Duane Gran’s log of thoughts

The Complete, Unquestionable, And Total Failure of Information Security.

The security company Scanit recently conducted a survey which tracked three web browsers (MSIE, Firefox, Opera) in 2004 and counted which days they were “known unsafe.” Their definition of “known unsafe”: a remotely exploitable security vulnerability had been publicly announced and no patch was yet available. Microsoft Internet Explorer, which is the most popular browser in use today and installed by default on most Windows-based computers, was 98% unsafe. Astonishingly, there were only 7 days in 2004 without an unpatched publicly disclosed security hole. Read that last sentence again if you have to.

The article is full of keep-you-awake-at-night concerns about computer security, most of which represent intractable problems. Unlike many security missives, the author isn’t dumping on just one application, but gives a wide survey of the uphill battle against a host of n’er do wells. The author plans a follow up article with practical suggestions and welcomes comment from computer security professionals.

My only nugget of wisdom to contribute is that the computer should assist with identifying suspicious behavior, but it shouldn’t assert the bona-fide safety of any particular activity — SSL being an exception. Once the computer says “this email is safe” or “this program is certified from vendor X” it creates an opportunity to impersonate some portion of the web of trust. Letting the computer do the bulk of analysis, as in the case of Bayesian spam filtering, and leaving the remaining 10% for human evaluation is a pragmatic approach which doesn’t lull the computer user into a false sense of security.

This entry was posted on Wednesday, May 17th, 2006 at 9:50 am and is filed under technology. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.