Dan Farmer | Network security: a devilish mess

In the aftermath of the Sept. 11 terrorist attacks, the Defense Department called on IT experts to help assess the security of public networks in the event of a cyberattack on the United States. Among the luminaries who converged on the Pentagon, including founders of Google Inc., Netscape Communications Corp. and Yahoo Inc., was Dan Farmer, current chief technology officer of Elemental Security Inc., former Marine, and conscientious objector to the first Persian Gulf War. He's also the guy who arguably put network security on the map.Today Farmer jokes good-naturedly about being the only tech expert in the room who hadn't gotten 'fabulously wealthy' off the Internet, but his influence on networking is well respected. He has spoken before Congress, co-authored a book on computer forensics and testified against the music-swapping service Napster on behalf of the recording industry (for which he received a gold record).But perhaps most important is his relationship with SATAN, the Security Administrator's Tool for Analyzing Networks, which he helped develop in 1995. Before SATAN, few IT administrators thought about network security or how hackers could break into their systems. Much to their discomfort, Farmer showed them.In April, Farmer and Elemental Security introduced their first product, a program that helps network administrators set and enforce security policies. He spoke to GCN technology editor Brad Grimes.FARMER: In 1993 I wrote a paper with my longtime co-author Wietse Venema in which we laid out how people break into systems. Security was starting to get some interest at that time, but people really didn't understand how it was possible to compromise systems, or how hard it was, or what the difference was between network- and host-level security. So we wrote a paper and said look, if you want to get serious about security, you need to know how people are breaking into your systems and check them out yourself, see if you can break into your own systems. As an appendix to that book we had a brief little mention that we were working on a tool called SATAN.The first real network scanner I had seen actually came out of one of the military labs, but it was never released. We decided what we wanted'since people were, and to some extent still are, uneducated about security'was something that was very friendly, very accessible and very usable. SATAN scanned networks looking for problems and gave [admins] information.But as we were writing this thing there was a furor that it was going to end the Internet as we know it and no one would be safe. By the time it got out, there was so much hype, it caused a big splash and got people thinking, 'Wow, we need a product to help us out here.'FARMER: Rumsfeld et al. asked Sequoia [Capital, a high-tech venture capital company in Menlo Park, Calif.] to gather half a dozen technical types and a half a dozen banking types to come to the Pentagon and talk to them about how, if we were attacked in the same way virtually as we were physically, it would impact the public networks and the banking networks. Because as you know, one of the interesting things over the last 10 or 20 years is that the government has really embraced [commercial off-the-shelf software] and moved onto public networks, and shed a lot of the proprietary stuff they use to rely on. So they're more vulnerable than ever in some respects.FARMER: One of the things that, to me, typified the whole experience, was a general there who was giving a report on what the state of security was in the military and the Pentagon. He laid out some real hard numbers like 'We've had this many attempted break-ins and this many break-ins and this many machines that were compromised.' And the numbers kept going down until at the end you had a very comforting, very small number of real problems. And I said, 'I don't believe your numbers. How can you stand here and say this? It's incomprehensible that that would be true.' And I think that took them by surprise.FARMER: I think any one individual who thinks they can make a difference to the government's or DOD's security is barking up the wrong tree. That isn't to say you shouldn't make the attempt. But they're such a large organization'and this is true of any large organization'that there is a resistance to change and a resistance to really understanding the problem and making fundamental changes that will address it. ... DOD is getting better, but there's still a lot to learn.FARMER: One of the problems is the dynamism of networks. In the military you have a machine that has a life span of three or four years; you have people getting shipped off to another location every couple of years; you have constant movement of organizations and people, constant restructuring, new leaders that always want to change things, a lot of mobile devices, a lot of stuff that is changing. You can't keep track of this stuff. ... They don't know what's out there and they don't know how it's being used. Even if you can get all the machines up to snuff against some policy or standards, they're so dynamic that it's not good enough.FARMER: When I talked to Congress, I had done a computer security survey of the Internet, just a brief little thing, scanning a bunch of machines, and presented the systemic problems I found. For example, I had scanned the White House computers and found a relatively serious problem and wrote to the White House before I released the survey. They didn't get back to me and I tried several times. I wrote this up in the survey, nothing happens. So I tell Congress that if someone had seen a physical problem at the White House, like a door open, the men or women in black would be all over it. But it's different [online]. Even after telling this story numerous times, I was never asked what the problem was.FARMER: They just had a problem in one of their network ports that would take down their computers in a couple seconds. It seemed serious to me, but no one asked me about it.FARMER: It's an indicator. You look at someone who's a D-plus compared to a B-plus and there's probably merit to that. How much weight to attach to it? I don't know. It's fun, it's handy, but there's a lot to consider.But even with the things people can agree on, there are systemic and deep problems within the government's computers. And the reason you don't hear about break-ins is not because they don't happen'I can assure you they happen all the time. The government has millions of computers and if you don't think they're getting broken into every day, you don't understand network security.FARMER: If I could have written the program myself and just given it away I would have done it. Starting a company is a lot of responsibility. ... But I thought, I can't do this myself, and it was such a big idea. The idea in a nutshell was security policy management, and what is policy, and how do you express your desire. No matter if you're an accountant or a computer security person, you want things to look a certain way, and a [security] audit simply checks the real life against what you want and tells you what's different.FARMER: [Laughs] Some people asked me why the hell I was working for the recording industry rather than Napster because I gave away all this software, don't I believe in freedom? But it was pretty easy for me. I gave away [SATAN] because I had a choice and wanted to give it away, but I don't believe in people predicating their business on the violation of copyright.