Security 2020: Reduce Security Risks This Decade

Published by

Wiley Publishing, Inc.

10475 Crosspoint Boulevard

Indianapolis, IN 46256

www.wiley.com

Copyright © 2011 by Doug Howard and Kevin Prince

Published by Wiley Publishing, Inc., Indianapolis, Indiana

Published simultaneously in Canada

ISBN: 978-0-470-63955-9

ISBN: 978-1-118-00831-7 (ebk)

ISBN: 978-1-118-00832-4 (ebk)

ISBN: 978-1-118-00833-1 (ebk)

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or website is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or website may provide or recommendations it may make. Further, readers should be aware that Internet websites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services please contact our Customer Care Department within the United States at (877) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

Library of Congress Control Number: 2010932423

Trademarks: Wiley and the Wiley logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. Wiley Publishing, Inc. is not associated with any product or vendor mentioned in this book.

I have been fortunate to work with many professionals in the world. Some were business experts, others contributed through capital investments, and many were technology leaders. Equally important were those that I worked alongside of and had the pleasure of supporting in the day-to-day activity of protecting our clients. You know who you are, and to each of you I say THANKS. Special thanks to Bruce Schneier, who was the CTO and founder of Counterpane and who I worked with for over four years. He graciously offered to write the forward to Security 2020 and provide some thoughts throughout. Thanks also to Toby Weir-Jones who contributed his expert review. In good conscience I must recognize my family, for without their support, and the continuous encouragement and consideration of my loving wife, I would not have had the energy to complete this time-consuming goal.

—Doug Howard

To my mom, a single mother with five children, who allowed me as a young boy to max out her only credit card with the purchase of my first computer, which I had to work to pay off with one full year of paper route money. Opportunity often comes when others believe in us and our dreams. That single act by my mother has led to more opportunity, fortune, travel, and other experiences than I could have ever possibly imagined. Thanks for believing in me, mom.

—Kevin Prince

About the Authors

Doug Howard, the CEO of VBrick Systems, leads a team of professionals that has a stated goal of being the world leader within the streaming video industry. In 2010, after over 20 years in the IT security industry, Doug decided to put his historic criticisms to work and try to build security within an IT product. He admits it's a challenging career change, but one he hopes he can look back on when he returns to the IT security industry and say “security can truly be built within the core of a product,” as well as bring back to the security industry more experience on how non-security product and application providers can improve their products and services.

When he took his sabbatical from the IT security industry in 2010 to join VBrick, Doug was the chief strategy officer of Perimeter, responsible for the mergers and acquisitions and the service strategy for the company. In addition to his position with Perimeter, he was the president of USA.NET, a company focused on delivering secure unified communications and which was a wholly owned subsidiary of Perimeter.

Prior to joining Perimeter, Doug served as COO of BT Counterpane where he was responsible for the business's ongoing operations. He led the teams responsible for the development, implementation, operations, and marketing of BT Counterpane's product and service line. Earlier he served as vice president of security and business continuity for AT&T Corp. There, he formed an organization that developed and launched new security services for each of the company's business lines of service—commercial, government, wholesale—as well as provided direction for the business continuity practice that delivered solutions for AT&T and its clients.

Doug started his career in the U.S. Air Force, where he worked for the Joint Chiefs of Staff at the Pentagon and had a temporary duty assignment to Cheyenne Mountain. After the military, he moved into the private sector and held positions in sales, operations, engineering, product management, and business development for companies such as Sprint, FLAG Telecom, Telenet, and Computer Sciences Corporation (CSC). He founded Technology Research International, Inc. in 1989, which was purchased by NBC Broadcasting in 1991.

Doug attended K-12 in eastern North Carolina where he grew up. Like the coauthor of this book, Kevin Prince, Doug came from a humble beginning, and while his family lived in a trailer park (not even a doublewide), his divorced parents never left him wanting for technology. In high school he received his first computer for Christmas, a Radio Shack TRS80 Color. Basic programming was all it did, and he was able to save his work on an attached cassette tape. Looking back, it's hard to believe it all began with a Christmas gift from his parents.

You can find a complete copy of his resume at:

http://www.linkedin.com/in/doughoward

The most valuable information I convey in this book is based on my interactions with some of the leading experts in the security field. My career strategy has always been simply to work with the smartest people I could find. If I can't be the smartest guy in an area of focus, then I'll befriend the smartest guy. I have been very fortunate to work with some real legends, befriend some of the most impressive intellects, and to have countless meetings and dinners with the most knowledgeable CISOs, CSOs, CIOs, and business people in the world.

I originally conceived this book in such a way that I could leverage this network of experts and create a knowledge base that was a consolidation of a lot of different people's views, the authors acting as moderators to guide the subject areas and focus the discussions. Well, remember that speech about setting a goal and creating a plan? I failed on that when it came to writing a book. So, I again got creative and engaged Kevin Prince, who I work with at Perimeter and who always produced consistent, high-quality content, articles, whitepapers, and the like, and suggested we write a book together and use my original concept. What follows is just that. I hope you enjoy!

Kevin Prince is the Chief Technology officer at Compushare, a SMART Technology Management Solutions provider for the Financial Services Industry. Prior to Compushare Kevin worked as Chief Technology Officer for Perimeter E-Security, a leading managed security service provider.

Kevin is a frequent speaker at various industry conferences, trade shows, and so on. He has written many whitepapers, articles, blog posts, and bylines on information security topics. He has spent considerable time training federal examiners on information security methodologies, technology solutions, and auditing practices. Many people recognize his end of year summaries on information security as well as his threat predictions for the coming year.

Kevin has more than 22 years of information technology experience, 14 of which have been focused specifically on information security. When he was a junior in high school, he began working in the computer labs at Salt Lake Community College (SLCC), where he fixed computers and tutored and helped students. He had a copy of Windows 1.0 on 5 ¼ floppy disks. He later became the Computer Lab Coordinator at SLCC when he was a senior in high school, and began building networks and even taught basic computer use labs to students.

Later Kevin went to work for a company called Intellitrends where he learned how to build computers. He then got a job at National Computer Systems where he did basic PC support. He worked for NCS for 5 years and went from PC support to Network Project Lead, with responsibility for the team that designed and built the network operation center, and supported the wide area network and server farm. That is also when he was introduced to the Internet, and soon after he was responsible for the corporate firewall. He was one of the first Microsoft Certified System Engineers (MCSE) when Microsoft released their training program. He went through a variety of courses, including Cisco certification and many others.

Kevin then had the opportunity to work for a “dot com” startup called Intellispan. He was one of the key individuals tasked with the design and implementation of a PKI-based nationwide secure dial-up network using unheard of “virtual private network” technology. The company raised over 30 million dollars and brought in a new CEO who decided to move the company from Arizona to Georgia. Kevin decided not to move with the company, but they wanted him to stay on so he transitioned into a sales engineering role where he had his first interaction with customers and got to see firsthand what organizations needed. This is where he learned that what they had asked them to build was not exactly what customers wanted. Kevin recommended that they modify the product to give customers what they needed, but the company refused.

Along with a friend, Kevin left Intellispan and started a company called Red Cliff Solutions. They were essentially integrators for a basic suite of information security solutions. The first year of any boot-strap startup is rough, and theirs was no different. After the first year, Kevin's partner decided he needed to get a “real job” and Kevin bought him out. Kevin established relationships with the credit union national association and began offering a managed security solution specifically designed for financial institutions. Later he was asked to train the federal examiners on information security practices and audit procedures. This led to a many speaking engagements each year as well as other partnerships, primarily in the financial space. After 5 years, he had successfully built Red Cliff Solutions into a very successful business that included about 500 financial institution customers. Red Cliff offers solutions such as firewall, intrusion detection and prevention, web content filtering, anti-virus, virtual private networks, and vulnerability assessments, all with 24/7 management and monitoring. In early 2006 Kevin sold Red Cliff Solutions to Perimeter E-Security, the leader in managed security services to financial institutions in the United States.

These experiences have given Kevin a unique blend of technical, sales, compliance, and business expertise. He is able to take real-world needs and understand the business drivers around them. He can help an organization meet regulatory compliance objectives without overselling them things that won't offer appropriate risk mitigation value. His experience lends itself to a high level view of the evolution of information security and where it is headed, so writing Security 2020 feels very natural. Using 20/20 vision of the history of information security we can look ahead towards the year 2020 and predict the future of information security.

For can view a complete copy of my resume at:

http://www.linkedin.com/pub/kevin-prince/3/70a/501

Credits

Executive Editor

Carol Long

Project Editor

Tom Dinse

Technical Editors

David A. Chapa

Toby Weir-Jones

Production Editor

Kathleen Wisor

Copy Editor

Foxxe Editorial Services

Editorial Director

Robyn B. Siesky

Editorial Manager

Mary Beth Wakefield

Freelance Editorial Manager

Rosemarie Graham

Marketing Manager

Ashley Zurcher

Production Manager

Tim Tate

Vice President and Executive Group Publisher

Richard Swadley

Vice President and Executive Publisher

Barry Pruett

Associate Publisher

Jim Minatel

Project Coordinator, Cover

Lynsey Stanford

Proofreader

Beth Prouty, Word One New York

Indexer

Johnna VanHoose Dinse

Cover Image

©Thomas Northcut/Digital Vision/Getty Images

Cover Designer

Ryan Sneed

Foreword

There's really no such thing as security in the abstract. Security can only be defined in relation to something else. You're secure from something or against something. In the next 10 years, the traditional definition of IT security—that it protects you from hackers, criminals, and other bad guys—will undergo a radical shift. Instead of protecting you from the bad guys, it will increasingly protect businesses and their business models from you.

Ten years ago, the big conceptual change in IT security was deperimeterization. A wordlike grouping of 18 letters with both a prefix and a suffix, it has to be the ugliest word our industry invented. The concept, though—the dissolution of the strict boundaries between the internal and external network—was both real and important.

There's more deperimeterization today than there ever was. Customer and partner access, guest access, outsourced email, VPNs; to the extent there is an organizational network boundary, it's so full of holes that it's sometimes easier to pretend it isn't there. The most important change, though, is conceptual. We used to think of a network as a fortress, with the good guys on the inside and the bad guys on the outside, and walls and gates and guards to ensure that only the good guys got inside. Modern networks are more like cities, dynamic and complex entities with many different boundaries within them. The access, authorization, and trust relationships are even more complicated.

Today, two other conceptual changes matter. The first is consumerization. Another ponderous invented word, it's the idea that consumers get the cool new gadgets first, and demand to do their work on them. Employees already have their laptops configured just the way they like them, and they don't want another one just for getting through the corporate VPN. They're already reading their mail on their BlackBerrys or iPads. They already have a home computer, and it's cooler than the standard issue IT department machine. Network administrators are increasingly losing control over clients.

This trend will only increase. Consumer devices will become trendier, cheaper, and more integrated; and younger people are already used to using their own stuff on their school networks. It's a recapitulation of the PC revolution. The centralized computer center concept was shaken by people buying PCs to run VisiCalc; now it's iPads and Android smart phones.

The second conceptual change comes from cloud computing: our increasing tendency to store our data elsewhere. Call it decentralization: our email, photos, books, music, and documents are stored somewhere, and accessible to us through our consumer devices. The younger you are, the more you expect to get your digital stuff on the closest screen available. This is an important trend, because it signals the end of the hardware and operating system battles we've all lived with. Windows vs. Mac doesn't matter when all you need is a web browser. Computers become temporary; user backup becomes irrelevant. It's all out there somewhere—and users are increasingly losing control over their data.

During the next 10 years, three new conceptual changes will emerge, two of which we can already see the beginnings of. The first I'll call deconcentration. The general-purpose computer is dying and being replaced by special-purpose devices. Some of them, like the iPhone, seem general purpose but are strictly controlled by their providers. Others, like Internet-enabled game machines or digital cameras, are truly special purpose. In 10 years, most computers will be small, specialized, and ubiquitous.

Even on what are ostensibly general-purpose devices, we're seeing more special-purpose applications. Sure, you could use the iPhone's web browser to access the New York Times website, but it's much easier to use the NYT's special iPhone app. As computers become smaller and cheaper, this trend will only continue. It'll be easier to use special-purpose hardware and software. And companies, wanting more control over their users' experience, will push this trend.

The second is decustomerization—now I get to invent the really ugly words—the idea that we get more of our IT functionality without any business relationship. We're all part of this trend: every search engine gives away its services in exchange for the ability to advertise. It's not just Google and Bing; most webmail and social networking sites offer free basic service in exchange for advertising, possibly with premium services for money. Most websites, even useful ones that take the place of client software, are free; they are either run altruistically or to facilitate advertising.

Soon it will be hardware. In 1999, Internet startup FreePC tried to make money by giving away computers in exchange for the ability to monitor users' surfing and purchasing habits. The company failed, but computers have only gotten cheaper since then. It won't be long before giving away netbooks in exchange for advertising will be a viable business. Or giving away digital cameras. Already there are companies that give away long-distance minutes in exchange for advertising. Free cell phones aren't far off. Of course, not all IT hardware will be free. Some of the new cool hardware will cost too much to be free, and there will always be a need for concentrated computing power close to the user—game systems are an obvious example—but those will be the exception. Where the hardware costs too much to just give away, however, we'll see free or highly subsidized hardware in exchange for locked-in service; that's already the way cell phones are sold.

This is important because it destroys what's left of the normal business relationship between IT companies and their users. We're not Google's customers; we're Google's product that they sell to their customers. It's a three-way relationship: us, the IT service provider, and the advertiser or data buyer. And as these noncustomer IT relationships proliferate, we'll see more IT companies treating us as products. If I buy a Dell computer, then I'm obviously a Dell customer; but if I get a Dell computer for free in exchange for access to my life, it's much less obvious whom I'm entering a business relationship with. Facebook's continual ratcheting down of user privacy in order to satisfy its actual customers—the advertisers—and enhance its revenue is just a hint of what's to come.

The third conceptual change I've termed depersonization: computing that removes the user, either partially or entirely. Expect to see more software agents: programs that do things on your behalf, such as prioritize your email based on your observed preferences or send you personalized sales announcements based on your past behavior. The “people who liked this also liked” feature on many retail websites is just the beginning. A website that alerts you if a plane ticket to your favorite destination drops below a certain price is simplistic but useful, and some sites already offer this functionality. Ten years won't be enough time to solve the serious artificial intelligence problems required to fully realize intelligent agents, but the agents of that time will be both sophisticated and commonplace, and they'll need less direct input from you.

Similarly, connecting objects to the Internet will soon be cheap enough to be viable. There's already considerable research into Internet-enabled medical devices, smart power grids that communicate with smart phones, and networked automobiles. Nike sneakers can already communicate with your iPhone. Your phone already tells the network where you are. Internet-enabled appliances are already in limited use, but soon they will be the norm. Businesses will acquire smart HVAC units, smart elevators, and smart inventory systems. And, as short-range communications—like RFID and Bluetooth—become cheaper, everything becomes smart.

The “Internet of things” won't need you to communicate. The smart appliances in your smart home will talk directly to the power company. Your smart car will talk to road sensors and, eventually, other cars. Your clothes will talk to your dry cleaner. Your phone will talk to vending machines; they already do in some countries. The ramifications of this are hard to imagine; it's likely to be weirder and less orderly than the contemporary press describes it. But certainly smart objects will be talking about you, and you probably won't have much control over what they're saying.

One old trend: deperimeterization. Two current trends: consumerization and decentralization. Three future trends: deconcentration, decustomerization, and depersonization. That's IT in 2020—it's not under your control, it's doing things without your knowledge and consent, and it's not necessarily acting in your best interests. And this is how things will be when they're working as they're intended to work; I haven't even started talking about the bad guys yet.

That's because IT security in 2020 will be less about protecting you from traditional bad guys, and more about protecting corporate business models from you. Deperimeterization assumes everyone is untrusted until proven otherwise. Consumerization requires networks to assume all user devices are untrustworthy until proven otherwise. Decentralization and deconcentration won't work if you're able to hack the devices to run unauthorized software or access unauthorized data. Deconsumerization won't be viable unless you're unable to bypass the ads, or whatever the vendor uses to monetize you. And depersonization requires the autonomous devices to be, well, autonomous.

In 2020—10 years from now—Moore's Law predicts that computers will be 100 times more powerful. That'll change things in ways we can't know, but we do know that human nature never changes. Cory Doctorow rightly pointed out that all complex ecosystems have parasites. Society's traditional parasites are criminals, but a broader definition makes more sense here. As we users lose control of those systems and IT providers gain control for their own purposes, the definition of “parasite” will shift. Whether they're criminals trying to drain your bank account, movie watchers trying to bypass whatever copy protection studios are using to protect their profits, or Facebook users trying to use the service without giving up their privacy or being forced to watch ads, parasites will continue to try to take advantage of IT systems. They'll exist, just as they always have existed, and—like today—security is going to have a hard time keeping up with them.

Welcome to the future. Companies will use technical security measures, backed up by legal security measures, to protect their business models. And unless you're a model user, the parasite will be you.

—Bruce Schneier

Introduction

The future is a result of the thoughts, dreams, and actions we take each day. Much like a butterfly's wings resulting in a hurricane across the world, the seemingly small actions we take within our daily roles in IT security can result in something as gentle as the wind, or as destructive as a hurricane.

—Doug Howard

Allow us to start with the obvious: the world around us is extremely fragile—the Earth's environment is fragile, the human psyche is fragile, and the technology on which we daily depend is fragile. To maintain the balance between Mother Nature, humanity, and technology, we must plan, execute, and adapt our activities. Regardless of how inconsequential each of us may feel at times relative to broader world events, each of us has a role in maintaining this balance. There should be no doubt that if each of us takes responsibility and contributes in small, simple ways, we can help maintain this extraordinary equilibrium in the world. This may seem an overly optimistic, maybe even a flowery statement, but we have all seen what big impacts small actions can have on an individual, an organization, and on the world as a whole. A small number of people in the world make headlines, but millions make an impact each and every day. Our goal in this book is simply to provide you with knowledge that can be used to perform your role as a user, an administrator, or as an executive to make the world of the future a little more secure than it is today. We accomplish this by providing you with a foundation of information for today's activities, but more broadly, with a view of the changes that are predictable through 2020 and beyond. This glimpse of the future will allow you to create and adapt your unique plan to worldly realities, threats, and demands as they evolve. Within these pages you will find content that will support your functions as an information technology (IT) security expert within this evolving and complex technology ecosystem. These predictions, forecasts, and stories will be valuable assets for planning your strategies, tactics, and activities and have a small (or, it is our hope, a profound) impact on your organization and the world.

When establishing a goal or objective, you must understand the building blocks that will make up a plan to reach that goal. Not all plans will include the same building blocks, but the core components are the same within most organizations when it comes to IT security. When creating an effective security program for an enterprise, you must understand not only the technology capabilities and limitations, but also the future technology, industry, regulatory, and business opportunities and challenges that will impact your future strategies and tactical actions, as well as your capital and operational investments. This book provides you with the information you need to understand how these core components influence and are influenced by the future.

As authors, we feel that not only must our predictions for the future be based on a realistic assessment of where IT security has been, but we must also consider how periods of rapid technological change and unexpected technology revolutions have and will affect the future. All this must also be balanced with the recognition that rapid change in business will be matched equally with new and evolving complexity, threats, and risk.

The Authors

While both of us believe we have a good grip on the marketplace, we also recognize that there are many right answers to every question in the security industry. We also recognize the value of having perspectives from business leaders, users, and investors, as well as from technology leaders. Therefore, we've written the book in a format that allows us to easily introduce the thoughts and observations of many contributors into various sections. In some cases, they simply reinforce what we have stated, while at other times they completely disagree with us or provide a completely different perspective from ours. In all cases, they add richness of content and experience to the book.

Now let's take a step back and set some context. One of the key considerations each of us noodles on when we pick up any book is what credibility, experiences, and perspectives do the authors bring to the subject area or the story? More specifically, what real-world experience does the author bring that will help me better understand the subject? Since this is our first book, it was recommended that we provide you some background on our experience and perspective so as to better establish our credibility on the subjects of security, business continuity, and governance. If you're like us, you have a unique set of skills and experiences that many of your peers could learn from. We are no different. Sure we've probably spoken at more venues, been quoted in the press often, and even shown up on radio and television shows representing the security industry, but those are simply footnotes in one's career. What's important is if we convey our knowledge and experience in an entertaining and professional manner. Maybe even more important are the experiences and opinions of our peers that we have brought to bear throughout.

The Variables of 2020

In order to understand our experiences, we welcome you into our minds, the minds of IT security professionals who have lived the life of fun, intrigue, risk, stress, and many sleepless nights … rarely does boredom find its way into our lives. Unlike many professionals in the IT security industry, we have spent the majority of our lives in IT security services companies. This may not seem to be an important differentiation; however, it allows us to provide you with a significant insight into the context of our vantage point. While most enterprise IT security professionals will have a few interesting experiences in their professional lives, those of you, as we have, who work as service providers see many more security incidents because of the number of customers they support. In addition to protecting hundreds, sometimes thousands of customer networks simultaneously, you also must protect one of the largest, most valuable targets there is … your own service provider network. It's often said that working for an IT security service provider exposes you to the world, threats, and not so obvious risks like no other role in the industry. It certainly will age you a little faster, too.

Leveraging these real-world experiences, our network of contributing authors, and industry information, we first provide a historical review and then a look into the future of IT security. Thus, the book provides those with little IT expertise an overview and historical perspective of IT security; it is also a good refresher for experts. History, or 20-20 views of the past, provide each of us a great base of knowledge from which to grow. No matter how vast or limited your experience is, you are always forced to start with what you know. When we began the journey of writing this book, we knew far less than when we completed it; often this was because of input from others, sometimes because of research, and surprisingly frequently because of our just taking the time to think through a subject. A series of projections based on what we know today and how various factors will influence those projections is the resulting content. Our journey into the future attempts to connect your emotions and imagination with the evolutions and revolutions in the IT security industry through 2020 and beyond. While many of the subjects are technical in nature, this is meant to be a book to awaken the concerns associated with reality and actual risk, while debunking media hype and unnecessary concerns. It stays high-level due to the breadth of subjects, but hopefully it's deep enough to provide value for each reader. We also outline future risk scenarios that may surprise you and some that you may have already considered. The book further prepares you with knowledge that can be used to anticipate and prepare for the threats in the upcoming years.

The future is defined by many variables, and many of them are in constant flux. Is that a statement to hedge our bets? No, simply a disclaimer to say neither of us claims to be futurist, rather intelligent players within the industry. Most of the projections we make are logical extensions of the trends and technologies already in play today. We chose the title Security 2020 for two reasons: first, because 20-20 reflects that vision in hindsight that is often so valuable, and secondly, that 2020 is only 10 years from now and making projections with reasonable accuracy is an achievable goal.

As we mentioned earlier in this introduction, our goal is simply to provide you with knowledge that can be used to perform your role as a user, an administrator, or as an executive to make the world of the future a little more secure than it is today. We hope when you finish this book you will feel that you have a few more building blocks in your plan, some considerations to adjust based on future predictions, and an appreciation for the job security that the IT security industry can provide in the foreseeable future.

Chapter 1

What Has History Shown Us?

The good news is that we can predict the future by knowing we are bound to repeat the past.

—Kevin Prince

Hindsight is clearly not 20/20!

Most people believe that, with the passing of time, an accurate history is documented and we may rely on that record as a true witness of the past. The truth is that the history that we are taught is often very different from the realities of the past.

Often, histories are not accurately documented because of the biases of those doing the recording. Sometimes story elements are handed down many times, with each repetition bringing about a slight change. Sometimes history is rewritten to hide shame, some horrific act, or an action that is no longer politically acceptable. Still other times, storytellers exaggerate the story each time they tell it to keep the listeners engaged. Whether it be one Egyptian ruler having the carvings, names, manuscripts, and sculptures of the previous pharaoh destroyed and his own likeness put in their place, or a short, overweight, and sexually confused European prince having all the paintings of him show him as a tall, strong man with a beautiful woman beside him, we have a habit of changing our recorded histories based on the history we want, not the realities that occurred.

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!