Creating Laws for Computer Security
In 2016 the website KrebsonSecurity was taken down by a large distributed denial-of-service (DDoS) attack. More recently, many large sites became inaccessible due to a massive DDoS attack (see, e.g., “Hackers Used New Weapons to Disrupt Major Websites Across U.S.” by Nicole Perlroth, Oct. 21, 2016, NY Times).
Sadly, the “Internet of Things” is really the “Internet of painfully insecure things”. This is fundamentally an externalities problem (the buyers and sellers are not actually bearing the full cost of the exchange), and in these cases mechanisms like law and regulation are often used.
So, what laws or regulations should be created to improve computer security? Are there any? Obviously there are risks to creating laws and regulations. These need to be targeted at countering widespread problems, without interfering with experimentation, without hindering free expression or the development of open source software, and so on. It’s easy to create bad laws and regulations - but I believe it is possible to create good laws and regulations that will help.
My article Creating Laws for Computer Security lists some potential items that could be turned into laws that I think could help computer security. No doubt some could be improved, and there are probably things I’ve missed. But I think it’s important that people start discussing how to create narrowly-tailored laws that counter the more serious problems without causing too many negative side-effects. Enjoy!
path: /security | Current Weblog | permanent link to this entry
Get your CII best practices badge!
If you’re involved in a free / libre / open source software (FLOSS) project, go to bestpractices.coreinfrastructure.org and get your best practices badge!
The Linux Foundation’s Core Infrastructure Initiative (CII) has just announced its CII best practices badging program for FLOSS projects. It’s a free program that lets developers explain how they follow best practices, and if they do, they can get a badge that they can show on their GitHub page or anywhere else. Early badge earners include the Linux kernel, Curl, GitLab, OpenBlox, OpenSSL, Node.js and Zephyr.
The idea is straightforward. The Heartbleed vulnerability in OpenSSL made it obvious that there are widely-accepted best practices that not everyone is doing - and that even includes important projects. This isn’t just speculation; if you compare OpenSSL before Heartbleed with current OpenSSL the difference is striking. I think it’s clear that if more projects would apply generally-accepted best practices, we’d have more secure software. This badging process helps projects identify those best practices, determine if they meet them, and show everyone else that they’re meeting them.
The web application and criteria are being maintained as an open source software project, so we’d love to have you! I say “we” because I’m leading this project… but it’s not just me, and we would love to have you involved.
More detail is in the Linux Foundation press release about the best practices badging project.
path: /oss | Current Weblog | permanent link to this entry
US government - Reusable and Open Source Software
The US White House has announced (in its blog) Leveraging American Ingenuity through Reusable and Open Source Software. They state that, “Today, we’re releasing for public comment a draft policy to support improved access to custom software code developed for the Federal Government.” They are accepting comments on this draft policy via GitHub pull requests, GitHub issues, or email. I definitely plan to take a look, and I’m sure they would like feedback from many people.
Note that I also posted this information on Twitter.
path: /oss | Current Weblog | permanent link to this entry
Using open source software to help technology transition of research
If you’re doing software research and development (especially on how to improve computer security), and are thinking about using an open source software (OSS) approach but don’t know a lot about it, here’s something that may help: Using an Open Source Software Approach for Cybersecurity Technology Transition (IDA paper P-5279, aka the “PI guide”). If you’re an old hand at developing Free/ libre/ open source software (FLOSS or OSS), you probably know most of this information. However, I’ve found that a lot of people could use a hand. Here’s that helping hand.
path: /oss | Current Weblog | permanent link to this entry
Address Sanitizer on an entire Linux distribution!
Big news in computer security: Hanno Boeck has recently managed to get Address Sanitizer running on an entire Linux distribution (Gentoo) as an experimental edition. For those who don’t know, Address Sanitizer is an amazing compile-time option that detects a huge range of memory errors in memory-unsafe languages (in particular C and C++). These kinds of errors often lead to disastrous security vulnerabilities, such as Heartbleed.
This kind of distribution option is absolutely not for everyone. Address Sanitizer on average increases processing time by about 73%, and memory usage by 340%. What’s more, this work is currently very experimental, and you have to disable some other security mechanisms to make it work. That said, this effort has already borne a lot of valuable fruit. Turning on these mechanisms across an entire Linux distribution has revealed a large number of memory errors that are getting fixed. I can easily imagine this being directly useful in the future, too. Computers are very fast and have lots of memory, even when compared to computers of just a few years earlier. There are definitely situations where it’s okay to effectively halve performance and reduce useful memory, and in exchange, significantly increase the system’s resistance to novel attack. My congrats!!
path: /security | Current Weblog | permanent link to this entry