Slashdot Mirror
Schneier on Economic Insights to IT Security
Scyld_Scefing writes "In his June 29, 2006 Wired News article, 'It's the Economy, Stupid,' Bruce Schneier covers the content of the 2006 Workshop on the Economics of Information Security. Schneier says that economic analysis of IT security issues is relatively new, and links to one of the significant earlier papers from 1991, 'Why Information Security Is Hard -- An Economic Perspective' (.pdf). This article states: 'According to one common view, information security comes down to technical measures. Given better access control policy models, formal proofs of cryptographic protocols, approved firewalls, better ways of detecting intrusions and malicious code, and better tools for system evaluation and assurance, the problems can be solved. In this note, I put forward a contrary view: information insecurity is at least as much due to perverse incentives. Many of the problems can be explained more clearly and convincingly using the language of microeconomics: network externalities, asymmetric information, moral hazard, adverse selection, liability dumping and the tragedy of the commons.'"
One of the hardest things about security is knowing you really have security. It's kind of like knowing your software doesn't have a bug. It's easy to know when you do have a bug, it's virtually impossible to know you don't.
I think security suffers the same or similar perception, rightly so. So, no matter how much you invest, how strict your policies, you really never know you have security. Couple that with how expensive it is to apply and enforce the more draconian policies... who wants to spend a fortune and find out they've been compromised anyway?
And, extreme security makes computing far less transparent, often to the exclusion of any reasonable work flow for day to day tasks. If security could be transparent (not sure it can), that would help.... no business likes fielding support issues for an entire corporation just because their network is PKI (ever administrate Sun's version?).
(I once worked at a place that had a thirteen-rule requirement for setting new passwords... it was so intrusive, I kept a printout of the rules on my monitor to try and avoid a twenty-minute guessing game session for setting new passwords. What was really funny was at one point the "rules" conflicted with one of our systems, so you couldn't define a qualified password that the system could use. Hilarious.)
On top of all of that, no matter how diligent you've been, one disgruntled (ex-)employee is all it takes with a modicum of social engineering savvy and you find the investment for naught. It's no wonder security is a tough nut to crack.
(As an aside opinion... I think the press gives too much attention to things like the recently stolen laptop with all of the info on it -- it was a stolen laptop, probably nothing more -- they get stolen all of the time, and people have no idea what they've gotten other than a "free" computer.)
Since you can sue to death anyone breaching security, you only need to put a cheap fence around the company assets and invoke the DMCA.
Put the incentives in the right place and there's still the issue of implementation. Nobody benefited from Chernobyl blowing, but it did anyway, and investigators think part of the reason is that there were no reactor engineers on duty. Security, just like industrial safety, depends on having trained and informed people at critical decision-making points.
Making security usable is another implementation issue. Everyone wanted airplanes to land safely, especially the pilots who were inside them, but there was one crash after another due to "pilot error" until the aerospace world began laying out controls and instruments to meet the needs of the pilots who used them.
True, incentives do come first. But even then they need to be carefully chosen. Bad publicity and the threat of job loss didn't make the VA careful: instead those incentives fueled a search for scapegoats, a search which ended with the analyst who had written permission issued on three occasions to take the data home with him.
http://www.ecampus.com/bk_detail.asp?isbn=05216052 10&referrer=frgl
Cheapest place a quick froogle revealed. I read this book a few months ago and found it pretty interesting, though perhaps best in its role as summarising further papers for reading.
Just to make this clear, "security" is not an end item. You cannot "have" security. My definition is: The process of identifying and evaluating threats and reducing their effectiveness.
h tml
As Bruce says, when there isn't an economic incentive, that process is not maintained.
But, suppose you are maintaining it. How do you know how good your security is?
Bruce also wrote about "attack trees".
http://www.schneier.com/paper-attacktrees-ddj-ft.
Identifying and evaluating the different avenues of attack is part of evaluating the threats. Once you've identified one, don't think about how you can "prove" it is "secure". Think about how you would go about showing that it is NOT secure. Make your statements about your security "falsifiable". Just like in the scientific method.
Then experiment, on an on-going-basis, to see if you can demonstrate that your security can be broken. This takes time and effort on your part as you have to continually read about the latest advances and theories.
Which gets back to the economic issue. If the organization does not see an economic incentive for you to perform that research/work, then you will be assigned to other tasks and the process will not be followed. If you are not following the process, there is no "security".
It should not be surprising to people that economics provides the basis for explaining many interesting situations that occur in the real world in relation to computer security. Recall that economics is the study of how humans react to scarcity, or more bluntly how we behave in light of the fact that we cannot simply snap our fingers and have anything we want immediately placed in front of us all of the time (with the possible exception of Bill Gates and a few others, but they are not representative). It is precisely the ability of economics to insightfully solve common conundrums with deliciously counterintuitive explanations that seems to fascinate so many people, as evidenced by the recent success of books such as Naked Economics: Undressing the Dismal Science and Freakonomics, despite the generally boring ways in which the subject is presented by our schools. If it involves human interactions and human nature then, ultimately, it involves economics.
I know this is author's description is "perverted" (quoting the article) when you can make a very direct reference to something else that is "Hard":
"Given better access control policy models": Learning how to say NO.
"formal proofs of cryptographic protocols:" cryptic nerd speak and or tech speak to keep the true introvert safe from those frisky STD laiden women
"approved firewalls:" contraception tools.
"better ways of detecting intrusions and malicious code": better methods to protect against STDs
"and better tools for system evaluation and assurance": the monthly "selfcheck" for various cancers.
"information insecurity is at least as much due to perverse incentives.": "perverse incentives??" what else could that analogy be like but the "temptation" of hot sex?
We will not see real security until Insurance companies start to really evaluate the risks involved. Once premiums sky-rocket due to poor security, then people will pay attention.
"To those who are overly cautious, everything is impossible. "
I've been telling my co-workers for a long time - while hackers who break into companies' networks should be punished, the companies, themselves should be punished more. The very first paragraph of this essay (the one comparing the European banks to the American banks) would seem to agree with me.
Let's face it: if your corporate network can't stand up to some high-school kid in his basement, it certainly isn't going to stand up to a well-funded foriegn power trying to attack us.
Sit, Ubuntu, sit. Good dog.
That is all.
It occurs to me that is similar to what I encountered when a I was sysadmin. The boss has no idea how many problems the company didn't have because you're good at your job. In fact, an admin that's always fighting fires can be highly valued for all of the work they put it in.
With security, the only measure is imagining the cost of outages and security breaks, maybe for other companies if you're good enough or lucky enough to prevent them. Otherwise, the bean counters will only look at what you want to spend as having no return.
An exception might be if the company hires a consultant (because what would YOU know. You work here. You can't be smart.) to assses the econonmic impact of the risks. That would be followed of course, by how you need to hire them to prevent the danger.
Ever dream you could fly? Get up from the Flight Sim. I Fly
It has a profound effect on our society.
Take for example the debt based money system we have now. The government has the ability print money (well, borrow) as it likes. Well when you have that power, it's pretty damned difficult not to use it. After all, raising taxes is about as popular as a fart in a lift and all politicians want to be re-elected. So borrow some money from the central bank to pay for your pet oil liberation project. This has a number of implications:
1: We've increased the amount of money available in circulation. This causes the value of the existing money to decrease; Inflation. Though it's percieved to be a general increase in prices it's essentially a tax on the currency holding population.
2: That debt you have to pay back, well it has an interest rate on it, the bankers want a little bit more back than they loaned, so you and everyone who works for you have to work that little bit harder to pay it back, you have to expand and grow to service the debt. The more you expand, the smaller the debt is in proportion, so you must expand. Which basically means there must be a continual increase in the exploitation of resources. For some reason the ecologists haven't picked up on this.
3: The government has free money to give away. Well, easy money anyway. The military, haliburton and all the direct contractors to the government benefit directly, in fact they get the cash before the inflation hits the economy generally so they benefit and grow hugely. Well we could call the military, it's direct suppliers like haliburton etc the military industrial complex.
4: Money is power, the free money the government is acquiring increases the power it has to intervene in, well anything it wants to.
So... Debt based money gives us... Inflation, mandatory economic expansion, increase in the size and power of the military industrial complex, increasing size and power of the state.
Deleted
The next workshop on economics & info security will be held in October. So if you have strongly held views in this area (and who on slashdot lacks strongly held views), then think about submitting. You don't have to be an academic to submit a paper, although arguments should be carefully constructed and well organized.
The Workshop on the Economics of Securing the Information Infrastructure (WESII)Suggested topics (not intended to be comprehensive):
Ross Anderson made an interesting presentation on the Economics of Dependability and Security at Networkshop this year which provides a good overview of the subject. The video and slides are linked from:w orkshop34/webprog.html
http://www.ja.net/services/events/networkshop/Net
In a nutshell, companies are incented to provide weak security, because including stronger security means loss of revenues and decreased profits.
I beg to disagree with this on 2 points.
First, more secure systems tend to run more efficiently and more reliably, thus increasing the users productivity. As you will not have to deal with your order entry being down for an hour on a crash or patch. More secure systems tend to be run by more knowledgeable staff, better planning, better management and a better choice of applications. Applications that are insecure are also tend to be unreliable, require higher "handholding" and service levels to keep running that increase costs. Over my years of experience, assessing security is a good way to generally assess products fitness for use and over all cost of ownership. Less secure products also tend to cost more to maintain.
Second, security is also about enabling the business to function efficiently. A case in point with employee access control (proxies) and QoS. Corporate I/T gets a call from the manager a major distribution center that they can't process shipments fast enough. So security investigated to find the telnet/ssh traffic for the business applications was competing on the WAN with video porn. Here is the kicker, of 3 video streams; one was going to that very same manager who called! Firing the manager, placing QoS and site filtering on the proxies increased the company's efficiencies. Positive impacts also include a lower risk of sexual harassment and increased customer service levels, with a nice byproduct of better profits.
So it might be more correct to say many companies perceive that security costs are not worth the investment and do not contribute to the bottom line. However, more often than not it is a misguided as many companies have gone bankrupt because their security practices were insufficient.
The biggest problem in security today is getting a rational and logical assessment of how much you should spend, and what you should spend it on. Sales people are liars, yet often management s most trusted source. But this is a I/T industry problem in general.
If product vendors include effective data security in their products:
1. they have to get export approval from their own country (see below for USA to see added costs)
2. they have to get import approval from the destination country (many will reject, thus the reduced revenues)
If the company is based in USA:
1. they cannot sell the software to anyone who appears on the Denied Persons Lists provided by the U.S. Govt (criminal penalties are heavy and how do you check DPL if the product is sold on store shelves?)
2. semi-annual reports need to be provided to the U.S. Bureau of Industry and Security that includes the names & full addresses of every single end-user who purchases the product.
3. the U.S. Bureau of Industry and Security can revoke authorization for the company to use License Exception ENC at any time (even after the 30 day review period) so the company risks becoming an instant violator of export regulations. Failure to answer any question whatsoever (e.g., how do we crack this in 5 minutes?) may result in being unable to sell to anyone outside U.S. and Canada even after you begin selling overseas. "All your balls are belong to them."
The above 3 points assume that you successfully receive authorization to export outside U.S. and Canada.
The impact is clear. Reduced revenues from inability to sell in as many countries and inability to sell off-the-shelf due to DPL requirements. Increased costs due to export compliance, semi-annual reporting, legal fees, etc. And of course the added risk of being charged with heavy criminal penalties for violating any EAR--even when selling to countries considered strong allies.
This 1-2-3 punch practically forces companies to sell weak security. The reasons you posted are highly unlikely to counter this impact on product vendors.
If you ever run a business that sells products, especially to consumers, you'll instantly recognize the above as a complete nightmare to be avoided at all costs. Who wants anything that massively reduces your total market size and simultaneously increases costs?