Wednesday, December 21, 2005

Security Orientation

Adam Shostack identifies Three Views of Software Security, which he calls orientations. So I wondered whether these could be mapped onto the four types of trust and mistrust, and whether that reveals a fourth orientation. But the mappings turned out to be a little more complex.

Typical assessmentType of Trust
Assurance of quality, reliability, safety, and appropriateness for use Commercial security products aren't good enough to be used. We are losing the security war.
Authority+Network: We are not getting adequate assurances of security - neither from centralized guarantors, or from the emergent power of the network.
Tools and techniques of exploration and exploitation at the micro and macro levels Unwilling to confer a positive evaluation on any product or technology vendor (especially Microsoft).
Commodity+Authentic: We hackers can usually engage more deeply with the product than the vendors themselves.
People are behaving rationally, if only we can understand their motivations Few people ask whether products are secure, so there is little explicit demand for security. Commodity+Network: Security (or its lack) emerges from the combined behaviour of rational actors.

There are several other possible permutations, but the orientation I want to encourage is based on Network+Authentic - combining a deep engagement with the (focal) practices of technical security with a broad and dynamic social base (process-driven, community-driven). Next question: how can we foster this orientation?

Technorati Tags: