SystemsSec 2018W Lecture 22
Audio
Notes
General system defense strategies are
- White lists
- Black lists
- Anomaly detection
- Virtualization
- Diversity
Examples to eliminate diversity
- Code reuse
- Code replication
- Centralization
- Best practices
- Specialization
- Substitution
- Interdependence
When we take control of the systems, we make them more fragile.
If you want diversity, you need to give up control of the system.
When societies become more authoritarian, they become more brittle and vulnerable to falling apart. Think of communism.
Computer scientists tend to be more authoritarian minded. We want control of our computers.
Phoenix pay system was used to centralize payments. This was a terrible idea that broke horribly.
Most of the code on most people’s systems is useless.
Specialization is when the code on any system should be specialized to do what it is supposed to do.
Everything we do in software engineering seems to be able adding functionality.
Software engineering we don’t really think about how adding a certain functionality will impact the security of the system.
Npm imports a lot of code that isn’t really necessary.
Allow the human to choose constraints.
Redundancy can be automated.
Things that frame evolution
- Selection
- Variation
- Reproduction
- Interdependence
- Implicit dependencies
When we simulate evolution using the characteristics above, you get optimization.
Most of our code that we use is not reusable. Code that is reusable is treated as very valuable and can get packaged as libraries.
Implicit dependencies are escapable in a certain environment. Suppose that you are building an application that provides some library, that library will be restricted to working only on that application. If you try to use the library elsewhere, it will break.
We gravitate to using the same things over and over again because they can easily be tested, they can easily be applied, and we know what they depend on.
Diversity leads to more robust code.
Bash is the interactive shell that we use. This is can be used as a normal command line or for shell scripts.
If you start using bash, you don’t always use it for what it is meant for. You start using it for other things. For example, bash is normally meant to be used as a command line. If you use it for shell scripts, you might start running into problems.
A number of websites, and applications are starting to become interdependent on chrome. For example the “stay focused” application is a web application designed to block websites. It is very dependent on chrome and cannot be used on any other web browser.
To note, everything breaks. There is no perfect security mechanism. We need to use a variety of different security mechanisms for optimal performance, not just one.
The goal of the attack is what we should focus on to consider security implications.
The attacker comes us with a strategy that the defender does not anticipate.
How do we prevent power from being misused?
Artificial life - Computers aren’t dependent, they are independent.