Given a securities trading algorithm that is very effective and thereby very valuable, how do you keep it secret and protect it from theft or copying? What techniques or architecture is the best?
The algorithm will of course need some input data and output some data. It will also need maintenance and development.
Preferably it would be connected to the network, but then there are all kinds of threats and possibilities of security breaches.
People are working on different parts of the algorithm either as software developers, testers, admins or as users. People in themselves pose security risks in that they may copy the parts that they have access to.
Here are some of my thoughts up to now:
Some organizations have an internal network that is not connected to the external network except through humans and USB sticks. The Stuxnet virus shows the USB stick approach is not enough to keep secrets secret. Humans have a very limited bandwidth and have a tendency for introducing a lot of transmission errors.
Some organizations instead of a direct network connection have a simple to analyze and understand RS232 serial connection to the outside world with a very limited bandwidth, and if too much data is being transmitted, they cut the connection until they have analyzed what data was being sent and why.
Extracting the valuable part from the standard straight forward parts of the algorithm reduces the target area.
Running on OpenBSD may help avoid several types of problems.
- Reverse proxy
- Up-to-date antivirus
- Honey pots to detect intrusions
- Storing everything on Truecrypt volumes
- Avoiding forgiving languages such as PHP, C, C++ and preferring languages that do additional checking such as C# or Java.
I think Warren Buffett has the ultimate security for his algorithm in that he keeps it in his head, and does not use a computer or a mobile phone.