Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!usc!elroy.jpl.nasa.gov!sdd.hp.com!uakari.primate.wisc.edu!zaphod.mps.ohio-state.edu!caen!news.cs.indiana.edu!rutgers!cmcl2!adm!news From: JRAMSDEN@wl7.prime.com Newsgroups: comp.unix.wizards Subject: (none) Message-ID: <26865@adm.brl.mil> Date: 13 May 91 10:09:19 GMT Sender: news@adm.brl.mil Lines: 54 Subject: OS security. To: (unix-wizards@sem.brl.mil) From: John Ramsden (jramsden@wl7.Prime.Com) Date: 13 May 91 11:02 AM I would have thought the easiest way to minimize the impact of the sort of OS security problems being discussed would be first to offer a substantial reward (say in the $100,000 range) for any demonstrable bug or oversight which allows security to be compromised. This would be a practical incentive for hard-up students to keep an eye out for them and, if one was found, to keep dead quiet about it and alert the prize committee (CERT or whoever) ASAP. All these responses would help contain the problem. Of course all sorts of things would have to be thought through, like ensuring that people working on OSs didn't deliberately introduce subtle bugs (or ignore existing ones they spotted) and later claim the prize (possibly with the aid of a collaborator) on the basis of those bugs. No doubt other readers will think of related issues, such as how to share the prize between independent discoverers, and I'll be very interested to hear them. Quite possibly there's some devastating observation that makes the whole scheme unworkable :-( Apart from the prize, a twin track approach should be to define some form of OS certification defining required minimum clear-up times for notified security problems, and notification of users to encourage upgrades (or compel them as a condition of maintenance contracts). Ensuring prompt upgrades is probably the main difficulty at present, especially in the high-volume and therefore low-support markets which are around now. In twenty years or so most OS upgrades will no doubt be done transparently via a comms channel (although think of the scope for abuse there would be in a security breach of a mechanism like that !). ------------------------------------------------------------------------ John R Ramsden | The hen is a noble beast, (jramsden@wl7.Prime.Com) | but the cow is much forlorner Prime Computer Inc. | as it stands in the rain Framingham, Mass. | with a leg at each corner. | W McGonnegal (19th C Scottish poet) ------------------------------------------------------------------------ EMPHATIC DISCLAIMER: The opinions expressed or implied in this posting are those of the author and don't necessarily represent those of Prime or its affiliates. ANOTHER ONE JUST IN CASE: In case you're a speed reader, who tries to take in paragraphs at a glance (not such a bad system when ploughing through unix.wizards :-), THE ABOVE IS NOT A PRIZE ANNOUNCEMENT !!