1 Raindrop

Future is Federation

Good post on Federation (of which globalization is the chief enabler) by Tom Barnett

The basic lesson I learned with my Packers is the same one cited here: "Technology has given individuals, microcultures and larger groups the means to survive."

The homogenizing/particularizing dichotomy of globalization on culture is not dissimilar to the impacts found in politics: the breaking down of fake states into constituent parts while simultaneously encouraging regional integration.

To me, this is the quintessential structure dynamic of globalization: more freedom below while more integration above. People faint over the notion of a world state, but that misreads the trends completely. We are headed for more forms of federation, not unification. Rather than have some global ID stamped on your forehead, Orwell-style, you're far more likely to have multiple passports.

Of course that future is already here, we now need to distribute the Claims based security protocols to support it, as described in the Laws of Identity

The use of the word claim is therefore more appropriate in a distributed and federated environment than alternate words such as “assertion,” which means “a confident and forceful statement of fact or belief.” (OED) In evolving from a closed domain model to an open, federated model, the situation is transformed into one where the party making an assertion and the party evaluating it may have a complex and even ambivalent relationship.

The world is already federated, its the computer that need to catch up, specifically the security protocols. CBAC gets us out of the world of point to point security and into a world where the security protocols reflect the assets which are composed of diverse resources. You can look at the evolution of security protocols on the web (oauth) and enterprise (SAML) that deliver on exactly this need.

10 Quick, Dirty and Cheap Things to Improve Enterprise Security

The most recent IEEE Security & Privacy Journal has a paper by James McGovern and I - "10 Quick, Dirty and Cheap Things to Improve Enterprise Security". We wanted to enumerate the many ways that security can be improved that don't require huge budgets, massive projects, or rafts of project management. Security does not have to require 7 figure projects, in fact many times its best to be quick (re-orgs happen so often that speed is super important), dirty (perfect software doesn't exist), and cheap (dollars are scarce). Here is our list:

1. Don't Just Market to Executives, Market to Developers

2. Leverage Container Services Wherever Possible

3. Encourage a Community Orientation

4. Focus Less on the Process and More on the Competence

5. Minimize the Ways to Attack an Application

6. Prioritize your Security Needs

7. Find Diamonds in your Backyard

8. Improve your Audit Logging

9. Send in the Crash Test Dummies

10. RTFM

11. Bonus Tip - Let Developers Be Successful

The paper was very fun to work on and I think will spur ideas, what quick, dirty and cheap ideas do you have to improve security?

Perverse Incentives

A major theme that Ross Anderson introduced is that Information Security is not just about policy (what the system's supposed to do), mechanism (delivering on the policies intent), and assurance (having some confidence that the mechanisms meet the policies goals). Its also about incentives. When incentives are mis-aligned, such as when the one who suffers the loss is not in a position to ensure safety against loss, then, well, you can expect bad things to happen regularly.

Of course, infosec is not alone in this regard and the great recession has provided many object lessons, perhaps none more than the one currently playing out between MGIC and Countrywide

MORTGAGE GUARANTY INSURANCE CORP., familiarly known as MGIC, which also has taken more than its share of lumps from the housing collapse, is wrestling with Countrywide over a bunch of the latter's bum mortgages it insured. At issue is whether those mortgages were mortally flawed from birth, something, alleges MGIC, that Countrywide had more than a little reason to be aware of.

In its complaint to the American Arbitration Association, MGIC makes no bones that it thinks Countrywide, eager to exploit the housing bubble, embarked on "a reckless strategy to attract new subprime and other high-risk business." And the insurer goes on to cite a clutch of cases to prove its point. We found the narrative lively reading (and we're grateful to Mark Hanson for bringing it to our attention).

There is, for example, the woman who bought a $600,000 house, claiming she worked as an account exec at a California investment firm, earned $13,494.03 (nice touch that three cents) a month, had a $45,000 bank account at Wells Fargo and, according to the insurance application, made a $30,000 down payment.

When MGIC nosed around, it discovered the investment firm she supposedly worked for didn't exist, neither did the bank account, she hadn't made a down payment and she actually earned $3,901.58 a month as a janitor at a medical facility.

In another instance, a $350,000 loan was extended by Countrywide to a fellow who wanted to buy a home valued at that amount and claimed he was a dairy foreman earning $10,5000 a month. Again, the snoops at MGIC discovered the guy was a milker at the dairy who earned $1,100 a month and signed the documents where he was told to -- even though he couldn't read English.

There's plenty more of the same in the complaint by MGIC charging that Countrywide agents were complicit in various and sundry deceptions. Frankly, we found it all something of a hoot, though it's not hard to see why MGIC isn't laughing. But even comic tales typically embody a moral, and this one is no exception. Fraud played no small role in the great demolition of housing, but the principal perpetrators were never diligently pursued and, for the most part, went crying all the way to the bank. Moral hazard, anyone?

Of course, Countrywide stood to benefit by generating loans, but in no way was forced to eat its own dog food or suffer downside risk based on the quality of the loans. MGIC's claim goes on to say that Countrywide relaxed its underwriting standards "to encourage Countrywide loan officers to systematically ignore risk in order to attract and retain business", which led to Counrtywide's loans defaulting three times the rate than other MGIC insured loans.