Because approved users can still do bad things using approved programs, it's essential that network packets be authenticated from source to destination, and traceable back to their originating point. This will prevent a user from creating malware and sending it to another location, or prevent a malicious user from using another innocent user's computer to do the same. In my Internet world, if the bad guy "borrowed" someone else's computer, we'd always be able to trace the perpetrator back to their lair.
Routers and networks that carry our information from point A to point B would also be authenticated and their unique identities added to each passed packet. It wouldn't be as slow as you think -- network devices are working at electric speeds (the speed of light minus minor, unavoidable impedances). Tacking on a unique, authenticable identifier will not add that much overhead.
The downside
Unfortunately, my brilliant idea (probably already thought of by a hundred other great minds decades ago) requires a complete
rebuild of every involved component: hardware, software, and user logons. The good thing is that most of the technology and
smarts to make it happen already exist. A tweak here or there is all that is needed...well, that and universal cooperation
and planning.
Because we like to do things in evolution vs. revolution, my model proposes "rings of trust," where differing levels of trust can be defined by each participating party. Users and computers not up on the latest computer security checks will be assigned a lower level of trust and have to go through additional (traditional) layers of security checks (anti-virus, anti-spam, and so on). Traffic arriving from users and computers with higher levels of trust will go directly to their intended destination.
Yes, even this system will be hacked, but it will fix the discovered problem, and all malicious exploits of that vulnerability are prevented at once. This beats our current game of "whack-a-mole" security defense.
If you don't like my plan, stay with the current status quo or make up your own plan. Stay on your version of the Internet and compute away. I'm hoping that someone powerful enough, a consortium of enough interested people and companies, comes together to make my vision a reality. Dare to dream.
And if you can make up a better solution, the world should beat a path to your door. Until then I'll just continue to believe my solution is the only one.
Roger A. Grimes is contributing editor of the InfoWorld Test Center. He also writes the Security Adviser blog and the Security Adviser column.


Talkback
E-mail
Printer Friendly
Reprints



