5 Key Factors of Complexity

Brian J. Truskowski, General Manager of Internet Security Systems (ISS), gave a keynote presentation at RSA 2009. His talk touched on an interesting topic that he referred to as the "5 Key Factors of Complexity."

He identifies that the key cause of compromise is human nature; the ability that humans are susceptible to social engineering. Instead of focusing on securing systems, Mr. Truskowski argues that we should design systems that are "resistant to human frailty." He goes on to state, that designing these systems (by reducing complexity) is difficult.

According to Mr. Truskowski, the 5 key factors of complexity and the key to designing these systems are:

1. Threats
   
2. Compliance
3. Technology
4. Economics
   
5. Business Needs

Contrary to security, Businesses have to keep focused on all of these factors or they will be unsuccessful. Vendors however, are according to Mr. Truskowski, only focused on one of these factors... Threats. He argues, If an enterprise doesn't focus on compliance, they are fined. If a business doesn't focus on business needs, the business can't change.

"It's like building the titanic. The ship's designers optimized around being able to withstand collisions at the sacrifice of maneuverability. There have been many theories over the years over why the Titanic sank, from Brittle steel to sub-standard rivets. But, in reality, it is obvious why the Titanic sank. It couldn't get out of the way of the iceberg. The Titatic's designers focused on size, strength, resilience, and luxury but not on maneuverability."

I think Mr. Truskowski's talk was the hidden gem at RSA. It is an interesting idea for security vendors to begin focusing on things other than threats. Of course, if the idea gets legs, it will be 10-15 years before any change occurs. It is great to see people thinking holistically about security.

The video/webcast can be seen here: (5 Factors of Complexity starts at 19:49)

http://media.omediaweb.com/rsa2009/webcast.htm?id=3_1

What businness actually want: lessons learned on the RSA floor

From a security perspective, companies want simple solutions. As I walked the RSA expo floor a few weeks ago, this became very apparent.

Vendors were pitching products that were among other things, "in the cloud", "self-maintained", and "auto-updated." It seems that companies are looking for simple solutions for complex problems. (Duh?)

As I walked around the exposition floor, I began to chuckle, realizing that there were more people in the Moscone center than there are attackers in the world. More money gets pumped into security products than actual money gets stolen. What an amazing idea.

Now, imagine I have a product that you can:

1. Plug into your network or computer.
2. Requires no "maintenance".
3. Will prevent your network/computer from being attacked.
4. Alert you after it has successfully prevented the attack.
   

This was essentially every product that was being offered at RSA.

My two-cents: No product or grouping of products will prevent an attack. You can do some preventative measures, however, if an attacker wants to get you, they will.

Good Luck!

Buzzword: Compliance

Compliance is not a new buzzword, in fact in other industries compliance has been around a long time. During the RSA conference, every vendor had the word compliance on their cardboard bulletin board, an adult version of a diorama. [1]

What are the different types of compliance?

In computer security, compliance began with the government. This is where all good ideas come from (sarcasm). Over time compliance regulations evolved into something that was "needed" by the industry to make sure that corporations took steps to protect their user's data. It is sad that corporations need an intervening body to tell them that they should secure their data. However, this is why HIPPA and SOX came about. Why should a hospitial spend money to protect patient's records? That is crazy talk!

I have been in the security community for a long time and I hate to tell you but companies will never care about security. They will do the minimum thing required in order to satisfy the masses. In the U.S. the only thing that matters is the bottom line. Companies pay for Cost-Benefit analysis on things to determine what the corporate strategy should be. Corporations don't do this because they care about the result, they do it to save money, thus being profitable for their shareholders.

If the only thing that matters is the bottom line, you need independent regulatory agencies to mandate certain rules for the greater good.

As long as consumers believe that the products they buy are safe, they will continue to buy them.

Let's take the protection on a container of Tylenol. In 1982, a bunch of people were poisoned in Chicago because someone decided to put potassium cyanide in random bottles of Tylenol. What was the result of this? The market share of Tylenol dropped from 35% to 8%. It took an entire year for Johnson & Johnson to grab the market share again. They did this by creating a triple-sealed package and dropped their cost to be more competitive. After this Johnson & Johnson grabbed more market share than they had before!

In this example, the consumer stopped trusting that Tylenol was safe and subsequently stopped buying Tylenol. They didn't stop buying medicine just Tylenol. The attacker could of poisoned other bottles too, but that didn't matter. What the customer cared about was the saftey of a product. When the consumer felt good about Tylenol again, they begin buying the product again.

The purpose of compliance is to make the consumer feel safe. The government needed to step in and mandate in order to have the people feel protected.

Does compliance work?

It depends on who you ask. Mike Bailey doesn't think so. However, others do. For instance, Companies that make profit from compliance defiantly think it works.

Why is compliance so often talked about?

Companies that do cost-benefit analysis like the ones above need to be compliant. They will comply the cheapest way they can, thus keeping their operating costs low. Companies will continue to offer cheaper and cheaper compliance products. Just remember, they get what they pay for.