When it comes to protecting the end user, the information
security community is awash with technologies and options. Yet, despite the
near endless array of products and innovation focused on securing that end user
from an equally broad and expanding array of threats, the end user remains more
exposed and vulnerable than at any other period in the history of personal
computing.
Independent of these protection technologies (or possibly
because of them), we’ve also tried to educate the user in how best (i.e. more
safely) to browse the Internet and take actions to protect themselves. With a
cynical eye, it’s almost like a government handing out maps to their citizens
and labeling streets, homes, and businesses that are known to be dangerous and
shouldn’t be visited – because not even the police or military have been
effective there.
Today we instruct our users (and at home, our children) to
be careful what they click-on, what pages or sites they visit, what information
they can share, and what files they should download. These instructions are not
just onerous and confusing, more often than not they’re irrelevant – as, even
after following them to the letter, the user can still fall victim.
The fact that a user can’t click on whatever they want,
browse wherever they need to, and open what they’ve received, should be
interpreted as a mile-high flashing neon sign saying “infosec has failed and
continues to fail” (maybe reworded with a bunch of four-letter expletives for
good measure too).
For decades now thousands of security vendors have brought
to market technologies that, in effect, are predominantly tools designed to
fill vulnerable and exploited gaps in the operating systems lying at the core
of devices the end users rely upon. If we’re ever to make progress against the
threat and reach the utopia of users being able to “carelessly” using the
Internet, those operating systems must get substantially better.
In recent years, great progress has been made in the OS
front – primarily smartphone OS’s. The operating systems running on our most
pocket-friendly devices are considerably more secure than those we rely upon
for our PC’s, notebooks, or servers at home or work. There’s a bunch of reasons
why of course – and I’ll not get in to that here – but there’s still so much
more that can be done.
I do believe that there are many lessons that can be learned
from the past; lessons that can help guide future developments and
technologies. Reaching back a little further in to the past than usual – way before
the Internet, and way before computers – there are a couple of related events
that could shine a brighter light on newer approaches to protecting the end
user.
Back in 1850 a Hungarian doctor named Ignaz Semmelweis was
working in the maternity clinic at the General Hospital in Vienna where he
noted that many women in maternity wards were dying from puerperal fever -
commonly known as childbed fever. He studied two medical wards in the hospital –
one staffed by all male doctors and medical students, and the other by female
midwifes – and counted the number of deaths in each ward. What he found was
that death from childbirth was five times higher in the ward with the male
doctors.
Dr. Semmulweis tested numerous hypothesis as to the root
cause of the deadly difference – ranging from mothers giving birth on their
sides versus their backs, through to the route priests traversed the ward and
the bells they rang. It appears that his Eureka moment came after the death of
a male pathologist who, upon pricking his finger while doing an autopsy on a
woman who had died of childbed fever, had succumbed to the same fate
(apparently being a pathologist in the mid-19th century was not conducive
to a long life). Joining the dots, Dr. Semmulweis noted that the male doctors
and medical students were doing autopsies while the midwifes were not, and that
“cadaverous particles” (this is a period of time before germs were known) were
being spread to those birthing mothers.
Dr. Semmulweis’ medical innovation? “Wash your hands!” The
net result, after doctors and midwifes started washing their hands (in lime
water, then later in chlorine), was that the rate of childbed fever dropped
considerably.
Now, if you’re in the medical trade, washing your hands multiple
times per day in chlorine or (by the late 1800’s) carbolic acid, you’ll note
that it isn’t so good for your skin or hands.
In 1890 William Stewart
Halsted of Johns Hopkins University asked the Goodyear Tire and Rubber
Company if they could make a glove of rubber that could be dipped in carbolic
acid in order to protect the hands of his nurses – and so was born the first
sterilized medial gloves. The first disposable latex medical gloves were
manufactured by Ansell and didn’t appear until 1964.
What does this foray in to 19th century medical
history mean for Internet security I hear you say? Simple really, every time
the end user needs to use a computer to access the Internet and do work, it
needs to be clean/pristine. Whether that means a clean new virtual image (e.g. “wash
your hands”) or a disposable environment that sits on top of the core OS and
authorized application base (e.g. “disposable gloves”), the assumption needs to
be that nothing the user encounters over the Internet can persist on the device
they’re using after they’ve finished their particular actions.
This obviously isn’t a solution for every class of cyber
threat out there, but it’s an 80% solution – just as washing your hands and
wearing disposable gloves as a triage nurse isn’t going to protect you (or your
patient) from every post-surgery ailment.
Operating system providers or security vendors that can seamlessly
adopt and automatically procure a clean and pristine environment for the end
user every time they need to conduct activities on or related to the Internet
will fundamentally change the security game – altering the battle field for
attackers and the tools of their trade.
Exciting times ahead.
-- Gunter
No comments:
Post a Comment