Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]

As a security advocate, I hope for a future where we can move away from systems that have been vulnerable by design such as Windows, Linux, iOS, and AWS. These systems were not initially designed with security in mind and have remained structurally vulnerable over time, despite attempts to bolt on security measures. To adequately address future security concerns, we need to design and verify a new computing stack that incorporates security principles specifically aimed at thwarting nation-state attackers like the NSA.

Although some commercial systems are still being regularly targeted by nation-state or state-sponsored attackers, historical systems and certification processes such as the Orange Book Level A1, SCOMP, GEMSOS, and the Common Criteria SKPP have provided adequate validation against such attacks. Successful evaluations have included practical testing, formal specifications, and formal proofs of correctness as part of the validation process.

Meaningful security against proven threats is only possible through the application of security principles that have demonstrated success against nation-state attackers, leading to a greenfield redesign of the entire computing stack. Attempting to bolt on security measures to existing systems is unlikely to provide meaningful security against current threats, given decades of failed attempts by large software companies via certification processes.

It's important to note that while some systems, like Windows NT, were initially designed with security in mind, they still suffer from vulnerabilities. A potential solution to this issue may be to create specialized, limited-performance systems that complement lower-security systems instead of replacing them. Additionally, disconnecting servers from the internet remains a viable security measure as it is unlikely for hackers to physically infiltrate a network.

Overall, our goal should be to develop a new computing stack with security designed, verified, and demonstrated to thwart nation-state attackers, rather than attempting to retrofit security measures onto existing vulnerable systems.

You seem to be from a bizarro world where these certifications are the be-all/end-all. No major advance in security was ever achieved by trying to follow some standard written by a bunch of people who haven’t themselves solved any of the engineering challenges.

I do, in fact, put stock in quality certifications. Most certifications are not worth the toilet paper they are written on; anything that gives a system as insecure as Windows top scores is obviously useless. In contrast, the best that Windows can certify against with respect to the Common Criteria is that it can verify that it is easily hacked by minimally skilled attackers which has been proven out in practice as true. That is a good sign of a security certification with standards, though by no means exhaustive.

You will find that all the certifications you are aware of, which has led you to the idea that all certifications are worthless, fall into this bad category since the commercial IT world is hopelessly incompetent with respect to security and their certifications are the corrupt supporting the corrupt. The standards and prescriptions they suggest are worthless as you state because they have not built anything great, have never seen a great system, and have no intention of creating acceptance criteria that their own incompetently designed systems would fail. Frankly, the number of security standards of any value is basically 0.

This does not mean that certifications created by entities that have never built the system they are trying to certify are useless. It is actually quite easy to create excellent acceptance criteria as long as you stray far enough away from prescriptive standards and accept based on the outcomes instead of mechanism. For instance, I am not a mechanical engineer, but I can design the acceptance criteria for a bridge as requiring 3x the maximum weight of fully loaded vehicles laid across the length of the bridge. I do not need to know how that is achieved, just that you must do so before I accept the bridge. Assuming such a standard is desirable (I am not a mechanical engineer so I do not know how bridge load specifications are actually done or what they must achieve), I created a fairly good standard with a acceptance test despite having no knowledge of how the bridge must be built. In fact, I can do this even if such a bridge can not be built with existing technology. In that case we have deemed that a adequate bridge with the desired safety properties is just plain impossible and should not be built.

In the case of the Common Criteria SKPP standard, one of the acceptance tests was that the NSA red-team must fail to find any deficiencies. Yes, the literal standard requires that the NSA be unable to hack it and it is verified by the NSA having a team attempt to hack it with full access to the source code, specifications, and proofs of correctness. Now for anybody whose gut instinct is that they will just pretend to fail (which is totally the right gut instinct to have), the NSA did the verification work for the only certified system, INTEGRITY-178B, at the behest of the DoD to verify that the core OS of the F-22 and the F-35, the top-line fighter jets of the US military, can not be hacked and either disabled or turned against the US by enemy countries. This is also the same system used in the flight and weapons control of the B-1 and B-2 intercontinental nuclear bombers and in various other NSA and DoD systems. So, pretending to fail is just shooting themselves, the US Air Force, and part of the US nuclear arsenal in the foot.

So yeah, go find me one of these uncertified systems that has achieved a "major advance in security" that the NSA can not hack and then we can start talking about whether there might be some good lessons to be learned. Until then we should probably look to the systems that can actually stop the prevailing threats in practice which the commercial IT sector thinks is literally impossible (that being protecting against nation-state attackers such as the NSA).

GPT-4 sentences by design?

All of those OSes are written in C, C++ and sputterings of asm.