Atomic Paradigms For Enterprise Security

chuckgregory:

For the most part, I agree with you.  The older I get, the more I find myself agreeing with Celine's Laws -- a set of philosophical principles invented by Robert Anton Wilson and attributed to one of his fictional characters. 

1. National security is the chief cause of national insecurity
2. Honest communication only happens in a non-punishing environment
3. An honest politician is a national calamity

#2 seems very appropriate to the Teller versus Oppenheimer debate.  If we know that we can be punished for telling the truth, we suddenly have a vested interest in lying.  I don't think that's any way for a society to be.

Jwallace, it never occurred to me that somebody would mistake my parenthetical 'aside' for a hyperlink. Makes sense that you would--but it wasn't.

For the record, I'm an old-fashioned hyperlink type: I put the actual address in there as text. It's a hangup of mine.

Thanks for your comments.

Chuck

Hi Chuck!

(read 'laws' here) <-- was that suppose to be a link?

"I believe in free speech, free information, freedom to say and do whatever we want"

That often gets me into social trouble in real life...especially when it comes to politics talk...I said loudly that I'm voting Republican this time around and that I thought Palin's acceptance speech was supercalifragilisticexpialidotious in front of Obama fanatic "friends"<--acquaintances really.

I am obviously not a politics "cheerleader" even in an election year...and if I were to 'freely' say 90% of all political 'promises' are hogwash and at the end of the day, no one wants our country to lose......

In my (perhaps not so) humble opinion:

Publicize every flaw. Climb every mountain. (Where did that come from? My subconscious seems to be acting on its own...)  Get everything out in the open and let the chips fall where they may. (Subconscious again. I'm talking in mixed metaphors today.)

I don't think network  vulnerabilities are in exactly the same class as the hydrogen bomb. But what do I know?

I believe in free speech, free information, freedom to say and do whatever we want, and freedom of people. I don't believe in censorship, or in any sort of suppression of information. I don't want my government, or anyone else's for that matter, to protect me from myself or from the ideas of others.

I have little respect for secrecy, and none for aribitrary rules (read 'laws' here).

Security is vastly overrated and often presents more of a threat than the  problem it is supposed to cure.

Insecurity is responsible for most security issues.

Destruction of information is far more serious than its dissemination.

Thanks for listening. I seem to be a bit radical today. (My knowledge of chemistry is not good enough to know where free radicals may fit into this discussion, though.)

Hi RBJ,

Thanks for the excellent comparison you drawed from the history of the H-bomb. It perfectlyy fits two schools of thoughts in Enterprise Security. I made a "Teller's contribution" to Ira's Post in disagreeing with the ethical and /or legal issues surrounding the MBTA saga. Fron reading your post and other related references, Teller was a Pragmatist to the highest degree. I don't devalue the Oppenheimer's approach but i think it cannot get the job done for us. If as you said on your post that our attack surface is approaching infinity, then only a Teller's approach can realistically do the job for us.

Most Enterprises by taking an 'Oppenheimer" view on security have stifle innovative solutions and in the process hindering advances that will make us more safe. Some enterprises can not even report a breach of security in their systems lest alone have the audacity to conduct research on potential vulnerabilties. All this is been done to sort of safe guard the reputation of the enterprise. While this action would serve their selfish objectives very well, it stalls innovative measures that would otherwise would have remedy the vulnerabilities.

Let their communities know when they believe they're being ripped off. I believe that's what these students were doing; they saw another exepensive public works project that seemed like a contractor was taking advantage of public money by providing a substandard product, and they wanted to expose it. It's hard to say whether the contractor was negligent, incompetent, or just trying to get something "good enough" to beat the deadline, but the students felt it was important to bring this to light.

Now the transit authority is trying to cover up their embarrassment by making the students into scapegoats, just like when idotic city officials over-reacted to the Aqua Teen Hunger Force ads and tried to accuse the artists who installed them of terrorism. Public officials will always try pull strings and change the rules to hide their own stupidity and incompetence.

after reading this:

"They are telling a terrific tale of widespread security problems, but they still have not provided the MBTA with credible information to support such a claim," says Joe Pesaturo, a spokesman for the MBTA. "It's that simple." <-- doesn't that already sound problematic?

and the defcon reastraining order, I'm beginning to wonder if those guys went to the seamingly arrogant and pompous MBTA first.

wait, did I just say something derogatory about a transit authority? 

I will blindly say that the 3 folks from MIT played it NICE!!

Here is a quote from this article(granted it is from MIT Technology Review, hehe):

"MiFare sold a lousy product to customers who didn't know how to ask for a better product," he says. "That will never get fixed as long as MiFare's shoddy security is kept secret." He adds, "The reason we publish vulnerabilities is because there's no other way for security to improve."

and

"The industry should view the MIT students' work as a free service that could ultimately lead to better security. Although there has been plenty of academic research on the security of RFID, he says, little has yet made its way into products. "The core of the problem is still industry's belief that they should build security themselves, and that what they've built themselves will be stronger if they keep it secret," Nohl says."

In this particular instance, I biasedly side with Teller (I just happened to have ran the ez-pass so many times that I got POUNDS of notices in the mail...still unresolved which is a nightmare, good thing I don't need an ezpass where I live now).