Eliminate All Coding Errors Within Two Years

Mary Ann Davidson, CSO of Oracle and champion of the quality coding movement, says she's tired of coders arguing that their jobs are too creative to eliminate errors such as buffer overflows - that coding's an art, not a science. She applauds ethical hacking, where developers attempt to break software before selling it. Davidson says some schools now divide developer classes in two, a green team for writing code and a red team for breaking it. The application's relative security becomes part of its final grade. "Why isn't that standard development process?" she asks.

Davidson knows that, with billions of lines of legacy code and billions more in development, eliminating all coding errors is quite a lofty goal. But, "We need goals, right?" she says. And if doing that means limiting the freedom and creativity of coders, Davidson says, so be it. "We should be marching toward a realm where it's harder for people to create vulnerabilities. We need a revolution," she says.

Pry PCs from Their Cold, Dead Hands

Guns are dangerous; therefore, we license them. We give them unique serial numbers and control their distribution. James Whittaker says programmable PCs are dangerous, so why not treat them like guns?

"Let's make all end-user devices nonprogrammable," he says. "No one can connect to the Internet on a machine that creates code. If you want a computer to do programming, you would have to be licensed. We could license software companies to purchase programmable machines, which would be completely traceable along with the code created on them."

That would blunt the information security problem - suddenly all that intelligence at the edge of the network that Amoroso wants to pull back in isn't just gone; it's physically stripped. On the other side, new levels of accountability and liability are created through licensing developers and eliminating anonymity from coding.

Catch Some Bad Guys

Time and again, security types bemoan the light sentences hackers get. If the penalties were harsher, perhaps people wouldn't be so fast to spread their malicious code.

But penalty is not a deterrent; arrest is. Right now, the bad guys know the risk equation is favourable - that it's extremely unlikely they will be caught. A higher capture rate would dissuade them.

Creating higher capture rates has a lot to do with anonymity on the network - or, more specifically, removing it. Many of the Big Ideas in this space propose less anonymity - licensure, for example. Microsoft's Charney wonders what effect automatic traceback packets - knowing quickly and reliably where data came from - would have. "It's an astounding thought," he says.

And then, he immediately comes up with the problems it presents. Traceback tells you where, not who. And privacy issues get thorny quickly. "Can you use the highway anonymously?" Charney asks. "No. But you also can't be stopped for no reason. More complicated than that, the US Supreme Court has already ruled that you can't force someone to attach their name to political speech if they don't want to. So do you create an anonymous part of the Internet to ensure free speech? And if so, what stops bad guys from just using that?"

Still, if privacy issues could be worked out, and capture rates went up, attempted attacks would go down.

Call the Cybercops

Part of increasing capture rates would have to include better policing. To help this, Bill Boni, CISO of Motorola, has come up with the Big Idea of a cybersecurity version of Interpol. "The problem with existing collaboration on cybercrime is, it's episodic and it ignores the fact that investigation requires the significant participation of the private sector." With a "Cyberpol", you could license private eyes and forensic experts who not only would facilitate the cooperation but also would improve response time, as there already isn't enough law enforcement for cybercrime.

"Every railroad has its own police who don't have to call for backup if you're doing something wrong on their property," Boni says. "In Canada, law enforcement has simply outsourced white-collar crime investigation to licensed private investigators. The Mounties just said: 'We can't deal with it. You investigate, and if we need to be called in, then bring it to us'."

A Cyberpol would facilitate international cooperation on investigations as well. That's key, as many virus writers live and work overseas, under the cover of fuzzy international law and law enforcement agencies with varying appetites for investigating cybercrime.