Vulnerable Compliance

Milestones: The X Window System and Kerberos (1988), the first information security consulting firm on Wall Street (1992), convenor of the first academic conference on electronic commerce (1995), the " Risk Management Is Where the Money Is " speech that changed the focus of security (1998), the Presidency of USENIX Association (2000), the first call for the eclipse of authentication by accountability (2002), principal author of and spokesman for " CyberInsecurity: The Cost of Monopoly " (2003), co-founder of SecurityMetrics.Org (2004), convenor of MetriCon (2006), author of " Economics & Strategies of Data Security " (2008) and of " Cybersecurity and National Policy " (2010).cal, but when the theoretical becomes practical it is too late for prevention. This essay is not about " responsible disclosure " ; its starting point is when disclosure passes the point of inevitability—the instant when the damage control phase begins, even if silently. Working exploits are cybercrime trade goods, instruments of national policy, or both. But we are here to look at one aspect of this and one only: what to do if a vulnerability is implementation-independent. Vulnerabilities are overwhelmingly dominated by failures of implementation, but that is not our interest. The designers of what we call the Internet wanted one thing: survivable interoperability. As a network of networks, an Internet neither requires nor expects the construction of some single mechanism under some single control, and that more than one path exists from A to B allows the Internet as we know it blithely to accept random faults, and to route around them. The sum of these two—synthesis by amalgamation plus active fault tolerance—yields survivability, with the side effect that attribution is impossible. The interoperability goal is inherently harder as interoperability requires out-of-band pre-negotiation of what we commonly refer to as (network) protocol. That is why we have the Internet Engineering Task Force, to standardize protocols in the Internet. Reading directly from " The Tao of the IETF " [1], In many ways, the IETF runs on the beliefs of its participants. One of the " founding beliefs " is embodied in an early quote about the IETF from David Clark: " We reject kings, presidents and voting. We believe in rough consensus and running code. " Another early quote that has become a commonly-held belief in the IETF comes from Jon Postel: " Be conservative in what you send and liberal in what you …