Top Five Reasons For Security FAIL

Adi Ruppin admits the Internet security industry has seen every type of product fail. The good news, he says, is that there's much to learn from such failures. Here are five such lessons.

By Adi Ruppin

December 11, 2009 — CSO —

The Internet security industry has seen every type of security solution fail. While there are exceptions, one can learn some general principles as to why things fail. Below are some observations.

The weakest link
"Security is only as good as its weakest link." This is probably the most well-known adage. Surprisingly however, many security solutions fail because of it, as the weakest link is often not obvious. This is best demonstrated with a couple of examples from the encryption world.

Take the best encryption algorithm you can find with the largest key length possible. Let's assume it is totally secure. Did you use the same level of sophistication when choosing the encryption key? If your encryption key is based on a password, for example, it is likely based on just a small number of bits and is expanded into the larger key size by the encryption software. However, it is still dependent on this small number of bits and is much weaker than you think.

Then there's the question of how you communicate that key to another party. Often times, communicating is the weakest link. A classic example is the use of One Time Pad (OTP), which has been in use since World War II. The OTP "key" is basically as long as the plain text is being encrypted, and theoretically it can be proven that OTP provides perfect security. Is that so? The weakness lies in how you communicate that OTP to the other party, and how you use it afterwards. Even if you send a messenger carrying that key to the other party and you're sure it hasn't been breached, common problems in operating such a system can render it extremely weak. If for some reason, you use some of the OTP more than once, there are simple cryptographical methods that would enable a third party to intercept and read your communications easily. The US was able to intercept communication of a Soviet spy ring by leveraging this principle.

As you can see, the weakness is often peripheral to the main part of the solution that you know or believe is solid.

Industry standard vs. proprietary
Resorting to proprietary solutions may give a small advantage due to "security by obscurity," however, it is dangerous to use solutions that are not widely scrutinized. Encryption is again a great example.

Using industry standards like AES means numerous experts have reviewed the algorithm and did not find serious issues. And if they do find them, you will know about it. Take first generation WiFi encryption (WEP). This method was very quickly shown to have serious vulnerabilities. Since it was a standard, the word quickly got out and it was replaced by stronger methods.

• Print