I spoke at a conference about the Prevention, Detection and Mitigation of Denial of Service Attacks years ago. Reviewing its content, I’m surprised of how current the information is even now, at least for level 3–4 DoS attacks: it’s true that there are newer techniques, but for all intents and purposes they are still the same procedures.

If I were to repeat it, the one thing I would add for sure is the recently released Roboo, the HTTP Robot Mitigator, a level 7 tool that verifies the existence of full browser stacks using advanced non-interactive HTTP challenge/responses mechanism to detect and mitigate HTTP robot and DoS attacks.

The script is always the same: first, an estimation of the expected loss from an intrusion or attack is provided; then, a proposal of countermeasures that are some orders of magnitude cheaper that the expected loss is suggested; in conclusion, the solution being offered features such a high ROI that only a fool will discard it, so runs the argument. Repeat for every antivirus, IDS, firewall or whatever security product being sold.

This myth is based on a loaded use of language that equals the notion of expending on security with that of an investment, a misleading and self-serving broken framework of economics that isn’t taking into consideration other variables like opportunity and hidden costs. As in the parable of the broken window, disregarding the ideal world in which nothing gets broken and the resources could be better put into use for other much more productive purposes leads to very misguided conclusions. That is, security is not an investment, and insecure programs don’t carry debts.

Computer security is a tax.

Different operating systems carry different levels of taxes: desktop Window carry a higher level of computer security taxes due to malware. And programming languages also differ: the tax bracket for ColdFusion is higher than the one for C, which is higher than the one for Java/C#.

And since software vendors aren’t liable for their insecure products, they have no incentive to internalize the hidden costs of security breaches and transfer them to customers, who must spend resources to protect their real assets, like the taxes citizens pay to governments to provide for security services.

The most creative parts of computer security are undecidable or NP-hard problems, a fact that creates a big divide in the computer security field: on the one hand, bug finding, exploit writing, secure code auditing and cryptographic protocol design are the most difficult tasks in the field to apprehend and resolve; but on the other hand, the pentesting process is largely better left to be done by software than by humans. The key insight is that no capital-labor substitution will ever take place in the first kind of activities, therefore productivity gains will never be achieved on them no matter what amount of innovation will ever be carried out in the next decades: that is, the same man-hours will be needed to produce the same amount of work in the future, if not more so, taking into account the exponentially rising number of computer systems and software components and their interactions.

And that is the depiction of the archetypal setting in which Baumol’s Cost Disease arises: tasks with no labor productivity improvements for decades, but with raising labor costs nonetheless, to keep up with the rising salaries in other jobs which did experience such labor productivity growth. The side effect of the disease, which makes it so nefarious to the computer security field, is that the best talent is lost to other tasks in this  process of constant readjustment.

An efficient public key traitor tracing scheme

We construct a public key encryption scheme in which there is one public encryption key, and many private decryption keys. If a broadcaster encrypts once with the public key, then each legitimate receiver can decrypt with a different private key. If a coalition of receivers collude to create a new decryption key then there is an efficient algorithm to trace the new key to its creators. Hence, our system provides a simple and efficient solution to the “traitor tracing problem”. Our tracing algorithm is deterministic, and catches all active traitors while never accusing innocent users, although it is only partially “black box”. A minor modification to the scheme enables it to resist an adaptive chosen ciphertext attack. Our techniques apply error correcting codes to the discrete log representation problem.

The most cited traitor tracing crypto-scheme versus… the Black Sunday hack:

Among the countermeasures he says he created was one known among pirates as the “Black Sunday” kill — an elaborate scheme that destroyed tens of thousands of pirate DirecTV cards a week before Super Bowl Sunday in 2001.

Instead of being delivered all at once like other measures, the Black Sunday attack code was sent to pirate cards in about five dozen parts over the course of two months, like a tank transported piece by piece to a battlefield to be assembled in the field. “They never expected us to do this,” Tarnovsky says.

Why stop at tracing traitors when you can wipe them out? Very clever.