[113741] in North American Network Operators' Group
RE: Michael Mooney releases another worm: Law Enforcement /
daemon@ATHENA.MIT.EDU (Deepak Jain)
Mon Apr 20 17:31:01 2009
From: Deepak Jain <deepak@ai.net>
To: "Valdis.Kletnieks@vt.edu" <Valdis.Kletnieks@vt.edu>, andrew.wallace
<andrew.wallace@rocketmail.com>
Date: Mon, 20 Apr 2009 17:30:18 -0400
In-Reply-To: <85296.1240259402@turing-police.cc.vt.edu>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
> On Sat, 18 Apr 2009 03:21:06 BST, "andrew.wallace" said:
> > The network community and the security community need to collaborate
> > as much as possible to defeat the threats.
> >
> > I'm British and i'm hoping to make UK as secure as possible.
>=20
> Umm. You missed the *very first* principle of proper security design.
>=20
> It shouldn't be "as secure as possible". It should be "as secure as it
> needs to be".
>=20
> I mean, I suppose you *could* go with mil-spec security, where all
> materials are kept in a locked safe under armed guard, and you had to
> fill out paperwork for each piece of paper you took out of the safe,
> and then more paperwork when you returned it. But did you *really*
> want all that effort just to check the headlines on bbc.com?
Let's not ignore the fact that if you set unreasonably high security standa=
rds
most likely: a) twitter.com or bbc.com wouldn't exist because of the high
security scrutiny they'd have been under before being allowed to connect to=
=20
anything and b) even if they didn't you wouldn't be able to see them becaus=
e
of the high security scrutiny you'd be under before you were allowed to con=
nect.
No one dies from an attack on twitter. Let the court/justice system deal wi=
th it whenever they get around to it. It keeps IT folks in jobs all over th=
e place, gives the news things to write about, and gives the NANOG mail ser=
vers something to use the network for.=20
Intelligence/security folks are tasked to deal with other things and with a=
real level of severity -- and it's quantifiable (at least in theory ;) ).=
=20
Another point, security is ephemeral - A wall used to be the "secure as pos=
sible" solution to protect cities from invaders. An entertainment novelty i=
n China rendered them obsolete when this black powder was reapplied to warf=
are. Some attacks (e.g. botnets) can only exist because we all have done a =
great job building networks over the last 15 years. Now we have new challen=
ges. They all take their own time to mature and address.
Deepak Jain
AiNET
