Subject: Security Paradox

From: Benny Nasution <[email-masked]>
Date: Tue, 15 Oct 2002 11:06:09 +1000

Hi all,

Regarding the previous postings saying that "anything can be 
compromised" including security, I think security also has a paradox.

Inspired by the book written by Weinberg and Weinberg, titled "General 
principles of systems design", I have an opinion that:

Security always needs to be increased to reduce threats and risks, but 
these threats and risks are the ultimate ýsource of information about 
the quality of its ability. Therefore the better the security is 
developed the less information you will get about how to improve it.

SECURITY PARADOX: 
Better security today risks worse security tomorrow.

Regards,

====================================================
Benny B. Nasution
School of Network Computing
Information Technology Faculty
Monash University
A U S T R A L I A
+61 401 230 818
+61 397 696 078
email: [email-masked]
====================================================

---

From: [email-masked]
Date: Mon, 14 Oct 2002 23:30:37 -0400

> developed the less information you will get about how to improve it.

Proper auditing and instrumentation will tell you what's being *attempted*.

Also, note that security is a *process*, and involves making trade-offs.
For instance, my network has well over 30K hosts on it.  Even if I manage to
make 99% of them totally hack-proof, I need to expect an average of 1 host
to be hacked *every day*.  Yes, I could probably harden it so 99.9% were
hackproof so I only had 3-4 incidents a month.  But it's not worth it - adding
that extra '9' would take more time than fixing the hosts.  I'm better off
hardening the 150 or so hosts that are really critical to 99.95%, creating
a document that will let the users get to 98%, and have a "it looks like you
got hacked, here's hints on cleaning up" form e-mail.

The day that things are so secure that we don't get enough feedback so we
have ideas on how to improve the process even more, I will *quite* happily
declare victory and retire.  However, given how *little* things have improved
in the 30 years since the original Multics penetration-test paper, I'm
afraid I won't be escaping before mandatory retirement catches up with me
in about 30 years.

http://domino.watson.ibm.com/library/cyberdig.nsf/1e4115aea78b6e7c85256b360066f0d4/fdefbebc9dd3e35485256c2c004b0f0d?OpenDocument&Highlight=0,multics

(If that doesn't work, go to:

http://domino.watson.ibm.com/library/cyberdig.nsf/Search

and search for 'Multics').
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: Joe Baptista <[email-masked]>
Date: Tue, 15 Oct 2002 00:21:14 -0400 (EDT)

> to be hacked *every day*.  Yes, I could probably harden it so 99.9% were

You know something.  In an earlier message someone mentioned the title
"security expert".  I think considering what we know of security on the
internet that the term "security expert" is an oxymoron.  Security experts
are essentially crisis managers.  And every firm should have one.

regards
joe baptista