Platypus (was RE: The Common Vulnerabilities and Exposures taxonomy)

["Anton J Aylward" <anton () the-wire com>]

On Wednesday, October 20, 1999 1:08 AM, Marcus J. Ranum said :
 
> The idea's got some merit - things will/would/can be better if
> we all use the same terms to describe the same kinds of events.
> That's just common sense. How far it'll go is still somewhat
> open to question.

Taxonomy is the basis for all science, all the way back to 
Aristotle, and his work on plants and animals.   Geology 
only took off when we were able to classify rocks and minerals.

However, any taxonomy is also deceptive, since one the categories 
are laid down, you have a tool to mould people's thinking.    
Geology suffered from revisions when we understood the earth's 
morphological processes.  Plant and animal taxonomy is being 
revised today with out understanding of DNA (not DNS) at both 
the cellular and mitochondrial levels.

Aristotle based his taxonomy, which the Swedish botanist Linneaus 
and others on the animals and plants he knew in the 'old world'.  
The Americas and Oceanea brought to light species that upset a 
lot of the traditional classifications.

Hence my title: Platypus.
Mammals are warm blooded and bear their young alive.
Platypuses lay eggs, but otherwise appear to be mammals.
In another setting, one might have die-hard Linneans assert that
all of Australia was populated by the feral descendants of an alien
space-craft, and refuse to categorise them.   When we compare this to 
some of the distorted religious and political beliefs held by otherwise
"sane" people, it doesn't seem so extreme.  The annals of science are
filled with odd-ball theories.

My point is that while a taxonomy is better than no taxonomy, a 
taxonomy blinds you things because you will try to fit something new 
into the old taxonomy.  If you make the taxonomy too flexible it can 
become meaningless for a number of reasons, one of which is that each 
instance become its own class.  

Taxonomy worked for rocks, once we understood the fixed number of 
geometric patterns crystals could form in; it worked for plants and
animals because species evolve slowly, so slowly as to appear to be 
a fixed set -- hence the religious war over the issue.

But I don't think vulnerabilities and exposures are like that.

Oh, we can make sweeping categorisations, wetware, hardware, software.
Stupidity or ignorance.  We can make causal analysis based on principles
that go back to issues like architecture, programming skills and such like.
But for the rest of it, we're in a red queen's race.  As technology moves 
on, so new _kidns_of_ exposures come to light.  A simple review of the last
decade or two will illustrate this quite dramatically.  We didn't have the 
Internet, we didn't have PCs, we didn't have Windows, we didn't have 
Microsoft or hundreds of other software developers.

Perhaps a better analogy would be some kind of science fiction story,
exploring new planets and new life forms that have no common evolutionary
basis with earth.  Each new planet (innovation in technology) brings with 
it a whole new biosphere that cannot be fitted in to a taxonomy based on 
earth's biology.

My fear is that, on the one hand, the taxonomy will blind us and render 
us incapable or recognising things we should because we can't fir them 
into the categories we have, and on the other, we will force something 
into an inappropriate category.  

As I said earlier, geology suffered from these kinds of problems until 
there was an understanding of the processes which formed the rocks.  
Perhaps we should be looking at the processes by which these vulnerabilities 
and exposures come about and seeing if there isn't more commonality there.  
After all, coal, diamond and graphite are all carbon, its the process by 
which they're former that matters.


--------------------------------------------------------------------
Anton J Aylward, CISSP          | The Internet is not the greatest 
System Integrity                        | threat to information security; 
InfoSec Auditing & Consulting   | stupidity is the greatest threat 
Voice: (416) 421-8182           | to information security. 
aja () si on ca                         |   Will Spencer <will.spencer () gte net>