A Profound Moment in Cybersecurity

Richard Power looks at the big picture and how security must move forward

It was charming to hear a happy customer extol the rewards of an economical solution to a nasty problem. But, as refreshing as that exercise was, at the end of the conversation, I had to return to the Moscone Center, to continue this long day's journey into night.

As I reported in my coverage of the RSA Conference 2009 for CyLab's Cyblog, at the general sessions, in panel discussion after panel discussion, and on the threshing floor of the exhibit hall, almost everyone was babbling on about the "Cloud computing."

Whitfield Diffie, Vice President, Fellow and Chief Security Officer of Sun Microsystems, said he is "bullish on Cloud computing" and that it is the type of challenge "seen not more than twice before" in the space.

But Adi Shamir, Professor of Computer Science at the Weizmann Institute of Science in Israel, is "very worried about it." According to Shamir, we risk trading in "many small disasters for one big catastrophe."

"Now that we are possibly moving into the cloud," he elaborated, "we are facing a real danger of a hacker taking out one data center to catastrophic effect."

Bruce Schneier, Chief Technology Officer, BT Counterpane, said he is "bored with cloud computing." Although it is presented as new paradigm, Schneier explained, "fundamentally, I do not see many differences, it is still about trust, it is a continuation of what we have been seeing."

And although Ron Rivest, Viterbi Professor of Electrical Engineering and Computer Science at MIT, described himself as "enthusiatic" over "Cloud computing," he quipped that "Swamp computing" might be more a appropriate term. Rivest also encouraged the attendees to consider the possible analogy with the differentials craze that led to the current global financial crisis; in both instances, CEOs are deriving benefits while off-loading risks, but that there could be similarly severe consequences.

But perhaps the most important insight on "the Cloud" came from Gary McGraw, CTO for Cigital (www.cigital.com), and author of several worthy tomes.

His latest book, Exploiting On-Line Games (Addison-Wesley, 2007), was also the subject of a panel McGraw led at RSA 2009. [McGraw discusses the issue in this podcast as well.]

In his opening remarks, McGraw welcomed the scattering of attendees to the "edge of technology," and declared "what we are talking about is the future of software security." There are so many people out on the exhibit hall floor hawking the so-called Cloud, "even though they have no idea what it means." But online games are massively distributed systems. "They put nine gigabyte globs in everybody's box."

Show Comments