In 1999, security technologist Bruce Schneier published "A Plea for Simplicity." In the blog, he famously wrote, "You can't secure what you don't understand" and "the worst enemy of security is complexity." Schneier explained that analyzing a system's security becomes more difficult as its complexity increases. His goal was to convince the technology sector to "slow down, simplify, and try to add security."
More than 20 years later, Schneier's plea seems naive and even quaint. Innovation has become a force of nature; it will neither stop nor slow down. More innovation means more features, which inherently means more complexity. We all want secure systems, but no one is willing to slow the march of progress to make that happen.
In "We Work the Black Seam," Sting sings, "They build machines that they can't control and bury the waste in a great big hole." Although he was singing about nuclear energy, the lament is true for many modern technologies — especially for computer systems and networks. The modern computer network is almost unbelievably complex. Thousands of nodes connect through millions of potential network paths. Most networks are not designed so much as they evolve. Corporations grow, contract, connect to suppliers, and merge with competitors. As they do, their network expands, shrinks, and morphs like a living entity. At any moment, no one is sure what devices are on it, exactly how they are all connected, or what all the security implications are. It is humanly impossible to keep track of thousands of ..
Support the originator by clicking the read the rest link below.
