How would you design an anti-cheating system?

I would avoid putting anti-cheating technology on the client, for hopefully obvious reasons. Earlier in this discussion I sketched out the idea of a lo-res view of state accessed and/or controlled by the client that can be used as fodder for an anomaly detection system that runs on the server side. I would start with a server-side focus.

I would also like to see more attention paid to basic software security issues -- bug and flaw removal and attacker-perspective based testing. I think that is bound to happen, given the kind of exposure online game security is getting now.

What differences do you see between MMORPGs and distributed systems used for business?

The biggest difference is one of size -- MMORGPs are much larger than any distributed system for business that I am aware of. Consider that World of Warcraft has 9,000,000 subscribers, all of who can connect at once if they want to. Now, that's a massive system.

With regard to architecture, there seems to be a trend towards fat clients of the sort that MMORPGs already use. If you consider Microsoft's Silverlight launch (a plug-in product meant to compete with Adobe's Flash), there is real evidence that thin clients are getting thicker as plug-in functionality spreads. That kind of trend makes me believe that the Web browser is not likely to end up as the "client of choice" in future systems. SOA may end up being more about fat clients than about Web-based clients.

From a security perspective, in some business verticals, such as the financial (sector), software security is much better understood and practiced than it is in the gaming industry. That may bode well for the security of future massively distributed systems for business. As financial institutions adopt massively distributed architectures, as MMORPGs already have, perhaps better software security will happen as a side effect.

In any case, massively distributed systems of all kinds are changing the security landscape in interesting ways.

Is there anything that system designers/architects should learn or copy from multiplayer games?

From a security perspective the main thing to learn is an important lesson about trust boundaries, state, and time. The larger these systems get the more the trust boundaries become complicated -- which machines, client software, components, etc. are to be trusted and which are not?

At this point in online game security history there are more things not to copy than to copy. For example, the idea of building a monitor for a game client that itself runs on the client PC is very silly and should not be copied. Or, when setting up a cryptographic pipe, giving a copy of the symmetric key to your potential attacker is dumb. Online games currently do both of those things.

There are plenty of technology lessons that can be learned from online games, such as how to load balance in a massive client-server system, but not really any great security lessons.