The latest paper of interest is “Liability and Computer Security: Nine Principles”by Ross Anderson. He’s apparently a Cambridge man who hass done a great deal to change the ideas behind security principles. He’s also got a fair flair for writing on dry topics in a not-so-dry voice. This is one of my favorite skills that I pray everyone can find, at least to some degree. This should especially be true if you’re one who enjoys writing more than 5 pages per research paper.
The focus of the piece is reconsidering the driving force behind security advancement. The classic direction is in implementing best practices available to engineers in order to minimize risk, although the paper didn’t speak to these principles directly. While using the previous direction as log from Frogger, it proposes the chief factor that drives advancement in security is liability and the transfer thereof. It tries the case through several examples focused primarily on security systems used in United Kingdom banks.
It’s hard to simplify in less than five pages, but overall it points out how litigation following incident lead to the most change in the way the UK banks operated and how this system differed from the American cousins. This may seem obvious, but he also tries to tease out the notion that the flaws in the systems did may have resulted from poor designs or because the industry as a whole was not handling these types of issues despite an abundance of technology that could have stopped many of these errors.
The premise is one that I can see merit in, but the application is quite limited in my mind. The shortcoming of this analysis is that thec cases cited showed that loss due to failure of security mechanisms could be mitigated by an insurer or other liable body. This is not a common issue. In fact, banks and other asset management systems are the only groups that fall into this category, from my view. The only way you can restore most, let alone all, losses resulting from a security incident is if the lost material is of an entirely non-unique, exchangable nature.
I’ve become intimately familiar the concepts of risk as it pertains to reputation, trade secrets, and personal data. These are the pillars of risk, and they are regarded as the very purpose for security in our age. If you look at each element of risk you can see where Anderson’s model doesn’t apply. There are far too many groups out there to determine that liability transferrance is even an option for most cases.
Can Oracle transfer liabile risk of reputation damage to an insurer if they write poor software? Google’s search algorithm is worth trillions of dollars if potential earnings considered, and they could not insure their systems against loss of that information. And how would the Department of Defense transfer liability of operations information being leaked through an insecure system?
These cases are just a few of the corporate and government organizations that represent a vast majority. It’s unreasonable to think that any of these situations would have liability driving their security design and implementation. Why would it then be a driving force for the industry as a whole? It is unlikely, at best.
Again, I do not disagree with Anderson’s paper entirely; I feel that it is quite limited in it’s potency on a broader scope. I applaud his introduction of litigation and liability to the process, but it has far less impact on security than he believes it to be. Liability will always be a concern for any organization, but that does not mean that purpose or method changes because if it.
