Security Pragmatics

Dr. Marc Donner, Director of Engineering, Google
Thursday, October 23, 2008

Abstract

During the 1970s and 1980s the New York City transit system was afflicted by an epidemic of rail car defacement.  Young vandals painted the insides and outsides of the cars. The city tried all sorts of tricks, including draconian restrictions on the sale of spray paint, severe punishment for the offenders they caught, and redesigning the interiors of the cars so that paint wouldn't stick. Nothing worked and it looked like the city was doomed to destruction. That is, until someone studied the behavior of the vandals and discovered that virtually all of the damage was being done in the rail yards where the trains were stored when not in service.  A little fencing, and a little patrolling and the problem was history.

Numerous commentators through history have noted that brute strength, as in a fortress with thick high walls, is never a reliable guarantor of security.  In this talk I will take you through some experiences from years of operational practice in industry, experiences of mine and of various others, that illustrate some of the pragmatic challenges in security.  I will attempt to demonstrate to you that dramatic improvements can be achieved with simple expedients and why many of the powerful techniques that we study are destined to be ineffective.

Bio

Dr. Marc Donner is currently an engineering director with Google in New York City where his team develops software for advertising. In his previous position as executive director at Morgan Stanley he led a number of projects that included early Web efforts, elimination of all printed reports from the clearance and settlement system, and event-based forecast modeling for individuals and enterprises. Prior to this position Dr. Donner was a Research Staff Member at IBM Research where his efforts focused on real-time systems, robotics, and large-scale distributed system management.

Dr. Donner received his PhD in Computer Science from Carnegie Mellon University and his BS in Engineering from Caltech. He serves as associate Editor-in-Chief of the IEEE Computer Society magazine, "Security and Privacy" and he is the organizer of the New York CTO Club.

• Presentation Slides [PPT]