State of Security - 2006

Dan Farber reports on the state of CyberSecurity in 2006 at Demo.

I have my own State of Security speach in mind.....

My Friends, we the state of CyberSecurity is very weak.

Our mainstream Operating Systems ignore research from the 1960s and 70s and persist in using a broken security model.

Our OS vendors worry about features and PR instead of security

Our users have grown accustomed to repeatedly being threatened with weapons of mass destruction which would not be possible with a secure computing model.

We face many threats, the largest of which are inerta, and our own mass ignorance.

The solutions offered are inadequate at best, and only a temporary measure.

Virus scanners and network filters won't work.

Security updates won't work.

Signed code won't work.

Managed code won't work.

"Trusted Computing" won't work.

Teaching students to write "secure programs" won't work (but it will help for other reasons)

Locking existing OSs down is only a stopgap.

The good news is that there are measures that will work. (see note below)

So you see, the day will come when We don't have to be afraid.

We will build operating systems that are fast, stable and secure. We'll be able to run any program from anyone, without fear. We'll be able to experiment and mix and match programs like never before.

The road ahead won't be easy. There will be miles to go, and may large challenges to meet, but we will get there. We will eliminate the need for virus scanners and anti-spyware programs. A pleasant side-effect will be the complete prohibition of DRM.

Please join me in my goal is to see a secure OS by 2010. Let's make it free and open source.


--Mike--

How? Here's how:
The key to security is to lock every application in a virtual machine. Now that both Intel and AMD seem to have realized just how important it is to be able to do real virtualization, this will radically drive down the cost of implementing a virtual machine, in terms of code, and especially performance.

We went through all these lessons with IBM's VM systems back in the 1960s and 1970s. You can't trust anything that isn't the operating system kernel and the hardware. And you can only trust them if they get see a lot of use and get watched like a hawk by the good guys.