Monday, November 10, 2014

Software innovation, security, and the chain of plus ça change

I've been thinking of sending a client a copy of Geoffrey Moore's Crossing the Chasm to give him an inside perspective in launching a new software offering.   Whenever I do that sort of thing, though, I always re-read the book myself, in case it comes up in discussion.  It's a fantastic book--don't get me wrong--but it's making me grind my teeth because my copy is the 2nd edition from 1998.  That the company/product references are stale isn't so bad--c'mon, I'm a History grad.  It's the feeling that I might be missing insights relevant to our broadband, mobile-driven, social media phase of the internet age.

Moore's non-tech references have sent me scurrying out to Wikipedia a few times so far.  One of those references was a quote by Willie Sutton, a prolific--though gentlemanly--bank-robber of the mid 20th century.  One of Sutton's nick-names was "the actor," because his preferred M.O. was impersonating people who would have a legitimate reason to be in the bank, jewelry store, etc. as a non-customer.  Additionally, one of his prison escapes involved dressing as a guard.  The true brazenness of that escape was in how, when he and his fellow escapees were caught in the glare of a searchlight as they were putting a ladder against the wall, Sutton shouted, "It's okay!" and the gang was allowed on its merry way.

Sutton caught my interest not because of his apocryphal quote, but because of his later career as a security consultant, writer, and general casher-in on his notoriety.  Toward the end of his life, he was even featured in advertisements for photo-IDed MasterCards, which (tongue-in-cheek) advised bank customers to "tell them Willie sent you."

It was impossible to miss the parallels with the only slightly less flamboyant Kevin Mitnick, over whom the media and law enforcement of the Clinton Administration worked themselves into a hysterical lather*.

Mitnick repeatedly stresses that his "successes" were more due to social engineering than software engineering. To quote an interview with CNN:

"A company can spend hundreds of thousands of dollars on firewalls, intrusion detection systems and encryption and other security technologies, but if an attacker can call one trusted person within the company, and that person complies, and if the attacker gets in, then all that money spent on technology is essentially wasted. It's essentially meaningless."

In other words, the art of impersonation strikes again.  Also like Sutton, Mitnick's career after "going straight" (in the parlance of gangster movies) involves hiring out his expertise to people who want to defend themselves against people just like him.  And, of course, writing books. 

Which--in the cluttered curiosity shop I fondly call a memory--calls to mind parallels even further afield in time and space.  My Gentle Reader will not be shocked to learn that the "father of modern criminology" and history's first private detective was a reformed criminal.  (Also unsurprising:  Vidoq's appeal for storytellers and novelists, which presumably didn't dent the sales of his own ghost-written autobiography.)

Then, too, in this part of Maritimes Canada, I only have to drive a few hours to view the remains of 17th- and 18th-century star forts in various states of preservation/restoration.  The star fort has its origins in the 15th century (as a response to the innovation of cannon).  But the example of Fort Anne in Annapolis Royal, Nova Scotia brings to memory the name of the Marquis de Vauban.  Vauban's career under Louis XIV was doubtless capped by his gig as Marshal of France.  But that career was made as an expert in both breaking and defending such fortifications. (In other words, he was a one-man arms race.  I'm sort of shocked that he didn't write an autobiography, too.)

Doubtless, My Lord de Vauban would strongly object to being compared with the above rogues, however they might have redeemed themselves to society.  Yet the parallel is undeniably apt, even for an age defended by earthen walls rather than firewalls.  The best defender is an accomplished (though hopefully reformed) offender, it seems.

Long--and meandering--story short, I'm probably fretting needlessly about missing any new insights on ideas that have been relevant since 1990 (when Crossing the Chasm was first published).  As we've seen, very rarely is there anything truly new under the proverbial sun.  But, hey, as long as I'm already making a trip to the bookstore anyway...

- - - - -

* "While in Federal custody, authorities even placed Mitnick in solitary confinement; reportedly, he was deemed so dangerous that if allowed access to a telephone he could start a nuclear war by just whistling into it." - Forbes. 2013.04.11