2

This may be a naive question. If it is, I'm fine with just a link to outside information. I studied RSA encryption about 2 years ago, but that's about it.

I'm just wondering: is it a matter of engineering or is it a fundamental problem? By the latter, I mean "will we always be forced to release information which could undermine secure communication?"

This question is posed under the assumption that it is hard to achieve. Is it?

Improve this question
3
  • Are you saying network as in LAN, internet or both?
    – user5575
    Commented Jun 2, 2012 at 0:50
  • without network, you need physical access to the machine to do something. That's one more (important) obstacle for the attacker.
    – Andre Holzner
    Commented Jun 3, 2012 at 9:44
  • I hate all of these answers. It might be 'hard' in a way like programming is 'hard' when you use a lot of global variables as newbie programmers do. (Solution is don't program it that way). But also i dont know if the question is setup or implementing
    – user5575
    Commented Jun 4, 2012 at 23:45

3 Answers 3

Reset to default
3

Basically, it's hard because there are so many little things that can go wrong. Often these little things can almost completely undermine the security of a network when found and exploited. However, when designing these security systems, it's very easy to overlook a small detail that might cause a problem later. To make things even harder, attackers and constantly and actively exploring different way to break security systems, and there's a lot of financial intensive to do so.

This is why most security experts will tell you to use pre-made solutions, instead of inventing your own. Getting it right by yourself is very difficult to do, and the pre-made stuff is already somewhat "battle-tested" in the field. Note, that even when you use existing tools that are secure, you have to be careful to use them correctly or they will still be insecure (WEP is a great example of this. They took secure algorithms and implemented and combined them in incorrect ways.)

Improve this answer
4
  • Could you give an example. I don't see why it is 'hard' at all
    – user5575
    Commented Jun 2, 2012 at 0:50
  • 1
    In addition there is always the human element when managing a secure network. Most people do not understand the first thing about information security and they will often be a cause of a breach (phishing, P2P, torrent downloads, weak passwords, passwords on paper etc)
    – KDEx
    Commented Jun 2, 2012 at 3:36
  • in fact, I saw suggestions to use non-standard protocols (e.g. custom protocol over a high speed serial link) e.g. when getting authorization from a server. The attacker would first have to understand the custom protocol and the custom protocol would not allow remote logins (for which there is always a risk on standard LAN). So custom solutions can have an advantage.
    – Andre Holzner
    Commented Jun 3, 2012 at 9:52
  • 1
    @AndreHolzner that's not really realistic. If you do it yourself, you will almost certainly screw it up at first, and a trained attacker will find out how to break it. Using something that's been verified and tested is still going to be more secure.
    – Oleksi
    Commented Jun 3, 2012 at 16:46
2

It is because there are many variables at play.

For example, networks usually have many services running at the same time, http, ftp, ssh, telnet etc. Each of the service introduces potential vulnerabilities that can compromise the network. Many of these are out of your control, and you will have to depend on the vendor to patch the holes.

Leaving unneeded ports open also introduces potential vulnerabilities, by increasing the attack surface an attacker can attempt to exploit.

As Oleksi said, there are many little things that can go wrong. Even using secure pre-made solutions could pose some problems, if one does not carefully configure it.

Improve this answer
4
  • i'm not op but i hate this answer. What other services does not have anything to do with implementation and just because they get it wrong it doesn't automatically make it 'hard'. -0.
    – user5575
    Commented Jun 4, 2012 at 23:44
  • @acidzombie24 If you have a hundred services running, with each service using 2 or 3 different, sometimes obscure ports, can you be sure you are always blocking the right ones? Even if you do, all of this services are third party applications which sometimes have vulnerabilities allowing the attacker to exploit. Can you really ensure all the services running on your network are free from 0-day exploits? If you hate all the answers offered, why not offer your own?
    – user10211
    Commented Jun 5, 2012 at 1:02
  • bc i don't know 'why' they are hard. I wasn't sure if op was asking about implementing code or setting up a network. Even if a service uses 3rd party libs, in my (very) limited experience i always get/parse the data in my own code before passing it to 3rd party libs. If the lib is doing the networking than hopefully they parse and sanitize correctly which i think is not difficult.
    – user5575
    Commented Jun 5, 2012 at 7:52
  • Firstly: my answer is with regards to implementing or setting up a network. For example, setting up a web server which is a common thing in a network. Can you really ensure that the web server you are using, say Apache, is 100% secure and free from vulnerabilities? Second: Even from a programming point of view, i think you are underestimating how difficult it is to code securely. Large scale programming projects are done in groups, can you really ensure that EVERY single programmer working on the code adheres to secure coding practices? One mistake and your code is exposed.
    – user10211
    Commented Jun 5, 2012 at 8:09
0

Other considerations are cost and ease of use or convenience. Generally, the more secure any system is, the more it will likely cost and the less "friendly" it will likely be for users. There has to be a balance. The business has to assess the risk and decide whether greater security is worth the cost and the possible inconvenience for the users.

Improve this answer
1
  • Only semi true. Sure no passwords would be 'easy'. But everything else does not need to suffer for having good security (no injections, holes, etc)
    – user5575
    Commented Jun 4, 2012 at 23:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .