The Era of Systems Security: How the Profession of the Information Protection Engineer Has Changed

We are in the middle of momentous changes in the way security is carried out. Over the last decade the landscape of information protection has been transformed beyond recognition, and in order to understand the future it is necessary to realize how the role of specialists, the technologies and the very philosophy of security have changed.

From an "Archipelago" to a Single System, and the Change of Roles

Ten years ago the head of the security service of a large company was, as a rule, a retired military officer or policeman. Computer security was considered an insignificant narrow specialty, which was handed over to the computer department. Physical guarding and locks remained in the charge of this same head. However, in the perspective of the next ten years the head will become a systems engineer. Physical security (locks and guarding) will be outsourced to specialized facilities management companies.
Formerly, security technologies represented an "archipelago" of mutually suspicious islands: cryptologists, OS protection specialists, developers of burglar alarms and chemists who created inks for banknotes. Each considered that the world ended at his shore. Today these islands are being joined by bridges. Practitioners understand that a systems view is necessary. The chemist who creates inks for banknotes must understand digital watermarks, and the cryptologist cannot confine himself merely to the confidentiality of communication channels.

Rethinking the Very Essence of Security

Ten years ago information security was defined by the triad "confidentiality, integrity and availability". Today in many applications these priorities are changing places. Security engineering now consists in systems remaining predictably reliable in the face of malicious actions, errors, accidents and even coercion.
Since attacks shift from the "hardware" to people, human, institutional and economic factors are becoming as important as technical ones. The goals of protection become more subtle and closer to business applications: confidentiality, safety and accountability. At the same time conflicts between goals often arise, for example when one side requires accountability and the other requires deniability.

The Collapse of Old Illusions and Complexity as the Main Enemy

Formerly the best security products were developed for governments in conditions of secrecy and were produced by defense contractors on a "cost plus" basis. Today commercial use exceeds government use many times over. In the future civilian agencies will use standard commercial technologies, and the military — commercial off-the-shelf (COTS) solutions. Government policy has also changed: if formerly it was devoted to maintaining the effectiveness of the huge communications intelligence networks of the Cold War era, then by the year 2000 control over cryptography had become irrelevant and was abolished. Confidentiality, DRM, consumer rights protection and electronic voting came to the fore.
The main technical challenge today has become systems integration and assurance. Ten years ago the inhabitants of the "islands" were full of confidence in their products: cryptologists believed that ciphers could not be broken, smart card manufacturers asserted that their chips were physically impossible to probe, the creators of holograms declared that forgery required a doctoral degree and $20 million worth of equipment, bankers considered that their ATMs could not mistakenly debit funds, the adepts of multilevel security (MLS) supposed that their approach would solve all problems, and Common Criteria evaluations were always honest and competent.
Today these familiar certainties have evaporated. Security has become part of the broader problem of dependability. We create ever better tools that allow us to climb ever higher up the mountain of complexity, but in the end we still fall off it. The proportion of large complex systems projects that fail has remained at the level of the 1970s, but the scale of catastrophes today is immeasurably greater.
Complexity is the real enemy of security. The distinction between "external" and "internal" violators, which formerly simplified the task, is rapidly disappearing. If formerly protection rested on a few large ideas and precise formulations, now it represents a diverse, imprecise and heuristic body of knowledge. The life cycle of systems has changed: if formerly it was a closed project with clear boundaries, now systems evolve and accumulate functions without limits.

Economics, Corporate Memory and Regulatory Failures

Changes in the nature of work also play their part. Formerly the chief internal auditor of a bank remembered all the frauds of the last 30 years and did not allow the IT department to repeat old mistakes. The new corporate culture with its staff turnover and "permanent revolution" (as Mao called it) has destroyed corporate memory.
Economics guarantees that insecure systems will be created, and responsibility shifted onto others. Governments try to keep up, but they are too slow and susceptible to the influence of lobbyists. We face a series of regulatory failures.

A Portrait of the Security Engineer of the 21st Century

The protection of information in computer systems is no longer a scientific discipline — it is engineering. The security engineer of the 21st century bears responsibility for systems that constantly evolve and face a changing spectrum of threats.
At his disposal is a large set of tools. He needs constantly to maintain his technical level: to understand the latest attacks, to be able to use new tools and to follow legal and political trends. He requires a solid intellectual foundation: cryptology, access control, information flows, networks and signal detection. He must also understand the basics of management: how accounts work, the principles of finance and the client's business processes.
But most important of all is the ability to manage technologies and to participate effectively in the process of the system's evolution in order to satisfy changing business needs. The ability to communicate with business people, and not only with other engineers, will become a vital skill, and experience will be of enormous importance. Such a specialist is unlikely ever to remain without work or to be bored.

A Debt to Society: Combating Fear

Finally, the political and social context cannot be ignored. The violent growth of the industrial-security complex after the events of 11 September has become a scar on the world and on our profession. Our debt is to help it heal.
The author's path to solving this problem lies through research in the field of security engineering and security economics, in order to understand what works in the real world, and not only in the laboratory. The dissemination of knowledge is a key factor. Economic growth and education also help: it is precisely the poor and the uneducated who are easiest to intimidate by the whipping up of fear (both on the part of Western leaders and on the part of bin Laden).
At least in countries with an educated population, voters have begun to recognize the excesses of the "War on Terror". Democracy is a key mechanism of adaptation. Therefore the last and perhaps most important way in which security engineers can make their contribution is participation in political debate. The more actively we involve the people who direct the discussions about emerging threats, the faster our societies will be able to adapt to them.