Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
Hopefully one day we can get away from systems that are vulnerable by design such as Windows, Linux, iOS, AWS, etc. where security was not considered during their design process and are thus structurally doomed to perpetual vulnerability as decades of history have shown that security can not be bolted on. Only a greenfield redesign incorporating security designed, verified, and demonstrated to thwart the best efforts of nation-state attackers such as the NSA is adequate for the future. Even now we see commercial systems regularly targeted by groups identified as nation-state or state-sponsored attackers, so anything less than stopping nation-state attackers is inadequate to protect against expected and proven threats.<p>Luckily, we have historically had systems and certification processes adequate for the task such as the Orange Book Level A1 which SCOMP and GEMSOS [1] were successfully validated against, and the Common Criteria SKPP [2] which required a NSA penetration test with no identified deficiencies that INTEGRITY-178B [3] was successfully validated against. The practical evaluations obviously being in addition to the formal specifications and formal proofs of correctness needed to demonstrate a secure design as part of the validation process.<p>Only by the application of principles used there, which have demonstrated success against nation-state attackers, to do greenfield redesigns of the entire computing stack is meaningful security against proven threats possible. Everything else is lipstick on a pig that is attempting to bolt on security which has never once succeeded in providing meaningful security against the threats we find ourselves faced with today despite decades of effort, billions of dollars, and endless failed attempted validations by large software companies via these same certification processes. In fact, so many, such as Microsoft and Apple, have failed that the Common Criteria standard [4] itself points out that (to paraphrase a bit) it is likely economically infeasible to retrofit an existing product line to protect against attackers with a &quot;Moderate attack potential&quot; as nobody has ever succeeded.<p>[1] <a href="https:&#x2F;&#x2F;www.cse.psu.edu&#x2F;~trj1&#x2F;cse443-s12&#x2F;docs&#x2F;ch6.pdf" rel="nofollow">https:&#x2F;&#x2F;www.cse.psu.edu&#x2F;~trj1&#x2F;cse443-s12&#x2F;docs&#x2F;ch6.pdf</a><p>[2] <a href="https:&#x2F;&#x2F;www.commoncriteriaportal.org&#x2F;files&#x2F;ppfiles&#x2F;pp_skpp_hr_v1.03.pdf" rel="nofollow">https:&#x2F;&#x2F;www.commoncriteriaportal.org&#x2F;files&#x2F;ppfiles&#x2F;pp_skpp_h...</a> Page 116<p>[3] <a href="https:&#x2F;&#x2F;www.commoncriteriaportal.org&#x2F;files&#x2F;epfiles&#x2F;st_vid10362-vr.pdf" rel="nofollow">https:&#x2F;&#x2F;www.commoncriteriaportal.org&#x2F;files&#x2F;epfiles&#x2F;st_vid103...</a><p>[4] <a href="https:&#x2F;&#x2F;www.commoncriteriaportal.org&#x2F;files&#x2F;ccfiles&#x2F;CCPART3V3.1R5.pdf" rel="nofollow">https:&#x2F;&#x2F;www.commoncriteriaportal.org&#x2F;files&#x2F;ccfiles&#x2F;CCPART3V3...</a> Page 39