Why am I writing this blog? Well one reason is advice from Mitchell Ashley that I have something to say worth reading. More specifically, I’ve started a software company (www.Secure64.com) with Bill Worley, a former Chief Scientist of Hewlett Packard, and we are engaged in an effort to make the web and all of its applications more secure, responsive and reliable.
There are many blogs and articles on internet security but for the most part they are technical and/or focused on describing the latest products. Yet 99&44/100ths% of users just want things to work. We can do a better job of managing our internet infrastructure, save everyone money in the process, and enable the next generation web applications that will improve our lives.
I’m going to cut through the clutter and the misusage of the term “security” and talk about what it means to you as a user of the web. Why you will look back a few years from now and say how much better things are than they were in 2008.
So with this first posting I’d like to focus on a recent Network World article entitled “IETF: Should we ignore the Kaminsky bug.” This is a fair point, considering that the web and its attendant software have more bugs and security flaws than there are human diseases, what’s the big deal about one more?
The obvious answer is that this is a big one, sort of like leaving the back door unlocked on your house. You may have the most secure laptop in the world and be communicating with the most secure web site in the world but if the cloud (the connections between you and your destination web site) sends you to the wrong place, or someone redirects you to spy on your activity, it doesn’t matter. You are hosed. That also applies to email, Voice over IP phone calls, VPN, SSL and other web activities, as Dan Kaminsky himself has noted.
The second reason to address the Kaminsky bug is that there is a simple, low cost solution in DNSSEC. What the article misreports is that DNSSEC is irrelevant until it is widely deployed. That is simply not the case. Getting the root signed is another roadblock but again not a requirement for DNSSEC to be effective. For more information about DNSSEC, go to the DNSSEC Home Page
The web is one of the primary drivers of wealth creation today. It’s ridiculous, and in fact it is unacceptable, to leave internet users open to exploit by malicious elements when a simple solution is at hand.
I’ll elaborate on DNSSEC, why it is now so simple to implement, and its beneficial impact in my next post.
Nice job on your first blog post Steve, and congratz on the new blog!
- Mitchell
Posted by: Mitchell Ashley | 11/21/2008 at 08:54 AM