Slashdot Mirror
Spaf's Crystal Ball: Network Security Predictions
remora writes "Eugene Spafford[?] (of CERIAS, and co-author of "Practical Unix Security") has written an article for Information Security Magazine with eight of his predictions for the coming years in network security. He touches on subjects such as "Spam will grow as a problem" (obviously), to the "Greater emphasis on international cooperation and communication. Some of the article is fairly predictable, but it is still interesting to hear from one of the more experienced security people out there."
it's ruining the whole concept of email. As soon as I set up an email address, boom, hundreds of spams. They find ways of sending it to you no matter what you do, unless you block all incoming email except from certain addresses, which defeats the point of email in the first place. How are we meant to give an email address to children when they're going to be bombarded with "See horny naked amatures live NOW!" half a dozon times per day.
If someone was dumping 100 pornographic adverts into your house's mail box each day, or DOSing your website, they can at least get in trouble. But with spam, nothing really is done to stop them, and they just keep on doing it. Convictions are rare and don't disuade them any more than a parking ticket. It needs to be recognised that spam is doing a heck of a lot to undermine the evolution of the internet.
While most of "Spaf's" comments seem fairly self evident, I liked this point regarding add-on security products:
"Expect to see several established products fail or be withdrawn because they are too invasive, have unfriendly interfaces, or are found to be considerably less effective than claimed."
This kinda makes me think of the effect that ZoneAlarm have had on the personal firewall market for instance. 3 years ago, firewall technology was clunky and strictly for the network administrator. Nowadays anyone can have a simple to configure basic level of protection thanks to a product that broke the paradigm and set a new standard for ease of use. Of course, the really security consciuos out there still have their infinitely configurable command-line tools, but at the same time, my dad (for instance) can feel comfortable with a product that he can understand.
A little planning goes a long way...
Whats the Use in enabling data streaming over bluetooth when we can't safely sent files over LANS and existing technology
Oh and I really think the advent of Wireless Networks and 3G Systems will open up a whole new Can of Worms in terms of security - We can Already intercept calls over GSM systems, now we're looking to send huge chunks of data via the same systems!
Someone is gonna get burnt...
It's hard enough to remember my opinions, never mind the reasons for them..
I like the part about cooperation. Hackers do it for years successfully, while network administrators prefer to sit in their closets under tin-foil hats hoping to preotect themself with obscurity.
Systems to share already exist. Just check the "Internet Storm Center" and DShield for a place to exchange logs and ideas.
---- join dshield.org Distributed Intrusion Detec
Consumers and technologists will continue to be enamored with fads and flash rather than quality and safety. Wireless will continue to be deployed in sensitive locations despite the terrible vulnerabilities and risks. Furthermore, we'll see policymakers and technicians continue to place faith in technology to solve our problems instead of investing in sound management and trained personnel.
The point being that security is frequently misunderstood, isn't sexy and doesn't appeal to the mass market. Possibly the only way to change this is for security to become a major feature of the products (a bit like microsoft is saying it's doing now) so that people will come to expect the security... Somewhat similar to the safety features in cars...
Take a look at CERIAS's sponsor list for a few reasons;
s or s/
http://www.cerias.purdue.edu/about/related/spon
"I'm tired of all this 'Aren't humanity great' bullshit. We're a virus with shoes" - Bill Hicks
"Other technologies about which we should exercise caution include VOIP, Bluetooth, open source, automated patching, RFIDs and biometrics."
Slashdot reporting on something that says Open Source has security problems? Wow!
For all of you who's wondering what he's talking about, think: trojan in OpenSSL, trojan in libpcap, immediate disclosure of apache vulnerabilities... its not all peaches and cream just because its open. Closed source has some important inherant security benefits.
"Consumers will embrace appliance-based computing as it becomes available."
Spaf apparently believes that consumers aren't capable of dealing with real computers; he thinks dedicated apps and devices are the future.
This reminds me of the NC vs. PC debate. PCs were supposedly too clunky, hard to use, and powerful for the average user; NCs were going to replace them. Eventually, PCs ate NCs.
I believe that looking at this issue from a security point of view is somewhat misleading. As Spaf himself seems to realize, most domestic consumers are misinformed and apathetic about security. The average person will see a refrigerator, that for no good reason, can go online, rather than a secure online service. PCs will still be more versatile than appliances, and will continue to provide more value. Remember how the next big thing 10 years ago was the iCoffeeMaker?
Domestic consumers won't use them. Corporate consumers won't use them. Who will adopt appliances?
oTrojaning of popular open source software (such as OpenSSH and tcpdump).
oRepetitive exploits in the same software, such as the recent BIND exploits in the latest version (and the eighty or ninety exploits that came before it).
oProgrammers releasing details of security flaws after their platform is covered but before everybody else has a chance to patch the problem.
So I think he may have a point. Closed source isn't secure, to be sure, but irregardless these continual problems with dealing with security flaws in free software beg the question of whether or not the open source methodology is much better in 'root'ing out problems.
Note: I'm just talking about security, not overall quality of product. I still use open source because I feel it is superior to closed source in so many ways. However, I want to burst this bubble we've collectively got about "Thousands of eyes on the source code mean we're all safer", because obviously it isn't turning out that way.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
after listening to a lecture he gave at AUSCERT2002 I think it comes down to his belief that even open source doesn't use methodologies that promote secure code from design. The example he gave was an old kerberos security flaw that existed for several years. many people had looked at the code but none picked it up. Just having a hundred people look at code doesn't make it secure. see trojan code that has been added to tcpdump as an example
There was a slashdot article the other day that mentioned the return rate on spam was something like 0.001-0.002%. If a filter that learns can kill 90% of it or more then you can stick an extra 0 in there at least. Let the fuckers burn their money if they wish, but there will be a point when most of them will simply give up.
Other technologies about which we should exercise caution include VOIP, Bluetooth, open source, automated patching, RFIDs and biometrics.{Emphasis mine}
It would be nice if he could give us a concrete reason why we should "exercise caution" with open source. Does he really have a valid point, or is he just propogating the "open source is less secure because crackers can see the code" myth?
He didn't say open source was bad - he said it was a technology 'about which we should exercise caution'. The listed technologies are not Bad Things, they are just things that require caution when incorporating them. Biometrics were also listed in the technologies where caution needs to be exercised. I think what he's getting at is that it is completely possible to build an insecure system with secure components, and that something can't be assumed to be good just because it is grouped with things that are.