Some 20 years ago, Bruce Schneier warned against creating your own cryptographic algorithms at home. The original piece was titled "Memo to the Amateur Cipher Designer". The topic hasn't lost any of its relevance since then. A quick Google search for "never roll your own encryption" still returns plenty of hits.
Without paraphrasing Mr Schneier, it could be said that cryptography is too research intensive a dicipline to be excercised as a hobby. It takes roughly 10 years for a dedicated cryptographer to mature in a proper research environment – one with peers to debate problems with, international conferences to attend, and a steady flow of peer review.
Beginners tend to fall into one of two traps:
- inventing something "new" that turns out to be mathematically easy to break
- overlooking the finer points of secure implementation.
They forget to wipe sensitive variables from memory, or they implement an algorithm in a way that lets an attacker read the private key straight off the processor's power consumption.
A well kept secret in the information security industry is that cryptography is not the only research-intensive domain of this kind. Whether we talk about the authentication and identity, or about perimeter protection, the same rule applies: you probably shouldn't attempt these at home.
The reason is simple. Scientific thinking behind these topics dates back to the 1970s, and in some rare cases even to 1950s.
One of the most ancient approaches was the "defense in depth" that one can admire on the All.Net web page. In 2004, the term BYOD (Bring Your Own Device) emerged, obscuring the previous clear understanding about the perimeter - an imaginable line surrounding our valuable assets from the hostile Internet.
Later, in 2009, a concept of "The Möbius Defence" was published stirring up the security world. What Peter Herzog actually told us was that an enterprise have to "muddy the waters", interleave the real resources by the honeypots and thus stretch the attack surface up to the cosmic size capable to exhaust any adversary. Or as it is often said in Estonia, to escape from a bear, you do not need to outrun the bear, you just need to run faster than your friend.
The security landscape is complex and is affected by multiple factors. Is it possible to take all these into account and calculate our success mathematically? Ideed, there is an interesting scientific direction dealing with the attack trees. It is probably easier to demonstrate what an attack tree is:
To calculate what the blacbeetle has in mind, as we like to say in Estonian, one has to think like an adversary. It might look like a funny computer game, but in fact these days the models and formulas,or to put it otherwise, mathematical ratiocinations are creating the distinction between the victory and defeat. With stating it, we are back where we started from. It's probably wise to avoid creating security systems from scratch, at home as an amateur, ignoring the half century long scientific research in the area.
Here at Cybernetica we are not amateurs. We have our own Information Security Research Institute – a luxury that few information security companies can afford. Our pledge is - supported by our scientists we are able to create better solutions than someone trying to leave the science out of the security game.