Here’s some followup to my Norton’s Law post — Quinn Norton explained “The main thing I’d add, and I should revisit this, is that it’s an expression of not too complex information theory/physics in our current data landscape: information, in all its glorious forms, requires energy, and if it doesn’t get it, it is subject to entropy. If it is energized, that’s usually copying.” In other words, we’re not disproving Claude Shannon’s information theory any time soon. And you know you’re looking at some fundamental truths when even SAP can’t argue.
So cool, that’s a better grounded explanation for the angle of decay in “all data is deleted or public over time”, but the security against malicious actors aspect could still use some thought. And then I saw Lcamtuf on enterprise security: “your security team is pitted against the sum of human ingenuity… The most successful security programs I’ve seen are not built around the idea of having perfect defenses… you’re going to get compromised… detect it, respond to it, and contain it faster than the attackers can achieve their goals.” Which has been the narrative in enterprise security for a really long time, after all. In this model, security is like keeping ants out of the kitchen: don’t leave ready sources of food and water, don’t leave easy paths to access those sources, and discourage them with cleanup and active measures when you slip up on the other two points. And it seems to me that this means entropy’s effect on data is an active security benefit in a way. It’s not something you can rely on, but it’s a bending of luck in the defender’s favor: data might be inaccessible or deleted by the time the attackers break in and get to where it should be.
Of course, that’s nothing to celebrate depending on. A team that cares about data CIA (confidentiality, integrity, and availability) will still do something active about protecting their data, of course. Entropy is something to fight, not something to rely on.
Monkeynoodle.Org 