The Net is basically doubling every 10 or 12 months. We don't even know where the end points are. Traditional security depends on closed systems and tight administration. We've walked away from what we know how to do. Now we have to build trustworthy systems from untrustworthy components.
Current security is like a cookie with a hard, crusty outside and a soft, chewy center.
Pethia likened survivable systems to highways and bridges, which are built of vulnerable materials but are relatively trustworthy infrastructures. Future survivable systems will exhibit diversity, redundancy, deep-down trust validation, risk management and good contingency planning, he said. SEI hosts the General Services Administration's Federal Computer Emergency Response Team Coordination Center, and Pethia said 40 percent of the 175 incidents brought to FedCERT's attention each week have an offshore component that is getting harder to trace. To bolster survivability, he said, SEI is building a network emulation test bed with 150,000 nodes. SEI designed the Capability Maturity Model followed by many large software development organizations to improve quality.