4 ms·

The thing about the prevailing commercial IT methodologies is that they can not deliver at the scale you are describing while also providing security within a f

by Veserv 5y ago

The thing about the prevailing commercial IT methodologies is that they can not deliver at the scale you are describing while also providing security within a factor of 10x of adequate, with adequate here meaning they would be happy to put the numerical cost to completely compromise their systems into their shareholder communications and consumer advertising and be happy to prove it by announcing a bounty for that amount at DEFCON and challenging anybody to claim it. There is no person with any technical competence and signing authority at any organization of that scale who would sign off on such an idea as they all know exactly how preposterous such a claim would be. The only thing that can be said about these systems is that they are functional at scale while being completely inadequate with respect to security, which, if security is not important as is the case for most organizations, is a perfectly valid tradeoff. However, if adequate security is actually important, such as when lives are at stake, these methodologies completely fail to fulfill such requirements. This is not merely the case when tackling the hard problem of large scale systems, where it might be forgiven to be unable to solve the hardest problem available, it is the case at every scale. At least capability-based systems have demonstrated adequate security at a usable scale, the prevailing techniques can not even do that. There is little reason to believe that abject failure at scale and an inability to solve any interesting sub-problem or smaller scale problem is a better way to success at scale than attempting to scale small successes.

ygjb 5y ago
I would like to challenge the notion that the executives at businesses at this scale are unwilling to communicate a numerical cost. I can't say which organization it was, or when it was, because I maintain enough of a public profile that it could leak specific information, but while doing a security consulting gig for a major global financial organization between 2001 and 2011, the team I was working with identified numerous serious concerns. The client company agreed that they were real risks, and even likely risks, but the financial impact, even if those risks were realized multiple times, were far below their documented thresholds for risk tolerance. In other words, the individual risks would have had to exceed $10M in impact per year, for multiple years before the financial impact of those issues would justify the massive cost of investment to remediate the risks. It's not that they didn't take them seriously, but the cost of the new system in development, which included addressing those risks, was so high that starting separate remediation efforts that would detract from those in progress changes introduced risk of the main replacement project failing. It was easier and lower risk and lower cost to just accept the impact of fraud, including compensating victims, than to try to fix it. Whether or not those "self-insuring" risk tolerance figures are public are a different matter. I do agree on the value and efficacy of capability-based systems, however the cost and effort to deploy and manage them, even in life critical environments, is so high that they are only practically effective in centrally planned environments where the funding for systems security is strongly decoupled from how that funding is acquired. In other words, capability based systems are, and will only be effective, at scale, in environments such as government (and even then, only military) or publicly funded, single payer, centrally managed health care systems (which don't really actually exist - most public funded healthcare in the world is centrally and publicly funded, but delivered by private service providers who bill the public funder). It's an effective model where the cost of reliably deploying and managing capability based security can be externalized from the line of business that requires that level of security.

by Veserv 5y ago

ygjb 5y ago

I would like to challenge the notion that the executives at businesses at this scale are unwilling to communicate a numerical cost. I can't say which organization it was, or when it was, because I maintain enough of a public profile that it could leak specific information, but while doing a security consulting gig for a major global financial organization between 2001 and 2011, the team I was working with identified numerous serious concerns. The client company agreed that they were real risks, and even likely risks, but the financial impact, even if those risks were realized multiple times, were far below their documented thresholds for risk tolerance. In other words, the individual risks would have had to exceed $10M in impact per year, for multiple years before the financial impact of those issues would justify the massive cost of investment to remediate the risks. It's not that they didn't take them seriously, but the cost of the new system in development, which included addressing those risks, was so high that starting separate remediation efforts that would detract from those in progress changes introduced risk of the main replacement project failing. It was easier and lower risk and lower cost to just accept the impact of fraud, including compensating victims, than to try to fix it. Whether or not those "self-insuring" risk tolerance figures are public are a different matter. I do agree on the value and efficacy of capability-based systems, however the cost and effort to deploy and manage them, even in life critical environments, is so high that they are only practically effective in centrally planned environments where the funding for systems security is strongly decoupled from how that funding is acquired. In other words, capability based systems are, and will only be effective, at scale, in environments such as government (and even then, only military) or publicly funded, single payer, centrally managed health care systems (which don't really actually exist - most public funded healthcare in the world is centrally and publicly funded, but delivered by private service providers who bill the public funder). It's an effective model where the cost of reliably deploying and managing capability based security can be externalized from the line of business that requires that level of security.