�����
JOCCH publishes papers of significant and lasting value in all areas relating to the use of ICT in support of Cultural Heritage, seeking to combine the best of computing science with real attention to any aspect of the cultural heritage sector.
�����
way as to reduce the risk of compromise to an acceptable level; if the attack can be made to cost far more than the perceived gain resulting from its success, then that is usually sufficient.
By asking the wrong questions— such as how to patch or modify existing items rather than ask what is appropriate to build or acquire—we end up with systems that cannot be adequately protected against the threats they face. Few current systems are designed according to known security practices,c nor are they operated within an appropriate policy regime. Without understanding the risks involved, management seeks to “add on” security technology to the current infrastructure, which may add new vulnerabilities.
The costs of replacing existing systems with different ones requiring new training seems so daunting that it is seldom considered, even by organizations that face prospects of catastrophic loss. There is so much legacy code that developers and customers alike believe they cannot afford to move to something else. Thus, the market tends toward “add on” solutions and patches rather than fundamental reengineering. Significant research funding is applied to tinkering with current platforms rather than addressing the more fundamental issues. Instead of asking “How do we design and build systems that are secure in a given threat environment?” and “What tools and programming constructs should we be using to produce systems that do not exhibit easily exploited flaws?” we, as a community, continue to ask the wrong questions.
Note that I am not arguing against standards, per se. Standards are important for interoperability and innovation. However, standards are best applied at the interfaces so as to allow innovation and good engineering practice to take place inside. I am also not overlooking the potential expense. Creating new systems, training developers, and developing new code bases might be costly, but
c There are many fine works on security engineering, including Ross Anderson’s opus of that title. If we return to the fundamentals, tried-and-true design principles were articulated by Jerome H. Saltzer and Michael D. Schroeder in “The Protection of Information in Computer Systems,” republished in Communications of the ACM 17, 7 (July 1974) but few systems are designed using these principles.
only initially—given current losses and trends, this approach would eventually reduce costs in many environments.
Robert H. (Bob) Courtney Jr., one of the first computer security professionals and an early recipient of the NIST/ NCSC National Computer Systems Security Award articulated three “laws” for those who seek to build secure, operational computational artifacts:d
• Nothing useful can be said about the security of a mechanism except in the context of a specific application and environment.
• Never spend more mitigating a risk than tolerating what it will cost you.
• There are management solutions to technical problems but no technical solutions to management problems.
Although not everyone will agree with these three laws, they provide a good starting point for thinking about the practice of information security. The questions we should be asking are not about how to secure system “XYZ,” but whether “XYZ” is appropriate for use in the environment at hand. Can it be configured and protected against the expected threats to a level that matches our risk tolerance? What policies and procedures need to be put in place to augment the technology? What is the true value of what we are protecting? Do we even know what we are protecting?e
As researchers and practitioners, we need to stop looking for solutions where the light is good and people seem to be gathered. Consider a quote I have been using recently: “ Insanity is doing the same thing over and over again while expecting different results.”f Asking the wrong questions repeatedly is not only hindering us from making real progress but may even be considered insane.
So, what questions are you trying to answer?
d My thanks to William Hugh Murray for his restatement of Courtney’s Laws.
e Many firms do not understand the value of what they are protecting or where it is located; see http://snipurl.com/sec-econ.
f This quote is widely attributed to Albert Einstein and to John Dryden. I have been unable to find a definitive source for it, however.
Eugene H. Spafford ( spaf@cerias.purdue.edu) is a professor of computer science and the executive director of the center for education and research in information assurance and security (cerias) at Purdue university.
copyright held by author.
References:
Archives