- Spam, and Other Problems with Email
- Hostile Code
- Security Breaches
- Identity and the Theft of Identity
- Should We Just Start Over?
- The Need for a New School
This chapter is from the book
This chapter is from the book
This chapter is from the book
Should We Just Start Over?
Describing the many failings of information security could easily take an entire book. We have described only some of the most visible problems. Given the nature of these issues, perhaps we should consider the radical step of rebuilding our information technologies from the ground up to address security problems more effectively.
The challenge is that building complex systems such as global computer networks and enterprise software is hard. There are valid comparisons to the traditional engineering disciplines in this respect. Consider the first bridge built across the Tacoma Narrows in Washington state. It swayed violently in light winds and ultimately collapsed because of a subtle design flaw. The space shuttle is an obvious example of a complex system within which minor problems have resulted in catastrophic outcomes. At the time this book was written, the Internet Archive project had 85 billion web objects in its database, taking up 1.5 million gigabytes of storage. During the 1990s, such statistics helped people understand or just be awed by the size of the internet, but the internet is undoubtedly one of the largest engineering projects ever undertaken. Replacing it would be challenging.
Even if we “just” tried to recreate the most popular pieces of computer software in a highly secure manner, how likely is it that no mistakes would creep in? It seems likely that errors in specification, design, and implementation would occur, all leading to security problems, just as with other software development projects. Those problems would be magnified by the scale of an effort to replace all the important internet software. So, after enormous expense, a new set of problems would probably exist, and there is no reason to expect any fewer than we have today, or that they would be any easier to deal with.
Much of the usefulness of the internet comes from its open-platform nature that allows new ideas to be developed and incubated. The ability of people to invent the world wide web, instant messaging, and internet telephony stems in part from limited (if any) restrictions on who can do what. Imagine if Internet Service Providers (ISPs) were required by law to collect and keep copies of passports from their customers, or if an official “internet certification board” had to approve new software. The rate at which individuals came online and at which new products were brought to market would be substantially slower. The internet’s success depends to a large degree on an open philosophy, which in turn requires accepting a certain amount of insecurity.
In recognizing this reality—that security threats and vulnerabilities will always exist—the question becomes, how efficient and effective can we make our response to those security challenges? If we are not making good decisions today, why not? Creating balanced solutions requires that we understand the true nature of problems. We need good information with which to make the right decisions.