The Future of Security

Kvorgette writes "Scott Berinato in The Future of Security presents a very dark future of security in the years around 2010. Several computer security experts expect that a major security-related problem (a 'digital Pearl Harbour') will change software development procedures and remove the freedom in computer use we are striving for. The worst part is, most experts apparently think removal of software tools and access to information from the majority of computer and Internet users would be a good thing."

Comments

Re:Security should be simple

[hankwang]

If I install a text editor, I probably don't want it to be able to access the Internet. It should be possible to say, "for this app here, don't let it do anything network related".

For Windows (sigh), you can use ZoneAlarm (free edition) to do exactly this. It would be nice to have something like that in the Linux kernel.

Re:No, it is not.

[gad_zuki!]

That's the real problem with outbound filtering, you're relying on the end user to say yes/no. Ideally the firewall should contact its vendors (or a public) database and tell the user if the program is malicious or not. You could automate this and never bother the user with those outbound requests.

Re:Leave it to Microsoft

[swordboy]

This kind of attitude is one of the reasons that Microsoft is where it is today.

There is currently a *large* market for someone that can create a simple solution to the security problem that exists with complex operating systems. For example: I work for a large financial company that does not allow any corporate access from non-corporate PCs because of obvious security reasons (i.e. - it would be easy to install a keystroke logger on just about any PC, Windows, Apple or otherwise). So everyone is stuck lugging their laptops around.

its not like some else will/can step in to take over.

This is very far from the truth.

Using the previous example, if someone created a Knoppix-like bootable "secure" distro that allowed a user to bypass the existing OS on a given PC, a company could allow users to use most any PC for access. Install some VPN software, simple self-checking environment, and perhaps a user-specific token and things become very secure. There would even be a market for a network bootable version.

But we are all going to sit on the sidelines while MS fixes the problem with trusted computing. All because of a lousy attitude problem.