Decentralization for Security

John Robb cites a paper The topology of covert conflict, by Shishir Nagaraja and Ross Anderson, July 2005, and notes the ongoing decentralization of guerrila and organized crime networks and their increased attacks on the networks of the larger society. He adds:

As a result of this shift, we need to think about security in terms of network dynamics. One of the few papers on this topic comes from Shishir Nagaraja and Ross Anderson (University of Cambridge) entitled "The Topology of Covert Conflict." In this paper, the authors apply game theory and various offensive (decapitation of highly connected or central nodes) and defensive (rapid replenishment, cliques, and delegation) strategies to determine potential outcomes. They found that decentralization (specifically cliques and delegation, see paper for descriptions of what these terms mean) provides a good means of defense against all types of decapitation attacks (against critical leadership targets or important infrastructure nodes).

Depending on ISPs alone to determine whether a given business’s connectivity is sufficiently redundant and interconnected isn’t sufficient, because ISPs don’t know that much beyond their own networks. Increasingly centralizing ISP ownership in fewer companies is even worse. This is true not only for the Internet itself, but also for all the other networks it increasingly connects, from food to electricity.

Crooks and terrorists are rapidly adopting decentralized networking for their own security and leverage. The only way to defeat them is by using that same leverage for collective action, ranging from reputation systems to holistic and synoptic monitoring to insurance.

-jsq