Security systems and requiring attacks instead of accidents to evade them

December 27, 2021

Very recently, in the course of a conversation on Twitter that more or less about our internal network access authentication needs, it struck me that sometimes that part of the purpose of a security system is to make it so that an actual attack is required to get past the security, instead of just an accident. I am considering attack in a broad sense, in the sense that someone who wants to sidestep your security needs to actively do something unusual.

There are two useful things that come from this simple dividing line. On the technical side, your security system is avoiding accidents. Here, for example, we don't want the "accident" of a new person plugging their laptop into our network (or getting on to our wifi) and immediately getting Internet access. In practice our network access system may not be throwing a big roadblock in their way, but it is throwing some sort of roadblock, one that they can't just go right over without noticing.

(Our wifi network has a network password, but you can imagine situations where the network password might get posted on a sign on the wall and lead visitors to think it was an open-access network. And a visitor might well have heard the instruction 'plug your laptop into any red network cable', which is a common one that people are told.)

On the social side, it makes a social and policy difference that a person has taken active steps to evade your security. Such a person can't claim to have made an innocent mistake, like plugging their laptop into a handy network cable and then accepting the result. They've taken active steps to bypass security. Because this is the case, you can also react to any unauthorized activities that you notice with the pretty sure knowledge that this isn't an innocent mistake. The person involved has little to no cover and you have more certainty about what's going on.

To use a metaphor, even if a fence is low, it means that people have to actively step over it instead of merely walking along.

(I've probably had something like this realization in the past, but I don't think I've written it down before.)

Comments on this page:

Your argument is the same one I have for not running an open wifi network at home, the way Bruce Schneier does:

His statement that "if someone did commit a crime using my network the police might visit, but what better defense is there than the fact that I have an open wireless network?" is exactly backwards. If you run an open wifi network, you are giving permission to any random person to use it for whatever they choose. If they choose to commit a crime, you can't evade responsibility, because you gave them permission to use your network. Whereas if you have security in place, yes, someone might hack it (although as Schneier observes, they're far more likely to just go to the coffee shop down the street with an open wifi than try to hack into yours), but that person can't argue that you gave them permission to use your network for anything.

By Greg Ruben at 2021-12-28 08:31:46:

Are you not part of Eduroam? At our university, there are NO WPA-PSK networks. On a rare case of some conference, they create a temporary SSID for those rooms. In some common places like the computing centre reception, they have SSO where one needs to login via Uni-ID/password to get temporary access but they get blocked after 30 min of usage (i.e) This is granted to help people setup their Eduroam.

By cks at 2021-12-28 10:06:36:

The university is part of Eduroam and has its own institutional WPA2-Enterpreise based wireless network, but we (the department) have our own wireless network for various reasons. One reason to do this is that not all visitors have Eduroam access; people may come from industry, for example.

Written on 27 December 2021.
« Our webmail is a surprisingly popular service
A thesis: large, significant open source projects must keep moving or die »

Page tools: View Source, View Normal, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Mon Dec 27 00:05:36 2021
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.