Information Assurance Technology Forecast 2008

A virtual roundtable (featuring panelists Steven Bellovin, Terry Benzel, Bob Blakely, Dorothy Denning, Whitfield Diffie, Jeremy Epstein, and Paulo Verissimo) discussing the next 15 years in computer security.     

DRM, Complexity, and Correctness

Steve Bellovin looks at the complex code behind Microsoft Vista and its DRM mechanisms. Increased amounts of code add to insecurity, but the real danger with DRM is with increased interaction among different pieces of code. A lot of new mechanisms have been introduced; more seriously, a lot of new communications paths and dependencies have been introduced. Worst of all, these paths and mechanisms are solving a new problem, one with which the profession has very little experience. Did Microsoft get it right?     

On the Brittleness of Software and the Infeasibility of Security Metrics

How secure is a computer system? Bridges have a load limit, but it isn't determined (as "Calvin and Hobbes" would have it) by building an identical bridge and running trucks over it until it collapses. In a more relevant vein, safes are rated for how long they'll resist attack under given circumstances. Can we do the same for software?     

Configuration management and security

Proper configuration management is vital for host and network security. We outline the problems, especially for large-scale environments, and discuss the security aspects of a number of different configuration scenarios, including security appliances (e.g., firewalls), desktop and server computers, and PDAs. We conclude by discussing research challenges.     

The Government and Cybersecurity

We all realize that computer security is a serious problem. But who should solve it? More precisely, who should be responsible for coping with computer insecurity - governments or the private sector? To some extent, the answer depends on how we view the problem. This installment of ClearText aims to get to the bottom of it.     

Seers and Craftspeople

Columnist Steve Bellovin discusses the need to judge new ideas more by their potential, and less by what they leave unsolved.     

Unconventional Wisdom

We are told that passwords are evil. We are told to change our passwords frequently, and never, never to write them down. We are even told that if you work for most U.S. corporations, frequent password changes are required by law. How much of this is true, and how much is simply mythology? Remarkably enough, the conventional wisdom can be wrong on all of these points, even the first.     

Security by Checklist

We've all seen the checklists with suggestions for how to secure your system. Many of us have even written them. (I have.) The problem is that security is more complicated than that, and checklists—especially if followed slavishly or enforced without thought—can make matters worse.     

Network and Internet Security

Abstract

One of the author's clients dismissed the possibility of a network sniffer attack. He said, “Network sniffers are not a concern. They cost $20,000 or more, so hackers cannot afford one.” He was wrong because there are many network sniffers that cost much less than $20,000. For example, there are free or almost free sniffers for the IBM PC with MS-DOS. Plus there are many sniff- ers for Windows 95, Windows NT, UNIX, and even hand-held computers. These sniffers are powerful and can capture user IDs and passwords or possibly confidential data from a network.     

Security and Privacy: Enemies or Allies?

We show ID cards at every juncture. Is this necessary? Is it helpful? Or is it actually harmful, not just to our privacy but to security as well?