Security Anecdote Theater, episode 2

Peter Ross, a master blacksmith at Colonial Williamsburg tells a story that I enjoy retelling-

Early in his career at Williamsburg, Peter was asked to make a reproduction of a lock from the Williamsburg collection. He carefully disassembled the original lock, inspected and measured every piece, and then made faithful reproductions of each component. When he tried to assemble the lock nothing fit. He filed, bent and reworked each piece until it finally went together and worked. Once the lock was complete, Peter was understandably impressed with his work and showed it off proudly. After the initial glow wore off, however, Peter noticed that the original lock was much nicer than his- it didn't show all of the signs of reworking and correction that his did. He reconciled himself to the obvious fact that the colonial era blacksmiths were simply better at the craft than he was.

As his skill and knowledge of the craft evolved Peter began to realize that his shortcoming was not in skill, but in perspective. Peter approached the task with the knowledge that careful measurement and replication will yield an exact duplicate- the modern view of manufacturing applied to an ancient craft. The original blacksmith made the first part of the lock from available material with little worry for exact measurements- because the second piece would be made to fit the first, and so on. The next lock made would probably look similar, but the parts wouldn't be interchangeable- but as long as both locks worked it didn't matter.

The colonial blacksmith had limited supplies of material and often had to reuse scrap due to the expense and scarcity of new stock. He also didn't have ready access to all of the tools that were available to smiths in England and the rest of Europe. The craft may be different, but in small business IT we face a similar situation- we often have very limited resources and must make do with what is available.

So, the next time you find something you would like to copy- whether its a network topology, directory services infrastructure, VPN deployment or even a hand-forged lock- start with your current situation in mind and work towards a functionally similar system. Make sure all the pieces fit together with each other and your environment, just don't get hung up on trying to make an exact duplicate.

Jack