- Unsupervised Learning
- Posts
- Markus Ranum: An Idealist To A Fault
Markus Ranum: An Idealist To A Fault
Markus Ranum is a highly-respected (for good reason) information security professional who has done a ton of cool stuff during his multiple decades in the field. Most notable to me is the fact that he is the father of the proxy firewall — quite an accomplishment. I actually had an opportunity to exchange a couple words with him once at a conference; both his experience and unique perspective were quite palpable.
At any rate, Markus has just come out with a new essay entitled, “The Six Dumbest Ideas In Computer Security.” I have some major issues with it.
Default Closed
His second point is that rather than eternally enumerating, tracking, and messing with what’s bad on a system, one should simply figure out what’s good and allow that and nothing else. I think that’s a great idea, don’t get me wrong, but I also think it’d be better if all programmers were security experts. It’s just not possible. He writes:
The problem here is simple. People have jobs where they maintain other people’s systems. They didn’t write the software that runs on them, and they barely have the power to ask for patches to be installed — let alone that the entire paradigm of system security be re-evaluated and implemented. I just don’t see anything practical in this point for the everyday administrator. We don’t have the luxury of fixing problems by being perfect.
Vulnerability Scanning and Pentesting Is Pointless?
His next point that I take issue with is the notion that vulnerability assessments and pentesting are pointless. I see his point and actually think it’s valid. The only problem with it is that it absolutely doesn’t matter. His point is essentially that by plugging holes we’re not addressing true security problems, i.e. the system’s security design.
Well, sure. But that’s absurd. What are we to do given the current problems? Stop patching also? Just give up because we’re not worthy of perfection? Seriously.
The basic problem that Markus has here is that he’s speaking in a completely ideal sense when it doesn’t represent the real world. The real world is made of systems that have holes in them. Those holes either get patched or money gets lost. As such, we run around playing the patching game — which is of course related to the “vulnerability research game” and the “vulnerabilty assessment” game. It’s life.
The underlying issue is that systems are horribly designed from the ground up. This is the concept that I touched on in my paper, “Jousting From Unicycles”, and I think it’s quite in line with Markus’ comments. What I didn’t do in that piece, however, was demean what measures are being taken today — in the unclean world we live in — in order to deal with the unfortunate truths we face.
Hacking Is Cool, Isn’t
His next point is that the whole concept of teaching and learning hacking is lame.
I couldn’t disagree more. Does he not realize that learning how memory is set up or how network traffic moves across a system is learning about engineering? Learning “hacking” in the true sense is learning how things work, and not just on a small, specific scale. The better security professionals learn “concepts”, not as series of examples that stand on their own. I think he’s really off on this one.
Conclusions
Overall, I think Markus is a man of extremes. He’s brilliant, there’s no doubt about that, it’s just that very little of what he’s said here is practical in any way. These ideas need to incorporated into security “design”, i.e. in future projects and future products (preferably into programming languages, system architecture, IDEs, and compilers).
In other words, we’re dealing with the here and now — not with some sort of fictional, ideal world where default-deny policies prevail, and all system admins have a full understanding of everything in their environment. It just doesn’t represent reality. Should it? Sure, but there are lots of things that should be the case. To me this is the same as criticizing local police because they wouldn’t be needed if everyone was nice.