Dialogue on Web Security

Web Chasms

You had a chance to consult for a business which wanted to, among other things, form a credit card transaction system as part of a "semi-conductor yellow pages" web site. You discouraged the client from doing credit card transactions on this web site. Why?

Call me old fashioned, but I'm still of the belief that a human can sell a lot more than a machine.

So if a firm is in business as an electronic/web directory, you'd expect it to sell door to door? Do you think, as web entrepeneurs, we'll make much money referring web cutomers to snail-mail set-ups? If we're not in the electronic sales biz, what are we doing... collectively and individually?

We are in an age of e-business... but, to sacrifice yourself as a guinea pig on the bleeding edge altar could result in profuse hemmoraging.

The philosophical aspects of being a pioneer are, I thought, one of your fortes. You often mention being an e-pioneer in many respects. And you are much more cautious in some respects, especially about building a foundation slowly, than are many others. But not everyone is made that way.

I've been doing business profitably on the net since 1994... I don't think that this particular client is in the black.

He founded, operated, then sold a national ISP , among other things. Now he's co-founded a second web business with some partners. So you two have a few things in common. But there's more than one formula for success, depending on how one defines it. Considering web biz is high risk on face value, if we're going to do any web e-security biz, we should afford others a bit of non-judgmental lattitude.

When the time comes that we don't need humans, what are we going to do?

At each stage in our recent historical development, from agriculture to mechanization, to industrialization, to technology and information eras, we seem to have been able to find other things to do with our time. Like invent the next era, for example. And the potential client wasn't asking us to eliminate human beings from the planet. He was asking us for guidance and security measures on *how* to more effectively *use* credit cards on his web site... not *whether* to use them. The more immediate practical issue here is, do you plan on turning away business because you don't personally feel comfortable with a client who is ( like everybody else, by your reckoning ) lacking 100% electronic security measures?

Hell, nothing's perfect, and certainly not anything as relatively new and amorphous as the web. If we do our best to give a client what they want, and update them on new topics or solutions concerning our web security, what else could we be expected to do? No one expects us to lay down our lives for the slaughter by not doing anything (and therefore dropping deals in the toilet) unless we can do it flawlessly, especially when we advise them in advance of the realistic risks they face in doing things their own way. All we can do is help them *minimize* their risk based on their own objectives, and based on their own choices about the mechanisms they choose to use to achieve them. Personally, I think *that's* where being human comes in handy.

If we can't be more accomodating to folks like the credit card transaction client, what are we doing in the web security business? Like, what the hell are we gonna do with, just off the top of my head, the Malay MSC project? Tell them (and their 200 multi-national company tenants) that they're full of shit and clearly don't know what they're doing? Or jump into the fray, make a few dollars and learn a few things to *advance* our knowledge of what to do with an *irreversibly* digitalizing world?

Mind you, the MSC project ain't a pipedream. MS is already there. NT&T is already there. Motorola is there. So is Siemens... the list is now 200 strong. The Malays are also building a reality, however frail, out of the long hyped theory of unpapered, electronic transactions which include everything from paying taxes to buying dinner at a local restaurant. They have no experience at this. But what the hell, nobody does... its just been talk for decades. Now, someone is trying to actually do it. And at the same time, they are trying to open their doors, politcally, culturally, and in many other ways, to businesses from all over the world to use the MSC as a *fully digital* launch platform for doing biz throughout Asia. This doesn't mean there will be no human contact among the biz's in question. Do they have problems? Hell yes... more than you know or could even guess at the moment... perhaps the same in spirit as with the credit card client.

So if we're going to talk philosophy, let's get to it right where it drops between our heels: change is constant. The only time we, as human beings, get into deep shit with change (especially rapid change as is inherent with the web) is when truly gifted and insightful humans jump the ship of change, leaving the course of our history to those primarily motivated by greed or artificial forms of power.

Malaysia's automoated federal currency system was hacked just weeks before the entire S.E. Asia region was hit by IMF currency devaluations. What would be your approach to this problem... resort to manually kept records, thus eliminating them from the world stock and currency market? Its a hell of a lot harder to get involved with a clear intention to do something both altruistic AND which has material, measurable results, than it is to be greedy. No question about it. "Good guys" gotta be alot smarter to not only outwit the bad guys, but also to fucking WIN. And i don't engage a fight to lose it. As for getting bloody in the process, well, i know a little bit about that, both literally and figuratively. That's the primary reason *I* had for forming the headhsed... its purpose is to scenario-plan the snot out of every major task we undertake which has such great "either/or" potential on the greed/altruism index... to reduce the goat-fuck potential and increase the success potential.

The bottom line on this thing is we didn't have a good pitch line and "organizational philosophy" established before taking our show on the road.

You and the S-man may or may not recall that, some months ago, that credit card client asked if we had any suggested referrals for micro-technology clients for their "yellow pages". In retrospect, I think this would have been the time/place to mention to me your posture about database and e-transaction security. We shoulda headshed-ed that issue right then and there.

Hmmm... I have no recollecton of this.

Well... that's a problem. It was e-mailed to you and the S-man.

As an incidental point, I mentioned this credit card client to you and S-man months ago as a potential client. I never got a response that you were doing anything with the request for the referral, or what you thought we should do with it. I'm doing my hellacious best to bring clean, decent dinero to our collective bank accounts.

What should I be doing... I'm not sure I understand???

It ain't "you"... its "we": I should have made more clear (in some way) the fact that i suspected the credit card customer's request for business referrals (some months ago) was likely gonna turn into a potential source of web security or marketing biz for us. Obviously, I didn't make that clear. From that point, I shoulda asked you for thoughts on how we should respond to the request for referrals, and then use the response as a vehicle to get in the door with them. I obviously didn't make that clear, either. Basically, its a matter of staying tighter on referrals for bizness than we have been, too. For example, if you have very specific ideas about web security that you know run counter to the rest of the herd, that's the kinda thing you need to "brief" me on before i go out on a selling spree. That way, you and i are gonna be representing the same basic philosophy and services... and no one will be able to divide us on points of principle.

  • C:/ Dialogue Prompt: Gaping Chasms in Web Perspectives
  • Brass Tacks: Credit Card Transactions
  • The Amorphous Moral To The Story
  • The Truth Is Out There: Just Ignore It If You Dare
  • Brass Tacks II: Houston, We Have A Problem...
  • Global Web Sec Topography

    Web Sec Dialogue Index