Slashdot Mirror
Schneier on Economic Insights to IT Security
Scyld_Scefing writes "In his June 29, 2006 Wired News article, 'It's the Economy, Stupid,' Bruce Schneier covers the content of the 2006 Workshop on the Economics of Information Security. Schneier says that economic analysis of IT security issues is relatively new, and links to one of the significant earlier papers from 1991, 'Why Information Security Is Hard -- An Economic Perspective' (.pdf). This article states: 'According to one common view, information security comes down to technical measures. Given better access control policy models, formal proofs of cryptographic protocols, approved firewalls, better ways of detecting intrusions and malicious code, and better tools for system evaluation and assurance, the problems can be solved. In this note, I put forward a contrary view: information insecurity is at least as much due to perverse incentives. Many of the problems can be explained more clearly and convincingly using the language of microeconomics: network externalities, asymmetric information, moral hazard, adverse selection, liability dumping and the tragedy of the commons.'"
One of the hardest things about security is knowing you really have security. It's kind of like knowing your software doesn't have a bug. It's easy to know when you do have a bug, it's virtually impossible to know you don't.
I think security suffers the same or similar perception, rightly so. So, no matter how much you invest, how strict your policies, you really never know you have security. Couple that with how expensive it is to apply and enforce the more draconian policies... who wants to spend a fortune and find out they've been compromised anyway?
And, extreme security makes computing far less transparent, often to the exclusion of any reasonable work flow for day to day tasks. If security could be transparent (not sure it can), that would help.... no business likes fielding support issues for an entire corporation just because their network is PKI (ever administrate Sun's version?).
(I once worked at a place that had a thirteen-rule requirement for setting new passwords... it was so intrusive, I kept a printout of the rules on my monitor to try and avoid a twenty-minute guessing game session for setting new passwords. What was really funny was at one point the "rules" conflicted with one of our systems, so you couldn't define a qualified password that the system could use. Hilarious.)
On top of all of that, no matter how diligent you've been, one disgruntled (ex-)employee is all it takes with a modicum of social engineering savvy and you find the investment for naught. It's no wonder security is a tough nut to crack.
(As an aside opinion... I think the press gives too much attention to things like the recently stolen laptop with all of the info on it -- it was a stolen laptop, probably nothing more -- they get stolen all of the time, and people have no idea what they've gotten other than a "free" computer.)
Since you can sue to death anyone breaching security, you only need to put a cheap fence around the company assets and invoke the DMCA.
Put the incentives in the right place and there's still the issue of implementation. Nobody benefited from Chernobyl blowing, but it did anyway, and investigators think part of the reason is that there were no reactor engineers on duty. Security, just like industrial safety, depends on having trained and informed people at critical decision-making points.
Making security usable is another implementation issue. Everyone wanted airplanes to land safely, especially the pilots who were inside them, but there was one crash after another due to "pilot error" until the aerospace world began laying out controls and instruments to meet the needs of the pilots who used them.
True, incentives do come first. But even then they need to be carefully chosen. Bad publicity and the threat of job loss didn't make the VA careful: instead those incentives fueled a search for scapegoats, a search which ended with the analyst who had written permission issued on three occasions to take the data home with him.
http://www.ecampus.com/bk_detail.asp?isbn=05216052 10&referrer=frgl
Cheapest place a quick froogle revealed. I read this book a few months ago and found it pretty interesting, though perhaps best in its role as summarising further papers for reading.
Just to make this clear, "security" is not an end item. You cannot "have" security. My definition is: The process of identifying and evaluating threats and reducing their effectiveness.
h tml
As Bruce says, when there isn't an economic incentive, that process is not maintained.
But, suppose you are maintaining it. How do you know how good your security is?
Bruce also wrote about "attack trees".
http://www.schneier.com/paper-attacktrees-ddj-ft.
Identifying and evaluating the different avenues of attack is part of evaluating the threats. Once you've identified one, don't think about how you can "prove" it is "secure". Think about how you would go about showing that it is NOT secure. Make your statements about your security "falsifiable". Just like in the scientific method.
Then experiment, on an on-going-basis, to see if you can demonstrate that your security can be broken. This takes time and effort on your part as you have to continually read about the latest advances and theories.
Which gets back to the economic issue. If the organization does not see an economic incentive for you to perform that research/work, then you will be assigned to other tasks and the process will not be followed. If you are not following the process, there is no "security".
It should not be surprising to people that economics provides the basis for explaining many interesting situations that occur in the real world in relation to computer security. Recall that economics is the study of how humans react to scarcity, or more bluntly how we behave in light of the fact that we cannot simply snap our fingers and have anything we want immediately placed in front of us all of the time (with the possible exception of Bill Gates and a few others, but they are not representative). It is precisely the ability of economics to insightfully solve common conundrums with deliciously counterintuitive explanations that seems to fascinate so many people, as evidenced by the recent success of books such as Naked Economics: Undressing the Dismal Science and Freakonomics, despite the generally boring ways in which the subject is presented by our schools. If it involves human interactions and human nature then, ultimately, it involves economics.
I know this is author's description is "perverted" (quoting the article) when you can make a very direct reference to something else that is "Hard":
"Given better access control policy models": Learning how to say NO.
"formal proofs of cryptographic protocols:" cryptic nerd speak and or tech speak to keep the true introvert safe from those frisky STD laiden women
"approved firewalls:" contraception tools.
"better ways of detecting intrusions and malicious code": better methods to protect against STDs
"and better tools for system evaluation and assurance": the monthly "selfcheck" for various cancers.
"information insecurity is at least as much due to perverse incentives.": "perverse incentives??" what else could that analogy be like but the "temptation" of hot sex?
We will not see real security until Insurance companies start to really evaluate the risks involved. Once premiums sky-rocket due to poor security, then people will pay attention.
"To those who are overly cautious, everything is impossible. "
I've been telling my co-workers for a long time - while hackers who break into companies' networks should be punished, the companies, themselves should be punished more. The very first paragraph of this essay (the one comparing the European banks to the American banks) would seem to agree with me.
Let's face it: if your corporate network can't stand up to some high-school kid in his basement, it certainly isn't going to stand up to a well-funded foriegn power trying to attack us.
Sit, Ubuntu, sit. Good dog.
That is all.
It occurs to me that is similar to what I encountered when a I was sysadmin. The boss has no idea how many problems the company didn't have because you're good at your job. In fact, an admin that's always fighting fires can be highly valued for all of the work they put it in.
With security, the only measure is imagining the cost of outages and security breaks, maybe for other companies if you're good enough or lucky enough to prevent them. Otherwise, the bean counters will only look at what you want to spend as having no return.
An exception might be if the company hires a consultant (because what would YOU know. You work here. You can't be smart.) to assses the econonmic impact of the risks. That would be followed of course, by how you need to hire them to prevent the danger.
Ever dream you could fly? Get up from the Flight Sim. I Fly
It has a profound effect on our society.
Take for example the debt based money system we have now. The government has the ability print money (well, borrow) as it likes. Well when you have that power, it's pretty damned difficult not to use it. After all, raising taxes is about as popular as a fart in a lift and all politicians want to be re-elected. So borrow some money from the central bank to pay for your pet oil liberation project. This has a number of implications:
1: We've increased the amount of money available in circulation. This causes the value of the existing money to decrease; Inflation. Though it's percieved to be a general increase in prices it's essentially a tax on the currency holding population.
2: That debt you have to pay back, well it has an interest rate on it, the bankers want a little bit more back than they loaned, so you and everyone who works for you have to work that little bit harder to pay it back, you have to expand and grow to service the debt. The more you expand, the smaller the debt is in proportion, so you must expand. Which basically means there must be a continual increase in the exploitation of resources. For some reason the ecologists haven't picked up on this.
3: The government has free money to give away. Well, easy money anyway. The military, haliburton and all the direct contractors to the government benefit directly, in fact they get the cash before the inflation hits the economy generally so they benefit and grow hugely. Well we could call the military, it's direct suppliers like haliburton etc the military industrial complex.
4: Money is power, the free money the government is acquiring increases the power it has to intervene in, well anything it wants to.
So... Debt based money gives us... Inflation, mandatory economic expansion, increase in the size and power of the military industrial complex, increasing size and power of the state.
Deleted
I really do respect the work and opinion of Bruce Schneier but I believe is completely overlooking the most fundamental issues summarized here:
k _security
http://www.innersafe.com/about_us#reasons_for_wea
In a nutshell, companies are incented to provide weak security, because including stronger security means loss of revenues and decreased profits.
If you are one of the masses that believe export restrictions related to cryptographic software today is loose, you are sadly mistaken. As the above link shows, gathering the names & addresses of every end user located outside US & Canada is not a practical option for many companies. And neither is checking each customer's name against the Denied Persons List. Fines and penalties are ridicuously high for violations.
So there you have it. Your security is sacrified because current laws penalize companies that provide strong data security. After all, governments get nervous when citizens can keep secrets from them and therefor restrict imports or exports (yes, even today in USA).
The next workshop on economics & info security will be held in October. So if you have strongly held views in this area (and who on slashdot lacks strongly held views), then think about submitting. You don't have to be an academic to submit a paper, although arguments should be carefully constructed and well organized.
The Workshop on the Economics of Securing the Information Infrastructure (WESII)Suggested topics (not intended to be comprehensive):
Ross Anderson made an interesting presentation on the Economics of Dependability and Security at Networkshop this year which provides a good overview of the subject. The video and slides are linked from:w orkshop34/webprog.html
http://www.ja.net/services/events/networkshop/Net