download issue 27 here - Help Net Security

Security was comparatively easy. Hundreds or
thousands of users were physically hard-wired
to the data center (pre-IP of course). Products
like RACF identified users with simple user_IDs
and passwords, and the mainframe
knew where every terminal was located. Users
and groups of users were given access
rights to specific files and directories. All of the
intelligence was at the central processing unit,
located in some distant environmentally
controlled room.
On August 12, 1981 along came the 5150.
You might know it better as the IBM PC. IBMʼs
thinking was that this miniature ʻalmost a
computerʼ was the perfect way to get small
businesses addicted to IBM and would then
grow into their larger offerings.
But business had a different idea. Why
shouldnʼt they be able to run software locally
on the PC and connect to the mainframe?
With programs and data now being processed
and stored locally at the PC, the old security
rules and architecture had changed almost
overnight.
Companies had to develop ways to manage
distributed computers, and push out security
policy and enforcement to the PC.
With the introduction of Local Area Networks, vendors introduced
competing and incompatible products, with negligible standards.
With the introduction of Local Area Networks,
vendors introduced competing and incompatible
products, with negligible standards. From
a security standpoint, the landscape changed
again. There was no longer any need to run
complex software at the PC. The LAN would
manage it all, and your PC would not be
burdened with the taxing processing.
This fundamental architectural shift in the IT
industry again challenged us “security folks,”
as now we had to consider how to secure the
LAN, the servers and the data that could still
be stored on the PC. We were treading on
entirely new ground.
In the rush to capitalize on Gordon Geckoʼs
“Greed is Good” mantra so loved by the financial
industry, along came client-server architecture.
This architecture expanded on the
LAN model by distributing processes and
storage across a plethora of servers in an effort
to increase power and balance loads. The
business units demanded the function, IT built
a solution, but the security problems were
immense and never adequately solved. A hybrid
of centralized, yet distributed security failure
points, was a catastrophe until a savior
appeared on the scene.
The sudden appearance of the Web triggered
the development of yet another IT architecture.
Every machine could be a client. Every
machine could be a server. Not quite what we
have come to know today as P2P networking,
but certainly an early evolutionary step. Again,
security was, at best, a minor afterthought
since the Web was designed to be platformagnostic.
Herein again, the mistakes of the prior generation
of IT management were repeated with
historical ignorance and arrogance. Letʼs take
this phenomenal connectivity, build piles of
cool applications that can be run on almost
any computer from almost any computer, and
return the power to the user.
Business was driving IT to build out function,
secure web programming was a distant formalization,
and the consumer demand was
and is still, insatiable. Where does security fit
into this model? Viruses, worms, and an endless
supply of threats created a multi-billion
dollar industry that is akin to the carnival game
of Whack-a-Mole.
Fast forward to today: Given the consumerization
of the Internet, security is again treading
in untested waters. Servers need to be secured,
but unless the virtual drawbridges are
in the ʻdownʼ position, commerce is shut off.
An architectural dilemma to be sure, compounded
by the fact that this security model
assumes that the individual user knows how,
and will actively participate in the security
process.
www.insecuremag.com 40