Peter Gutmann on Computer Security Mentality

Well-known security researcher Peter Gutmann has a draft of his book on Engineering Security available on his web page. He has a lot of good commentary about challenges that the security community is facing. So far, my favorite passage challenges the common mentality that security has to be 100% or it's just not worth having.

Engineering an effective security solution in the presence of security geeks is an extremely difficult problem... Consider as an example of this a world where no-one ever locks their front door when they leave the house, and someone suggests that fitting locks and actually using them might help in dealing with the spate of burglaries that have occurred recently. This would be totally unworkable. If you lost your key you’d be unable to get into your own house. Conversely, anyone who found it or stole it could now get in. For a house with multiple occupants you’d need to get a new key cut for everyone in the house, including any temporary guests who were staying for a few days. If a neighbour dropped by to return an item that they’d borrowed they wouldn’t be able to get in. If there was a fire then emergency services wouldn’t be able to get into the house to look for people who might be trapped there. Door locks are obviously completely unworkable, and therefore not even worth trying. Better to leave the
burglars a free hand than to even attempt a flawed security mechanism of this type.

Comments

Janne said…
I agree with the sentiment, it's hard to cope with security geeks... meaning security laymen. :-)

Although, admittedly, even security professionals seem to sometimes forget that there's the A even in the old CIA triad. However, anybody even with rudimentary education in information security should have heard about availability.

I was just joking last week when a friend of mine posted on Facebook that in a mall the only open WiFi network was called "WHO CARES ABOUT SECURITY". I was saying to him that, well, it is a "secure" network, just has much more emphasis on A than on C or I.
9:00 PM
skip hire online said…
It's really Great.This is great book and really helpful. i would like to read it.It would be helpful for future.
6:25 AM
Optimun said…
This comment has been removed by a blog administrator.
9:54 AM
Post a Comment

Popular posts from this blog

How to Fix a Jammed Toyota Camry Trunk

This problem needs a higher pagerank, so I figured I would post the solution here. If your Toyota Camry trunk won't open, one possible reason is that it is set to valet mode. Valet mode means that you cannot open the trunk using the release lever inside the car. To set valet mode, you put the key into the trunk lock and turn it counterclockwise. You will know that your trunk is in valet mode if the lock is horizontal rather than vertical, and if you cannot open the trunk using the lever near the driver's seat. Of course, a problem is that sometimes the Camry can get stuck in valet mode, such that you can't use your key to get out of it. (You can see how I spent part of my Sunday morning ...) The solution turns out to be WD-40 . Spray some WD-40 on your key and on the lock. Put the key in, and jiggle it around, and happiness ensues. From an interaction design perspective, it sort of makes sense to have a valet mode. After all, the point of having a valet key is to limit the
Read more

Web 2.0 and Research

I've been chatting with many of my friends and colleagues about an issue that's been bugging me for a while, namely whether academic research has any role to play in the emerging Web 2.0 . I've been slowly coming to the conclusion that the answer is not much. I had a similar discussion with other researchers at HotMobile a few weeks ago. When the web first came out, pretty much every systems researcher ignored it because it was so ugly. The web was not very sophisticated in terms of distributed systems, HTTP lacked elegance, HTML conflated many different ideas, and so on. There were also not any really new ideas with the web, as evidenced by the fact that Tim Berners-Lee 's first paper on the Web was (probably rightfully) rejected from an ACM conference on hypertext. I'm sure one thing that really irked researchers about the nascent web was that it completely ignored the large body of work in hypertext and distributed systems that had preceded it. Even in 1997, as
Read more

[Research] Famous Rejected Papers

I've always thought it would be fun to compile a list of famous rejected research papers, ones that later turned out to be highly influential. For example, in My Life as a Quant , the author tells the story of how the famous Black-Scholes paper (which describes how options should be priced) was rejected several times. The work eventually led to a Nobel Prize in economics. (Yes, I know, there technically is no Nobel Prize in economics). Then there's George Akerlof 's work on asymmetric information . I don't recall exactly, but I think the reviewers thought it was too simplistic. It also led to a Nobel Prize in econ. And then there's Tim Berners-Lee 's original paper on the World Wide Web. He describes his experiences in his book Weaving the Web . I think it was submitted to a hypertext conference, but was accepted only as a demo. I'm guessing reviewers didn't see much novelty in the work, which probably was correct from a research perspective.
Read more