trends in cybersecurity

[coderman]

On Mon, Dec 2, 2013 at 8:11 PM,  <dan at geer.org> wrote:
>...
> Trends in Cyber Security
> http://geer.tinho.net/geer.nro.6xi13.txt

thought provoking read, as always. thanks Dan :)

this is worth posting whole, particularly this observation:
"""
... polarization has come to cyber
security.  High end practice is accelerating away from the low end.
The best skills are now astonishingly good while the great mass of
those dependent on cyber security are ever less able to even estimate
what it is that they do not know, much less act on it.  This
polarization is driven by the fundamental strategic asymmetry of
cyber security, namely that while the workfactor for the offender
is the incremental price of finding a new method of attack, the
workfactor for the defender is the cumulative cost of forever
defending against all attack methods yet discovered.  Over time,
the curve for the cost of finding a new attack and the curve for
the cost of defending against all attacks to date must cross.  Once
those curves cross, the offender never has to worry about being out
of the money.  That crossing event occurred some time ago.
"""


i do have one comment, per:

"""
Everyone my age working in cyber security was trained for something
else, and because of that switch between one field and another
brings along the hybrid vigor of seeing the cyber security world
through a different lens.
"""

instead of having a "cyber security" profession, all aspects of
"information security", "software security", or "cyber security" as a
specialization should not exist.  competence and experience with these
subjects should be considered part of routine software and systems
development practice. (right now this is mostly impractical, however,
it need not always be so...)


best regards,



--- cut-for-posterity ---


.Trends in Cyber Security
.Dan Geer, 6 November 13, NRO

Thank you for the invitation to speak with you today, which, let
me be clear, is me speaking as myself and not for anybody or anything
else.  As you know, I work the cyber security trade, that is to say
that my occupation is cyber security.  Note that I said "occupation"
rather than "profession."  On 18 September, the U.S. National Academy
of Sciences, on behalf of the Department of Homeland Security,
concluded that cyber security should be seen as an occupation and
not a profession because the rate of change is too great to consider
professionalization.[1]  You may well agree that that rate of change
is paramount and thus why cyber security is the most intellectually
demanding occupation on the planet.  In writing this essay, I will
keep my comments to trends rather than point estimates, just as you
asked in your invitation, but let me emphasize the wisdom of your
request by noting that the faster the rate of change, the more it
is trends that matter and not the value of any given variable at
any given time.  With luck, each of these trends will not be something
that you would argue with as a trend.  Argument, if any, will be
in their interpretation.

Note also that these trends do not constitute a set of mutually
exclusive, collectively exhaustive characterizations of the space
in which we live and work.  Some of them are correlated with others.
Some of them are newly emergent, some not.  Some of them are
reversible to a degree; some not reversible at all.  I am not, today
anyway, looking for causality.

Trend #1: Polarization

Much has been written about the increasing polarization of American
life.[2]  The middle is getting smaller whether we are noting that
only the middle class is shrinking, that it is the middle of the
country that is depopulating, that the political middle is lonelier
and lonelier, that both farms and banks are now only too small to
matter or too big to fail, that almost all journalism is now advocacy
journalism, that middle tier college education is a ticket to debt
and nothing else.

I submit that this trend towards polarization has come to cyber
security.  High end practice is accelerating away from the low end.
The best skills are now astonishingly good while the great mass of
those dependent on cyber security are ever less able to even estimate
what it is that they do not know, much less act on it.  This
polarization is driven by the fundamental strategic asymmetry of
cyber security, namely that while the workfactor for the offender
is the incremental price of finding a new method of attack, the
workfactor for the defender is the cumulative cost of forever
defending against all attack methods yet discovered.  Over time,
the curve for the cost of finding a new attack and the curve for
the cost of defending against all attacks to date must cross.  Once
those curves cross, the offender never has to worry about being out
of the money.  That crossing event occurred some time ago.

I'll come back to this first bullet at the end, but I mention it
first as polarization is becoming structural and of all the trends
the most telling.  You can confirm this by asking the best cyber
security people what they do on the Internet and what they won't
do on the Internet.  You will find it sharply different than what
the public at large does or will do.  The best people know the most,
and they are withdrawing, they are rejecting technologies.  To use
the words and style of the Intelligence Community, they are
compartmentalizing.

Trend #2: Trends themselves

The idea that under the pressure of constant change about all you
can measure is the slope of the curve has gone from
don't-bother-me-with-math to everybody's-doing-it.  A Google search
for the phrase "information security trends" turns up 13,400 hits
and no two of the top ten are from the same source.  Consultancies
talk about what they are seeing in the back room, product vendors
talk about evolving needs, and reporters talk about what they are
seeing out on the street.

I am one of those folks.  A Wall Street colleague and I run the
Index of Cyber Security.[3]  The ICS is what is called a sentiment-based
index; if you are familiar with the US Consumer Confidence Index,[4]
then you already know what a sentiment-based index is.  Respondents
to the ICS are top drawer cyber security practitioners with direct
operational responsibility who share, each month, how their view
of security in several areas has changed since the month before.
Because there are no absolutes in cyber security, not even widely
agreed upon definitions of the core terms that make up cyber security
practice, a sentiment-based Index is, in fact, the best decision
support that can be done.

The Index asks the respondents monthly whether each of two dozen
different risks has gotten better, gotten worse, gotten a lot better,
gotten a lot worse, or stayed the same since the month before.  Out
of this, the Index of Cyber Security is calculated and released at
6pm on the last calendar day of the month, in further similarity
to the Consumer Confidence Index.  We write an analytic annual
report that I have given to the organizers for your further reading.
As an index of risk, a higher ICS number means higher risk.  That
risk number has risen, and seems likely to continue to rise.  It
is a composite trend line, but what is more interesting is that the
components of the risk are much more varied, i.e., what is the
dominating risk one month may not be the next.  We think that this
captures, in part, the dynamic nature of cyber security and does
so in a way not otherwise being done.  Respondents seem to agree
that the ICS does offer decision support to front-line people such
as themselves.

Trend #2, then, is that there is increasingly wide acceptance that
absolute measures are not worth seeking and a kind of confirmation
that cyber security is a practice, not a device.

Trend #3: Physics and its impact on data

As you well know, more and more data is collected and more and more
of that data is in play.  The general, round-numbers dynamic of
this trend are these: Moore's Law continues to give us two orders
of magnitude in compute power per dollar per decade while storage
grows at three orders of magnitude and bandwidth at four.  These
are top-down economic drivers and they relentlessly warp what is
the economically optimum computing model.  The trend is clear; the
future is increasingly dense with stored data but, paradoxically,
despite the massive growth of data volume, that data becomes more
mobile with time.

As is obvious, this bears on cyber security as data is what cyber
security is all about.  In 2007, Jim Gray gave a seminal talk[5]
about the transformation of science, coining the term "fourth
paradigm."  By that he meant that the history of science is that
science began as an endeavor organized around empirical observation.
After that came the age of theory -- theorizing as the paradigm of
what science did.  Then science became computational, again meaning
that the paradigm of what science did was to calculate.  His argument
for a fourth era was that of a paradigm shift from computational
science to data intensive science.  You here at NRO need no primer
on the power of that shift in paradigm, but I am here to tell you
that cyber security is embracing that fourth paradigm and it is
doing it now.

Ecology professor Philip Greear would challenge his graduate students
to catalog all the life in a cubic yard of forest floor.  Computer
science professor Donald Knuth would challenge his graduate students
to catalog everything their computers had done in the last ten
seconds.  It is hard to say which is more difficult, but everywhere
you look, cyber security practitioners are trying to get a handle
on "What is normal?" so that that which is abnormal can be identified
early in the game.  Behavioral approaches leading towards intrusion
detection are exactly the search for anomaly, and they are data
based.  The now-famous attack on RSA Data Security that led to RSA
buying Net Witness is an example of wanting to know everything so
as to recognize something.  I'm on the record at book length [6]
that the central organizing principle behind a competent security
program is to instrument your data sufficiently well that nothing
moves without it being noticed.  Physics has made it possible to
put computers everywhere.  Physics has made it possible to fill
them all with data.

Cyber security is barely keeping up, and not just because of two,
three, or four orders of magnitude in the physics upstream of the
marketplace.

Trend #4: Need for prediction

We all know that knowledge is power.  We all know that there is a
subtle yet important distinction between information and knowledge.
We all know that a negative declaration like "X did not happen" can
be only proven if you have the enumeration of *everything* that did
happen and can show that X is not in it.  We all know that a stitch
in time saves nine, but only if we know where to put the stitch.
We all know that without security metrics, the outcome is either
overspending or under protecting.

The more technologic the society becomes, the greater the dynamic
range of possible failures.  When you live in a cave, starvation,
predators, disease, and lightning are about the full range of
failures that end life as you know it and you are well familiar
with all of them.  When you live in a technologic society where
everybody and everything is optimized in some way akin to just-in-time
delivery, the dynamic range of failures is incomprehensibly larger
and largely incomprehensible.  The wider the dynamic range of
failure, the more prevention is the watchword.  As technologic
society grows more interdependent within itself, the more it must
rely on prediction based on data collected in broad ways, not
targeted ways.

Some define risk as the probability of a failure times the cost of
that failure.  To be clear, a trend in favor of making predictions
is a trend subsidiary to a trend in the cost of failure.  I've
written at length elsewhere about how an increasing downside cost
of failure requires that we find ways to be resilient, but not
resilient in the sense of rich redundancy, not resilient in the
sense of having quick recovery mechanisms, but resilient in the
sense of having alternate primary means that do not share common
mode risks.  As such, I strongly recommend that manual means be
preserved wherever possible because whatever those manual means
are, they are already fully capitalized and they do not share common
mode risk with digital means.

There is now more information security risk sloshing around the
economy than could actually be accepted were it exposed.  The
tournament now turns to who can minimize their risk the best, which,
in the civilian economy at large, means who can most completely
externalize their downside information security costs.  The weapons
here are perhaps as simple as the wisdom of Delphi, "Know thyself"
and "Nothing to excess" -- know thyself in the sense of quantitative
rigor and a perpetual propensity to design information systems with
failure in mind; nothing to excess in the sense of mimicking the
biologic world's proof by demonstration that species diversity is
the greatest bulwark against loss of an ecosystem.

Trend #5: Abandonment

If I abandon a car on the street, then eventually someone will be
able to claim title.  If I abandon a bank account, then the State
will eventually seize it.  If I abandon real estate by failing to
remedy a trespass, then in the fullness of time adverse possession
takes over.  If I don't use my trademark, then my rights go over
to those who use what was and could have remained mine.  If I abandon
my spouse and/or children, then everyone is taxed to remedy my
actions.  If I abandon a patent application, then after a date
certain the teaching that it proposes passes over to the rest of
you.  If I abandon my hold on the confidentiality of data such as
by publishing it, then that data passes over to the commonweal not
to return.  If I abandon my storage locker, then it will be lost
to me and may end up on reality TV.  The list goes on.

Apple computers running 10.5 or less get no updates (comprising
about half the installed base).  Any Microsoft computer running XP
gets no updates (comprising about half the installed base).  The
end of security updates follows abandonment.  It is certainly ironic
that freshly pirated copies of Windows get security updates when
older versions bought legitimately do not.

Stating the obvious, if Company X abandons a code base, then that
code base should be open sourced.  Irrespective of security issues,
many is the time that a bit of software I use has gone missing
because its maker went missing.  But with respect to security, some
constellation of {I,we,they,you} are willing and able to provide
security patches or workarounds as time and evil require.

Would the public interest not be served, then, by a conversion to
open source for abandoned code bases?  But wait, you say, isn't
purchased software on a general purpose computer a thing of the
past?  Isn't the future auto-updated smartphone clients transacting
over armored private (carrier) networks to auto-updated cloud
services?  Maybe; maybe not.  If the two major desktop suppliers
update only half of today's desktops, then what percentage will
they update tomorrow?

If you say "Make them try harder!," then the legalistic, regulatory
position is your position, and the ACLU is already trying that
route.  If smartphone auto-update becomes a condition of merchantability
and your smartphone holds the keying material that undeniably says
that its user is you, then how long before a FISA court orders a
special auto-update to *your* phone for evidence gathering?

If you say "But we already know what they're going to do, don't
we?," then the question is what about the abandoned code bases.
Open-sourcing abandoned code bases is the worst option, except for
all the others.  But if seizing an abandoned code base is too big
a stretch for you before breakfast, then start with a Public Key
Infrastructure Certifying Authority that goes bankrupt and ask "Who
gets the keys?"

Trend #6: Interdependence

The essential character of a free society is this: That which is
not forbidden is permitted.  The essential character of an unfree
society is the inverse, that which is not permitted is forbidden.
The U.S. began as a free society without question; the weight of
regulation, whether open or implicit, can only push it toward being
unfree.  Under the pressure to defend against offenders with a
permanent structural advantage, defenders who opt for forbidding
anything that is not expressly permitted are cultivating a computing
environment that does not embody the freedom with which we are
heretofore familiar.

Put concretely, the central expression of a free society is a free
market, and the cardinal measure of a free market is the breadth
of real choice -- choice that goes beyond color and trim and body
style to choices that optimize discordant, antithetical goal states.
The level of choice on the Internet is draining down.  You may revel
in the hundreds of thousands of supposedly new voices that have
found a way to chatter in full view.  You may note that new "apps"
for Android plus iPhone are appearing at over a thousand per day.
You may rightly remind us all that technology is democratizing in
the sense that powers once reserved for the few are now irretrievably
in the hands of the many.  What stands against that, and why I say
that it stands against that, is increasing interdependence.

We humans can design systems more complex than we can then operate.
The financial sector's "flash crashes" are an example of that;
perhaps the fifty interlocked insurance exchanges for Obamacare
will soon be another.  Above some threshold of system complexity,
it is no longer possible to test, it is only possible to react to
emergent behavior.  The lowliest Internet user is entirely in the
game of interdependence -- one web page can easily touch scores of
different domains.  While writing this, the top level page from
cnn.com had 400 out-references to 85 unique domains each of which
is likely to be similarly constructed and all of which move data
one way or another.  If you leave those pages up and they have an
auto-refresh, then moving to a new network signals to every one of
those ad networks that you have so moved.

The wellspring of risk is dependence, especially dependence on
shared expectations of shared system state, i.e., interdependence
on the ground.  If you would accept that you are most at risk from
the things you most depend upon, then damping dependence is the
cheapest, most straightforward, lowest latency way to damp risk,
just as the fastest and most reliable way to put more money on a
business's bottom line is through cost control.

Trend #7: Automation

Shoshana Zuboff of the Harvard Business School notably described
three laws of the digital age,

. Everything that can be automated will be automated.
. Everything that can be informated will be informated.
. Every digital application that can be used for surveillance and
.    control will be used for surveillance and control.

It is irrelevant, immaterial and incompetent to argue otherwise.
For security technology, Zuboff's Laws are almost the goal state,
that is to say that the attempt to automate information assurance
is in full swing everywhere, the ability to extract information
from the observable is in full swing everywhere, and every digital
application is being instrumented.

Before In-Q-Tel, I worked for a data protection company.  Our product
was, and I believe still is, the most thorough on the market.  By
"thorough" I mean the dictionary definition, "careful about doing
something in an accurate and exact way."  To this end, installing
our product instrumented every system call on the target machine.
Data did not and could not move in any sense of the word "move"
without detection.  Every data operation was caught and monitored.
It was total surveillance data protection.  What made this product
stick out was that very thoroughness, but here is the point: Unless
you fully instrument your data handling, it is not possible for you
to say what did not happen.  With total surveillance, and total
surveillance alone, it is possible to treat the absence of evidence
as the evidence of absence.  Only when you know everything that
*did* happen with your data can you say what did *not* happen with
your data.

But this trend of automating is now leaving the purely defensive
position behind.  In a press release two weeks ago today,[7] DARPA
signaled exactly that, and I quote

   [T]he Defense Advanced Research Projects Agency intends to hold
   the Cyber Grand Challenge -- the first-ever tournament for fully
   automatic network defense systems.  DARPA envisions teams creating
   automated systems that would compete against each other to
   evaluate software, test for vulnerabilities, generate security
   patches and apply them to protected computers on a network.  The
   growth trends ... in cyber attacks and malware point to a future
   where automation must be developed...

The automation trend is irreversible, but it begs a question that
I fear no one will answer in a way that doesn't merely reflect their
corporate or institutional interest, namely are people in the loop
a failsafe or a liability?[8]

Trend #8: Dual use

I've become convinced that all security technology is dual use.
While I am not sure whether dual use is a trend or a realization
of an unchanging fact of nature, the obviousness of dual use seems
greatest in the latest technologies, so I am calling it a trend in
the sense that the straightforward accessibility of dual use
characteristics of new technology is a growing trend.

There are a lot of examples, but in the physical world any weapon
usable for defense can be repurposed for offense.  Every security
researcher looking for exploitable flaws is deep in the dual use
debate because once discovered, those flaws can be patched or they
can be sold.  The cyber security products that promise total
surveillance over the enterprise are, to my mind, an offensive
strategy used for defensive purposes.

There was a time when flaws were predominantly found by adventurers
and braggarts.  Ten plus years of good work by the operating system
vendors elbowed the flaw finders out of the operating system and,
as a result, our principal opponents changed over from adventurers
and braggarts to being professionals.  Finding vulnerabilities and
exploiting them is now hard enough that it has moved out of the
realm of being a hobby and into the realm of being a job.  This
changed several things, notably that braggarts share their findings
because they are paid in bragging rights.  By contrast, professionals
do not share and are paid in something more substantial than fame.
The side effect has been a continued rise in the percentage of all
vulnerabilities that are previously unknown.  The trend, in other
words, is that by crushing hobbyists we've raised the market price
of working exploits to where now our opponents pay for research and
development out of revenue.

Simulating what the opponent can do thus remains the central task
of defensive research.  Much of that research is in crafting proofs
of concept that such and such a flaw can be taken advantage of.
Corman's neologism of "HD Moore's Law" says that the trend in the
power of the casual attacker grows as does the trend of the power
in Metasploit.[9] It is hard to think of a better description of
dual use.

Trend #9: The blurring of end-to-end

To my mind, the most important technical decision ever made was
that the security of the Internet was to be "end-to-end."[10]
"End-to-end" is a generic technical term yet simple to explain: the
Internet was built on the premise that two entities could connect
themselves to each other and decide what they wanted to do.  The
network was a delivery vehicle, but the form, content, and security
of the connection between the two ends was to be their own choice.
End-to-end is a model where the terminal entities are smart and the
network is dumb.  This is completely (completely) different than a
smart network with dumb terminal entities at the end of the wire.
No other design decision of the Internet comes close to the importance
of it's being an end-to-end design.  With end-to-end, security is
the choice of the terminal end-points, not something built into the
fabric of the Internet itself.  That is American values personified.
It is the idea that accountability, not permission seeking, is the
way a government curbs the misuse of freedoms, and, as accountability
scales but permission seeking does not, accountability wins.

End-to-end security is the digital manifestation of the right of
association and, in any case, is what enabled the Internet to become
relevant in the first place.  End-to-end does precisely what Peter
Drucker told us to do: "Don't solve problems, create opportunities."
The provision of content from anywhere to anywhere, which is the
very purpose of an internetwork, is a challenge to sovereignty.
America's Founders wanted no sovereign at all, and they devised a
government that made the center all but powerless and the periphery
fully able to thumb its nose at whatever it felt like.  Much ink
has been spilled on the frontier ethic versus the wishful policies
favored by the comfortable urbanity of the welfare state, but the
Internet's protocols have everything in common with the former and
nothing in common with the latter.

The free man requires the choice of with what degree of vigor to
defend himself.  That is a universal; America's Founders laid that
down in the Second Amendment, just as did George Orwell in the
English democratic socialist weekly "Tribune" when he said, "That
rifle on the wall of the laborer's cottage or working class flat
is the symbol of democracy.  It is our job to see that it stays
there."  Were George Washington or George Orwell still among us,
they would know that smart end-points and dumb networks are what
freedom requires, that smart networks protecting dumb end-points
breed compliant dependency.

But the trend is otherwise, and not just because of the fatuous
fashionability of entitlement, but rather because of a blurring of
what the term "end" means.  So very many people have adopted automatic
synchronization of multiple devices they own that one has to ask
whether their tablet is an end or their collection of mutually
synchronized devices is an end.  So many Internet-dependent functions
are spread silently across numerous entities and applications that
what is the end may well be more dynamic than can be described.  If
an end implies unitary control on the part of an owner, then set
theory says that mutually synchronized devices are a unitary end.

That blurring of "end" makes end-to-end provisioning problematic
as a set of devices cannot be assumed to be equally on and equally
participating in any given transaction.  Quoting Clark & Blumenthal[11]

   There is a risk that the range of new requirements now emerging
   could have the consequence of compromising the Internet's original
   design principles.  Were this to happen, the Internet might lose
   some of its key features, in particular its ability to support
   new and unanticipated applications.  We link this possible outcome
   to a number of trends: the rise of new stakeholders in the
   Internet,...  new government interests, the changing motivations
   of the growing user base, and the tension between the demand for
   trustworthy overall operation and the inability to trust the
   behavior of individual users.

This is nowhere so evident as in security, that is to say in the
application of the end-to-end principle to cyber security.  What
does end-to-end secure transport mean when travelocity.com is showing
you a page dynamically constructed from a dozen other entities?

Trend #10: Complexity in the supply chain

Even without resorting to classified information, it is now clear
that supply chain attacks have occurred.  Whether reading journalistic
accounts or Richard Clarke's novel _Breakpoint_, the finding is
that the supply chain creates opportunities for badness.  None of
the things I've yet read, however, blames the supply chain risk on
its complexity, per se, but that is the trend that matters.

Security is non-composable -- we can get insecure results even when
our systems are assembled from secure components.  The more components,
the less likely a secure result.  This applies to supply chains
that are growing ever more complex under the pressure of just-in-time,
spot market sourcing of, say, memory chips and so forth and so on.
Because the attacker has only to find one component of that chain
to be vulnerable while the defender has to assure that all components
are invulnerable, rising supply chain complexity guarantees increased
opportunity for effective attack.  It cannot do otherwise, and the
trend is clear.

Trend #11: Monoculture(s)

Beginning with Forrest in 1997,[12] regular attention has been paid
to the questions of monoculture in the network environment.  There
is no point belaboring the fundamental question, but let me state
it for the record: cascade failure is so very much easier to detonate
in a monoculture -- so very much easier when the attacker has only
to write one bit of malware, not ten million.  The idea is obvious;
believing in it is easy; acting on its implications is, evidently,
rather hard.

I am entirely sympathetic to the actual reason we continue to deploy
computing monocultures -- making everything almost entirely alike
is, and remains, our only hope for being able to centrally manage
it in a consistent manner.  Put differently, when you deploy a
computing monoculture you are making a fundamental risk management
decision: That the downside risk of a black swan event is more
tolerable than the downside risk of perpetual inconsistency.  This
is a hard question, as all risk management is about changing the
future, not explaining the past.  Which would you rather have, the
unlikely event of a severe impact, or the day-to-day burden of
perpetual inconsistency?

When we opt for monocultures we had better opt for tight central
control.  This supposes that we are willing to face the risks that
come with tight central control, of course, including the maximum
risk of all auto-update schemes, namely the hostile takeover of the
auto-update mechanism itself.  Computer desktops are not the point;
embedded systems are.  The trendline in the number of critical
monocultures seems to be rising and many of these are embedded
systems both without a remote management interface and long lived.
That combination -- long lived and not reachable -- is the trend
that must be reversed.  Whether to insist that embedded devices
self destruct at some age or that remote management of them be a
condition of deployment is the question.  In either case, the
Internet of Things and the appearance of microcontrollers in seemingly
every computing device should raise hackles on every neck.[13]

Trend #12: Attack surface growth versus skill growth

Everyone here knows the terminology "attack surface" and knows that
one of the defender's highest goals is to minimize the attack surface
wherever possible.  Every coder adhering to a security-cognizant
software lifecycle program does this.  Every company or research
group engaged in static analysis of binaries does this.  Every
agency enforcing a need-to-know regime for data access does this.
Every individual who reserves one low-limit credit card for their
Internet purchases does this.  I might otherwise say that any person
who encrypts their e-mail to their closest counterparties does this,
but because consistent e-mail encryption is so rare, encrypting
one's e-mail marks it for collection and indefinite retention by
those entities in a position to do so, regardless of what country
you live in.

In cyber security practice, the trend is that we practitioners as
a class are getting better and better.  We have better tools, we
have better understood practices, and we have more colleagues.
That's the plus side.  But I'm interested in the ratio of skill to
challenge, and as far as I can estimate, we are expanding the
society-wide attack surface faster than we are expanding our
collection of tools, practices, and colleagues.  If you are growing
more food, that's great.  If your population is growing faster than
your improvements in food production can keep up, that's bad.

In the days of radio, there was Sarnoff's Law, namely that the value
of a broadcast network was proportional to N, the number of listeners.
Then came packetized network communications and Metcalfe's Law,
that the value of a network was proportional to N squared, the
number of possible two-way conversations.  We are now in the era
of Reed's Law where the value of a network is proportional to the
number of groups that can form in it, that is to say 2 to the power
N.  Reed's Law is the new reality because it fits the age of social
networks.  In each of these three laws as publicly stated, the sign
bit is positive, but in parallel with the claim that everything is
dual use, the sign bit can also be negative because interconnections
are a contributor to the net attack surface.  If an Internet of
Things is indeed imminent, then the upward bend in the curve of the
global attack surface will grow steeper regardless of what level
of risk there is for any one thing so long as that level of risk
is always non-zero.

Trend #13: Specialization

Everyone my age working in cyber security was trained for something
else, and because of that switch between one field and another
brings along the hybrid vigor of seeing the cyber security world
through a different lens.  Statisticians, civil engineers, and
lawyers alike can contribute.  But the increasing quality of prepatory
education, the increasing breadth of affairs for which cyber security
is needful, and the increasing demand for skill of the highest sort
means the humans in the game are specializing.

While some people like to say "Specialization is for insects," tell
me that the security field itself is not specializing.  We have
people who are expert in forensics on specific operating system
localizations, expert in setting up intrusion response, expert in
analyzing large sets of firewall rules using non-trivial set theory,
expert in designing egress filters for universities that have no
ingress filters, expert in steganographically watermarking binaries,
and so forth.  Generalists are becoming rare, and they are being
replaced by specialists.  This is biologic speciation in action,
and the narrowing of ecologic niches.  In rough numbers, there are
somewhere close to 5,000 various technical certifications you can
get in the computer field, and the number of them is growing thus
proving the conjecture of specialization and speciation is not just
for insects and it will not stop.

--------------

What does it all mean?

All of these trends reflect state changes ongoing and likely to
continue to move forward.  If we could count on them to maintain
some smooth progression, then we might plan actions around them,
but we cannot.  At any moment, a game changer may arrive, but that
is not something you can plan for, per se.

I began with the trend of polarization and I end with it.  The range
of cyber security skills between the best and the worst is growing
wider.  As the worst outnumber the best and always will, we need
look no further than the history of empire where, in the end, it
is polarization that kills them.  The Internet is an empire.  The
Internet was built by academics, researchers, and hackers -- meaning
that it embodies the liberal cum libertarian cultural interpretation
of "American values," namely that it is open, non-hierarchial, self
organizing, and leaves essentially no opportunities for governance
beyond a few rules of how to keep two parties in communication over
the wire.  Anywhere the Internet appears, it brings those values
with it.  Other cultures, other governments, know that these are
our strengths and that we are dependent upon them, hence as they
adopt the Internet they become dependent on those strengths and
thus on our values.  A greater challenge to sovereignty does not
exist, which is why the Internet will either be dramatically
balkanized or it will morph into an organ of world government.  In
either case, the Internet will never again be as free as it is this
morning.

That polarization of cyber security within the Internet grows from
our willing dependence on it despite the other trends of which I've
spoken.  I don't see us deciding to damp that risk by curbing
dependence though, to be clear, that is precisely the trajectory
which my own life now follows.  I don't see the cyber security field
solving the problem as the problem to be solved is getting bigger
faster than we are getting better.  I see, instead, the probability
that legislatures will relieve the more numerous incapable of the
joint consequences of their dependence and their incapability by
assigning liability so as to collectivize the downside risk of cyber
insecurity into insurance pools.  We are forcibly collectivizing
the downside risk of disease most particularly the self-inflicted
ones, why would we not do that for the downside risk of cyber
insecurity and, again, particularly the self-inflicted ones?

Where there are so many questions and so few answers, such deep
needs and such shallow appreciation of trend directions, the greatest
risk is the risk of simplistic solutions carried forward by charismatic
fools.

There is never enough time, thank you for yours.


--------------

[1] "Professionalizing the Nation's Cyber Workforce?"
 www.nap.edu/openbook.php?record_id=18446

[2] _Hollowing out the Middle_, Carr & Kefalas; _Race Against the
Machine_, Brynjolfsson & McAfee; _Average Is Over_, Cowen

[3] "The Index of Cyber Security,"
 cybersecurityindex.org

[4] "The Consumer Confidence Index," Technical Note, 2011
 tinyurl.com/3sb633k

[5] Gray, "eScience," NRC-CSTB, Mountain View CA, 2007
 research.microsoft.com/en-us/um/people/gray/talks/NRC-CSTB_eScience.ppt

[6] Geer, _Economics and Strategies of Data Security_, 2008

[7] www.darpa.mil/NewsEvents/Releases/2013/10/22.aspx

[8] Geer, "People in the Loop: Failsafe or a Liability?", 2012
 geer.tinho.net/geer.suitsandspooks.8ii12.txt

[9] Corman, "Intro to HDMoore's Law," 2011
 blog.cognitivedissidents.com/2011/11/01/intro-to-hdmoores-law

[10] Saltzer, Reed, & Clark, "End-to-End Arguments in System Design,"
1981
 web.mit.edu/Saltzer/www/publications/endtoend/endtoend.pdf

[11] Clark & Blumenthal, "Rethinking the design of the Internet,
The End-to-End Arguments vs. the Brave New World," 2001
 cyberlaw.stanford.edu/e2e/papers/TPRC-Clark-Blumenthal.pdf

[12] Forrest, Somayaji, & Ackley, "Building Diverse Computer Systems,"
HotOS-VI, 1997
 www.cs.unm.edu/~immsec/publications/hotos-97.pdf

[13] Farmer, "IPMI: Freight Train to Hell v2.01," 2013
 fish2.com/ipmi/itrain.pdf


more material at geer.tinho.net/pubs