April 2016 Archives

On the Approachability of Problems

"The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man."
George Bernard Shaw

The response to my most recent post has been intriguing insomuch as it was completely predictable and expected (though nonetheless disheartening). The few people who've commented have generally said things like "unrealistic" and "unimplementable" and "already been done, failed." Ironically, none of these criticisms are true, nor are they even necessarily knowable. Sure, there have been other attempts at strict compartmentalization (see Qubes OS), but those attempts aren't a true analog for what I suggested. I digress...

The purpose behind my post here is twofold. First, framing problems is imperative to solving them. Frame a problem in the wrong way and you'll either find no answer, or worse, you'll find a woefully inadequate (or even regressive) answer. Second, we as an industry need to stop being total a**holes when presented with new ideas and open our minds to future possibilities. There's nothing worse than hearing about a new approach, idea, technology, whatever, and immediately responding negatively. What's up with that? Rude, to say the least. Again, I digress...

Framing problems is really what I want to talk about today. The ability to shift our thinking to alternative viewpoints is incredibly critical when thinking about how to solve various problem states. In the example of my endpoint security post, the shift in thinking is to realize once and for all that the current framing of the problem makes it unsolvable. We have ample history now to clear demonstrate that how we're attacking (traditional OS) endpoint security simply isn't reasonable, rational, or pragmatic. As such, time to pivot.

Solving Endpoint Security

"Insanity: doing the same thing over and over again and expecting different results."

As a security architect, I've come to truly loathe the endpoint security space. The "answer" seems to be an unending stream of "yet another agent" to layer onto an endpoint, usually just to supplement another tool that's insufficient. Rarely, if ever, can I remove one of these tools (like AV! I still have AV after all this time?!), which means I get to encounter all sorts of conflicts and problems, and for what benefit? Why am I investing hundreds of thousands for incredibly small incremental gains? Insanity...

Part of the challenge with endpoint security is the problem state. As it stands today, we're typically stuck in a traditional general purpose OS environment with very little useful segregation. We deploy tools that live inside this general environment and then hope that a) they keep functioning, b) don't introduce more problems, and c) are somehow able to get enough visibility to assert reasonable control. Sheer folly. It's like trying to estimate the size of an infinite universe from an ant's perspective.

Putting aside specialized solutions deployed to endpoints for solving non-endpoint problems (like monitoring or controlling data movement)... the core focus of endpoint security /should/ be focused on monitoring for state changes. Unfortunately, in a general OS environment, this is very difficult because there are rarely clean, clear boundaries that can be watched for these state changes. In the mobile world we see this problem moving to a slightly more tenable position wherein wrappers and containers can be deployed to better define boundaries, which then enables watching for state changes. We're also starting to see this in production applications that leverage a container-based micro-services architecture. All of which leads me to an interesting thought:

unikernel+containers+sidecars=secure endpoint!

My Other Pages

Support Me

Support EFF


Bloggers' Rights at EFF

Creative Commons License
This blog is licensed under a Creative Commons License.
Powered by Movable Type 5.2.10