Cooking With Technology

Secure Enough: Or Security as Threat Mitigation

My “Why I Don’t Use Antivirus” post has been receiving a recent surge of traffic, and with it, new commentors who open my eyes to how other people think. The result of my reading these comments is the conclusion that people view practices as either “secure” or “insecure,” while leaving little room in between the camps.

In this post, I’m going to introduce a concept that is hardly new, but needs more attention:

Secure Enough: The point in which the impact of an unmitigated risk is less than the effort to mitigate the risk.

Defensive computer security is not a game you can win. All it takes is one unacceptable compromise for you to lose, while offensive computer security plays with polar rules. What changes from person to person however is the definition of “unacceptable compromise.” For a home machine, it may be an attacker gaining access to information that would leave an individual financially vulnerable. For a business, it is definitely related to the goals of the business and the damage a compromise could inflict.

Because of this, every entity’s security model is going to be different, but they (should) all start with an analysis of resources and the priority with which they should be protected. Then, and only then, should layers of security be applied to a system. The reason for this?

Security applied without cause increases complexity of a system with no added benefit. [1]

Breaking it down, the steps to deciding how to secure a system are as follows:

1. Quantify the resources of a system (not forgetting privacy, damage to community, and other frequently overlooked aspects of a compromise)
2. Determine the importance of defending each resource (including cost to repair, replace, and contain the results of an attack in man hour, intellectual property, and dollar cost)
3. Determine the risk tolerance for each resource identified, independent of cost (with 0 meaning much risk tolerance, and arbitrarily high numbers conveying increasingly less risk tolerance, for the sake of this article)
4. Determine the cost of defending each resource (using the same criteria as #2, in addition to including cost to maintain the security measure)

I won’t go further into describing how to do the analysis, because every entity is going to be different with every facet. Regardless, once the three steps have been performed, deciding which security layers to apply is the result of an expression like the following: [2]

if: (importance of resource + cost of resource) * risk tolerance > (cost of implementing security measure)

then: Defend resource using security measure identified

else: Analyze less costly alternatives for defending resource, defend with blanket defense, or ignore additional defense for this resource completely

This trivially says that if the resource is important, valuable, and you cannot risk an attack on it, it will be beneficial to mitigate any risk of that resource being compromised. Alternatively, if the resource is not important, not valuable, and you can tolerate the risk of it being compromised, it may not be worth the effort to mitigate the potential security threat. Points in between become a balance of cost of and risk tolerance versus the cost of implementing a security layer to protect the resource.

This method of securing a system obviously leaves security threats that are not directly mitigated. But the idea is not to get perfect security coverage, it is to adequately cover the resources that are worth defending. Or, in other words, the goal is to be Secure Enough.

[1] Okay, maybe there is *some* benefit, but because the security layer was applied without direct cause, the potential benefit will only be realized on accident – but regardless increases the complexity of a system.

[2] I made this expression up, it is only given to convey the relationship between the involved metrics.

Storing Data in the Cloud

I want to open this up with a question posed by j9er on twitter:

j9er Taking cloud computing to its ultimate outcome, does ayone care that, say, Microsoft would have all your data? Or, Google?

My concise response: yes, I care. But the three primary reasons go beyond the 140 characters twitter would allot me.

Unrestricted Access

The big thing that keeps me from being completely comfortable with a third party storing my data for me is whether I would have unrestricted access to my data. Currently, users are even having problems with google disabling access to its user’s gmail accounts. So say Google or Microsoft have all my data, not just my e-mail and some google docs: how are they going to guarantee that I can access my data how I want, when I want, and wherever I want?

Security

Beyond that, security is an issue. On my home system or my personal servers, I can guarantee their security, as I am the sole administrator of my nodes and I am security conscious. Additionally, my personal data is not coveted by malicious hackers. The amount of effort it would take for someone to gain access to my machines externally is definitely not worth the information they would gain access to. However, when the information of millions of users is aggregated into one location, that data becomes extremely attractive. So the second question becomes: how can the company guarantee the security of the cloud, and the security of the information within? (On that note, I highly reccommend the cloudsecurity blog, where they attempt to answer these questions.)

Privacy

The last concern is one I am sure most people familiar with the topic have thought about. Storing information with an organization involves a great amount of trust, and when it is done improperly people raise their voices. (A good example is any time the CIA/NSA/FBI want to merge databases. If you do it without consent, it is an improper collection of information.) Storing information in the cloud therefore needs to be consensual, guarded well, and exposed only to the owner and applications owned by the organization, but never reviewed by humans, and with all personally identifying information scrubbed.  The final question therefore is: how can the organization storing my data guarantee my personal privacy?

I care about my data. Especially who has it, who may have access to it, and how it may be used to identify me. Until the questions can be answered and those guarantees made, I won’t be comfortable storing all my data in the cloud.