jump to navigation

Making Security an Explicit Goal November 22, 2013

Posted by patrickcallan2013 in Security.

Ross Anderson’s article, “Why Cryptosystems Fail”, discusses multiple points at which computer system security can fail. [1] The article reveals the complex interactions of people, processes and technology that if not dealt with properly will compromise system security. The author provides examples demonstrating security extends beyond implementing only technology to address the problem. The people aspect was demonstrated in the author’s example of a bank publishing a widely distributed “branch operations manual” containing a test ATM transaction key sequence that causes ATMs to dispense 10 bank notes and a bank employee providing a customer with an ATM card PIN without requiring personal identification documents. [p. 35 in [1]] Process problems were shown by an example in which a bank did not have procedures implemented to use registered mail for secure delivery of ATM cards. [1] Technology related security problems can arise when staff lack security knowledge to implement complex technology; “Given most managers and staff cannot be assumed to have any specialized knowledge at all, security products should only be certified if they are simple enough for ordinary technical staff use.” [ p. 37 in [1]] Security requires coordination in all areas – people, processes and technology. Failing to address all areas often weakens or compromises security as these examples demonstrated.

Many organizations have a false sense of security because technology has been implemented to provide security. Anderson notes “Any security technology can be defeated by gross negligence” and “… trusting technology too much can be dangerous.” [ p. 36 in [1]] Anderson’s research found “… organizational problems of building and managing secure systems are so severe that they will frustrate any purely technical solution.” [ p. 36 in [1]] Technology alone will not establish security. There are many ways to compromise system security so efforts should be focused upon implementing an overall security strategy that includes careful evaluation of people, processes and technology.

A central point Anderson stressed was explicit consideration of security goals as part of the system design and software engineering processes. If security is not explicitly considered, it is unrealistic to expect the finished system or software to achieve that goal. Anderson identifies this problem stating “…there is a sense in which there are no ‘secure’ systems at all; there are merely computer systems whose goals include beating foreign armies, preventing fraud, or winning lawsuits. If these goals are not made explicit, they are unlikely to be achieved.” [ p. 40 in [1]] Security should be an explicit and routine part of any process, system development or software engineering project to insure the resulting process, system or software does not compromise the organization’s security. Maintaining security is difficult with multiple factors capable of undermining the goal. Consequently, the security implications of the people, process and technology facets of information systems should be proactively considered when systems or software are being designed and implemented rather than reacting to security problems after the fact.

[1] Anderson, Ross J.. “Why Cryptosystems Fail”. Communications of the ACM Volume 37 Number 11. November 1994.



No comments yet — be the first.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: