CyberSecurity

The Future of Information Security

by Martin Libicki

To illustrate the future of information security, imagine me giving you a piece of information, to wit, that the interests of your employers, the nation's security, and world peace would be greatly advanced if you were to, literally, take a long walk off a short pier. Few of you are likely to do that -- even though I have conveyed a piece of information to a set of very complex information-processing systems, that is, you, the reader.

The basic reasons are obvious: I have no authority to make you do anything, the act suggested is something no sane person would do, and there is little if anything I can say that will make you insane. In a nutshell one can recognize the three primary methods by which information systems are protected: authorization, message filtration, and ensuring the integrity of core processes -- or to put it more in terms of today's tools: good passwords, firewalls, and virus detectors.

However, imagine me as an internationally recognized expert in information warfare asserting that the threat of information warfare would be to the 21st century what the threat of nuclear warfare was to the latter half of the 20th century. To my mind this is still lunacy, albeit a more subtle one, but it is a proposition which some people would be more inclined to accept -- indeed, many act as though they do. This piece of information does not get blocked by the obvious filters. But, it too, is potentially dangerous.

There, in a nutshell is the message. As computers become smarter, more sophisticated, and more flexible, they will become more like us. That is, they will acquire the reliable information security provisions that all of us carry around as our basic make-up. Yet, as they become more like us, they will begin to ingest information at the semantic level from outside sources as we do (as in fact, you are doing now), and will thus be heir to more subtle but no less problematic forms of information warfare. Or, to put it simply: today's problems will pass and tomorrow's will rise -- I just cannot say exactly when either will occur or how quickly. What I can try to do is lay out some indicators and warnings of each.

It is important to note that forecasts about information security are inevitably forecasts about information systems themselves. A large part of what makes information systems open to attack is that they contain bugs, often and pertinently referred to as undocumented features. The more experience one has with any one piece of software the more holes can be closed. Yet, even a perfect fix lasts only until the next innovation hits the system. To give an example: it used to be one could open up any E-mail without worrying about what it might do to your system. But, over time, E-mail has come to contain attachments; attachments often come with activatable macros, and macros, in turn, may carry viruses. This is a problem that simply did not exist several years ago. In years to come, one might make similar statements for objects over networks, ActiveX files, and others in that menagerie. As such, the art of forecasting tomorrow's troubles is intimately related with the art of forecasting tomorrow's pointless wonders.

Key Trends

Let's start off by looking at some of the key factors that influence the current level of information security: legacy systems, the threat, consciousness of the threat, operating systems, security tools, the cost of storage, the Internet, and cryptographic methods. This examination is offered with the caveat, of course, the current state is a matter of serious dispute. Not every system fault is the result of a hacker; but some are. Many such faults go unnoticed. And, a record of what is, is an indicator, but only an indicator of what could be.

Legacy Systems: In the old days, information systems were relatively secure by virtue of being hosted on large proprietary machines and connected to very little. What makes systems vulnerable is the shift to smaller and far more open systems (not built with security in mind) coupled with the rise of networking. For many of us, small open networked systems are the here and now; for others, however, they are still in the future. Sometimes it takes a situation like the Y2K bug to remind us that while the leading edge of technology races ahead, the lagging tail may be long and thick. As people move away from closed proprietary systems, they will expose themselves to more security risk, especially in the process control sectors (e.g., SCADA systems). For this reason, but perhaps only for this reason, one may see a decline in the average level of information security over the next few years.

Threat: It is extremely difficult to know what the threat to information systems actually is, and thus all the harder to know in what direction it is going. In terms of actual day-to-day threat, information warfare has remained distinctly unimpressive. Most computer crimes are internal affairs, and most external computer crimes arise, not from systematic attack, but by small groups, or, more likely, random malevolence and even curiosity run amok. Is the relatively benign past a predicator of a relatively benign future? When the United States had one big enemy, no one could cogently argue that the lack of a nuclear strike yesterday meant that the threat was gone. But today, the United States faces, not one dragon holding its fire until the right moment, but a profusion of snakes each with their own agenda and motivations. Thus, the question -- why haven't we seen something big already -- deserves an answer. That is, if somebody has not done something already, what makes one sure that anyone can do anything? Conversely, America was, by contrast to Europe, considered immune to the more conventional sorts of terrorism. After the World Trade Center bombing took place, that idea vanished.

In a sense, the threat by foreigners to U.S. information systems is a lagging indicator just as the conversion of legacy systems is. The Russians and the Chinese appear to be very interested in computer warfare -- at least if their published writings are at all indicative. This makes sense; if one wishes to hold off the world's superpower, and if information systems lie at the core of what makes the superpower super, then that's the place to attack. That said, the Russians and Chinese seem to be more interested in the possibilities of unleashing destructive viruses then they are in the world of day-to-day computer intrusion. This bias may exist because they lack many open computer networks upon which to practice their intrusive arts -- but a virus can be tested on a stand-alone machine.

Will others grow interested in computer warfare? America is a trendy place and information warfare is a trendy subject. We, who are drenched in silicon, will spin ourselves up on this threat well before others catch on -- notably those others who live in lands unblessed by much computer equipment and who thus lack an intuitive sense for their place in a modern world. True, all nations, even poor ones, have some hackers; but without a broad infusion of computer-consciousness within the top leadership, the resources required to build hacker cadres and the wit required to put this approach on a list of serious attack options is unlikely. Most enemies of the United States live in places where systems are rare. That said, the entire world is becoming wired. If information warfare is a popular meme within the Department of Defense, the awe with which DOD is held worldwide cannot help but make it a popular meme everywhere else as well. Hollywood, is of course doing its part; more often than not the cinematic proof that someone is brilliant is provided by their being able to get into systems that they were otherwise barred from. Thus the option of information warfare is likely to rise on the agenda over time. Here too, the averages are affected as much by changes in the lagging edge as by changes in the leading edge.

Trends in lower-level threats such as crime or terrorism are harder to assess. In general, criminal enterprise tends to be responsive to opportunity with very little lag and thus a lurch upwards in the direction of computer crime seems unlikely; at worst, a gradually rising level can be expected. As for terrorism, the world's disaffected tend not to be the more computer-sophisticated and are likely to prefer violent means for the time being. Furthermore there is a great difference between five terrorist groups taking faux credit for an obvious act of terror (e.g., a car bomb) and the same folks taking credit for some glitch (e.g., a telephone outage) which may equally well be an act of nature, human error, design flaw, or the result of hostile activity.

Consciousness: The flip side of trying to gauge the changing threat is trying to gauge whether people are going to start taking computer security more seriously or not. The two are, of course, related; the greater the threat, the more likely people will take security seriousness; no threat, less response.

What other indicators should one look at? One indicator may be how people respond to the Year 2000 problem. Assume the problem is as serious as people think, that many systems owners respond late, poorly, or not at all, that consequent damage results, and that lawsuits start to fly. What kind of echoes will this cause? Will systems owners be held liable for damages to third-parties due to software negligence? What standard for due diligence will result? Will users learn to be wary of anything a computer produces (thus reinforcing the need to keep wetware in the loop)? And, of course, will people take the same view of a system owner's inability to keep intruders out as they might for their fecklessness in dealing with the inevitable transition from the year 1999 to the year 2000? Wild cards may make a difference. Say a major earthquake hits California leading to the failure of institutions that have failed to back up their data several hundred miles away. Will people pay more attention to redundancy and back-ups as a result? Indeed, any publicized systems failure is likely to heighten people's awareness of unnatural risks as well.

Operating Systems: Most of the more serious weaknesses in computer systems lie with the operating system itself. It may be unfair but indicative that Unix assumed its current features at the University of California in the late 1970s, a time in its academic history that may be described by many adjectives, of which "security" is probably not one. In part because of its academic legacy people have been working on Unix security, in many ways, harder than they do for any other operating system. Over time, therefore, absent major changes, one might expect Unix to get more secure.

Indeed, one might have imagined that Windows NT, which is based on Digital's VMS (a fairly secure system to begin with), plus another twenty years to reflect on information warfare, would be highly secure. Strangely enough, current versions are less secure than Unix and have bugs all their own. The computer industry seems, lately, to put more value on slick features than steady performance. At some point, economies of scale must set in, the n^th added feature will not be terribly exciting, and computer makers will settle down to engineering greater reliability into what they sell. But don't ask me when.

In the meantime, the Web has become the focus of the computer industry's developments. In some cases, especially electronic commerce, people are paying serious attention to security. But the glitzy end of the Web business -- Java, ActiveX (which is worse), automatic software updates, and the various plug-ins -- are all carriers of great mischief from the unscrupulous.

Security Tools: Current trends in information security treat it is a problem that can be solved by adding a patch here and there. Firewalls go on the outside of one's system and are meant to filter out certain types of messages by looking at each packet and making a determination based on their ostensible purpose (which can often be revealed by their port number). Intrusion detectors look for particular activities which are characteristic of known fault patterns and then take appropriate action (e.g., alert administrators, withdraw user privileges, note what systems or numbers the intruder is coming in from). Neither firewalls nor intrusion detectors are altogether reliable today, but they are getting better against a given level of threat. It is unclear whether they might go too far and make it possible for foes to instigate an anaphylactic attack, one which, using the immune system metaphor, works by overstimulating and thus setting a system's internal defensive mechanisms against itself.

The Cost of Storage: As the price of computer storage falls, the feasibility of archiving everything rises to the point where no one has a credible excuse for losing information (although finding archived information after the crash will take work). To give an example, the 17-gigabyte DVD (digital versatile disk) of the year 2000 has enough capacity to store the complete billing records of a week's worth of long-distance calls made in the United States. In sensitive environments, very fast CD-ROMs (or any other non-volatile memory) may replace writable hard disks for storing operating systems -- thereby giving viruses nowhere to rest. CD-ROMs operating with zero buffer can also log everything that happens to a computer without some hacker going back and writing over the record.

The Internet: The evolution of the Internet, itself, will shape the near-term information security environment. The next version of the Internet Protocol, IPv6, has provisions for many security features such as encryption, key passing, and digital signatures. Eventually IPv6 will be universal, but deployment remains slow; the greatest penetration is occurring within specific circles of universities and other leading edge sites.

Several features of the Internet make it particularly attractive for hackers. What should only be a near-term problem is that the Domain Naming Service, which translates names (e.g., www.ndu.edu) into byte-addresses is poorly protected and has little authentication capacity. Chances are the former will be fixed, and, it may also be possible to authenticate the true source of any message coming into one's system in most cases.

A more permanent feature of the Internet is that it lacks a packet-level billing system. This makes broad flooding attacks possible and makes more focussed attacks very hard to trace back to their source. However, unless the free-packet structure of the Internet proves to be its undoing, the prospects for packet-level billing are modest.

Cryptographic Methods: Cryptographic methods remain the most obvious tool for information security. As hardware gets faster, the processing load for encryption and authenticating messages can be expected to decline. This is obviously true if the key length stays the same, and almost as certain if measured as the time it takes to encrypt a message which takes a fixed X hours decrypt (as supercomputers get better, the required key length rises). Thus, everything else being equal, cryptographic methods will see greater use, and information security will rise.

Needless to say, everything else is not equal in this field, and there are important policy and technology questions that must be factored in. The first policy question, of course, is when -- not whether, but when -- the U.S. federal government will give up trying to control encryption. One must admire the control effort both for its doggedness and cleverness, but in the end, it can only delay the inevitability of technology. One may debate the merits of key escrow forever, but there is no denying that industry does not find the federal government helpful, and, indeed, is preparing to spend several million dollars saying as much in the public media. In the meantime, however, federal policy is confusing the market for encryption (perhaps deliberately so) and thus delaying its use as a way to defend information infrastructures.

The confusion in cryptography is not doing any favors for the digital signature market. The federal government built a digital signature standard around a technology, that has a non-trivial side-benefit; it cannot be reverse engineered into a public key encryption system. The market seems to prefer RSA's private standard. Compared to encryption, the level of federal resistance to digital signatures is far less and parts of the federal government are, in fact, working hard to encourage its use. The immediate requirement, particularly for electronic commerce, is greater, and thus digital signatures are likely to proliferate. A real spur to its use may come if and when people exploit digital signatures as a apply-once use-forever stamp to documents. For instance, college graduates may get a signed and dated bitstream of their grades that they could give to anyone; recipients could verify its authenticity by computer.

Technology remains the wild-card behind any forecasts of encryption's use. Innovations such as elliptical methods or cryptographic analysis will affect the time required to generate or break codes. Yet, very little in the last fifteen years has broken the fundamental fact that increases in key length have a modest affect on the cost of making codes and a major affect on the cost of breaking them. The one joker in the deck is the prospect of quantum computing which can break the back of the prime factoring problem thereby rendering both public key encryption and digital signatures obsolete. But no one knows whether quantum computers will work.

Summary: Overall, near-term prospects favor greater information security. True, closed systems are continuing to open up and the number of opportunities for waging computer warfare continues to rise. Yet, protection tools are becoming better, the Internet is likely to become more secure, the costs of backup and redundancy are likely to fall sharply, and cryptographic methods are likely to spread.

Potential Bends

At this point, I want to explore the second half of the future: the prospect that while the long-term information security environment is likely to become better in obvious ways, it is likely to worsen in subtle ways. The key to understanding this phenomenon lies with how tomorrow's information systems are going to be used.

As noted earlier, the increasing power of hardware and the growing sophistication of software suggests a future in which silicon starts to act more like carbon: that is, computers take on more characteristics of humans while networks take on more characteristics of human organizations.

Tomorrow's information systems are likely to make, or at least set the table for, more judgements than today's do. What is more, the feedstock for these judgements are likely to be information harvested from the world out there. Such applications are likely to appear among institutions that depend on reacting to an outside environment: e.g., politico-military intelligence, business sales-and-marketing, environmental control, or broad-scale social service functions such as law enforcement, traffic regulation, or public health. Institutions that do not react with the outside directly but may learn from external experience may develop some links with the outside world. Process control applications may never have these links, at least not directly. Yet, even process control applications may not be immune to influence. For instance, a toy company may have its agents cruise the Web in search of data to help them predict the hot trend for next Christmas. The results of its search will change what it makes, thus its production mix, and thus how it schedules and supplies its production lines -- a classic process control application.

Today, computers process information using tight algorithmic logic from a carefully controlled set of inputs -- the way they are supposed to. Tomorrow, computers may use techniques of logic processing, or neural network technologies to sift through a trusted set of material and bring things up to human attention. The day after, so to speak, computers may reach and present conclusions based on material of widely varying reliability. Thus a military intelligence system may evaluate the relative security of a village through a combination of authenticated overhead imagery, an analysis of potentially spoofable telephone switch activity and overnight police reports, and the collective detritus of written gossip from electronic community bulletin boards. A traffic controller may set stop-lights based on monitored traffic flows, plus a forecast of the kind of traffic loads selected large events may generate based on what their organizers predict. A drug company may put out usage advisories to doctors based on combing through data-bases on hospital treatments and outcomes. Individuals may plan their evenings out based on the suggestions of their agents trolling web sites that list entertainment offerings cross-correlated by less formally established "what's-hot" lists.

Needless to add, there will be people who find it worthwhile to corrupt such systems. They may not all be criminals; indeed, many of them would classify themselves as basically honest gamesmen eager to put the best face on the world's data-stream in order to influence the judgements of Web users. Some Web sites are crafted so that their URL appears at the top of search lists generated by automatic tools (e.g., Altavista). It would not be surprising to see the less scrupulous engage in many of the same fraudulent techniques of misrepresentation and lying that today's con artists do. Indeed, for a long time to come, computers will be easier to con than people will. Thus, a flow of false information on patient histories that reflect the efficacy of a licensed drug may subtly shift a system's recommendations to another one (bad reports of which are buried). A series of reports on the flow of loans to an otherwise suspect lender may convince rating agencies to boost its reputation and permit it to garner loans that it otherwise would not deserve (and has no intention of paying back).

Once you have this picture of the future, it does not take much imagination to forecast what else may go wrong. So here goes:

Learning Systems and Neural Net Computing: For the most part, one can determine why a system does what it does by examining its source code to learn what and querying coders to learn why. Tomorrow, that process may not be so easy. Computers may learn from experience. If they use traditional AI, they will build and refine a data base of rules that will govern the logic by which they draw conclusions. If they use neural nets, they will steadily tune their association matrices by using real-world test sets and backward propagation.

All this is well and good -- until something goes wrong. If the experience base upon which learning systems or neural nets have been corrupted then their conclusions will be similarly corrupted. Fixing them will be costly. Corruption must be detected, and that may be possible only by observing poor decisions. What if the corrupter alters the input so that the system makes a bad decision only when it encounters a very specific input set? Unless one knows the input set, corruption may be completely masked. Even if the nature of the corruption is determined, when the system was corrupted has to be estimated. Then the system can be reset to its last known uncorrupted state, if one has archived such parameters. Otherwise, the system has to be returned to its original settings, which means losing all the learning that has taken place since it was turned on.

Software Agents: One of the ways integrated open systems work is by letting clients place software agents on servers. These software agents, in effect, query servers, in some cases periodically. Sometimes results go back to the client. In other cases, one agent or a part of an agent may be sent forward to other sites. For instance, a travel agent, so to speak, interested in putting together a meals-lodging-entertainment-and-transportation package may be split into four sub-agents (each of whom then go out looking for the best deals in their area, return candidates, so that the master agent can fit them together).

In theory anything an agent can do may be done by successive queries, but the use of agents saves on message traffic (especially for "tell-me-when" requests) and permits in-server consolidation. Badly designed agents, whether by not-so-benign neglect or malign intent, may cause some servers to cycle forever for an answer, set up a mutually destructive server-to-server harmonic, or may replicate without bounds and clog entire networks. Malevolent agents may look for certain outgoing mail, and then work their way into systems from which it originated. If mischievous enough, such agents could have a chilling effect on free network speech. Indeed, network administrators are already beginning to understand that bringing a network to its knees does not take many automatic E-mail responders (All it takes is one message sent to at least three individuals on vacation that echo an "I am on vacation" message to everyone on the original mailing list).

Hijacked agents or agents forwarded to successively less trustworthy servers ("a friend of a friend of a friend ...") may relay misleading or dangerous information back. In a sufficiently rich network, replicating agents may be carriers of replicating viruses whose eradication may be fiendishly difficult if there are niches in the network ecosystem that cannot be identified or do not cooperate.

Ecologies: The reference to ecosystems was deliberate. Systems, beyond some point of complexity, and many seemed to have reached that point, become extremely difficult to control in the sense that one can predict the performance of the whole by understanding the performance of each part. Even perfect understanding of components cannot predict all fault modes in a succinct way. Although today's hacking requires active intruders, much of the risk and tedium associated with malicious hacking can be transferred to bots -- pieces of code that wander the Net looking for a computer to roost in. A single hacker unleashing a flood of junk to clog a system can be traced and stopped; perhaps even caught. Similar effects, however, may be generated by implanting a virus in thousands of systems. Turning on one or two (e.g., including a key word in otherwise innocent text) can simulate a chain letter on steroids, as each infected system turns on another, with thousands of sites flooding the system, well before their owners know what is going on.

Mother Nature has long ago given up trying to govern complex systems by imposing behaviors on each component. Instead, ecologies carry on from one year to the next through a mix of competition, diverse niches, predator-prey relationships, and, above all, a facility for adaptation and evolution. Tomorrow's networks may need some way to maintain homeostasis by populating themselves with analogous instruments. Needless to add, of course, no one will get the proper combination and distribution of instruments right the first time. It is not much of a leap to see how such instruments may be used by evildoers to bring systems down to the silicon version of extinction, at least temporarily.

A New Approach: All this suggests a completely different approach to information security. Consider how complex humans are compared to computers and how they, like computers, network themselves in order to exchange knowledge. Yet, for the most part, it is difficult for humans to pass disabling bitstreams among each other. Few word combinations can cause a rational person to seize up, spin cycles endlessly, or flood friends and acquaintances with pointless communications. Why? As noted earlier, humans accept inputs at the semantic rather than syntactic level; messages are converted into specific meanings and then processed as such. Information and commands are screened for harmful nonsense.

Yet, as any observer of human affairs can attest, cognition does not prevent certain messages from achieving widespread and deleterious affects. Ideas grip the imagination and spread. Some induce "extraordinarily popular delusions and the madness of crowds" (indeed, "information warfare" is, itself, such a meme). This is where education, notably classical education, comes in. People are trained to externalize and objectivize information and view it as something separate from the self; to examine information critically and thereby avoid the twin hazards of excessive naivety or total cynicism. Rhetoric deals with the proper inference of intentions from statements. Logic deals with generating correct implication therefrom. Language is taught as a precision tool so that information could be passed and understood with clarity. Etiquette governs what people say (and how intrusively) and inculcates propriety so that people keep private information private. Thus can humans interact with others, even strangers, to form functioning organizations and other relationships.

Building such sophistication into silicon will not be easy, both technically and socially. To exchange information requires conformance to shared norms at several levels: of meaning, of intention, of context, and of behavior (e.g., what constitutes a legitimate piece of information). Without shared norms -- standards as it were -- there is no meaning but only programmed reactions. As long as that is true, it will be difficult to defend information systems from a potentially polluted environment except through mechanisms antithetical to the way we would like to see ourselves be. That is, we will have erected castles, moats, gates, and sympathetic brigands to defend ourselves against cyber highwaymen.

Computers cannot be made consistently more powerful and remain safe if they are not endowed with the power not only to input and output bytes but understand them. But, having taught them to listen and speak we must simultaneously teach them proper manners.

Recapitulation: The moral to the story will be, if not familiar, then at least recognizable.

The old model of information security is hard and closed: users, processes, and code are either licit or illicit. There is no grey area. The trick is to differentiate between the two, give the former just enough liberty to do their job, and close the system off to the rest. This model is not entirely bad; indeed, one ought not to run a military C2 net, nuclear power plant, air traffic control system, telephone switch, or funds transfer system any other way.

The new model of information security is open and fuzzy. It is necessarily that way because the systems that we want to both exploit and protect must be open to the outside world and learn from it. One therefore needs a security model that recognizes that fact and makes continual judgements over the validity and reliability of information it ingests. All of this presumes, of course, that the core functions are lock-tight, and that, in turn, requires that the architecture of what must be protected is both simple and transparent. Ironically, that is key to letting systems deal with ambient complexity and opacity. The first challenge ought to be simple; regretfully we have made it complicated, but, one hopes, not too complicated, thereby leaving us with the really fun complex security problems of the future.