Financial Cryptography: Our security sucks. Why can't we change? What's wrong with us?

April 17, 2007

Our security sucks. Why can't we change? What's wrong with us?

Adam over at EC joined the fight against the disaster known as Internet Security and decided Choicepoint was his wagon. Mine was phishing, before it got boring.

What is interesting is that Adam has now taken on the meta-question of why we didn't do a better job. Readers here will sympathise. Read his essay about how the need for change is painful, both directly and broadly:

At a human level, change involves loss and and the new. When we lose something, we go through a process, which often includes of shock, anger, denial, bargaining and acceptance. The new often involves questions of trying to understand the new, understanding how we fit into it, if our skills and habits will adapt well or poorly, and if we will profit or lose from it.

Adam closes with a plea for help on disclosure :

I'm trying to draw out all of the reasons why people are opposed to change in disclosure habits, so we can overcome them.

I am not exactly opposed but curious, as I see the issues differently. So in a sense, deferring for a moment a brief comment on the essay, here are a few comments on disclosure.

Disclosure is something that is very hard to isolate. SB1386 was a big win, but it only covered the easy territory: you, bad company, know the victim's name, so tell them.

Disclosure today doesn't cover what we might call secondary disclosure, which is what Adam is looking for. As discussed Schechter and Smith, and in my Market for Silver Bullets:

Schechter & Smith use an approach of modelling risks and rewards from the attacker's point of view which further supports the utility of sharing information by victims:

Sharing of information is also key to keeping marginal risk high. If the body of knowledge of each member of the defense grows with the number of targets attacked, so will the marginal risk of attack. If organizations do not share information, the body of knowledge of each one will be constant and will not affect marginal risk. Stuart E. Schechter and Michael D. Smith "How Much Security is Enough to Stop a Thief?", Financial Cryptography 2003 LNCS Springer-Verlag.

Yet, to share raises costs for the sharer, and the benefits are not accrued to the sharer. This is a prisoner's dilemma for security, in that there may well be a higher payoff if all victims share their experiences, yet those that keep mum will benefit and not lose more from sharing. As all potential sharers are joined in an equilibrium of secrecy, little sharing of security information is seen, and this is rational. We return to this equilibrium later.

Disclosure implies the company knows what happens. What if they don't?

Disclosure assumes that the company will honestly report the full story. History says they won't.

Disclosure of the full story is only ... part of the story. "We lost a laptop." So what? "Don't do that again..." is hardly a satisfactory, holistic or systemic response to the situation.

(OK, so some explanation. At what point do we forget the nonsense touted in the press and move on to a real solution where the lost data doesn't mean a compromise? IOW, "we were given the task of securing all retail transactions......")

So, while I think that there is a lot to be said about disclosure, I think it is also a limited story. I personally prefer some critical thought -- if I can propose half a dozen solutions to some poor schmuck company's problems, why can't they?

And it is to that issue that Adam's essay really speaks. Why can't we change? What's wrong with us?

Posted by iang at April 17, 2007 03:42 PM | TrackBack

Comments

as i've periodically mentioned before, we were brought into help word smith the cal (state) digital signature legislation ... and then later the federal legistlation
http://www.garlic.com/~lynn/subpubkey.html#signature

as part of that activity we were exposed to some of the disclosure/notification legislation work going on ... both with regard to the use of personal information as well as security breaches and data breaches. a few recent posts in various
threads mentioning notification/disclosers
http://www.garlic.com/~lynn/2007f.html#72
http://www.garlic.com/~lynn/2007f.html#75
http://www.garlic.com/~lynn/2007g.html#8

this somewhat, subsequently also got us roped into co-author of x9.99 financial privacy related standard ... somewhat in support of that activity i had done a merged privacy taxonomy and glossary ... reference here
http://www.garlic.com/~lynn/index.html#glosnote

and for other topic drift, some other recent threads ... much more on the integirty and security side of the topic ... as opposed to the notification/disclosure side of the topic
http://www.garlic.com/~lynn/2007h.html#36
http://www.garlic.com/~lynn/2007h.html#37

and separate part/aspect (which touches slightly more on some
of the business issues) in the same thread
http://www.garlic.com/~lynn/2007h.html#27
http://www.garlic.com/~lynn/2007h.html#28
http://www.garlic.com/~lynn/2007h.html#31

Posted by: Lynn Wheeler at April 17, 2007 07:24 PM

I would add one other factor from Brian Chess at last year's OWASP conference. He talked about new companies that have low security risk (they have not accumulated assets yet), but high market risk (they need to build a business). Over time, successful companies accumulate assets and market position, these lines intersect, the company is successful they have lower risk on market share and they become a bigger security target, and so on. He was taling about startups, but I think the same concept applies in how firms perceive new solutions in general. SInce the lines cross over time this also explains why security always feels like it is playing catch up

http://1raindrop.typepad.com/1_raindrop/2006/10/brian_chess_on_.html

Posted by: Gunnar at April 18, 2007 09:06 AM

It's not that we're unable to propose solutions, it's that they're hard to compare. My assertion is that once we overcome the desire to hide our errors, we can learn to compare in better ways.

Posted by: Adam at April 18, 2007 04:10 PM