Feeds

As Emperor of Security, I hereby decree...

Benovolence is my middle name

  • alert
  • submit to reddit

SANS - Survey on application security programs

Comment Ever since I was a little kid, I've been interested in Roman history. It still amazes me when I think about ancient Rome: the most powerful empire the world had ever seen, bringing countless advances to far-flung nations, yet still barbaric in astonishing ways, finally brought low due to a wide variety of causes and plunging the lands it had conquered into darkness for a millennia. In particular, the Roman emperors present a parade of fascinating characters, with many of them beautifully illustrating Lord Acton's famous dictum that, "power tends to corrupt, and absolute power corrupts absolutely".

Caligula (12-41 CE; reigned 37-41 CE) indulged in an almost constant stream of cruel, bizarre, and monomaniacal behaviours, including various sexual perversions, torture of slaves, forcing soldiers to gather seashells as "spoils of the sea", and demanding that he be worshiped as a living god.

Nero (37-68 CE; reigned 50-54 CE) is usually described as insane, and many of his actions help to bolster that view. Besides murdering his mother Agrippina and his aunt Domitia, Nero sang and played the lyre, dressed in his stage costume, as Rome burned for a week in 64 CE.

Commodus (161-192 CE; reigned 180-192 CE) was overly proud of his physique, commissioning statues of Hercules to use his head, fighting in the arena as a gladiator (for which he billed the city a million sesterces every time), and demanding that he be worshiped as a god. Even a harem of 300 women didn't satisfy his urge to prove himself, as he renamed Rome to Colonia Commodiana, the Senate as Commodian Fortunate Senate, the Army as Commodian Army, and the calendar months to correspond with him and his honors.

Elagabalus (203-222 CE; reigned 218-222 CE) was sexually insatiable, taking a Vestal Virgin as a wife, standing nude at his bedroom door propositioning those who walked by, and committing many other acts I can't write about here. He also had himself circumcised so that he could act as the high priest of the Sun cult he promulgated during his reign.

In this column I'd like to declare myself Emperor of the Security world. Don't worry, I won't force you to worship me as a god, nothing will be renamed in my honor, and no one will be forced to gather seashells (although my car does need a washing...). As for perversions, this is the internet we're using here, so everyone's safe. No, instead, I plan to rule as a benevolent dictator, trying to bring wisdom and reform to a troubled land. As your new emperor, these are my security decrees:

Training and licensing for all new computer users

There are millions of computers users out there already, and it would be impossible to verify their abilities at this point. However, all new computer users (and any existing users trying to buy a new computer or upgrade) must go through mandatory security training before they are allowed to buy and/or use a computer. Training would include basic security concepts, tips for secure computing, general terms and definitions (virus, phishing, Trojan Horse, and so on), and an understanding of general security software (see: Mandatory anti-virus, anti-spyware, and firewall software below).

Once the training has been completed, the user can take a security test. Upon successful completion of the test, the user receives a license. Every three years, the licensee must retake a test that covers changes in computer and network security. It's just like a car: in order to exercise your right to drive a car, you have to show that you know how to use it.

Mandatory multicultures

It's pretty well been proven that operating system monocultures are a bad thing (900Kb PDF). In a biological population, the introduction of a disease into a monoculture can spell doom for the entire group: since everyone is the same, everyone is vulnerable in similar ways. This is analogous to computing monocultures: if everyone is running Windows (or Mac OS X, or Linux, or whatever) and a serious compromise enters that population, then there is the danger that everyone in that group will suffer devastating losses.

The way around that: mandatory multicultures. No organisation can have more than 75 per cent of its computer operating systems be from the same family. Seventy five per cent Windows, 25 per cent Mac OS X. Or, 75 per cent Mac OS X, 15 per cent Linux, and 10 per cent Windows. And so on. By enforcing a multiculture, we slow the spread of security diseases like viruses and worms. As a bonus, this would also encourage the further use of open data formats, which brings us to our next decree (notice how I'm using the royal plural now?).

Governments must use open data formats

The Massachusetts government has shown us the way: all governments - whether, local, state, or federal - must use only software that supports open formats. If it's produced using public money, then it should be readable and usable by as many members of the public as possible. Further, open formats improve the likelihood that documents will be readable further into the future. Probably the best explanation of this important ideal was written by Peruvian Congressman David Villanueva Nuñez in answer to Microsoft Peru.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.