Computer security is a solved problem.[1] The problem arose during the VietNam conflict, and was solved in the 1970s.
I suspect that the current widespread ignorance of this fact is the result of a covert operation by one or more TLAs.
I suspect that the current widespread ignorance of this fact is the result of a covert operation by one or more TLAs.
If we could now find out how to do security in an economical, non-annoying way, that would be great
Basically you have to have a whole team of people whose only job is to maintain the correct/accurate security levels for everyone else, grant and revoke them in a timely manner.
And a whole another team to maintain this for every single software service that the company runs and uses, internally or externally.
So the solution is either a huge performance or cost penalty, or both.
> I suspect that the current widespread ignorance of this fact is the result of a covert operation by one or more TLAs.
No. It's a simple fact that it's difficult and costly to maintain and most orgs don't have the talent to do so in-house or the money to hire external experts.
Image if some agency had decided that knowledge of fuses and circuit breakers should be restricted in the national interest. This would make electo-security a Trillion dollar industry.
Just as cyber security is now.
--
We let random people plug things into the electrical grid. We don't have to run an "electrical scan" for each item plugged in. We don't have central authentication of people and devices being plugged in. This is because the default is NOT to get all of the power in the US electrical grid in every outlet. It's a default deny policy. We all understand how it works.
When experts are required, they come in, make required changes, and leave. On site electricians aren't a common site except for weird things like McCormick place in Chicago, where they are required to plug ANYTHING in.
If a user wants to plug in an Electric Range, Electric Dryer, Welder, etc. they have to find an appropriate outlet. The capabilities of each outlet are defined in advance. There are widely respected standards.
On the other hand, we are forced to run virus scanners, and try to enumerate every piece of code before we use it to compute. If we run code, it can use all of the resources of the host it's running on, in almost all cases. The policy is default allow. We blame users, applications, and software vendors for mishaps. There are no standards. Everything is layers of band-aids on top of Operating Systems that are insecure by design.
This is madness.