Slashdot Mirror
Openness and Security on Campus
djeaux writes "The April issue of Syllabus includes an interview with Jeff Schiller, Network Manager at MIT, about openness and security in academic computing. Schiller has some interesting things to say about product liability for software, including an out for open source software and boils security down to a simple maxim: You must install patches. He also says that what makes security hard is that it's a 'negative deliverable.'"
Security is simpler than that. Security requires fences, in the electronic world just as in the physical world.
those fences can be visible or invisible, incorporated or separated, But they will NEVER stop dis-honest people. No fence will categorically keep out all burglars. No computer security(short of pulling all the plugs) will keep everyone off your computer. Openness and security can co-exist ONLY when everyone is trustworthy.
Food not Bombs is a nice platitude but it breaks down when you notice that the Bombees are usually well fed
The Army reading list
People have to accept security as a regular part of life. There are LOTS of negative deliverables we subscribe to in our lives, and pay quite handsomly for. Off of the top of my head, I think of auto insurance. I mean - yeah we see nothing making it better.... but we know very well the hell that may arise if we don't have it.
Nor would I applaud Automatic Update as a triumph for the end-user -- it delivers more than security fixes and can affect the stability of a machine. But the point about firewalls only being as good as the policy on employee laptops is a good one.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
But, I fear that the commercial interests in this game, if they felt that Congress was backing them into a situation where they would have to accept liability, my guess is they would strenuously lobby that liability applies to everything, including open source, in an attempt to kill off open source. So that's the conundrum.
That was a very insightful quotes regarding the worry I've been having off late. Given their way, lawyers, lobbyists, anti-opensource corporations and their political puppets will all rally to impose liability for software on the end-developer.
If such a development happens, we could very well see software developers forced to buy "malpractice insurance" like doctors/medical professionals - that alone will be enough to kill opensource software, not to mention the plethora of lawsuits and ugly frivoulous lawsuits which've plagued the US medical system and escalated medical costs.
And ust to play devil's advocate to his suggestion that free software developers not be held liable - since they're "giving away" their stuff: somebody could turn my anology around and make outrageous claims like "exempting voluntary software developers from liability is like encouraging quacks to pursue their medical endeavours".
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
Of *course* you have to install patches. There is a bored 11 year old out there somewhere who thinks can prove he's "133t" by downloading a sploit off of packetstorm and owning your box.
:(
It doesn't matter that he has no knowledge of how to code a similar sploit himself, or that he could not admin your university WAN. It doesn't matter that university cut-backs mean you don't have enough money for a test LAN to make sure the latest buggy patches won't break business critical software/services or bring your servers to their knees. All that matters is that he can go on IRC and tell everyone how "k-rad 133t" he is.
Stupidity wants to be free!
"Weapons should be hardy rather than decorative" - Miyamoto Musashi
I think that goes for OS's too
He also says that what makes security hard is that it's a 'negative deliverable.'"
I'm certain there are countless flaws in this idea. But hey, you don't post to slashdot without some risk of being shown what a moron you are right?
How about having DSL/Cable companies give an incentive to customers whose computers do not become infected during the blitz of mass email worms and trojans. Something like a few bucks off of your ISP bill to free software. Some kind of incentive for NOT getting infected besides the fact that you don't have anything on your computer.
It would benefit them in that it lowers their costs and increases their reliability if hundreds to thousands of their customers aren't sending DOS, etc.
Of course, there are issues such as privacy implications (how would they know you're infected or not) to hardware costs for the ISP.
My stance is that you're essentially playing baseball in your heighbors yard. He won't change the way you play the game, or change the rules necessarily, but he sure is going to limit how far you can hit the ball. Like the green monster at Fenway.
>> You must install patches.
in the "real world", when there is a security
threat, such as a gas leak, you call the repair
person, who fixes it.
This is the equivalent of "install patches"
Note that there is a level of confidence in
calling the repair person, that they won't
paste adds all over your living room, or install
a wire-tap on your phone line, or a spycam
in your bedroom.
unfortunately, in the computer world, all too
often the "patches" are used as trojans.
they change user settings, put in spyware,
brake working code, etc
so, ppl are hesitant to apply patches, with
good reason.
Comment removed based on user account deletion
sPh
``JS: The reason it doesn't crash all that often is because system software developers took some time and effort to make that the case. If they would take the time and effort to make it be secure, it would be secure.''
No. More secure, but not secure. For one thing, things will be overlooked. For another, there will always be things that were not known to be security holes at the time, but that will later turn out to be such.
``JS: I think Linux is much more secure than a lot of the other stuff that's out there, because so many people look at the source code--not everyone looks at it, but enough people do, so that problems get fixed earlier, rather than later.''
Many people look at the sources, but do they find the vulnerabilities? See also above.
In short, nothing is going to give you guaranteed security. Having said that, crackers will only go so far to break a system, so absolute security isn't even required. This makes any security measure useful, including firewalls (which JS argues against).
As a closing remark, despite these minor points, I found the article a very good read; JS seems to have his heart in the right place. Heh, it makes me frown every time people say "security" and mean "restrictions" (see also MicroSoft and Trusted Computing).
Please correct me if I got my facts wrong.
In my experience, there are basically two things that are *MOST* commonly seen in academic networks; one is either internal or external parties trying to take advantage (and misuse) the massive bandwidth that campuses have available, or someone trying to discover and manipulate potentially sensitive documents (such as grades).
I think firewalls have their place, you're right. But being at the receiving end of a rather draconian installation/firewalling policy for no apparent reason other than just reducing work for the systems operators (and increasing work for students, supervisors in general); I'm thinking that there should at least be a set of carefully monitored, but open machines for people to just mess around with. It's a campus, a seat of learning. Sometimes, when you're trying to learn something, things break. Do you want to be too worried about breaking a piece of "mandated" software and having a risk of getting your ass chewed, instead of experimenting ?
Campuses have different security requirements and needs from commercial outfits, IMHO. Sometimes, administrators just don't understand that and try to implement the same policies willy nilly. Security isn't just about procedures and blanket firewalling.
'personal firewalls' are the wrong solution. The proper solution is to not run unnecessary services out of the box in the first place. Really, NONE. If a user needs to run a particular service, then they should know how to enable it and how to secure it. But to run things as part of a default install is silly. It's bad enough in the windows world that netbios is always-on (RPC vulns anybody?).
Mod parent up. Most of the networking people who now implement policies that reduce their workload but cripple students' ability to explore gained their skills from similar exploration years ago.
It is always possible to make security problems at the design level, like forgetting to check an account balance before allowing a withdrawal in bank software, but humans are very good at thinking in those ways, and those kinds of problems are rare.
---------
Create a WAP server
You put as many "locked doors" as possible in the way of a potential intruder so that each time the intruder is faced with a new "door", he or she may simply decide your system is no longer worth the effort and give up trying to get in.
Patches are the "last locked door" - in other words, once you've definitely decided that you need to run a specific application on the Internet, you make sure that it's updated to the latest version.
However, prior to that, you've already ensured the application is configured correctly, that the box it's running on has security permissions locked down, that the box is behind a firewall and probably a NAT box also for good measure.
Not to mention some good system logging and alarming going on so you have the best chance of shutting the box down when someone does get in.
In security, only the paranoid survive...
Gentoo Linux - another day, another USE flag.
Windows update does break stuff, but it is not the only option for automatic or manual updates from Microsoft. They even offer a corporate version which doesn't rewrite policy everytime you update which is why most apps break when they do
Please name the last time any organization of any size successfully sued Microsoft over a product liability issue. I'll even take FOAF references to orgs getting under-the-table reimbursments if that's all you have.
sPh
Some university administrations are concerned with protecting the rest of the Net from their students; others think that interferes too much with legitimate research. Some other poster commented that their university's policies are to be "open", but they block incoming Port 80 and Port 25 to student residence networks - meaning that students can't run their own web servers or mail servers, which is distinctly *not* openness.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks