Battlestar Security Plan
How my wife's buggy Windows laptop, a presentation I had to give on enterprise security, and a classic episode of Battlestar Galactica led to a new level of clarity on cybersecurity.
Anyone who has had to wrestle with the challenges of security at home or the office quickly succumbs to frustration. The number of products intended to 'help' just seem to slow down all the real work you want to do. Even worse, the very security systems you put in place require a significant amount of your attention to ensure they are working properly and that you are responding to them appropriately. We're constantly trying to block activities or behaviors that are potentially risky, while simultaneously scanning all our digital assets for signatures of hidden breaches or malware. It is a new overhead to digital work that is growing in cost more than healthcare, yet the only solutions on the market lead to more of the same.
Making it all worse is that the time and cost of dealing with a security failure is at least an order of magnitude worse than the hassle of maintenance. It's the emotional equivalent of hearing a car crash in your driveway, but not being able to look out the window. Did someone just total your car? Was it just someone hitting the mailbox? Was anyone hurt? Who do I call, the police or an ambulance or a tow truck? If you're lucky with a security failure the problem will be something you can actually find. What is more likely is you're never quite sure what was compromised and what 'compromised' means.
Thank You Commander Adama
So my wife's Windows laptop has some bizarre malware on it. We have the full-boat Norton Security suite all up-to-date, perform regular backups, and the riskiest behavior is surfing reviews of summer camps. As the sole member of our homes IT department, it is left to me to figure out what went wrong and how to get everything back to normal. In this state of frustration I drift off to watch a great episode of Battlestar Galactica (the SyFy version, not the old one from the 70's). In the BSG universe cybersecurity is even more important because the computers (Cylons) are trying to kill us (people). With that asymmetrical threat cybersecurity is a lot more black and white. There are trusted systems and then everything else. 'Everything else' being stuff that you never connect to or use unless you want to risk killing everyone (see above). There are no 'DMZ' areas. There is no 'scanning for viruses'. The only trusted systems are the ones you *know* are trusted and anything else is bad. "So say we all!"
Time to Change Before The Cylons Show Up
The clarity of cybersecurity in the BSG world comes from 2 main truths: 1) if you don't know a system is clean, you assume it's compromised, and 2) compromised systems will likely kill you. Setting aside the latter, the former is actually a powerful change in perspective. If we change our security stance from prevention and defense to validation, several things change. For one, if you have an asset, let's say a individuals laptop, and there is some indication that it is no longer secure, you do NOT attempt to correct it. The unverified system is taken offline, nuked and rebuilt from a known safe configuration. Data is completely fungible, and never sacrosanct on any one asset. All components of the IT infrastructure, servers, PCs, laptops, routers, etc... all have their own tests for validation and if they fail they are taken offline and recycled back to a completely fresh, valid state.
Interestingly, what makes this kind of security stance feasible now is the explosion in 'cloud' assets. More and more of our core data and applications exist on commodity cloud solutions. Bringing up new assets is a matter of a few commands and mouse clicks already, so to eliminate a component and replace it is no longer a multi-hour project. And though our individual laptops and PCs are not virtual, the reality is that most of the data we need to do our work is. Think of how easy it is to switch to a new phone now, compared to the past. It is easy precisely because all our data is mirrored outside the device, as are the applications we use. There is no reason why switching to a new laptop should be any less smooth.
The implications of this kind of security stance are also in-line with many IT best practices.
- Any single asset should be considered expendable. That means data needs to be replicated in ways to assure access to it.
- All assets exist in either an affirmed, valid state or are recycled. There is no 'fixing' a problem or removing a virus. Once the valid state has been compromised the system is completely replaced.
This is not a panacea, but it is a shift we will be seeing more and more as the risks of cyber security failures increase.