Path: utzoo!utgpu!watmath!clyde!bellcore!faline!sword!arrow!yba
From: yba@arrow.bellcore.com (Mark Levine)
Newsgroups: news.sysadmin
Subject: Re: Two digit security IQs in action
Message-ID: <928@sword.bellcore.com>
Date: 9 Nov 88 17:16:33 GMT
References: <361@itivax.UUCP> <367@execu.UUCP> <1294@tmpmbx.UUCP> <2517@cs.Buffalo.EDU> <16653@agate.BERKELEY.EDU>
Sender: news@sword.bellcore.com
Reply-To: yba@sabre.bellcore.com (Mark Levine)
Organization: Bellcore, Red Bank, NJ
Lines: 36
Followup-To:

[weemba says the whole point of the worm discussion is "learning nothing"]

I stand amazed at the high pedestal we make for computers.  Gee, did you
know that locks can be picked?  That the front door of your house can be
kicked in?  Your car can be stolen?  Your bank vault robbed?

There is nothing wrong with security, but in the last analysis it always
becomes an economic problem, and absolute security is prohibitively
expensive.  Every time I see a burglary reported in the press I do not
expect to replace the glass windows in my house with bullet-proof plastic
nor will I run out and replace all the wood with steel and concrete.  By
the same token I will not begin to divert all my resources from applications
to improving the reliability of network services in my operating system.

This seems rational, and does not excuse a failure to do maintenance when a
serious problem is exposed and a free patch supplied.

For rational people, the law is a part of raising the cost of sociopathic
behavior like killing and loosing tapeworms onto the network.  Where
accidental it is still "manslaughter" as opposed to "murder" in that the
act did damage, even if not premeditated nor intentional.  Making a hero
of the guy who breaks into your house and shoots your dog, because it suddenly
illuminates the fact that hiring a security patrol might be a good idea, is
not something I want you to do.

If nothing has been learned, it is certainly in the column under "computers
are not different than other spheres of human activity" -- is it not so?
We know our systems are imperfect, but also that they are usable.  I submit
that if an admin wants to bet the 8 hours of restoring bug-infested system
from scratch against the years of vetting every piece of software he sees,
that is not necessarily a bad choice.  If you have much more valuable data
you cannot see disrupted, get off internet, or consult your actuarial tables
for the bet you can lay.

Eleazor bar Shimon, once and future Carolingian
yba@sabre.bellcore.com