The document discusses the concept of trust in various digital contexts. It raises questions about trusting social networks, banks, governments, code, and partners. It also discusses factors that can undermine trust, such as malware, hackers, and fraud. Finally, it suggests that reducing risks requires attention to people, processes, technology, and independent review over time.

1. Trusting the Trust Budi Rahardjo budi@indocisc.com http://rahard.wordpress.com Inixindo Security Day Seminar The Executive Club, Jakarta, 19 March 2009

2. Trust vs. Security [no 100% secure system] march 2009 BR - trusting the trust

3. Security vs. … Convenience Performance Business Requirement

4. Failing the trust Malicious software ; virus, worm, … Malicious users ; crackers, attackers, … Fraud ; disgruntled employees, … Indentity theft ; unauthenticated users, … march 2009 BR - trusting the trust

5. identity theft [facebook, friendster, … social networks do you trust your “ friends ”?] march 2009 BR - trusting the trust

6. “On the internet, nobody knows you’re a dog”

7. Authentication Authentication factors What you have (card, token) What you know (password, pin, id) What you are (biometrics) Electronic transaction requirement 2 factor-authentication

8. Do you trust your bank? march 2009 BR - trusting the trust

9. [“borrowed” slides on skimmer attached on an ATM machine of a local bank. Sorry, I cannot add the slides here since I don’t know the owner of the slides to ask/acknowledge.] march 2009 BR - trusting the trust

10. Do you trust your e-government? [election jokes, e-gov, e-proc] march 2009 BR - trusting the trust

11. [Examples of bad 2009 election campaign posters are available at http://janganbikinmalu2009.com] march 2009 BR - trusting the trust

12. Can you trust your code ? march 2009 BR - trusting the trust

13. Open Source is better, IF … march 2009 BR - trusting the trust

14. you play with your code [read Ken Thompson, "Reflections on Trusting Trust" ACM , September 1995] march 2009 BR - trusting the trust

15. Reflections on trusting trust Self reproducing code “Learning” program Create trojaned compiler compile a “bug” version when detect a pattern

16. meaning … skill is important [awareness too] march 2009 BR - trusting the trust

17. Reducing Risks Anti virus, 2 factors authentication, … march 2009 BR - trusting the trust

18. Reducing Risks But … really … people , process , & technology

19. Reducing Risks Review periodically by independent , trusted 3 rd party How do you trust your partner?

20. Thank you for trusting me :) Budi Rahardjo [email_address]