Security in a bubble

Security must be distributed, ubiquitous and pervasive

People don't notice change when it's gradual. Sometimes, however, small, incremental changes add up in a way that isn't noticed until a change in degree becomes a change in kind.

So it is with Internet connectivity and perimeter security. In the beginning companies had "the Internet connection," a single pipe to the outside world. With one connection, there was a clear and easy-to-manage perimeter. And so, perimeter security flourished.

Over time, companies have added more and more connectivity, gradually changing their network architecture from a single "funnel" into the Internet to a mesh-like network with near-ubiquitous connectivity. What started as a series of changes in degree has become a change in kind. Companies no longer maintain "a connection" to the Internet; they are fully meshed, and a significant percentage of their work happens "out there." As a result, perimeter security also has changed -- from being fundamental to being almost obsolete.

The closest real-world parallel to perimeter security is the medieval castle with its walls and moat. With its single gateway, the castle forces all traffic to a single choke-point where access controls can be applied. Contrast the castle with a modern city, where there are thousands, if not tens of thousands of entry and exit points. It might be possible to set up roadblocks at every point, but it would be totally impractical. Not only would such a security scheme be ineffective, but it also would cripple the city as trade, re-supply and people-flows would grind to a halt.

Page Break

We see such measures in modern cities only during war, and even then they are broadly condemned because of the civilian suffering they cause. So, if this example is instructive for information security, modern corporations can not sustain a "hard" perimeter any more than a modern city can. Yet if we look at the security architecture of most companies, we seem to try to ignore the fact that "many connections" is not just a change in degree from "one connection" but a fundamental change in kind.

A biological example helps to demonstrate this. Assume there is an outbreak of disease. Would we attempt to construct a large plastic bubble to envelop Chicago? Or would we instead depend on individual immunity and vaccination to protect the residents? A bubble has the same problems as a perimeter: The insiders starve because of the lack of trade, and the bug always gets through anyway. Maximum downside, not much upside.

The unifying theme is the same: We cannot depend on architectural solutions for security in a corporate world where connectivity and mobility are ubiquitous. Those who fail to see that networks have fundamentally changed still are trying to adapt perimeter security to this new reality. The new reality, however, calls for individual immunity -- every server, desktop, smart phone, router and network device needs to carry a strong set of defenses.

Security must be distributed, ubiquitous and pervasive. It's either that or you end up huddled inside the bubble, starving for lack of trade and deluded into hoping nothing gets through.