do we really need bruce schneier?

there's a sacred cow in security, a living sacred cow by the name of bruce schneier... a cryptography expert, a squid enthusiast, and a self-proclaimed media whore, bruce schneier is one of the biggest names in security and he's asked if we really need the security industry...

according to bruce:

The primary reason the IT security industry exists is because IT products and services aren't naturally secure.

naturally secure? my reaction to those words is much like peter lindstrom's reaction, it seems to mean perfectly secure without 3rd party assistance (ie. inherently invulnerable) but that's just absurd... i know perfect security is impossible, you know perfect security is impossible, and bruce better darn well know that it's impossible otherwise what good is he as a security expert?

his very next sentence reads:

If computers were already secure against viruses, there wouldn't be any need for antivirus products.

now here it's quite clear he's talking about perfect security against viruses... there's just one problem, viral susceptibility is inherent to general purpose computers - so long as you can share data and the device can do more than a handful of narrowly defined things it can support viruses... this has been known for over 2 decades, i've said it here many times in the past, i've even said it in the comments on bruce's own blog so it's not as if he's never been exposed to the idea...

a really telling quote is the following:

The whole IT security industry is an accident -- an artifact of how the computer industry developed.

this suggests that security is only needed because of accidents/mistakes that happen when designing and implementing systems... this is a fundamental assumption that few people in security these days seem to question... a vulnerability is often described as a flaw, mistake, or error in the code - but this is one of the most common misconceptions i see about the nature of vulnerability as it ignores the prospect of inherent vulnerability... everyone always says that things should be made secure from the beginning instead of bolting security on after the fact, but the only way to avoid needing to add security after the fact is if it was perfectly secure from the beginning and once again, that's just not possible, not just because it's so hard to avoid all possible mistakes but because some forms of vulnerability aren't the result of a mistake... take a website, for example - there can only ever be a finite amount of bandwidth available for hosting that website so it will always be possible for an attacker (or group of attackers) to use up all of that bandwidth irrespective of any mistakes in the website or webhost or network or browser or operating system or any other component even remotely associated with such an attack...

bruce wants to believe that eventually security will be folded right into the products (like the OS) and services (like the network connection) so that 3rd party security products become redundant... this is, at it's heart, the logical conclusion to where the best-of-breed detractors see things going - after all, if security functionality is going to converge into single integrated products, it might as well converge right into the products that security is supposed to be protecting in the first place, right? unfortunately there will always be new and as yet unheard of attacks (and even existing attacks are not completely obviated by even the best security) so products and services can never be naturally secure and it will always be necessary to bolt on additional security after the fact...

so the question is, has bruce jumped the shark and do we need him badly enough that we'll follow...