Revisiting Fundamental Laws of Security, or What We Can Learn from Biology
In an earlier post I discussed how one of the underlying principals in Jesper Johansson's Revisiting the 10 Immutable Laws of Security, Part 1, is that complexity can yield greater security. In this post I want to see if we can find patterns of complexity that improve robustness and resiliency and distinguish those from complexity that leads to less security.
For starters I want to take a look at biology. After all the most complex, robust and resilient systems we know of are organisms. What design patterns occur in living systems that could help us with systems design? I'm no biologist but here's a SWAG:
1. Proof Reading: Don't assume processes are always correct, double check. When our DNA replicates, there is a proof reading process that checks to make sure the copy is correct. This help prevent too many damaging mutations. It's life's version of "trust but verify." Bacteria and viruses don't have this and they mutate like mad (and leave us with antibiotic resistant bacteria); we're too complicated to survive without a proof reader. Perhaps our software is getting to that level of complexity as well.
2. Feedback Loops: At some level life is a bunch of chemical reactions. What keeps everything synchronized and working together? Part of it is feedback loops. Make too much of Chemical A? No problem there is a chemical feedback loop that shuts down production until we need more of Chemical A. See how many loops are in a simple metabolic pathway here; for a more details look, check out this image. The principal here is complex systems are in a state of flux and need mechanisms to maintain a proper functioning state. There is an assumption that something in our environment will push us out of our ideal state so we need mechanisms to get us back.
3. Redundancy - We have two lungs, two kidneys, and can live with one of each. Cells have duplicate genes. The principal here is that stuff happens and we need biological backups. We have this pattern in IT with data backups, redundant arrays of disks, dual network controllers, extra power supplies. We need more of it in software design.
There are probably anti-patterns in complexity that undermine security. I doubt we'll find many analogs in biology, evolution has a way of weeding those out. I'll have look around and come back to this question in another post.



Email This!
Digg it!
Del.icio.us
Reddit!
Newsvine
