the difference between security and risk

the concepts of security and risk are often used interchangably, in part because risk is often thought of as a security-related concept, but they are in fact very different things and using one to mean the other often leads to confusion and ultimately dilution of the terms themselves...

to start off with, security is a property of a system (and i mean system in the most general sense, not just a computer system or operating system)... some people will tell you security is a process and i myself have used that phrase, but that phrase is actually meant to convey the fact that achieving and maintaining a reasonable level of security is a (never ending) process...

security can be thought of as the relative absense of serious vulnerabilities... the fewer vulnerabilities there are and the less serious they are the more secure the system is... now it's important to realize that we don't and can't know all the vulnerabilities of any system so security is fundamentally unmeasurable and unquantifiable... instead we have to estimate, we have to make our best guess based on the number and severity of known vulnerabilities of the system, and by severity i mean the extent to which the value of the system is lost if the vulnerability in question is exploited... the more insecurities there are and/or the more severe they are, the less secure the system is believed to be... of course, as it is ultimately just a guess - arguments over which browser or which operating system is more secure is about as meaningful as arguing over which flavour of icecream is best...

risk, on the other hand, is the chance of a bad thing (or any one of a class of bad things) happening - in this context, the chance of a vulnerability getting exploited... unlike security which depends solely on the system, risk depends on the the time and effort available to mount an attack... time comes from the window of exposure - the longer that window is open the more time the attacker community has to find a workable exploit and to find YOU, and so the greater the chance they'll do both... effort comes from the attackers themselves... the risk of a security breach is directly affected by the value of that breach, not to the victim, but to the attacker community... even a low impact vulnerability can have a high risk of being found and exploited if it's a desirable target... the more desirable the breach, the more people there will be looking at it, the more man-hours worth of effort will go into trying to find a successful attack, the higher the chance of finding a successful attack while the target is still interesting and the wider the attack is likely to be deployed... what does the the attacker community value? they want the biggest bang (figuratively) for the buck they can get - the more popular the system, the more overall impact they can have with a given unit of effort...

now, while security and risk are quite different, they do tend to interact with one another... low risk, for example, can obscure the presence of insecurities from the public... the lower the risk, the less likely a real exploit will ever see the light of day, regardless of the severity of any vulnerabilities that may be present... sometimes obscurity is used to try to affect lower risk - this is where the myth of security through obscurity comes from... clearly obscurity can't do anything about the presence of vulnerabilities except make them less likely to be found... that's not to say it can actually prevent the attacker community from discovering and exploiting the vulnerabilities because it can't... obscurity is just a way of managing risk, however correcting the vulnerability (when possible) is by far a more effective means of managing that risk and should be the preferred method... unfortunately some vulnerabilities are not correctable, either by virtue of being inherent in the fundamental building blocks of the system (such as virus infectability being inherent to the general purpose computing platform) or the result of some social rather than technical problem, so sometimes alternative risk management techniques like obscurity are reasonable... i know some people don't want to hear that, some people worship at the altar of full-disclosure, but to them all i can say is that a foolish consistency is the hobgoblin of little minds... if the risk can't be managed by eliminating the vulnerability then another method has to be used...

high risk obviously can be very good at revealing the presence of insecurities (usually to the detriment of the victim) - as more new vulnerabilities are found in the system, the total number of known vulnerabilities goes up and the security estimate for that system goes down... the security estimate can go back up when those vulnerabilities are corrected, but it doesn't go all the way back since each new vulnerability reflects more and more poorly on the underlying quality of the system... it isn't until a highly attractive target endures long periods without a breach that significant improvements in the security estimate are made... high risk can also magnify the public perception of insecurities, even when they're low severity ones... because of the confusion between risk and security, the higher the rate and wider the deployment of attacks makes the severity of the vulnerability seem worse even though the number of attacks isn't really related to the number of vulnerabilities or their severity... this translates into a lower confidence in the security of the system, however our security estimates are not based on public opinion and therefore may not be significantly changed... take, for example, the LSASS vulnerability in windows - with each new piece of malware written to exploit it the security of windows remains the same and the severity of the vulnerability remains unchanged, but the chance of a windows system that exposes that vulnerability to the internet getting breached goes up...

low security can increase the risk of a breach dramatically when combined with popularity... the attacker community is made up of humans after all, and humans are essentially lazy creatures so a widely deployed (popular) highly insecure system represents exactly the kind of low-hanging fruit that is most attractive to them... the fact that a system is highly insecure often means there are a wide variety of vulnerabilities for the attacker to choose from and so it's easier to find one that suits his/her needs and the fact that the system is popular makes it more worth the effort to look for one... when not combined with populatity, low security can languish in obscurity never knowing a successful exploit... low security always increases overall risk to some extent, but how much is determined by other things...

as you'd expect, high security lowers the overall risk of a breach... as vulnerabilities are eliminated the total number of remaining vulnerabilities goes down and so does the remaining avenues of attack... the fewer of those there are, the harder it is to find one and thus the lower the chances that one will be found... the risks of finding any particular remaining remaining vulnerability doesn't necessarily change that much, of course, but the chances of finding one that is no longer there obviously drops to zero... it's important to note that this is only true for instances of the system that are up-to-date - after a vulnerability has been found and publicized through the availability of a security update it becomes quite easy for the attacker community to use it against those instances of a system which haven't yet eliminated it through updating/upgrading...

while it may seem at first glance that there's a relationship between a high number of attacks and low security, that's a correlation rather than a causal relationship... the fact that low security but unpopular (and therefore low risk) systems generally receive few attacks indicates that attacks are related more closely to high risk than to low security...

so now that you know all this, what can you do with it? well for one you can better evaluate claims of high/low security (we'll never really know which operating system or which browser is more secure)... you should also be able to recognize which issues actually pertain to risk and why/how they're important to you and/or your organization... clearly you want high security, you want there to be as few potential avenues for attack as possible, but you also want low risk - there can be no perfect security, there will always be a few avenues for attack and having a low number of them doesn't help much if those avenues are being used frequently...

why microsoft hates 3rd party patches

it's not exactly news anymore, but it's happened again - a bug has cropped up in microsoft's software that is so serious that outside parties have been forced to create patches for it due to microsoft's glacial pace...

microsoft doesn't like this, it doesn't like this one bit... it makes them look like chumps... here they are with full access to the source code, tens of thousands of developers, and billions of dollars to throw around and some guy at some security firm somewhere makes a patch faster than they can? they do not want these kinds of comparisons to happen, they do not want people to see what kind of performance the microsoft security machine is really giving them...

one of the things they say is that only microsoft patches are guaranteed to work with everything... they have all these tests they need to perform to make sure they don't break anything and comparing their process to what 3rd party patchers do just isn't fair... problem is, not only are microsoft's patches NOT guaranteed (there have been multiple instances where their patches inadvertently broke things) but it also underlines the fact that compatibility rather than security is their first priority... and this comes from a program manager at microsoft's security response center....

microsoft's security efforts are a failure, a farce, and the public has lost confidence in them... and not just a little bit of confidence either; the WMF incident back in december and now the new IE vulnerability just a few months later, both with wide adoption of 3rd party patches, indicates that this is a watershed event... confidence in microsoft's security efforts has crossed a threshold...

the worst thing, for microsoft at least, is that they're losing control over a captive market... 3rd party patches open the door for competition for their paid support program(s), as well as eat away at the leverage they have for getting people to upgrade by ending support for older versions of their products... ending support has a lot less meaning when other people are willing to pick up the slack...

microsoft talks a good game about security, i saw one of them talk about it at RSA2002, they go to great lengths, but they seriously underestimate the significance of risk when they leave the window of exposure open as long as they do while trying to make the perfect patch... when there's a serious exploit in the wild there should be no question of whether or not to release a patch out of cycle, it should be released as soon as it's made and refined and updated after the fact... so long as a seasoned expert at writing secure code is making the patch (rather than some green code monkey they're trying to train), any problems that might arise from a rushed patch are almost certainly going to be less severe than than the one it's supposed to fix... further, new vulnerabilities from a rushed patch would require additional time and effort from the attacker community to exploit so as long as the development of the patch continues after the initial release so that updates to the patch can be pushed out if needed...

mac computers and viruses

there's been a lot of coverage lately of the issue of mac security, unix, and viruses, and i think it's time to dispell a few myths...

1. macs are immune to viruses...
   
   they most certainly are not... OSX/Leap is an overwriting virus and instant messenger worm that operates on the mac osx platform...


2. macs were immune to viruses...
   
   they were never immune to viruses - no general purpose computer system can be immune to viruses...


3. macs were virus-free before OSX/Leap...
   
   OSX/Leap wasn't the first mac virus, it was just the first virus for mac osx... previous versions of the mac operating system had other viruses... not to mention some ms office macro viruses were able to operate on macs just like on windows machines, because ms office is a platform in and of itself...


4. the fact that it took so long for mac osx to get compromised means that mac osx is more secure than windows...
   
   it actually means no such thing... because of the smaller user-base a compromise of the mac osx platform has less payoff for the attacker community, therefore they aren't as interested in it, therefore there are fewer people working on it, therefore there are less man-hours going into the effort, therefore it takes longer and/or has a lower probability of success... mac osx may or may not be more secure than windows, but the key to it's apparent resistance to attack is that it's a lower risk platform (there's a big difference between security and risk, but i'll leave that for another time)...


5. mac osx is more secure and/or immune against viruses because it's based on unix...
   
   the first academic study of viruses was carried out by fred cohen on a professionally administrated unix system and the virus(es) still worked (see this paper for details)... unix is just as capable of supporting viral infection as any other OS...


6. mac osx is more secure than windows...
   
   maybe (and so this isn't technically a myth) but that doesn't mean there aren't security vulnerabilities or that mac users don't have to worry about security... with the release of viruses for the platform and the discovery of arbitrary code execution exploits it's clear that macs have many of the same security problems that windows has and as macs become more popular more and more effort will go into finding them... also consider that, due in part to these myths, mac users are less accustomed to thinking about security and so can be fool by less sophisticated ploys... users are a big part of the security of the system (often users are the weakest link in that security) so mac users really should not be taking security lightly as they're at greater risk than they probably realize...