Slashdot Mirror
Fixing Security Through Obscurity?
LineNoiz asks: "I work as a junior developer at a small company that sells check printing software. One of my company's favorite things to tell customers is how secure our product is and how it will reduce check fraud (we even sell check fraud insurance). I cringe everytime I hear them say it, because I know that it is 'secure' only because of it's relative obscurity. I personally know very little about security, and really have no idea what it would take to make our product secure. All I really know is that this is a problem waiting to happen. How can I convince my managers that our security is nothing to brag about? How can I convince them to spend the time and money to make it secure? Where can I myself go to learn more about security and what it would take to make/keep it secure?"
> How can I convince my managers that our security is nothing to brag about?
:)
The risky way would be to create and demonstrate an exploit. Et voila, they're convinced.
Of course, you run the risk of being replaced by a security-knowledgable programmer once you do so.
To help you convince them, learn about security, and present a fix for the problem. Then tell them they can REALLY go crazy on the security promotion aspect once they do so. Help them sell the product, and you may be sitting in the cat-bird seat, whatever that is.
You even admit to not knowing where it is insecure, or what needs to be addressed in order to secure it. This is a beautiful troll.
You're an underpaid jr. developer....
Your company makes check writing software.....
You want to show them that their software is insecure....
Your Poor. They have checks. Things are insecure.....
Hmm....
Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.
Go and write a million lines of security software and don't provide the guarantee - it isn't worth as much to the customer.
What you have to realize is that it is an easy equation for your company
How many reimbursements do they have to pay out on an annual basis. vs. How much will it cost to lower that number.
I am betting they are paying out pretty close to 0 in reimbursements (which is why they are advertising this)- how much of your salary will it take to make the product even slightly more secure ?
I have mod points and I am not afraid to use them
Why rock the boat in this economy? You could be fired just because you pissed someone off. It's not worth the risk. Be happy you're working! I know it really bothers you, but not as much as missing those paychecks will. If you really need to, create one simple, nicely worded email outlining your concerns, and send it to the manager in charge. Keep a copy for youself. If in the future something does happen you can say, "see, I tried to warn you but you didn't listen. Here are my ideas for preventing it in the future..." --Chris
Now I am no expert on hacking or security but I once read a book that changed the way that I write software. Hacking Exposed taught me a number of different methods that can be used to find weaknesses in software. Once I learned some of the attacks that people could use against my applications fortifying against those attacks became much easier.
Java Cryptography was another informative read.
security through obsecuirty is not a good security model at all, but i think alot of companies still reley on it.
+-+-+-The folowing statement is true. The previous statement is false.-+-+-+
On the Internet, inside information is currency, and there will always be counterfeiters among us.
-- J. Michael Straczynski
I recently listened to the audio book version of Frank Abagnale's "Art of the Steal" and I would definitely recommend it in your case. Like his other book, "Catch Me If You Can", it has some great anecdotes about cons. It even has a whole section devoted to check fraud.
"Art of the Steal" aims to teach how to avoid getting scammed, in business and at home. It is definitely lacking in some areas, such as computer security, but does offer some useful advice and it might be handy in opening management's eyes to some of the threats to security.
If you tell them the truth, they will fire you. You work for buttheads. If you work really, really hard, they will not be sued for their stupidity. Of course that assumes they don't fire you.
Why do you care? Shut up! Take your wages. If that bothers you, find a new job.
PS - if you do talk to your boss and you do get fired, how many years will you be out of work while he's still being paid his salary. think about it - who hires a sysadmin fired for security concerns.
1000s Warcraft Gold while you sleep
No seriously, after you are hacked a few times you start to learn about security and if you are like most people you become parinoid about it.
Only 'flamers' flame!
Does slashdot hate my posts?
Security is not just a thing that software has or doesn't have. In order for us to answer this question, you need to tell us what you do and don't want people to be doing. How well the software addresses that distinction is what a specific instance of "secure" is.
If you are really concerned, read everything written by Bruce Schneier
Applied Cryptography will take you trhough the technical aspects of it, as well as presenting some of the attacks you can/might expect.
Secrets and Lies is a more business focused book, and while it won't give you technical tools, the discussion on attack trees is a great intro to building a coherent security policy.
The thing to remember about security is that it is an active process. In simplest terms: Put up an obstacle, identify when someone is trying to breach it, and have a response prepared.
Some of the basics are: sending all communication over encrypted channels, using key based authentication, lock accounts after some number of failed attempts, provide an audit trail for transactions, and only allow people sufficient permissions to get their work done.Using a Queueing or other type of well developed remoting system will minimize buffer overruns. Again, most of that type of stuff is in Applied Crypto.
Good Luck
Open Source Identity Management: FreeIPA.org
Ignore the fact that it's a check/cheque/Czech printing company and focus on the question.
I guess they have some sort of software which allows people to order cheques remotely (either dial up or internet) and have them sent to their business or house etc. This poses the security risk.
/* affect != effect */ void affect(int *thing,int effect) { *thing += effect; }
I cringe everytime I hear them say it, because I know that it is 'secure' only because of it's relative obscurity.
By "obscurity", do you mean it's not a well known product?
I'm going to jump out on a limb here and guess that if you're going around making check software, then someone in the company actually spent a number of minutes x (with x >> 5) thinking about security in the product.
Here's an idea. You're a junior developer, right? Why not sidle up to a senior developer and say, "Hey, can we talk for a moment?" Tell them you've recently become interested in security and learning more about it. Ask them what the current security for your products is. If there isn't really any, ask them if they know if competitors use any kind of security features, saying something like, "I'll bet it would make our product look better if we could tell potential customers that we use x, y, and z to make our products secure." If he or she doesn't sound interested, evaluate how this makes you feel about working there. It probably isn't a good idea to make this a crusade; it'll just make you look mean spirited if you push through your senior developers. You can choose to stay in the company, knowing the product isn't fully secure, or if security is your thing, you can move to a company that's more secure.
Think about a worst case scenario: someone writes a series of checks that are bad. That's not impossible to happen with normal non-computer generated checks anyways. It could potentially be a lot of money -- perhaps -- but credit card fraud is generally a lot easier to perpetuate. Most check fraud that does occur is people writing big checks on their own accounts that bounce, or it's people just forging checks, neither which you or your company have any part in.
If you were in a company storing electronic medical records or bank accounts, then security through obscurity would be pretty catastrophic. But I'm guessing that you're blowing this out of proportion.
Karma: Chevy Kavalierma.
Do you have a friend (or trusted FOAF) that could potentially be purchasing the software?
Talk with him about what sort of questions to ask the salesman, and possible resposnses to weasel replies. Do NOT divulge any trade secrets.
Then have him call up to get a sales pitch.
A salesman bitching to management about a lost sale because of lousy security may be listened to more than a tech.
Developers, especially young ones, often see things that they think need to be changed, and get frustrated when management seems to ignore their concerns. In many cases, the techies are actually right, but they don't understand that (a) there are many, many issues to be considered that they don't know about and (b) simply claiming that a problem exists isn't enough. You also have to communicate the problem and its solution clearly and effectively, without rocking the boat.
The solution in all cases, not just in issues of security, is to do your homework. When presented with a thoughtful, detailed, documented analysis of a problem, its potential *business* impacts, and a recommended solution, managers generally do take note.
In this case, if you really care about the issue, there are some things you can do that will almost guarantee that you'll be listened to:
First, you need to both educate yourself and construct and analyze a threat model. The "education" in question is more about business and risk analysis than, say buffer overflows and leaky protocols, and the process of building and analyzing the threat model will give you a lot of it.
A threat model generally consists of the following major areas:
After you've created the threat model, you need to analyze it. To do that, you need to try to quantify all of the elements of the model. In the business world that ultimately comes down to assigning dollar values to everything. For each attacker, try to figure out how much they could steal by attacking the system. Even harder, try to quantify the value of attacks for ideological reasons (if any). For each risk, quanitfy how much the company stands to lose if the risky situation happens. For each avenue of attack, try to quantify the cost of performing the attack.
Once you have dollar values for everything (many will have to be expressed as ranges, and all will be built on guesswork), look to see if there is any combination of motivated attacker, risk and avenue that looks like a "good attack". That's an attack in which it's in the attacker's best interest to perform the attack, taking into consideration the possible negative effects as well as the benefits, the attacker's motivates, access, resources, etc.
Think long and hard about all of the good attacks, try to assign probabilities to them based on everything you've learned (plus another crapload of guesses, of course) and you should able to come up with an expected cost for each of them.
The last stage of the analysis is to try to guess at the cost of fixing them. Don't even bother trying to think about financial "benefits" of fixing them... "You can tell all the customers that its *really* secure!" doesn't mean much because they can *already* tell the customers that. It may not be true, but you're wandering into marketing, where truth is... flexible.
You're not
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Just tell us what company this is. Leave the rest to the /. crowd.
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
Perhaps its not a great idea to be working at a financial company, and go about broadcasting your insecurities and saying you dont know much about security.
Good thing your email address is from a yahoo domain.
It still might just be possible that the cost of hiring security specialists/developers in the long term is more costly than paying through insurance the very occasional mishap.
And as you mentioned it is a check printing app. The one we use just runs in a windows2000 server and prints to a network dot-matrix printer. We take care of the security at the network level and at the workstation, so all is well. Unless the application must be accessed over the Internet, I doubt much security is required at that level.
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
Even if the product has more holes than swiss cheese, they will say it is secure because that's a popular sales buzzword. The truth is irrelevant, just tell people what they want to hear, and take their money. That's how Microsoft does it. All they will ever care about is moving the merchandise, and you can't change that. I know it is hard when you care about what you do, but you need to find a way to accept that you only work there, and it is their problem, not yours.
How ya like dat?
Now, the way insurance works is that someone computes the risk, defined by the equation
where R is the risk, P is the probability of the undesirable event, and H is the hazard, or cost of the undesirable event. The idea is that the risk is how much money you have to put away to account for the times you have to pay the penalty -- and insurers then charge M R (M > 1) as a premium. (As a rule of thumb, M is about 2; this means they make some margin and have some room for a run of bad luck.) Now, what you're saying is that P is much higher than you think they imagine1) Find a check printing software house with poor security on software
2) Get hired
3) Print checks bypassing the poor security
4) Profit!
Dude, I've been in your shoes. Straight out of college, financial software company that might have printed checks, scared to death that 'security' meant changing the attributes on the plain-text username/password files to hidden+system. Your situation will be different, because I"m sure they're not the same company (the one I worked for has been bought and sold several times since I was there, so it's not the same at all). But here's what I did: 1. Analyze the threat. Figure out how some one could get in on purpose, and how someone could find the obscurity part on accident. Document it well. 2. Propose a solution. Don't walk in with "this is a problem! We need to research it!" Suits tend to like things nice and tidy. If possible, give 'em an analysis document. 3. Don't spaz about it. I acted like "I did my job bringing this to you in a document - now it's in your court. But if you do something, I've already worked it out in that document for you." Several posters have said "Don't do anything in this economy" and crap like that. Don't you believe it. If one major lawsuit hits your company because of this, the customers and stockholders will be running away in droves. Then you likely will get laid off. Most companies want employees that give a crap. Sounds like you do. Show them you not only give a crap, but have potential. And if they don't act on it, then don't take it personal. Later, Don.
Another point- he says his company sells insurance. I would at this point bet this insurance comes from an outside underwriter, and thus their company has their liability covered.
Give it up, you will never get the company to spend money on security. There is no reason to: they are insured! The mess-up wont cost them anything, but being proactive will. Lets say something gets messed up; I bet they get enough money from the insurance payment to impliment a 'solution'.
Manipulate the moderator system! Mod someone as "overrated" today.