Security in a Complex World
In 1999, security technologist Bruce Schneier published “A Plea for Simplicity.” In the blog, he famously wrote, “You can’t secure what you don’t understand” and “the worst enemy of security is complexity.” Schneier explained that analyzing a system’s security becomes more difficult as its complexity increases. His goal was to convince the technology sector to “slow down, simplify, and try to add security.”
More than 20 years later, Schneier’s plea seems naive and even quaint. Innovation has become a force of nature; it will neither stop nor slow down. More innovation means more features, which inherently means more complexity. We all want secure systems, but no one is willing to slow the march of progress to make that happen.
In “We Work the Black Seam,” Sting sings, “They build machines that they can’t control and bury the waste in a great big hole.” Although he was singing about nuclear energy, the lament is true for many modern technologies — especially for computer systems and networks. The modern computer network is almost unbelievably complex. Thousands of nodes connect through millions of potential network paths. Most networks are not designed so much as they evolve. Corporations grow, contract, connect to suppliers, and merge with competitors. As they do, their network expands, shrinks, and morphs like a living entity. At any moment, no one is sure what devices are on it, exactly how they are all connected, or what all the security implications are. It is humanly impossible to keep track of thousands of access controls or fully understand the aggregate effects.
At first, many believed adopting cloud technologies would make security easier. Unlike the operating systems of the ’80s and ’90s, public cloud platforms were designed with security in mind. If the customer configures them correctly, Amazon, Microsoft, and Google promise, their infrastructure is secure. So far, that promise seems to be holding true. But innovation breeds complexity, and that immutable law of nature turns out to be true in the public cloud as well.
So…