Network World
Saturday, November 22, 2008
DNSstuff.com
Get information about your IP
IP Information
50+ On-demand DNS and network tools

Community: Security

Navigation

RE: Howard Schmidt patrols cyberspace

Gut reaction OK?

I think someone who has been on the “public tit” (politcially correctness aside)for as long as Mr. Schmidt has is not the best guy to throw at the challenges we now face. We need a new paradigm to protect what we have created from all foes driven by money and political will. We are at risk now big time, and out of the box thinking is required, not the “same old same old”. That means inventing predictive systems that reconize new threats, and counter acts that threat in a autonomic way.

Click to read the article this is in response to.

The problem of working within a system

0

One of the books I read a while back made a really good point: all the security devices and methods work "within the system". They assume that things "play by the rules". If we just enforce the rules then all will be good with the world. This is what I refer to as the "administrator's (or lawyer's) viewpoint". Make a rule; everyone follows the rule; no problem.

The trouble is hackers and those with malevolent intent do not play by the rules. Just as Morpheus tried to teach Neo about the Matrix and what rules could be broken, hackers find creative ways around the rules. They view the world through a different set of filters than do administrators. They don't look for ways to play within the rules, they look for ways around them. For the best of the hackers, persistence and creativity do wonders in helping them achieve their objectives: a key that lets them pass.

The point of all this is simple: we need the best creative minds of technically savvy people to look for ways to find keys. Firewalls, IDSes, IPSes and all that security "stuff", so necessary on a day-to-day basis, are all "administrator" tools. They work within the system. We need things to test and probe our networks and systems in ways not yet imagined, in ways not intended by these systems' designers. Until we learn to see things through more than our current paradigm, we will continue to be subject to more and more inventive hacks.

BTW, it is a good book.

Don't knock it

0

Mr. Ingram's comments indicate two things: First, he read the article incorrectly. It is about history and lessons learned. Maybe if you ask Mr. Schmidt really politely, he will write about "predictive systems that reconize new threats, and counter acts that threat in a autonomic way."

Second, Mr. Schmidt's biography indicates he has not worked on just the "public tit", but as the "chief information security officer and chief security officer for Microsoft", and held a top security job at eBay.

Calling government service the "public tit" is all well and good, but we all get paid by someone's "tit", whether it be the corporate "tit" as an employee, the customer's "tit" as an entrepreneur, or by daddy's "tit", if we live on an inheritance. Perhaps the lessons learned here for Mr. Ingram are : "Lessons Learned refers to the past tense (weren't you listening in first grade English?) , and don't knock the "tit", no matter whose it is.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Post new comment

The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <a> <em> <strong> <i> <b> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <blockquote> <br /> <br> <p>
  • Lines and paragraphs break automatically.
  • You can use BBCode tags in the text.
  • Web page addresses and e-mail addresses turn into links automatically.

More information about formatting options

CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.

Advertisement: