PDF
The New Screen of Death
Is securitya problem that just can’t be solved?
Edward Grossman, Editor, Queue
In the olden days (say, all the way back in 1995), the popular complaint about computers was that they crashed too often. And while stability remains a problem in which perhaps there’s still progress to be made, the blue screen of death has been eclipsed by the new screen of death: Security.
It’s not as if people aren’t trying to solve the problem. There’s certainly no shortage of security books, security products, security conferences—you catch my drift. Heck, even Microsoft has made security “job one.” You would think that with all this focus we would be in a better place than we are—but headline after headline, day after day, we see new vulnerabilities exploited and new cracks hacked. Why isn’t the situation getting any better?
It was to this question that we turned our attention when the ACM Queue editorial advisory board sat down to pull together a special report on network attacks (the point of origin for most security breaches). We didn’t want to throw together another “turn your firewall on, keep your patches up to date, and avoid buffer overruns” diatribe, as you might see elsewhere. Instead, we wanted to get at the root of the problem—what in the world is going on? Why aren’t things getting better? So we decided on a simple, basic approach—to take stock of the current situation, to look at how we’ve gotten here, and hope, therefore, to better understand where the solutions may lie.
With mission in hand, the first step was obvious: take a major network attack—for example, a havoc-wreaking worm of recent vintage (and there are many to choose from)—and figure out just what happened. Jim Morrison, a senior security consultant with Symantec Security Services, obliges with his “Blaster Revisited,” a fictionalized (to protect the innocent?) look back at how things unfolded as the Blaster worm propagated.
Next up is an introspective exploration that asks the hard questions about why the programming languages that we use in our programming lives in make it so easy to code insecurely. Marcus Ranum, senior scientist at TruSecure, tells it like it is in “Security: The root of the Problem.” Should we be expecting more of our languages—or more of ourselves?
An important part of improving security and defeating future attacks is being able to identify both how people got in and what they did when they got there. Part science, part art, “Network Forensics” by Ben Laurie, technical director of A. L. Digital, looks at why this is sometimes easier said than done.
Our special report on surviving network attacks rounds out with a look at why outward-facing defenses leave gaping holes unprotected from ill-intentioned or uneducated insiders. Herbert Thompson and Richard Ford, of Security Innovation and the Florida Institute of Technology, respectively, discuss several pitfalls to look out for in “The Insider, Naivety, and Hostility: Security Perfect Storm?”
Before signing off I did want to mention one more thing. Every once in a while you cross paths with a person or an idea (or both!) that simply makes you stop and take notice. Rarer still do you have the opportunity to sit down and actually get that person to explain their project to you at length. Queue is delighted to be able to bring you just such an opportunity. Queue editorial advisory board member Stu Feldman, vice president for Internet technology at IBM, recently had such a chat with a man who’s quite literally trying to re-create antiquity’s Library of Alexandria, Brewster Kahle. You may know him for Alexa Internet, or you may know his Wayback Machine (http://www.archive.org/web/web.php). Kahle’s obviously no newcomer to innovation—and his “library of everything” is just one of those ideas so crazy it just might work.
Read on!
EDWARD GROSSMAN is responsible for Queue, so blame him if you don’t like it: [email protected]. In earlier incarnations he was a development project manager at a still-in-business dot-com and a closet coder (his parents still don’t know—“Our son Ed? Oy, he works with computers, doing something”).
Originally published in Queue vol. 2, no. 4—
Comment on this article in the ACM Digital Library
© ACM, Inc. All Rights Reserved.