Hmmm,
The key word has to be "informal" because by definition it implies an "inability to be consistently applied"Quote:
experts that feel informal security models are better?
That has just got to be a nightmare?
By definition, the formal model IS the superset, because it is what you derive your application models (subsets) from.
Anything above the formal model basically is "blue cloud" stuff, as in it hasn't been modelled yet
;)
Very observant young Will. Indeed he is a professor there and our paths have crossed more than once.Quote:
Yesssss doctor, if my recollection serves me correct, he's a professor at the institution where you obtained your masters.
I think the world is a much more interesting place with you in it young Will. For that reason, do not fear, I will not come calling.
;)
Oh joy... more anti-Trusted Computing garbage.
They should at least attempt to make sense...
They say that the original idea of trusted computing is to allow you, the user to decide what to trust and what not to trust. This is called, "normal computing" your current Windows/Mac/Linux/Unix system works in this manner. You and you alone decide what the system can run... but where is the trust?
You can't trust the system to protect you. Why not? Because you have final say over what it can run and how. The system has no say in the matter.
You can't trust the application vendors to protect you, again you decide how and if to use those applications. The vendors don't control what resources you provide their applications or how you use them. Furthermore, how do you even know that the application you are getting from them is even any good? Maybe it contains spyware or adware or worse?
So who can you trust? The hardware? Bah, it'll do whatever you tell it to.
It looks like this method of leaving all the choice of trust up to the user really doesn't grant any trust at all. So... back to history class... what is a trusted computer? It used to be a system that had specific hierarchical controls that ensured you could trust what the system told you. Ideally it would remain free from subversion by users or malware... even if you, the user made a mistake.
If only there was some way to get back to that idealic state... where users have control over their computers, even through poor choices or even being tricked into trusting the wrong things (unless you married the first girl you kissed... you have at some point put your trust in the wrong thing...). If only there was some way for users to have some sort of safety net... to ensure that faulty choices don't destroy the trust they place in their systems!
Oh wait... that's right... the TCPA does exactly that. By dividing the system into several hierarchical components, users can have complete control over what applications they install and how they use their computer... and at the same time be safer in knowing that it is highly unlikely that ANYTHING they do, no matter how bad a choice of trusting the wrong thing... at the end of the day they can still trust their system.
This of course is merely one of the many, many benefits of the new trusted computing initiative.
cheers,
catch
Catchy, nothing you have said thus far is incorrect. Believe it or not, I stand more or less on the same side of the trust/distrust line that you do.
You probably know that I'm very familiar with all the models and standards you've mentioned and so passionately herald.
Here is my only issue (other than people will ultimately ruin any perfect model). Unless you can wrap it up and sell it to your organization, it’s all worthless. I’ve stood on the same soapbox as you do now for more years than I care to recall. After a while, I realized that the models weren’t broken, the organization was. If I ever hoped to implement these models in the organization, the root problem had to be addressed first.
To this day, I’m still looking for the magic bullet. I’ve made significant gains here and there but unless there is 100% buy in, the conditions are not right for these models to work.
That said, how would you sell these models, standards and such to the organization?
Hmmm, this conversation is interesting, but might I be allowed to introduce a bit of humour?
Please try the Speer 485grain SJSWHP in .45ACP..............I suggest 4.7 of "Bullseye" as a starting point, and adjust your load from there :DQuote:
To this day, I’m still looking for the magic bullet.
You've already answered that; I trust myself, not Bill Gates.Quote:
You and you alone decide what the system can run... but where is the trust?
Damn straight, because I trust myself, not Dell or Gateway.Quote:
You can't trust the system to protect you. Why not? Because you have final say over what it can run and how. The system has no say in the matter.
You're making this too easy; making my arguments for me.Quote:
You can't trust the application vendors to protect you, again you decide how and if to use those applications. The vendors don't control what resources you provide their applications or how you use them. Furthermore, how do you even know that the application you are getting from them is even any good? Maybe it contains spyware or adware or worse?
Once again, repeat after me.Quote:
So who can you trust? The hardware? Bah, it'll do whatever you tell it to.
I trust myself, because I can force the hardware to obey me
not Steve Jobs.
I already have one, because I trust myself, not the US Congress.Quote:
If only there was some way for users to have some sort of safety net.
And i especially don't trust Hillary.Quote:
knowing that it is highly unlikely that ANYTHING they do, no matter how bad a choice of trusting the wrong thing...
:cool:
Well rc... if you trust yourself so much, why don't you make your own system? Or do you not trust yourself that much? Wouldn't it be nice to trust things beyond your own little sphere of control?
Maybe I don't trust you, I don't trust that you won't foolishly install a rootkit or get hacked... resulting in an attack against one of my systems from your compromised box.
Maybe I don't trust Johnny Neophyte not to have the same problem.
Where is my trust, or anyone else's?
The fact of the matter is, no one is forcing you to use a TCPA system... you'll just find that it will only be as useful as a non-TCPA system... and considering all the advancements resulting from TCPA you'll be left out. But at least you can go on trusting yourself to remain backward.
horsey... yeah I figured you took a point of common ground. How to sell a good model to a flawed organization (read as "more or less all organizations")? This is one of those questions they always ask during interviews... and to be honest I don't have a canned answer. The best I can hope for is the integration of whatever model through new programs/projects depending on my clout. Each time providing Sr. Management with analysis indicating the given model is somehow good for them (typically cheaper in some way is the best answer aside from "it'll keep you out of jail" which isn't even foolproof).
I always answer interviews in a similar manner, and it never seems to be treated as a good answer. I guess they don't care for something about my philosophy of organizational integration, not just blindly imposing my department's will to all I survey.
I had a company idea that I've been working on, and if I am unable to land an overseas job, or at least a far away job I might pursue the idea further... but that is workkits and walkthroughs for nearly all level of employee for a whole slew of standards and models. The idea is, if you can inform employees at a grass roots level about how a particular way of working can make their job easier or make them more efficient (and thus more likely to be promoted, in theory anyhow) that they will naturally start adopting elements making an eventual shift to full compliance a simple process. Following the idea of "Do this because it is better FOR YOU, and here is why." not just "Do this because I'm telling you to."
Ultimately knowledge is power, any staff wants to operate most easily and efficiently... by educating them you merely put a greater range of options in their hands.
I guess where employees are involved there is no magic bullet, but that doesn't mean the target is no good.
cheers,
catch
OK, so you hit on several elements that are key.
The first element is the assumption that the employee wants to do the right thing. This is the case most of the time.
The second element is that you understand that you must first figure out what motivates management to institute change. This varies by organization and even within the ranks of the same organization. Again. Not surprising that you also understand that it's never a 100% sell but a long journey where you hope to get as close to 100% as possible.
The third element is that you understand that the battle isn't necessarily most important at the management level, rather, equally at the end user level. I use a flank strategy here hitting both the top and the bottom while pressuring the middle. This simple military approach actually is quite effective in business/Govt. I've done wonders with simple security training classes for non technical staff. What we consider common sense they see as enlightenment.
So in the end, while you understand there are indeed perfect models, implementing them in imperfect conditions removes the perfect label. That said, would you agree with this statement?
--TH13
This is a complex issue... I believe that so long as the model is applied over a finite set of known or predictable events it is possible for the model be perfect... even within an otherwise imperfect system/organization.
If the model deals with or is applied to unlimited (finite but unbounded) sets of known and unknown events, it is no longer possible for the model to even be perfect. (The beauty and curse of this is the more you know, the more perfect models are possible heh)
Thus in an open system, like dealing with people (and not in mere avatars or "subjects" like in closed systems) the whole notion of perfection goes out the window.
This doesn't mean that there are no really good models which can be applied to unlimited sets, they just are not perfect. ;)
I can't even tell you how many times I've advised companies to not filter workstations web access by content. Managers get a little power, and suddenly they become Stalin. Treat your employees with respect and valued professionals and they'll act the part. Treat them like children... and guess what? This doesn't mean that a system of protection can be ignored... but keep it reasonable.Quote:
The first element is the assumption that the employee wants to do the right thing. This is the case most of the time.
cheers,
catch