Trusting Trust

An old and respected paper about compilers teaches us a lot about network security architecture.When I recently blogged about how Web ads can be compromised to infect users who visit famous Websites, I mentioned a key paper in security history, "Reflections on Trusting Trust," by Ken Thompson. "In 1984, Ken Thompson, the co-inventor of Unix, wrote a paper for the ACM called 'Reflections on Trusting Trust.' In it, he stipulated how he could insert a backdoor into the compiler so that even if your code is safe, after being compiled it will get back-doored.

While his paper is about compilers, the concept is trust. How far can you trust anything? How far can what you trust, in turn, trust anything further down the line?

If you write your own programs, then you can be reasonably sure they have no backdoor. Do you also write your own compiler? How about the operating system? The motherboard? The CPU?

There's no end to trust. No matter how paranoid you are, eventually you have to take a leap of faith."

Here's how this concept affects network architecture security: When you build a network, you may invest in high walls -- strong outward defenses. Is there any reason to invest in defenses inside that circle of high walls?

Security is not just a profession of risk and trust, but also of cost and benefits. If you had 100 percent security -- which isn't possible, of course -- would you benefit at all by adding security inside the walls? Would spending more resources make any sense?

We can always use more security if we can afford it and it's indeed useful. We can't ever tell what did get through our first lines of defense, or what we may not know we need to defend against.

So add more defenses, but use common sense.

While layered defense is a solid strategy, another option is instead investing your resources where you see the most risk. So if you already filter the Web well or if infected machines can't communicate with the world, anyway, you may not need to put additional security resources there.

Both of these approaches are extreme archetypes -- the best bet is somewhere in the middle. Trusting trust says we will always have another layer to add.

I try and subscribe to the "always add more security" approach, but I make sure I model it after my risk analysis so that it's applied correctly.

Post a comment if you have had any experiences with this.

Follow Gadi Evron on Twitter: http://twitter.com/gadievron

Gadi Evron is an independent security strategist based in Israel. Special to Dark Reading.