Frank Lloyd Wright Was Right!

CERT/CC was founded over two decades ago, SANS was created 20 years ago, and USENIX has been providing a forum for world-class security experts for even longer than that. Yet in spite of these prominent centers of excellence (and their sage advice), we keep seeing new attacks, new exploits, and new vulnerabilities—in simpler terms, "same stuff, different day." It's not just because there are more bad guys out there (although there are), and it's not just because the bad guys are smarter (but they are). In my opinion it is because we are working with tools and systems that are fundamentally flawed. Our house of bricks is built on a sandy foundation, and we now find ourselves at a crossroads—the same crossroads that every technology has faced in human history: start over again and do it right from the start, or keep doing it wrong until it all falls over in a heap.

This talk will try to take a lighthearted look at some really bad news: either we will have to spend a lot of money redeveloping our basic tools, infrastructure, and operating systems properly, or we will have to spend a lot of money patching bugs and regularly recovering from security disasters (and continually be faced with the same basic problems). With one way we have a lot of unhappy people now, while with the other we will have a lot of unhappy people later.

In the 1950s, the architect Frank Lloyd Wright was given a tour of Pittsburgh which ended atop Mount Washington. He was asked, "What should we do?" In his inimitable style, he looked around and said, "Raze it and start over." Having lived in Pittsburgh for 35 years, I can tell you that he was right.

I've worked with computers for as long as I've been in Pittsburgh. Frank's advice is strangely apropos to my chosen profession, too . . .