speaker: Bill Cheswik
- the sci fi authors of the 50’s didn’t come close to reality
- Advanced persistent threats aren’t advanced. Buffer overflow, etc are known
- the order of things is to make something new work and then figure out security – predicts security problems in Obamacare data handling
- UI is sill evolving. touch is only a decade old
- Old Microsoft menus are too slow. Can’t get faster at them like with UNIX. [lesson: support multiple levels of skill]
- prefers “grapes to raisins” instead of “apples and oranges”
- You don’t have to be a mechanic to use a car. But now adding a computer to your car. CAN bus “it just works” can be hacked by bad mp3 files. [Eek!]
Current state of affairs
- The fact that we do banking and shopping (money) online shos the internet is working,
- The current state of affairs is still lousy
- Certain thing needs to work regardless of “what grandma does wih the keyboard”. It isn’t grandmas fault. She shouldn’t be ABLE to do something wrong.
- We are all “grandma” at some point
- Checklists , virus checking, strong user passwords and user education aren’t enough to solve bad engineering.
- A virus checker finds evil software on a machine. It’s too late at that point.
- Shared and dynamic libraries meant to save memory when we were memory constrained to share common OS binaries. We aren’t memory constrained anymore. Don’t need these binaries considered trusted as side effect of this anymore.
What does victory look like
- OS that can’t be changed or subverted regardless of app or user action
- Apps can’t tained OS can limit to signed and approved apps
Metrics
- People want a number. But what is it measured in? Lines of code? Connectivity to Internet. (reference “an attack surface metric”)
Metric 1 – setuid
- Kernels talk to the world. Programs talk to the kernel. The diagram is usually shown th eother way
- Quick way to rate UNIX system security: look for setuid programs as root that aren’t needed. Why need etra holes at the bottom of the boat.
- Considers this # (5 in this case) to be a measure. [one is su though which seems like a door to anything]
Metric 2 – number of network services available to outside
- Again, more than you think
Metric 3 – how muc will someone pay for a zero day exploit
- Adobe Reader and MAc are low. iOS tops list with Firefox and Chrome blelow it
- This is a factor of how security it is (how hard to find an issue) plus how desirable he platform is to find an error in
- Predicts Android will have more issues because open source and hard to have displine when too many people finger in it.
Keep it small
- Keep software simple/li>
- Google’s Go language uses this small/fast is better principle
What works
- CPU speed is a tool
- Could use ores as separate machines with separate cache and memory
- Personal responsibility for the code. Such a Kunth’s personal checks for finding a bug. [I actually did this at work. I wanted to prove i was possible to fix a certain issue reliabily. I offered my teammates $1 for each issue they found in that space. It cost me exactly $1.]
- Literate programming.
- Software”annealing” – just fix bugs and don’t make other changes for a long time. This is why sendmail and other old programs are stable
- Strong type checking. Pascal style, not C
- Virtual machines where line is between kernal and hardware
- If you have other controls, a 4 digit PIN is fine
Excuses
- li>People write buggy code. Too many requirements. Too much change
- Governance is a big concern
- Still have DDOS
- We have home field advantage
- Believe we can win
Reference to Dean Kamen for doing security well in products – insulin pumps and wheelchairs [and segways]
Tool:
CertPatrol on Firefox – see what certs used
My take on this:
Good start to the conference. This situation is part of why my mother’s computer is a Chromebook. You can’t install software. If you mess up, you can easily reimage and not lose data or settngs. It’s not perfect, but it is closer.