proposal: "security spectrum scale" (SSS)

regarding the recent Markoff NYT article on NFS weaknesses, I agree
it seemed to be overblown. but in fact I have been betting that feeling
from *all* the recent articles on the netscape bugs etc (egad, am I
mistaken, or whas there front page NYT coverage for a *buffer*overflow*?
at least there was for a single *poorly generated random seed*!!). 
for example, in another, the fact that netscape had a buffer overflow in URLs
was translated by a reporter into "a similar bug was used by Robert
Morris in the infamous worm that infected the entire internet a few
years ago" or something similar.

it seems to me what is lacking in all this is a *security spectrum*.
unfortunately security experts sometimes have a tendency to equate
*any* security weakness with a catastrophic one. while this is a good
approach in general, i.e. to be as conservative as possible, in 
practice there can be no doubt that some security weaknesses are far
less severe than others.

if the security *experts* conflate the issue of the *severity* of
a security breach (and I see this happening all the time on this
list), there is little surprise that reporters aren't
figuring it out either. some of the really obvious example of the kinds of
differences in security that are being conflated: client vs. server
problems (server problems are far worse of course; the netscape bugs
were mostly *client* problems), subnet vs. overall network problems, bugs
that allow people to merely crash a system vs. submit arbitary
code, etc.

to aid this serious problem, I propose the creation of a 
UNIFIED SECURITY SPECTRUM RANKING.

this would be a list of all the different types of security weaknesses
a system can have, and their LEVEL OF SEVERITY. it would attempt to 
rank every type of security breach possible. then, when a new
security weakness is discovered, it could be ranked A1 or B5 or C6
or whatever. this would be a sort of technological "richter scale"
that would allow the novice to immediately understand that a given
bug that was recently discovered (say, the recent netscape bugs)
was, say, not really as potentially severe as the Morris worm.

a press article might say something like,  "the recent netscape
bug was ranked a B5 on the security scale by experts. this means that an 
unauthorized intruder could break client software. the bug could
potentially be as serious as A3, meaning that arbitrary code could
be submitted. the other bug was classed B3, because it allows the
detector to grab unauthorized data, but still be detected in 
doing so." 

etc!!

I think it is pretty obvious how much of a positive effect this could
have in quantifying and tracking and publicizing new bugs. it might
make it impossible for a reporter to give an improperly alarmist
position. for example, no one would take seriously an article that
gets excited about a 3.6 richter scale earthquake. similarly, the
reader might be able to draw his own conclusions if we came up with
a sufficiently universal scale and it is widely used in articles.

furthermore, this scale would tend to help the reporter/editor immediately know
if a given bug report is newsworthy (if they continue to enthusiastically
report bugs, although I wonder if this is a fad that may die out).
and ultimately it might really help the issue of "proper attention
to bugs". the public is getting a scare story for almost every new
bug, and this is just not appropriate. to use my tired analogy, it is
like the media putting every dinky earthquake item on page 1.

another idea behind the rating: it might be a sort of matrix format,
such as "a-6-alpha" where each of the elements indicates some kind
of independent factor. for example the "a" might mean "client side",
the "6" might mean "crash only", the "alpha" might mean "breach
cannot be detected after the fact". however it shouldn't be so
complicated that the novice can't immediately determine which of
two rankings is more severe.

now, I am really rather surprised that no such scale appears to 
exist currently. I highly suspect the NSA probably has a system for
this but unfortunately it is not being used by CERT or anyone else
that I know of. if anyone does know of this kind of "security spectrum",
I think our cause of trying to improve software security would be
furthered immensely if whenever reporters call about bugs, the scale
factor could be consistently and uniformly used in association with 
trying to describe the severity of the bug.

I am willing to work on a beta version of this "security spectrum"
if there is sufficient interest. it certainly seems like a far better and 
worthwhile investment of time than, say, "the geek code", the latter of which
is already highly developed!! I don't really consider myself the best 
qualified in terms of experience but sometimes if you want something done, you
have to do it yourself.

however, if we do this, I hope that a good scale that is pretty general
and doesn't need extensions can be done from the start, before its widespread
usage, so that later changes do not confuse users. there is already 
confusion in the media about two slightly different richter scales, this
is a pity. 

another neat perq: if the cypherpunks come up with a good scale, it
could be a tremendous positive publicity tool. "today experts discovered
a bug in -x- that rated a -y- on the CSSS (Cypherpunk Security Spectrum Scale)"

generally, regarding cypherpunk priorities, I think the "media can be made 
our friend", but we just have to learn how to be more meticulous and 
careful in our interactions with them. in general I don't really think
a lot of the misreporting going on is the fault of the reporters involved.
it's not surprising they get their stories mixed up, when, IMHO, even
the "experts" they quote aren't particularly polished and don't really have 
their act fully together (or at least, tend to misrepresent the problems
from the beginning).

(most of the last Markoff article imho can just be chalked up to, "two 
prestigious graduate students who discovered something significant recently 
wrote a message warning about another significant security problem."  it shows
how absolutely critical it is to be careful what you say once you have
built up a bit of a reputation.  these two grad students are now being
watched as the Chicken Little's of Cyberspace by the media, unfairly
or not. be careful about wishing about fame, or anything else!! you might
get it!! makes me a bit nervous about causes *I* have promoted in the 
distant past.)

--Vlad Nuri

-----BEGIN PGP SIGNED MESSAGE-----

Hello,

"Vladimir Z. Nuri" <vznuri@netcom.com> wrote:

...
> to aid this serious problem, I propose the creation of a 
> UNIFIED SECURITY SPECTRUM RANKING.

Good idea - if you can pull it off. If you can't, you will create
even more confusion. That is a decision only your conscience can make.

> this would be a list of all the different types of security weaknesses
> a system can have, and their LEVEL OF SEVERITY. it would attempt to 
> rank every type of security breach possible. then, when a new
> security weakness is discovered, it could be ranked A1 or B5 or C6
...

I wouldn't use <letter><number> because that could be confused with
Orange Book security ratings. The RISKS are obvious, as they say.

...
> another idea behind the rating: it might be a sort of matrix format,
> such as "a-6-alpha" where each of the elements indicates some kind
> of independent factor. for example the "a" might mean "client side",
...

If you want multi-axis, perhaps something like the Geek code, except
standardized so that severity is apparent even if you don't remember
the letters?

(Eg in the Geek Code "+" is usually good but many people wouldn't look
well on d++ or w+++++ (conservative dress and Bill Gates resp.). You
would want "+" to always be good, for example.)

You also want it fairly short (media) - alternatively make it so that
it is possible to say (eg) "A2" or "A2+dx/g8/b*" depending on how much
detail you want (column space).

...
> I don't really consider myself the best 
> qualified in terms of experience but sometimes if you want something done, you
> have to do it yourself.

A.k.a. "cypherpunks write code".

...
> another neat perq: if the cypherpunks come up with a good scale, it
> could be a tremendous positive publicity tool. "today experts discovered
> a bug in -x- that rated a -y- on the CSSS (Cypherpunk Security Spectrum Scale)"

What's wrong with "a bug in -x- that rated -y- on the Cypherpunk Scale"?
There's already TDM TLAs (that's "too damn many three letter acronyms").


Then williams@va.arca.com (Jeff Williams) responded:
...
> Unfortunately, severity is a question of perspective.  In some
> environments, an operating system crash could be considered catastrophic.
> In others, it just means reboot and continue.  I'm not a policy wonk,
> but security is relative to what you care about.

That doesn't rule out a scale: it merely changes how you perceive the
scale.

An earthquake 3.6 on the Richter scale would be no problem if you are
playing poker, say, but "catastrophic" if you are playing mikado.

It also depends on the "Operating System" (building) you are in.

> > to aid this serious problem, I propose the creation of a 
> > UNIFIED SECURITY SPECTRUM RANKING.
> 
> There already was a USSR, but I think it ultimately failed :-}

I wouldn't exactly say Soyuz failed; I'd say the main problem was that
they got a leader with a conscience... And you can't have a totalitarian
dictator with a conscience (as you can see).

...
> > bug that was recently discovered (say, the recent netscape bugs)
> > was, say, not really as potentially severe as the Morris worm.
> 
> To whom?

I would suspect the best answer is "to the general public" or "to the
average user".

If you are not an average user, you reinterpret the rankings to your
liking, making sure that you get more information on those that are
potentially severe to you. It'll still help you by giving you a 
preliminary ranking.

...
> The only way to unify security rankings is to constrain the problem by
> assuming an environment and intended uses for the system.  It sounds
> like you are assuming a low assurance workstation with an internet
> connection which is used for non-critical home or business purposes.

No, that is not necessary. Just like you can say an earthquake measures
3.6 on the Richter scale without making any statements about whether
or not it is "severe".

...
> Any flaw rating system needs to consider how it will deal with advancing
> protection technology.  For example, susceptability to viruses is much less
...

Not really, you don't need to change the Richter scale just because
buildings have got more solid. The perception of the scale needs to
change, but not the scale itself.

> Also, how do you rate situations where flaws are combined to mount an attack?
...

Then you are asking not for a rating of individual bugs, but overall
bugginess of a product. That can be rated on the same scale or a different
one, but it is a different question.

("A bug discovered in -x- rating -y-, raising the overall bugginess
or -x- to -z-. Film at 10.9959268374")

Then "Vladimir Z. Nuri" <vznuri@netcom.com> responded:
...
> the security rating would not be particularly useful to security experts,
> other than giving a rough idea of the potential severity of the problem.
...

Yup, or if you have long and short versions the long could actually
contain some more useful info.

...
> if something is not done to help convey accurate information,
> a void occurs and potentially "urban myths" 
> such as "the internet steals your credit cards" would tend to 
...

Do we *mind*? "The internet steals your credit cards - download Magic
Money!" :-)


OK, I guess we do mind.

Jiri
- --
If you want an answer, please mail to <jirib@cs.monash.edu.au>.
On sweeney, I may delete without reading!
PGP 463A14D5 (but it's at home so it'll take a day or two)
PGP EF0607F9 (but it's at uni so don't rely on it too much)

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAwUBMIRw5SxV6mvvBgf5AQF/iQQAory7PrJ2sJ1FXSOmXbwju5UHGbOjIMJV
CxWD7yPdAooz7ou8JImjky2c558YRxuY+cEXyCvOkTUzgtHwrwCY4IYI/U6e44fw
a9En7faSYG5eqOldpeSyuGqbC8DqEhuHAZiReFUHAduZw+fy7Oq9XNbWGZe20ZEN
I4Hsw6AvvRA=
=WTgn
-----END PGP SIGNATURE-----