(none)

[JRAMSDEN at wl7.prime.com]

Subject:  OS security.
To:       (unix-wizards at sem.brl.mil)
From:     John Ramsden (jramsden at wl7.Prime.Com)
Date:     13 May 91  11:02 AM


I would have thought the easiest way to minimize the impact of the
sort of OS security problems being discussed would be first to offer
a substantial reward (say in the $100,000 range) for any demonstrable
bug or oversight which allows security to be compromised.

This would be a practical incentive for hard-up students to keep an
eye out for them and, if one was found, to keep dead quiet about it
and alert the prize committee (CERT or whoever) ASAP.  All these
responses would help contain the problem.

Of course all sorts of things would have to be thought through, like
ensuring that people working on OSs didn't deliberately introduce
subtle bugs (or ignore existing ones they spotted) and later claim
the prize (possibly with the aid of a collaborator) on the basis of
those bugs.

No doubt other readers will think of related issues, such as how to
share the prize between independent discoverers, and I'll be very
interested to hear them.  Quite possibly there's some devastating
observation that makes the whole scheme unworkable :-(

Apart from the prize, a twin track approach should be to define some
form of OS certification defining required minimum clear-up times for
notified security problems, and notification of users to encourage
upgrades (or compel them as a condition of maintenance contracts).

Ensuring prompt upgrades is probably the main difficulty at present,
especially in the high-volume and therefore low-support markets which
are around now.  In twenty years or so most OS upgrades will no doubt
be done transparently via a comms channel (although think of the
scope for abuse there would be in a security breach of a mechanism
like that !).

------------------------------------------------------------------------
John R Ramsden               |  The hen is a noble beast,
   (jramsden at wl7.Prime.Com)  |  but the cow is much forlorner
Prime Computer Inc.          |  as it stands in the rain
Framingham, Mass.            |  with a leg at each corner.
                             |      W McGonnegal  (19th C Scottish poet)
------------------------------------------------------------------------

EMPHATIC DISCLAIMER: The opinions expressed or implied in this posting
are those of the author and don't necessarily represent those of Prime
or its affiliates.

ANOTHER ONE JUST IN CASE: In case you're a speed reader, who tries to
take in paragraphs at a glance (not such a bad system when ploughing
through unix.wizards :-), THE ABOVE IS NOT A PRIZE ANNOUNCEMENT !!