In one of Sean Carroll's AMA's, he once said something along the lines of "entropy favors the attacker over the defender."<p>That really stuck with me. My internal thought was "it's easier to kick over a sand castle than to build one." It seems to ring true for infosec, societal structures, and kinetic cases. Is this just a base truth?
I think it bears mentioning that like sand castles, software engineering has approximately zero building codes.<p>Try kicking over a building sometime. (Or don't - you'll stub your toe).
Well, I don't want to get on the capital E - engineering tangent regarding software. But yeah, agreed on that. In most cases, we have been vibe engineering software this whole time.<p>Tangent aside, entropy favors the attacker even in the case of a building that has PE stamps on the plans and passes all codes at time of construction. Just leave it alone for a while with no maintenance, it will fall. Or, hire one man to correctly place charges. Far less work than what it took to build it.<p>edit: I want to make clear that what amazes me is how hard we fight entropy. We have built fragile societies, fragile technologies, we ourselves are fragile. And yet, humans are generally pretty cool and choose not to destroy all of these things, though we do have a few assholes amongst us.
"Software architecture" and engineering quality overall has had questionable quality at best. I don't see how vibe coding big new systems will make it better. I predict vibe coding will make for an even more golden age of hacking and a large increase in ransomware and breaking into systems. Today's giant hodgepodge of glued together software products could actually be better than vibing up something new.<p>I'd also expect the offensive side of hacking into systems will greatly benefit from LLMs finding an almost endless series of new vulnerabilities in even crappier llm software. I'm just so cynical.
That's kind of the definition of life tho, a system that fights, or "exports" entropy. Built in to our very code. Even the sand castle kickers are doing it for many years just just to be able get to the point to kick.
In the physical sense, entropy favors the attacker because destroying something is just helping it along the path it wants to take. Everything wants to turn into dust, all the time. It takes energy to prevent it from happening. The attacker can use significantly less energy to get it moving.<p>Consider the energy requirements to construct a skyscraper compared to the energy requirements to demolish one.
The tools to "knock over" a software system are easy to download and come by, but do require some skill.<p>On the other hand, "You wouldn't download a wrecking ball?"
Indeed, <i>except</i> when you get into the critical software realm. Firmware for pacemakers, avionics etc. There are respective ISO's and enforcement bodies.<p>I wonder if that ever expands to traditional software when the stakes of malfunction/blast radius increase significantly with time.
“It’s easy to destroy a building than to build one” is still true, building codes or not.
buildings may be quite hard to destroy, but the relevant question is whether it is proportionally harder to build one.<p>required codes and standards may raise one (difficulty of removal) or both (difficulty of removal + difficulty of construction) in varying proportion.
I mean for just the EU you have:<p>Digital Operational Resilience Act (DORA) and Cyber Resilience Act (CRA) which enforce mandatory governance and processes like resilience testing and cybersecurity lifecycle requirements.<p>GDPR & Data Protection frameworks which requires architecture to support CRUD operations on all PII, data minimization, customer-managed encryption architectures and so forth.<p>...and the anti-vibe code framework aka the EU AI Act, which requires human oversight and data quality controls.<p>This is completely aside from any industry specific engineering codes like in Finance where you have to adhere to things like ISO 20022 or iXBRL/ESEF standards, user accessibility mandates, and PCI Compliance mandates for things like Security Architecture over and above the CRA.
Yes, I've worded this as 'the asymmetry between creation and destruction'. Any idiot can destroy a piece of glass, it takes a whole raft of experts to make a pane and then some more to properly mount it.
Per the IRA after an unsuccessful attempt to assassinate Thatcher, "Today we were unlucky, but remember we have only to be lucky once, you will have to be lucky always."
IRA was unsuccessful in case of Thatcher, but was successful in case of Lord Mountbatten.<p><a href="https://en.wikipedia.org/wiki/Lord_Mountbatten" rel="nofollow">https://en.wikipedia.org/wiki/Lord_Mountbatten</a><p>I see The Troubles, as a civil war in UK.<p><a href="https://en.wikipedia.org/wiki/The_troubles" rel="nofollow">https://en.wikipedia.org/wiki/The_troubles</a>
It is not a base truth. It is just that complete negligence is currently standard, legal, and expected in most industries. Kind of like before basic sanitation was legally mandated at hospitals preventable deaths dramatically higher.<p>I have designed and audited systems for dozens of orgs that protect hundreds of billions in value and regular transaction volume. HSMs, remote attestation, quorum controlled servers with custom and fully audited operating systems, and in some cases a geodistributed network of underground bank vaults, NSA tempest spec zero emissions chambers, and security down to the laws of physics.<p>Security can be assured with high confidence for the right price, but very few are willing to pay for it and fewer still experienced enough to offer it. 15-200k a week is common depending on reputation, but I know at least one that claims to bill 1m/w.<p>Personally I do not believe hoarding effective security tactics for private audiences is ethical, and thus I insist any security work and research resulting from my work for employers, clients, and my own companies must all be freely licensed open source. No exceptions for any amount of money.<p>Security will be normalized when it as open, cheap, and too easy to justify not doing.<p>Shameless plug, this is why I co-founded Caution.
> It is not a base truth.<p>When you operate in an environment where every "good boy" can be wiped by a single "oh shit", statistics are against you. That <i>is</i> a base truth. The failure can rest on negligence but negligence isn't a necessary component for failure. For attackers their failures are wiped by a single success, for defenders their successes are wiped by a single failure.<p>In a different life I worked on designing and implementing similar systems to the ones you described, except with even more money going through them. They can can still be hacked, at incredible expense. And the hackers could even make a huge profit with the treasure trove they have access to. But getting away with it is orders of magnitude more difficult than the hack. The money involved to make the hack profitable is impossible to hide on the world stage. It takes a lot of political capital and military to be able to steal billions+++ and get away with it (nation state attackers, not just a group of hackers). So hackers go for lower risk jobs where the payout can even be similar just because of the lower cost to succeed.
Doesn’t entropy also lead to more weak targets, therefore the secure defensive target is less appealing?<p>The whole “you don’t have to outswim the shark, just the guy next to you.”
Yes, but I think that asymmetry manifests itself in the opposite direction too:<p>It's much harder to have perfect opsec and never be caught for the wrongdoing. The other side only needs patience.
I think its generally true. attackers have to get it right only once, where as defenders have to get it right every single time.
WP was designed around the idea that it should be easier to improve than deteriorate.
> In one of Sean Carroll's AMA's, he once said something along the lines of "entropy favors the attacker over the defender."<p>Eh, kinda. The defenders have the advantage of playing on the home turf. They know their infrastructure, can have sensors and traps everywhere. The bad guys are stumbling in the dark. They have no idea what's real and what's a honeypot, what signals you're watching, etc.<p>The problem is that almost no one takes this advantage seriously. If you're not paying attention to your infra, yeah, you're gonna get owned.
> They know their infrastructure, can have sensors and traps everywhere.<p>They can have, but they’re sufficiently tied up with other corporate busy work that they don’t.
Yeah but you know there trade offs like free society, freedom of movement, privacy and stuff that you need to sacrifice to take advantage of home turf. And you need to do this everywhere. Attacker can pick his targets on his own schedule, you need to defend always.
It just goes to show how pro-peace and stability humans are in general. It's so easy to cause death and destruction, and we most often do not choose to do that. While maybe peak_local_max_asshole = true, we have certainly been progressing in that direction, haven't we?
[dead]