Hello,

We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not a subscriber? Subscribe now for unlimited access to online articles.

Simson Garfinkel

A View from Simson Garfinkel

Yoran and Spaf's Law

eWeek has a nice tip-of-the-hand to Spaf’s “first principle of security administration: “If you have responsibility for security but have no authority to set rules or punish violators, your own role in the organization is to take the blame when…

  • October 31, 2004

eWeek has a nice tip-of-the-hand to Spaf’s “first principle of security administration: “If you have responsibility for security but have no authority to set rules or punish violators, your own role in the organization is to take the blame when something big goes wrong.”

The principle was first published in the book that I co-authored with Professor Gene Spafford of Purdue University, Practical UNIX and Internet Security. It’s directly applicable to the case of Amit Yoran, who resigned from the National Cyber Security Division of the Department of Homeland Security. According to author Ben Rothke, “Yoran lacked both an important title and appropriate authority–which are everything in government.”

Personally, I think that the cybersecurity problem is one that needs to be solved by slowly building consensus — not with the computer security establishment, but with the computer users throughout government. We have a very deep problem that comes from deploying a series of computer systems that are very difficult to secure. Fixing the situation is going to be a multi-year project—one where the authority will come from consensus, bridge-building and the persuasiveness of arguments, not from org charts and budget lines.

The whole “cyberspace security czar” approach is fundamentally flawed. I hope that the next administration can start things out with a new approach.

I should note that I co-authored Practical and UNIX Security with Dr. Spafford, but the law is all his.

Want more award-winning journalism? Subscribe to MIT Technology Review.
  • Print + All Access Digital {! insider.prices.print_digital !}* Best Value

    {! insider.display.menuOptionsLabel !}

    The best of MIT Technology Review in print and online, plus unlimited access to our online archive, an ad-free web experience, discounts to MIT Technology Review events, and The Download delivered to your email in-box each weekday.

    See details+

    12-month subscription

    Unlimited access to all our daily online news and feature stories

    6 bi-monthly issues of print + digital magazine

    10% discount to MIT Technology Review events

    Access to entire PDF magazine archive dating back to 1899

    Ad-free website experience

    The Download: newsletter delivery each weekday to your inbox

    The MIT Technology Review App

  • All Access Digital {! insider.prices.digital !}*

    {! insider.display.menuOptionsLabel !}

    The digital magazine, plus unlimited site access, our online archive, and The Download delivered to your email in-box each weekday.

    See details+

    12-month subscription

    Unlimited access to all our daily online news and feature stories

    Digital magazine (6 bi-monthly issues)

    Access to entire PDF magazine archive dating back to 1899

    The Download: newsletter delivery each weekday to your inbox

  • Print Subscription {! insider.prices.print_only !}*

    {! insider.display.menuOptionsLabel !}

    Six print issues per year plus The Download delivered to your email in-box each weekday.

    See details+

    12-month subscription

    Print magazine (6 bi-monthly issues)

    The Download: newsletter delivery each weekday to your inbox

/3
You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.