KDB Systems

A while back I wrote a blog post com­par­ing com­puter secu­rity to walk­ing in the rain. This morn­ing it was rain­ing pretty hard dur­ing my morn­ing walk. It wasn’t rain­ing quite as hard as when I wrote the pre­vi­ous post but west coast­ers know what “rain­ing pretty hard” means. For the rest of you, it was rain­ing as hard as you’ll prob­a­bly ever expe­ri­ence unless you live in a rain for­est. For some rea­son I decided not to use the same gear as in the blog post. I had the Halti jacket and Tilley hat on. I didn’t take an umbrella, wear gloves, or wear rain pants. I ignored my own advice from this blog post about secu­rity being a marathon where we can never relax. In half a block my pants were soaked through. A few min­utes later my hands were cold. I had to cut my usual walk in half because I was get­ting cold and wet. Com­puter secu­rity is sim­i­lar. Use the appro­pri­ate tools. Don’t take short­cuts. Never relax or get complacent.

This morn­ing I was out walk­ing in the rain try­ing to come up with a good idea for a blog post. I’ve been think­ing a lot about com­puter secu­rity lately. As I was walk­ing I realised that walk­ing in the rain was a good anal­ogy to use when think­ing about com­puter secu­rity. I have to deal with a very wet cli­mate. I enjoy spend­ing time out­doors. Some­times I have things I have to get done that require me to be out­doors. This means I have to come up with a way to deal with rain. I actu­ally have sev­eral strate­gies for deal­ing with rain depend­ing on what I’m doing, how hard it’s rain­ing, and how long I’ll be exposed to the rain.

The sim­plest strat­egy is to just try to stay out of the rain. This is OK for very short dura­tions in the rain. If I’m quick I stay rel­a­tively dry while going from my door to the car, or from the car to a store. In com­puter terms this would be like run­ning Win­dows with min­i­mal secu­rity enhance­ments, noth­ing but what’s built in. It’s very easy and con­ve­nient. Most of the time I won’t get too wet. Occa­sion­ally I’ll get caught in a down­pour and get soaked to the skin requir­ing a full change of clothes. Most of the time I don’t use this strat­egy nor would I rec­om­mend it for oth­ers as they will inevitably get wet at some point.

The next strat­egy is to wear a coat. This gives some added pro­tec­tion but when I do get caught in that down­pour I may have to change my pants or at the very least my shoes and socks after­wards. If it rains hard enough or I’m out­side long enough the coat will even­tu­ally soak through. Over time the coat wears out and becomes less effec­tive at keep­ing the rain out. I have to buy a new coat. There are many dif­fer­ent types of coats, some of which give much bet­ter pro­tec­tion from the rain than oth­ers. There are wind­break­ers, rain coats, and over­coats. Choos­ing which coat to use takes expe­ri­ence with the weather and know­ing how hard it’s likely to rain. This would be like Win­dows with an antivirus/mal­ware pro­gram installed.

This morn­ing while walk­ing it was rain­ing pretty hard. I took an umbrella and wore a rain coat. I was out in the rain for quite a while. I still got a lit­tle bit damp but that was mostly because I was too hot while walk­ing up the hills. The prob­lems were mostly inter­nal caused by the pro­tec­tion I was using. Some of the damp­ness was caused because the umbrella didn’t pro­tect against splashes from the rain drops on the side­walk and for a small period of time it was rain­ing hard enough that some of the drops made it through the umbrella (a Microsoft golf umbrella by the way) in the form of a fine mist. This is like Win­dows with a hard­ware fire­wall (umbrella), antivirus soft­ware(coat), and anti–mal­ware soft­ware (the coat is a spe­cialised rain coat). All that pro­tec­tion may get in the way and cause it’s own prob­lems but in the end it does a pretty good job of pro­tect­ing me from the rain. If some­one was going out in the rain this is what I would rec­om­mend, with a warn­ing that it may not be the ulti­mate in pro­tec­tion. They may get a lit­tle damp at times. Some of the damp­ness may be caused by the pro­tec­tion itself (per­spi­ra­tion).

Last win­ter I vol­un­teered to work at one of the 2010 Olympic venues (Whistler Olympic Park) for a ski jump­ing event. One of the perks was a very high tech Halti all weather jacket. This jacket is made of some super high tech mate­r­ial that allows you to work very hard and not get soaked from your own per­spi­ra­tion. At the same time it is com­pletely water­proof even if you are out in the rain for hours on end. I was shov­el­ling snow at the top of the big ski jump in major sleet (mixed rain and snow) for hours. I had a Tilley hat, the Halti coat, sim­i­lar high tech rain pants, microfi­bre cloth­ing under­neath, rub­ber boots, and some high tech thin­su­late gloves. This would be like run­ning Win­dows in a vir­tual machine on a very fast com­puter that was behind a locked down server class OS that enforced net­work poli­cies and an enter­prise class fire­wall. I was able to work for sev­eral hours in extremely adverse con­di­tions with­out get­ting wet at all. I was able to get the work done with no prob­lems caused by either my envi­ron­ment or the gear I was using to pro­tect me from the environment.

What does all this say about com­puter secu­rity? Secu­rity is about mit­i­gat­ing risk. You have to assess the risk and come up with a plan to mit­i­gate the risk that is appro­pri­ate to your bud­get and envi­ron­ment. No mat­ter what you do, you will never get the risk down to zero. With enough resources you can get close. The closer you get to zero risk the higher the cost. For most of us the cost/benefit falls some­where in the mid­dle which means we may have to deal with occa­sion­ally get­ting a lit­tle bit damp.