Is Security Still Unnecessary? - Twenty-Four Seven Security

« Los Alamos and The Network Forensic Search Engine: A Talk With Packet Analytics | Main | Next Hundred Years of Security »

March 03, 2008
Is Security Still Unnecessary?

The reason for the somewhat nonsensical title to today's blog is it's a response to some commentary on Wired by Bruce Schneier written awhile ago, which essentially wonders why security is even necessary. While this was written in May of 2007, I believe that many of the points Schneier made are still particularly valid.

Today's security is mostly built after the fact, after the exploit has been exploited, and in how many other industries would such a system work: I mean, you can't exactly sell life insurance after the guy is dead.

The entire existence of the security industry today depends on IT products and services that are not secure. This method is a very inefficient way to manage and spend security money. The most problemmatic of this arrangement is that, for all the security products and services and doomsday bluster, system and security remains effectively insecure.

Also, as Schneier says, "As IT becomes more of a utility, users are going to buy a whole lot more services than products. And by nature, services are more about results than technologies. Service customers -- whether home users or multinational corporations -- care less and less about the specifics of security technologies, and increasingly expect their IT to be integrally secure."

Why can't applications applications secure right out of the box? The fact is, things are definitely trending this way (see Rothman's excellent Penetration Testing article).

The way I look at it, you can make every application as secure as Fort Knox (by the way, is Fort Knox still the Gold Standard in security, or are they just piling gold bricks behind a hurricane fence these days?), and there is still going to be vulnerabilities. Because as I've said here time and again, the main security loophole is us: wetware, the human being, the 99 percent-of-the-time smart and savvy but only occasionally gullible and dumb-as-bricks (I'm speaking for myself here) security loophole.

So I guess if security is ever going to get truly effective, we're gonna have to get something to plug or download into us. And like they say in the military, Generals are always fighting the last war, and as far as I can see, there is always going to be an effective hacker insurgency doing active battle against our networks and data, forcing us to change strategies and troop alignments (i.e. security spending).