Original URL: http://www.theregister.co.uk/2006/03/28/security_czar_decrees/

As Emperor of Security, I hereby decree...

Benovolence is my middle name

By Scott Granneman

Posted in Security, 28th March 2006 09:29 GMT

Comment Ever since I was a little kid, I've been interested in Roman history. It still amazes me when I think about ancient Rome: the most powerful empire the world had ever seen, bringing countless advances to far-flung nations, yet still barbaric in astonishing ways, finally brought low due to a wide variety of causes and plunging the lands it had conquered into darkness for a millennia. In particular, the Roman emperors present a parade of fascinating characters, with many of them beautifully illustrating Lord Acton's famous dictum that, "power tends to corrupt, and absolute power corrupts absolutely".

Caligula (12-41 CE; reigned 37-41 CE) indulged in an almost constant stream of cruel, bizarre, and monomaniacal behaviours, including various sexual perversions, torture of slaves, forcing soldiers to gather seashells as "spoils of the sea", and demanding that he be worshiped as a living god.

Nero (37-68 CE; reigned 50-54 CE) is usually described as insane, and many of his actions help to bolster that view. Besides murdering his mother Agrippina and his aunt Domitia, Nero sang and played the lyre, dressed in his stage costume, as Rome burned for a week in 64 CE.

Commodus (161-192 CE; reigned 180-192 CE) was overly proud of his physique, commissioning statues of Hercules to use his head, fighting in the arena as a gladiator (for which he billed the city a million sesterces every time), and demanding that he be worshiped as a god. Even a harem of 300 women didn't satisfy his urge to prove himself, as he renamed Rome to Colonia Commodiana, the Senate as Commodian Fortunate Senate, the Army as Commodian Army, and the calendar months to correspond with him and his honors.

Elagabalus (203-222 CE; reigned 218-222 CE) was sexually insatiable, taking a Vestal Virgin as a wife, standing nude at his bedroom door propositioning those who walked by, and committing many other acts I can't write about here. He also had himself circumcised so that he could act as the high priest of the Sun cult he promulgated during his reign.

In this column I'd like to declare myself Emperor of the Security world. Don't worry, I won't force you to worship me as a god, nothing will be renamed in my honor, and no one will be forced to gather seashells (although my car does need a washing...). As for perversions, this is the internet we're using here, so everyone's safe. No, instead, I plan to rule as a benevolent dictator, trying to bring wisdom and reform to a troubled land. As your new emperor, these are my security decrees:

Training and licensing for all new computer users

There are millions of computers users out there already, and it would be impossible to verify their abilities at this point. However, all new computer users (and any existing users trying to buy a new computer or upgrade) must go through mandatory security training before they are allowed to buy and/or use a computer. Training would include basic security concepts, tips for secure computing, general terms and definitions (virus, phishing, Trojan Horse, and so on), and an understanding of general security software (see: Mandatory anti-virus, anti-spyware, and firewall software below).

Once the training has been completed, the user can take a security test. Upon successful completion of the test, the user receives a license. Every three years, the licensee must retake a test that covers changes in computer and network security. It's just like a car: in order to exercise your right to drive a car, you have to show that you know how to use it.

Mandatory multicultures

It's pretty well been proven that operating system monocultures are a bad thing (900Kb PDF). In a biological population, the introduction of a disease into a monoculture can spell doom for the entire group: since everyone is the same, everyone is vulnerable in similar ways. This is analogous to computing monocultures: if everyone is running Windows (or Mac OS X, or Linux, or whatever) and a serious compromise enters that population, then there is the danger that everyone in that group will suffer devastating losses.

The way around that: mandatory multicultures. No organisation can have more than 75 per cent of its computer operating systems be from the same family. Seventy five per cent Windows, 25 per cent Mac OS X. Or, 75 per cent Mac OS X, 15 per cent Linux, and 10 per cent Windows. And so on. By enforcing a multiculture, we slow the spread of security diseases like viruses and worms. As a bonus, this would also encourage the further use of open data formats, which brings us to our next decree (notice how I'm using the royal plural now?).

Governments must use open data formats

The Massachusetts government has shown us the way: all governments - whether, local, state, or federal - must use only software that supports open formats. If it's produced using public money, then it should be readable and usable by as many members of the public as possible. Further, open formats improve the likelihood that documents will be readable further into the future. Probably the best explanation of this important ideal was written by Peruvian Congressman David Villanueva Nuñez in answer to Microsoft Peru.

Fines for insecure software

Bruce Schneier has often written about economic externalities, in which "the cost of a decision [is] borne by people other than those making the decision". In other words, companies creating software don't really suffer financially when their software products ship with massive insecurities in them. This needs to change.

If a company ships software that proves to be insecure, perhaps in some critical way, it'll be fined. The fines will based on a percentage of yearly revenue, and it will be a big enough percentage to hurt. There's one exception to this rule: if the software is released under an open source license (as determined by the Open Source Initiative), then there's no fine. (Ed: Is this because they have no money?

Organisations entrusted with your data will be held accountable

Another result of the current reality in economic externalities in security is the almost constant loss of personal and financial data due to carelessness and hacking. It's reached epidemic status, and it too needs to stop. The solution is similar to that in the previous decree: fines keyed to the organisation's yearly revenue. In addition to fines, however, these organisations will have to reimburse the people whose data was lost or stolen. A few large fines and reimbursements, which will lead most definitely to some firings, and I guarantee that security in this area will improve.

Mandatory disclosure of data loss and hacking

Of course, along with massive fines comes mandatory disclosure. If a company loses data, or is the victim of a security breach, it must reveal this to the public. A website will be set up to list these organisations so that they can be publicly shamed, and the amount they paid in fines will also appear there. California has such a law, without which the public would never have known about some particularly egregious data losses that a few companies incurred. A national law would go the next step to help inform people while holding companies accountable.

Mandatory anti-virus, anti-spyware, and firewall software

If you drive a car without changing the oil, eventually you'll destroy that car. Likewise, if you use a computer without anti-virus, anti-spyware, and firewall software, eventually you'll destroy that computer and hurt others as your infected machine spews malware and spam onto the net. When computers first boot, users should be offered the choice of several different anti-virus, anti-spyware, and firewall software packages, including ones that they install themselves, to preserve competition. Instead of 30 or 90 days, this software should be good for a year. How many people today buy new computers and don't buy the subscription after 90 days? As the end of that year approaches, users should be warned repeatedly that they must upgrade. No upgrade, no net access...except to sites offering upgrades. No anti-virus, anti-spyware, or firewall software, no net access...except to sites offering this software.

DRM cannot be used to deny fair use or first sale

I recently wrote a column explaining that DRM as currently practiced is a disaster not only for users, but also for the companies trying to use the technology. To solve those problems, DRM should be allowed, but it cannot be used to deny fair use or first sale rights.

Briefly put, the right of fair use says that I can use copyrighted materials in ways that the copyright owners may not intend or desire - for educational use, say, or for reviews or critique - while the right of first sale says that I can transfer to another person or entity a copyrighted work without asking permission first. If DRM prevents someone from exercising fair use or first sale, it's verboten; otherwise, it's OK. If you want to use DRM to protect your company's financial records, that's fine; if you want to use it to keep me from backing up my DVD or transferring songs I bought to a friend, that's not allowed.

That's it...those are my decrees. Some of you will call me mad, some of you will accuse me of megalomania rivaled only by the Roman emperors of old, and some of you will see things that I left out. Perhaps my ideas are crazy, but they're at least enough to spark discussion about solutions. And as a benevolent dictator, I choose to emphasise the word "benevolent" - if we try an idea for a while and it doesn't work, I'm more than willing to try something else. Finally, I urge you to propose your own ideas. If you were emperor of the security world, what would your orders be?

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Scott Granneman is a senior consultant for Bryan Consulting Inc in St Louis. He specialises in internet services and developing web applications for corporate, educational, and institutional clients.