Security in Opened versus Closed Systems – The Dance of Boltzmann, Coase and Moore Presented By Chad Frommeyer

Introduction Abstract/Introduction Security Reliability Growth Symmetry Breaking Real World Problems Conclusion

Abstract/Introduction Open Versus Closed Systems Source code availability –Benefits Hackers/Attacks? –Benefits Defenders/Security? Is there a clear answer?

Security Reliability Growth A MTBF of x requires x hours of testing Failure time observed by a tester depends on initial quality of code and the amount of time testing: K/t (Alpha testing with source knowledge) Beta testing without knowledge of source code decreases the probability of finding a bug because the tester can only test various combinations of input Probability decreases by a factor of Lambda(l): K/lt

Security Reliability Growth Initial alpha testing now involves more restrictions: K/t With bugs that are harder to find Statement: Open and proprietary software will exhibit the same level of reliability growth Why: Bug is easy or hard to find, still results in the same reliability growth

Symmetry Breaking Open and closed systems are equally secure in an ideal world Attackers will however find and exploit phenomena to break this symmetry

Symmetry Breaking Transient costs –Vulnerability Patch Time to Market Low cost for Open Source High cost for Closed Transaction Costs –Fixing Bugs found During Beta Testing Open source results in more bugs earlier Closed source would have less cost of bug fixing during early stages of testing

Symmetry Breaking Vendor Behavior –Motivated to create a better code/product –Patch Delivery/Shipping May be considered to undermine security statements Vendors are given a grace period before having to publish a patch

Symmetry Breaking Testing Focus –Testing of newly added code is important, and open source allows testers to identify what is new –Open source testing may not have consistent focus to all functionality

Symmetry Breaking Reporting Bugs –Defenders of open and closed systems are equally as likely to report a bug –Equal amount of effort is typically required for both open and closed systems

Real World Problems Information security a high priority Copyright Protection -- DMCA

Real World Problems TCPA –Trusted Computing Platform Alliance –Digital Rights management in a PC –Monitors Machine State for changes in hardware and software –Too many changes recognized requires recertification with vendors –Vendors must approve the state of the machine

Real World Problems TCPA –Allows vendors to recognize trusted and non trusted environments –Non trusted environments will not have all available functionality from vendors –Can cause data files to be encrypted with TCPA keys which allows control of who can open what files

Real World Problems TCPA issues –Who/How will it be governed –How will this effect European Union –Who will write regulations for Europe –Will this stifle open source

Real World Problems TCPA – Competition Issues –Gives vendors the right to control who and what can open the data files –This gives the potential for monopolization of certain markets –This provides more protection against reverse engineering –Proprietary standards can often benefit the ones creating the standards

Real World Problems TCPA in Production –IBM claims compliance on its laptops –Microsoft XP and the X-Box claim that certain features are compliant

Real World Problems TCPA Economics –Products that are successful and TCPA compliant can control all related products –Any product that is to be written to comply with a TCPA compliant product must first go through the original product manufacturer –Venture Capitalists will require TCPA compliance to protect investements

Real World Problems TCPA in the Flattened world –TCPA creates a problem within the “Flat” world –In the flat world everyone has the ability to challenge the marketplace even the two man company –This will set that back, and possibly stifle creativity from the smaller competitors

Conclusion Access to source help or hinder? –Fix bugs easier due to accessible source –Develop exploits with less effort –Answer: In a perfect world neither benefits Functionality is more an issue than reliability to the vendor Security for vendor means securing their place in the market versus protecting the user

Conclusion TCPA doesn’t help the user as it is suggested TCPA helps the Vendor crush competition Questions