trust & security

I was asked about my previous post on green security what the 'angle' was. Well, the environmental impact of security is hard to dispute, be it in technology, construction, policy, etc. but it's an impact that in many cases we have not tried to find a solution for. A technological example would be cryptography; compression algorithms can't really be applied to encrypted data. As a result, encrypted data may well take up more storage and/or bandwidth (read: energy) than unencrypted data*. The moderation of environmental impacts that are attributable to security is something that is only recently being considered, and like security, it is something that should be factored in at design-time with ongoing assessment if it is to be effective.

*one solution here is to compress the data prior to encryption, though this introduces it's own issues; if the data is not easily compressed or if the cost of the compression algorithm is relatively high, it can lead to overall higher environmental costs.

How to go about doing this? Well, for me the logical starting point would be the incorporation of green concerns to the threat and risk assessment processes used in both ICT and in the real-world. This would naturally lead on to balanced green-secure solutions for a given problem, of course there is going to be a trade-off in each case. For example, I would like my phone sim to be biodegradable, but for such a small piece of plastic I would be quite concerned about the security of the sim and its associated account. If making the sim biodegradable allows for easier attacks I would have an issue with it. The car charger for the phone on the other hand has a much bigger environmental impact and I would be less concerned about security there, so a potential win-win. Another example would be the encryption algorithm used for an application, energy consumption is usually factored into the choice of algorithm if the deployment environment is battery powered (think mobile devices). A green-concious approach might also consider desktop deployments and the like, even when there is not a technological necessity to do so.

What to take from this is that there is no silver bullet for security and its green-related issues, only tools that can be applied to solve problems.

Reading into the question, an angle is something that can be exploited. Making devices 'smarter', well yes, but for what purpose? While we are not as interested in say construction we should not discount physical security altogether as there are security applications with strong ICT elements that may be of interest. I'm reminded of AAL and sensor networks, where ICT can form a key part of the solution. For example, consider border controls and other types of checkpoints where cars and HGVs are idling for long periods of time. A secure way of reducing emissions in all those parked vehicles or of protecting staff from a build-up of fumes is of interest. Ordering a remote switch-off of engines might be a quick and effective solution, but not a safe one!

So, in these few examples we see a couple of different avenues for 'an angle'. One is where applying technology as a solution to green issues can introduce potential security vulnerabilities that need to be addressed. Another is the idea that security itself is inherently un-green and existing security solutions may need to be reassessed to make them more eco-friendly.

Given the difficulty in reconciling security with the green agenda, it should be viewed as an opportunity. I would suggest that when formulating solutions the incorporation of tools and techniques that measurably reduce environmental impact as part of the project would, in general, help provide a competitive edge over alternative approaches.

The angle is: Be Green.