hold it’s self up as a science or atleast one founded on logic and maths, thus proofs etc. The problem is that big grey pachyderm with big nose and ears trying to be invisable in the room despite the fact every one has to tiptoe around it as it fills almost the entire space is lack of usable measurands or any measurands at all…

If you can not perform a comparative measure of significance over time, which you mainly can not in ICT Sec, then you can not realy show what is working and what is failing. As the later is, as a probability way more likely, then the chances are, what ever you are doing, it is not likely to be working but failing.

Whatever a supposed adjudicator (reviewer/journalist) is going to see is in all probability going to be a success in an adherents (developer/salespersons) mind and more or less irrelevant to all others… Then those arguments that are effectively “I’m right because I say I’m right” would not work with mesurands of merit across a whole system. But such arguments work well in ICT Sec currently with no measurands.

And as is such with life the more money or publicity there is to be made the more strident that argument tends to get, especially when it turns into market share.

Worse perhaps is the “early on take up bonus”. There are failings in the simple economic models of markets that are to do with “distance costs”. That is under the physical and traditional telecoms models “you pay by the mile” that is your market price rises with distance which puts a boundary around your place of manufacture where someone still paying start up costs will be cheaper as they are that much closer to a customer (it’s also a reason for import tariffs). The Internet currently does not have these costs and even if it did the near zero cost of localised data duplication would render them ineffective.

Thus you have a number of “global” advantages not seen in more traditional markets in being first to market… Firstly you are “the only game in the world” which means those that need or want such a product have only you to go to. This gives rise to the advantage that for a very short while you have the market –all be it initialy small– entirely to your self, which gives you more time to grow with the market than potential competitors, which not only helps reduce comparative start up cost impact, providing you can keep the imputus going it will give you a near permanent market lead. Secondly as the market grows you are the market leader which makes it more likely that a new customer would come to you all other things being equal because they have more people to use the product with. Thirdly due to the way some information products work you get initial scaleability advantages due to natural law constraints[1].

There are basically two types of information products these days, those that are local to the user and those that are local to the product provider. The latter we tend to lump under the title “cloud”.

From a user privacy perspective the more local they keep data to them the easier it is to secure. From a service providers perspective the opposit would apply if they actually had an interest in keeping the remote users privacy. Which the number of press articles about data breaches would suggest to many that the service providers consider “lip service” sufficient…

When you consider service providers a new entrant in an existing markey all other things being equal has to find a way to do things in a less cost per user way so that they can scale up faster. There are two ways to do this firstly technology advantage secondly revenue advantage.

In most cases a new entrant will not have a technological advantage, as market leaders in any given domain also tend to have advantages when it comes to accessing new technology.

Which leaves “revenue advantage” there are two ways firstly increase the profit per customer, secondly reduce the cost per customer. In both cases security is going to suffer. That is either the data held on a customer is considerably larger thus a more promising target for attackers or the “sunk cost” of security measures is cut back beyond the point it is effective thus they become an easier target to attack.

The problem with security is it is seen as either an expensive defence expenditure where the only way you can tell you are not spending enough is you are breached, or worse a non profit item that is an expensive waste of resources that inhibit lower cost thus more profitable working proceadures and practices. But worst of all in startups it’s generally not even a consideration as it delays “getting to market” thus builds a tsunami of technical debt that will in all probability not be payed off before the venture goes bust or is bought up by another organisation.

[1] The basic natural limit to speed of processing at the user level is not “heat death” and similar you get told about but distance due to the speed of light. When you perform a search, generally the distance over which the user request is sent and the answer returned is unimportant, what is critical is the distance between the searching CPU and data to be searched on storage devices. Thus having that function as dense as possible is where the cost savings on user transactions can be made. This remains true for given user types however users in one region are not entirely like those in a different region when it comes to searching. Especially on a global basis, thus as growth rises there is a point where splitting databases up by language or regional information becomes worth while to manage network issues and improve reliability thus availability.

Clive Robinson • December 19, 2018 3:31 AM

@ gordo,

Gunnar Peterson

I used to read and comnent on his blog 1raindrop quite some years ago now. He made a point of saying how most business security had not changed in around twenty years, with firewalls at the perimeter, and counting rejected connect attempts as a success measure…

I also read and posted to the Mandiant founders blog, I don’t know what rank he held in the airforce but he had a habit of following the “US existrntial threat” line a little to closely for my liking. He and Gunnar got into it over the economic policy that China was then following of reinvesting a large amount of what it had earnt from America back in America and thus owned a conciderable amount of US assets, thus had a degree of leverage on the US economy.

It was around the time of Banking Crisis One and I agreed more with Gunnar’s view point as it had more valid economic sense to it. I stopped visiting the Mandiant blog around then when it got more than a little to shrill for my liking. Gunnar’s blog started to change direction as well into an area that was not of much interest to me so… To be honest it’s been atleast a couple of years now since I saw his name come up anywhere…