Four Sons of VoIP security

On the Jewish holiday of Passover, we read about the tale of the four sons: One wise, one wicked, one simple and one who does not know how to ask a question. In this special Passover post, I will consider their approach to security.What does the wise son say? For the wise son, no amount of security is enough. He will use authentication, integrity and privacy algorithms to protect his online data and communications, although he knows that all measures of security are theoretically breakable. He will check exactly how strong is the encryption on any product he buys, and as a vendor, he will ship products so secure that only a super-computer can actually run them.

What does the wicked son say? The wicked son uses security, and expects products he buys to be secure, but does not really care about security in the products he sells. He knows others are interested in security, so he will implement some security-like mechanisms, usually something that actually sends the user name and password as clear text over the net.

What does the simple son say? He knows security is important, and he knows a thing or two about it, but he realizes that if anyone ever really wanted to break through his security, he could. So he sets up his security to thwart the casual nose poker, and in the products he sells he implements a simple security scheme to authenticate the user and give his some degree of privacy.

And the one who does not know how to ask? He doesn’t know anything about security, and does not think it’s really needed. People should mind their own business, as he does, and they shouldn’t go where they are not invited.

Security is a controversial issue in protocols. You can find the whole range of opinions. The four sons above represent the four main approaches to the issue. While the one who does not ask, the simple son and the wise son form a spectrum of approaches, the wicked son is outside the spectrum. The wicked son mimics the approach of the simple son (or sometimes even the wise son) but in fact causes more harm than good. I will explain why in my next post.