TNC 2002, Limerick©The JNT Association, 2002 Moores Law of Computer Security Andrew Cormack UKERNA

TNC 2002, Limerick©The JNT Association, 2002 Moores Law (1965) Gordon Moore, co-founder of Intel Number of transistors per square inch on integrated circuits had doubled every year since the IC was invented. Predicted that this trend would continue for the foreseeable future. In subsequent years, the pace slowed down a bit, but data density has doubled approximately every 18 months, and this is the current definition of Moore's Law, which Moore himself has blessed. Most experts, including Moore himself, expect Moore's Law to hold for at least another two decades. Webopedia.com (1998)

TNC 2002, Limerick©The JNT Association, 2002 Moores Law of Intel CPUs George Watson, University of Delaware

TNC 2002, Limerick©The JNT Association, 2002 A sample of papers and articles Is there a Moores Law for data traffic? Our incredibly shrinking storage Can we get our economy to grow in synch with Moores Law? Moores Law influences fiber optic development Music, Morality and Moores Law

TNC 2002, Limerick©The JNT Association, 2002 Moores Law of other things Network traffic Disk space Money Bandwidth Crime What about security?

TNC 2002, Limerick©The JNT Association, 2002 CERT/CC vulnerability notes From:

TNC 2002, Limerick©The JNT Association, 2002 CERT/CC incident reports From:

TNC 2002, Limerick©The JNT Association, 2002 Moores Law of Security: Bad news!

TNC 2002, Limerick©The JNT Association, 2002 Why this exponential growth? Growth in Number of computers on the Internet Complexity of standard computers Bandwidth connecting those computers Number of would-be intruders And their level of technology ( not their skill) Bandwidth connecting intruders to computers CPU power available to the intruders

TNC 2002, Limerick©The JNT Association, 2002 And at the same time More reliance on computers For home banking, study, employment… How many of us rely on them for our reputations? More demand for ease of use Internet-ready computers in supermarkets More inter-dependent systems New routes for attack Unexpected consequences of attack

TNC 2002, Limerick©The JNT Association, 2002 Who benefits from growth? ?

TNC 2002, Limerick©The JNT Association, 2002 Talking of exponential growth… David Moore, CAIDA

TNC 2002, Limerick©The JNT Association, 2002 How bad can it get? Moores Law doubles every 18 months Incident reports double every 12 months Code Red II infections doubled every 20 minutes!

TNC 2002, Limerick©The JNT Association, 2002 Does it matter? Not (much) if networks are for research and play But governments are planning an e-future All government services on line by 2005 (UK) So computer (in)security affects Taxes Health Elections …

TNC 2002, Limerick©The JNT Association, 2002 Perception is even worse than reality Computer error is the commonest excuse We expect computers to fail So we wont even shop on line Resulting in Lack of understanding Irrational assessment of risks Wildly unpredictable behaviour

TNC 2002, Limerick©The JNT Association, 2002 What can we do about it? Safe computing needs to be the accepted norm Needs pro-active security by everyone Designers Programmers Implementers & maintainers Operators Users …and everyone else!

TNC 2002, Limerick©The JNT Association, 2002 Understand risks Everything has risks Lower tolerance on systems we dont understand Help others to understand Production Internet cant be the Wild West

TNC 2002, Limerick©The JNT Association, 2002 Safety Safety on the tarmac highway depends on Safe design and build Safe maintenance Safe vehicles Safe drivers Safe passengers Safety on the information super-highway does too!

TNC 2002, Limerick©The JNT Association, 2002