The relationship between data security and its degree of political correctness probably seems a little curious. However, that relationship may be critical to seriously reducing hacking, viruses and other negative aspects of an insecure data network environment.
As I read, too often, about hackers, cyber-warfare and digital vandalism, I am reminded of the emperor’s new clothes: surely some small child will eventually exclaim, “He has no clothes!” But, alas, no child has yet noticed, and we go on, day by day, each of us praying silently that it is not our turn to be the winner of Shirley Jackson’s Lottery.
This passive attitude is not new in human history. Before modern science and the invention of vaccines, prayer was the only action we could take to prevent contracting the plague, smallpox or other deadly diseases. There is undoubtedly a very long list of large and small disasters which we simply accepted for years as unavoidable. So waiting for an inevitable encounter with the hacker trolls isn’t new, from a historical perspective.
Surely there must be a better way!
SECURITY 101
We know a lot more about data security principles and practices than might be guessed from observing present circumstances. We know that we have to consider physical, technical and procedural measures. Physical includes tangible things such as padlocks, strong doors and the like. Technical includes alarm systems, computer hardware and software features, cryptography, and so forth. Procedural involves passwords (changed often), regular audits of the locked doors and the hardware / software safeguards, backing up of data off-site, etc. When the physical, technical and procedural measures work together the way they’re supposed to, the bad guys have to work much harder.
Computer hardware and software is at the front line of data security. The computer processors must include instructions for protecting memory (both store and fetch operations) and for protecting access to the small number of powerful privileged instructions, which are designed for use by only the operating system or control program. The Intel architecture design (and its “me-too” competitors) used for a very large number of small computer processors today incorporates essential security features, as does every (or almost every) large and small computer processor available today.
But if genuine security is as simple as it seems, why are we still vulnerable? If you don’t physically engage the lock on your door, the quality of the lock and strength of the door are moot. If a bank should decide that an existing greenhouse could be the vault for its new branch location, you might wonder if enough add-ons could ever make that vault secure. If the computer operating systems or control programs do not fully utilize the built-in security features of the processors, how could we expect secure networks and systems?
How did we arrive at what seems such an indefensible position? Two curious facts from the paradigm shift represented by the change from steam locomotives to diesel electric locomotives give us a clue. None of the companies which developed and produced the diesel electrics had ever been in the locomotive business; and none of the companies which produced steam locomotives ever started producing diesel electric locomotives.
DATA SECURITY LORE AND HISTORY
The large mainframe computers, which preceded microcomputers, had (and still have today) very stable, reliable and secure operating systems and networks. Unfortunately for all of us, little of that existing body of security knowledge, architecture and experience crossed the gap into the world of personal computers.
Way back when, AT&T’s Bell Labs and Western Electric divisions were the preeminent designers and manufacturers of telephone switching computers. To help streamline the integration of rapidly-arriving new solid state electronics technology into communications switching computers, Bell Labs computer scientists developed the C programming language to help speed up the programming (as contrasted with low-level assembly language). A related follow-on was the control program, Unix. Because the world of telephone-switching computers was absolutely internal to the AT&T network and the Bell Telephone companies, the Unix software architecture design did not include the robust features now considered necessary for security.
A good corporate citizen, Bell Labs provided the source code for Unix essentially free to colleges all over the U. S. Therefore, to most computer science students the Unix design was their familiar model—security deficiencies and all. As an expected follow-on, Unix-like control programs became the norm for the growing population of small computers and the microcomputers we call “personal computers” today.
Another unfortunate (for security, that is) aspect of computer networking was the design criteria for the U. S. Department of Defense’s Advanced Research Projects Administration Network, ARPANET. The intent of this network was to facilitate communications between the scientists who were working worldwide on DOD unclassified projects. Because these projects were pure research (not applied research) and therefore unclassified, the decision was made to dispense with the hassle of normal DOD security precautions. Because only accredited scientists working on existing contracts were provided with network connections, there was very little fear of mischief making.
But a funny thing happened on the way to network: ARPANET became the basis for what we now call the Internet. Adding the essential security to a wide-open network has been somewhat analogous to adding security to the original non-secure Unix control program.
MORE LORE THAN HISTORY
From this point, we phase into more lore than history. What we know is the result of informal conversations with individuals who worked in the various computer and communications disciplines during the extremely rapid growth of personal computing and networking. In short, this information is comprised of leaks, inadvertent or intentional, by the principals involved.
Personal computers were being sold several years before International Business Machines finally developed a general personal computer product. But there is no argument that IBM’s entry into the general personal computing arena was what really accelerated the phenomenal growth of the PC, its associated support businesses, and the Internet.
IBM had actually been successfully building and selling personal computers for some number of years to the scientific and engineering niche market (what we might call “engineering workstations” today). Other divisions of IBM also had extensive experience in microprocessor design, manufacture and programming. However, this wealth of expertise and experience unfortunately caused, or contributed to, decision paralysis: which division should be assigned the new general personal computer project? Failing to make a real decision, IBM formed a small independent business unit to create the PC product.
It’s easy to be a Monday morning quarterback, and there were a number of questionable decisions made by this independent business unit. Two of those were significant in setting the path to the insecure data environment in which we find ourselves today. First, the business unit chose a microprocessor supplier that didn’t really have a product that met the unit’s requirements; second, the business unit made a microprocessor control program supplier decision, which even today seems bizarre. The hardware manufacturer subsequently worked diligently to improve its product, and it has little or no security shortcomings today. Unfortunately, it does not appear that the same can be said of the control program supplier.
DATA SECURITY GOING FORWARD
The Wham-O¹ marketing strategy has proven to be very successful. However, the use of that strategy for computer control programs and software does not appear to have good results for consumers and users of that software. We all want new bells and whistles (“the sizzle sells the steak”) but most of us, given a choice, would put reliability, maintainability and security way ahead of new features.
But we have not been given that choice. Insiders tell us that an essentially complete redesign (and recoding) would be required in order to have architected, built-in, state-of-the-art security features in the Unix-like microprocessor control programs or operating systems used in small computers today. Those insiders also tell us that such an extreme redesign would be quite expensive and that there is no business case for such a project today.
POLITICAL CORRECTNESS TO THE RESCUE!
One thing many of us observed over the past twenty or thirty years is the power of political correctness. Once an idea, a concept, or even a food item is accepted as politically correct, we can count on forty percent of our population to support it—irrespective of its degree of rationality or absurdity. So our challenge is to convince a critical mass of citizens that secure computers and secure data networks are politically correct.
During the last few years of apartheid in South Africa many of us refused to buy South African products or invest in South African companies. This was the politically correct thing to do; and we have numerous other examples of shunning companies and products which were not politically correct.
Surely if the word gets out, a number of us (possibly including the occasional enlightened government organization) will refuse to purchase computers of any type that are loaded with Microsoft Windows (or other Microsoft control program) until Microsoft produces a control program / operating system that is as secure as IBM’s “MVS Server Family” of operating systems. (This is not a promotion for IBM’s software; it’s just that MVS is a good basis for security comparison).
Bill Gates is widely admired for his political correctness and for his philanthropy that supports politically correct endeavors. If buyers avoid the Windows control program because of its lack of robust security, perhaps Mr. Gates will get the message that data insecurity is definitely not politically correct. I would hope that he then might use his still-important influence to convince Microsoft executive management that a secure operating system could indeed be a profitable project.
—-
¹The Wham-O Company is an admired and successful west coast company which has brought us, among other blockbuster products, the Hula Hoop and the Frisbee. The Wham-O strategy has been to roll out an attractive product quickly, grab as much market share as possible, and utilize intensive marketing as the inevitable copycat products of competitors start arriving in the retail supply conduits. It is likely that many companies have studied Wham-O’s techniques and adopted them for their own products.