Skip to Content
Uncategorized

Yoran and Spaf’s Law

eWeek has a nice tip-of-the-hand to Spaf’s “first principle of security administration: “If you have responsibility for security but have no authority to set rules or punish violators, your own role in the organization is to take the blame when…

eWeek has a nice tip-of-the-hand to Spaf’s “first principle of security administration: “If you have responsibility for security but have no authority to set rules or punish violators, your own role in the organization is to take the blame when something big goes wrong.”

The principle was first published in the book that I co-authored with Professor Gene Spafford of Purdue University, Practical UNIX and Internet Security. It’s directly applicable to the case of Amit Yoran, who resigned from the National Cyber Security Division of the Department of Homeland Security. According to author Ben Rothke, “Yoran lacked both an important title and appropriate authority–which are everything in government.”

Personally, I think that the cybersecurity problem is one that needs to be solved by slowly building consensus — not with the computer security establishment, but with the computer users throughout government. We have a very deep problem that comes from deploying a series of computer systems that are very difficult to secure. Fixing the situation is going to be a multi-year project—one where the authority will come from consensus, bridge-building and the persuasiveness of arguments, not from org charts and budget lines.

The whole “cyberspace security czar” approach is fundamentally flawed. I hope that the next administration can start things out with a new approach.

I should note that I co-authored Practical and UNIX Security with Dr. Spafford, but the law is all his.

Keep Reading

Most Popular

conceptual illustration showing various women's faces being scanned
conceptual illustration showing various women's faces being scanned

A horrifying new AI app swaps women into porn videos with a click

Deepfake researchers have long feared the day this would arrive.

2021 tech fails concept
2021 tech fails concept

The worst technology of 2021

Face filters, billionaires in space, and home-buying algorithms that overpay all made our annual list of technology gone wrong.

glacier near Brown Station
glacier near Brown Station

The radical intervention that might save the “doomsday” glacier

Researchers are exploring whether building massive berms or unfurling underwater curtains could hold back the warm waters degrading ice sheets.

Professor Gang Chen of MIT
Professor Gang Chen of MIT

In a further blow to the China Initiative, prosecutors move to dismiss a high-profile case

MIT professor Gang Chen was one of the most prominent scientists charged under the China Initiative, a Justice Department effort meant to counter economic espionage and national security threats.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.