Balancing security and functionality is nothing new. But is there a way to fairly allocate the security costs to the users who benefit from the functionality? We ask the LinuxWorld OpenSolutions Summit keynote speaker Bruce Schneier.
LinuxWorld: Why don’t companies buy more secure software, or at least why don’t they buy less insecure software?
Schneier: You know those of us in the security industry have been wringing our hands over that question for years, for decades. Why don’t they do it? There are a couple of reasons. The first is — it’s sometimes hard to tell what a secure product is. I can hold up two products; they use the same buzzwords. They have the same protocol standards. What is secure, and what isn’t? And you don’t know. And these might be security products. These might be networking products or office products. It’s very hard to tell what a secure product is and what an insecure product is. That’s reason one.
The second reason, companies actually don’t want to be secure, that’s wrong. They want to be secure, but it’s more important to be able to do things. So, installing a firewall, which would make you a lot more secure, a company is going to configure it pretty much open because it allows them to do peer-to-peer file sharing or use this application or do that or check their mail from afar — all those things they want to do that go against security. So, when security goes against functionality, it often loses, especially at the high level. You can tell a lowly employee to be secure, but you’re not going to tell the CEO. That’s the second reason.
The third reason is that a lot of the insecurities we see don’t affect the company at the boardroom level. A worm and a virus attack, which might make all the tech staff scramble and work without sleep for 15 hours, the CEO doesn’t see. He doesn’t care. As far as he’s concerned that worked out great. Why bother spending? So, you have a whole lot of factors in play. It’s not that companies don’t want to be secure; it’s that they either don’t care or don’t know how or don’t understand they’re not.
LinuxWorld: So, if you’ve got, say a marketing department that asks for some big Web application to be installed, and then it turns out there’s a security issue with that, whoever is the “security person” inside the company ends up cleaning up that mess.
Schneier: And the security people know that. I mean if you say no too often, the marketing department is going to go around you. If you say no wireless, someone is going to stick an access point in. If you say no BlackBerry, someone is going to forward their mail to Google, and then get it from there. As a security officer, you’re in a very tough position of basically having to allow what the employees want to do and doing the best you can. Now, that’s not necessarily bad. If you think about it, security is there to make the company safe while it’s in business. If the company can’t do the things it wants to do, then the security is irrelevant. So, I’ll give you an easy example. And you go to Amazon.com, and you buy books, you can use a secure server. You can use SSL. You could also choose not to. And if you click on, “don’t use a secure server,” you know what Amazon does? They sell you the book anyway. They realize that even though it’s less secure, it is still good business for them to sell the books. There’s an example of the business process taking precedence over security. I mean there are some things you should never do, but in general security doesn’t win when it goes against what the company wants to do as a company.
LinuxWorld: So, is there any way to allocate security costs onto the departments that are asking for and receiving the benefits of possibly insecure things?
Schneier: That’s the trick. And I think you have to do that. I mean just like many companies pass IT on to the different departments and have interdepartmental accounting, they could also pass security. If the marketing department decides that it wants to have a new application that punches a new hole into the firewall, and maybe it’s good, and maybe it isn’t, you could say to the department, ‘This is what it is going to cost you, and the cost will be higher because of increased insecurity.’ That can work pretty well for some things. For some things it won’t. If you’re worried about the corporation as a brand, if you’re worried about a network breach that will put the company on the front page of the newspaper, you really can’t allocate that to a department because it’s a very, very great cost, and it affects the entire company. You have one department putting the entire company in jeopardy. So, it’s harder to do that kind of economic thinking. But you’re on the right track. We need to think about it economically.
LinuxWorld: Does security always have to be a cost center, or is there some top line benefit that a company could get from having a reputation for better security?
Schneier: Security is always a cost center, but it allows for benefits. So, for example, the telephones in a company are always a cost center. Yet without the telephones, you couldn’t make sales. You couldn’t make profits. Security will be a cost center — again, let’s take Amazon as an example — their Web security is a cost center, but without it, they can’t sell books. They can’t make money. So, security does cost, but security facilitates better things. If you have good security, you can do things that maybe your competitors can’t. It is always looked myopically — it’s a cost. But you look at it in the broader context, it’s a benefit that allows the company to do things it couldn’t do otherwise.
LinuxWorld: In your upcoming talk at Linux World Open Solutions Summit on Feb. 14, you’re going to be talking about the economics of Internet security, and I noticed in the announcement that you’d be looking at it from the attackers’ point of view, too. What’s an attacker doing to maximize return on investment, and should security people be paying special attention to those types of attacks?
Schneier: I think they should. If you think about it, an attacker goes through an economic decision just like a defender. An attacker is spending time, an attacker is spending time, money, risk — the risk of capture — for some attackers, death, if you’re thinking of a terrorist. And this attacker wants to maximize his return on investment. And that might be money in the case of a criminal. It might be deaths in the case of a terrorist. Depending on whether it’s organized crime or a loan criminal, they’ll have different resources they can expend.
You have to look at the attacker as a capitalist; as someone who is trying to get the best return on his investment. And this isn’t to excuse him or to figure out why it’s OK, but if you don’t understand your attackers’ motivations, you’ll never defend yourself. For example, the kind of defenses we might put in place for a fraudster, a criminal trying to get money, is very different than the kinds of defenses you put in place against a hacker who wants to deface your Web site and look cool. Those attackers have different goals. They have different resources. They have different levels of risk they’re willing to tolerate, and they’re not the same, and the defenses won’t be the same.
LinuxWorld: Does it make sense to have somebody on your security team or within your company play the role of an attacker in a what-if scenario?
Schneier: You certainly have to
