Security threats Toolkit
Story: Researcher: Operating systems inherently flawed
Yes - they are - but they need not have been
The driver problem was known almost 30 years ago and became a major concern in the design of Intel's 286 chip. It was recognised that device and allied drivers would enter an OS from any source, a source beyond the control of that OS designer or distributor and well beyond the comprehension of an inexpert end-user. Thus separation via "protection rings" (4 in the case of the Intel 286 and even today's Pentium), instruction limitation, memory segmentation and memory capability hardware were all introduced based around the "Multics" experience. A sheer lack of interest by governments and regulatory authorities led to a "laisez-faire" attitude towards the ICT industry and no imperatives for "designed-in" security ever materialised - and still do not. The commodity OS of today is simply the "weakest link" and by today we should have had modernised version of "mandatory access control" in place suitable for home/small business and enterprise systems. ("B2 by '95"?) Joanna is 100% right. Increased sophistication in attacks are rendering the commodity OS completely vulnerable to any form of malware, from spyware to rootkits to..... The answer - well, SELinux was a start (thanks to the USA's NSA) but even it does not support the true security hardware implicit in Intels' original design. The "mess" that is the Intel "TXT" (trusted execution technology) or "LaGrande", along the lines of Microsoft's "Palladium" scheme, is providing a ridiculous patch up to hardware that should not be necessary. Yes - a new protection ring - "ring -0" plus some protected memory access. Imagine what could have been - trusted XENIX, GEMSOS technologies all made available to the connected global Internet user.
As the House of Lords has intimated - the only way anything will happen to change the situation is most likely by legislation over the ICT industry - but - hold on - wasn't that also needed for the car, air transport, pharmaceutical and numerous industries.
It really is time to STOP BLAMING THE END-USER for security problems that have been built into commodity operating systems. Governments need to BLAME THE ICT INDUSTRY itself.
Full Talkback thread
