I mentioned in yesterday's post that Andreas Antonopoulos at Network World raises the possibility of introducing randomness in anti-virus applications, in part inspired by the predictability problem becoming apparent in the Société Générale case. I argued that randomness isn't enough, we need multiple layers of defense.

But, as the WSJ article shows, the Société Générale did have at least two systems that would/should/could have detected the unauthorized activities. The problem was the trader new how both systems worked and there was not sufficient complementarity between them. Two systems that leave the same hole can be just as bad as one system that leaves a hole. Multiple countermeasures must compensate for each others weaknesses.

Take for example the idea that you should run different anti-virus systems on the network and on clients. The reasoning being that malware that slips past one will be detected by the other. This is true, to a point. But if both AV systems uses the same combination of signature and behavioral analysis class of techniques then there is a chance that something will slip through both. Another approach is to have a countermeasure that is designed to function assuming malware does make it through, e.g. intrusion prevention. This is a different model that is triggered by activities at different stages of information processing.

Belts and suspenders do the same job but more importantly they do it in different ways and that is what is needed when dealing with intelligent, determined adversaries.