Security

General discussion

Locked

The Six Dumbest Ideas in Computer Security

By jdclyde ·
This came in a security newsletter I recieve. I read it and some of the ideas I thought were pretty obvious to me, yet some others made me have to think about them for a while as they are counter the conventional "wisdome" about computer security.

"Marcus Ranum released any interesting editorial entitled "The Six Dumbest Ideas in Computer Security." He gives his views on common security misconceptions that seem to be perpetuated throughout corporate IT environments. You can read this and other editorials at:
http://www.ranum.com/security/computer_security/editorials/dumb/"

After reading this, what is your take? Are we just chasing our tails so vendors can continue to make a profit?

Is this approach something that you use, or could use?

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

society rules vs computer rules

by CTOS In reply to The Six Dumbest Ideas in ...

I agree in total with Ranum that society changing for the worse IS the real problem; but that is not under our control to reverse, that I know of.
Computer design was a great invention, but it was designed by beginners as well. Now that it is apparent that we need to change the way we think and design, initiation of the changes should take place and virtually eliminate the badness of society. This would happen when we take their "playground" away by removing the basic access to individual machines.
No matter what the subject is, take one step back in the discussion and view it and you will usually find a different focus on the item. That is what Ranum did and I applaud him for this insight! It is the way I *feel* and it is nice to hear someone actually say it and put it in print!
Cant change society and the growing badness? Change the playground and the access to it!

Collapse -

good point

by dirtycar74 In reply to society rules vs computer ...

I like the analogy (sp?) of the playground; very cute and yet to the point and presents a strong visual that almost everyone can relate to.

Collapse -

Ahhh... the PERFECT IT world!

by Lando56 In reply to The Six Dumbest Ideas in ...

Of course the author makes some very good points, but does sometimes goes off in whatever direction that is basically a non-exsistant world... and never will exist. As one replier insinuated(sorry, forgot who) business drives IT, NOT the other way around. That is not to say that what ever business says 'goes'... of course IT has to be sure that it is safe, beneficial and cost effective.

As far as educating users ( the weakest link in the security chain) to 'demand'(?) that CPA's, insurance adjusters, finance executives, heart surgeons... whomever, become IT experts is to completely misunderstand the purpose of the business. People do not go to a medical specialists because the doctor has a BS in Computer Science or security certifcation.

Anyway, in closing ( I know...finally!)yes, some good ideas, some a little too esoteric, and some that just will not work in the real world.

Collapse -

Another LA LA Land Citizen!

by Yowye In reply to The Six Dumbest Ideas in ...

Lets put an end to EXE's...
Thats not smart... that's plain Lunatic
Your intire Frame work depends on Executeable Files, weather upper class or subclass.
Upperclass = loading schematic that puts the program on your computer... by simply embedding it into the framework of your funtional code.
1 Messing with this eliminates program addions to be easily if not entirely capable of embeding them selves into the system... which means you cannot also load the software you want without reloading your entire system mainframe, and that will cause more problems then permiscuous spyware.
2 When you think that your problems can't get any worse then the previous statment... then you realize that you also messed up the Subclass EXE's
Subclass = loading schematic that opens the program each time you want to use it... so in a manner of speaking... you just initially prevented most of your programs from running properly.
If you affect the Upperclass = loading schematic you will also affect the Subclass = loading schematic and visa-versa.

In other words... you just created a diffrent and maybe even larger pile of headaches.

Collapse -

Instead of complaining, offer solutions

by dirtycar74 In reply to The Six Dumbest Ideas in ...

I know most of the folks who frequent these boards are pretty busy, so I'll cut to the chase...

When you say that something is "a dumb idea", you are stating the obvious, but you have yet to really offer up any real solutions or plans that the average IT guy/gal can take up and follow through with.

Next time you want to rant about the standard practices, you might want to try re-designing the infrastructure of a mega-corporation first; only then will you see the futility in the whole design and re-design process. The whole idea behind most of the "dumb ideas" listed is the fact that they allow most things to work across a wide variety of setups. Until you invent something better, keep your rants to a minimum please. I want useful ideas not mindless drabble or follow the leader (and bash the industry standards), thanks.

And please don't take this as a flame or that I disrespect your point of view; I like the fact you are willing to voice this, just please remember that until there is something better, we are all pretty much stuck with what we have...

Collapse -

Angry but not ranting

by Praetorpal In reply to Instead of complaining, o ...

I think he asking us to challenge the status quo. He is a security person, not a kernel programmer. It is not up to him to provide a solution. He is only making us aware of the reasons we are losing ground, as we continue to accept the status quo. I am telling you, after 2 years of writing editors, writers, you name it, that few people have the vision to accept the possiblity of anything new being better in this area, yet the status quo is failing us.

If you want a solution, I again invite you to google Trustifier for your own information.

Collapse -

I think my reason for pointing the article out was missed

by jdclyde In reply to Instead of complaining, o ...

I think my reason for pointing the article out was missed.

I firmly believe we should here NEW ideas all the time, not just the ones that agree with what we already think.

Remember the old "no stupid questions" rule? That is why in Brain Storming sessions NOTHING is evaluated or discounted until after the collection time is done. Sure, some ideas are not very good, but a "bad" idea will get someone else think of why the idea is bad and how to make it a GREAT idea. None would have happened if the first "Bad" idea wasn't thrown into the discussion in the first place.

Not to mention, many inventions are done by MISTAKE.

If more people start to question the "chase your tail" mentality we are all stuck in, someone WILL come up with that solution.

And for the same reason Windows is so easy to be compromised, a vanilla config is just BEGGING for trouble.

We need to expect MORE from software vendors.

Collapse -

Pushing patches in the Middle of the Day

by kit_eizenga In reply to The Six Dumbest Ideas in ...

Our Security guy used to push patches in the middle of the day. Oh would users be pissed.

Collapse -

Too much money involved

by NickNielsen In reply to The Six Dumbest Ideas in ...

I believe that to completely implement his suggested solutions in today's IT market is an impossibility; too many people have an entrenched economic interest in the status quo.

On the other hand, if software developers would simply write their applications so all actions take place by default in the &user& directory, we could probably eliminate 90% of what is already out there. It might even make the Microsoft "Limited" account actually useful for something besides an interesting entry in the WinXP user setup dialog.

Collapse -

Excellent article, some concerns

by rm3mpc In reply to The Six Dumbest Ideas in ...

Overall, I thought the article was excellent. The author did what
a few others I have encountered have done: he stood the
problem on its ear and looked at it in a different way, and drew a
set of conclusions that defied conventional wisdom. Even if you
find cause to disagree with him, he makes you think.

The article is most relevant to businesses which can afford to
have smart sysadmins, isolation servers, etc. Home users, who
are both victims and vectors for malware, wouldn't be able or
interested enough to do everything he calls for.

The solutions should come from the OS providers. NOTHING that
can harm a system should be allowed onto it without explicit
permission, whether we're talking about .exe executables, Java
scripts, VBS or whatever. The OS should be layered and should
protect itself. That doesn't render a system completely
bulletproof because social engineering can trick a user into
making an ill-informed choice, but it's a major step in the right
direction.

Furthermore, installed software should list every unique feature
and request permission before putting in components that you
didn't explicitly ask for. Why should Acrobat Reader add a Yahoo
search bar without asking me if it's OK?

And every installed component should be required to list the
vendor who provided it along with a brief description in plain
language that says this is part of such-and-such an application.
That information should be available in things like System
Configuration files, the System Registry, Add/Remove Programs
in Windows, and whatever provides similar functions in other
OSes.

That said, I think the article should be required reading for every
software designer/programmer. It wouldn't be a bad idea to
circulate it around management, either.

Regarding the 80/20 rule as applied to sysadmins, netadmins, et
al., that may be true, but even more to the point, it's a
management problem. Management often doesn't see the
problem, or imposes constraints that make it nigh unto
impossible to provide a secure system.

And when catastrophe strikes, who will get the blame? He or she
to whom responsibility was delegated (see attached memo
outlinking job responsibilities), but who lacked the resources to
do the job.

I still hold the OS developers most to blame, followed by the ISPs
who can catch this stuff before it lands on your lap.

Related Discussions

Related Forums