The Failure of Information Security

Noam Eppel writes to share a recent editorial regarding the current state of information security. From the article: "It is time to admit what many security professional already know: We as security professional are drastically failing ourselves, our community and the people we are meant to protect. Too many of our security layers of defense are broken. Security professionals are enjoying a surge in business and growing salaries and that is why we tolerate the dismal situation we are facing. Yet it is our mandate, first and foremost, to protect."

Comments

Failure of security professionals?

[Whiney Mac Fanboy]

"It is time to admit what many security professional already know: We as security professional are drastically failing ourselves, our community and the people we are meant to protect. Too many of our security layers of defense are broken. Security professionals are enjoying a surge in business and growing salaries and that is why we tolerate the dismal situation we are facing. Yet it is our mandate, first and foremost, to protect."

Bollocks - this implies that there's more security professionals could do, but they choose not to, to drum up business.

The sad reality of the matter is the vast majority of the threats they mention - Spyware, phishing, Trojans, viruses, worms, rootkits, spam, web app vulnerabilities & ddos attacks - are enabled by the existence of botnets (to stage attacks from, send spam, provide anonymity, host phishing webservers, etc)

The source of (the vast majority of) botnets is Microsoft's security failures in the late 90's/early 00s. How are security professionals supposed to combat something that happened in the past in another company?

Furhtermore, the list of data losses

Credit Card Breach Exposes 40 Million Accounts
Bank Of America Loses A Million Customer Records
Pentagon Hacker Compromises Personal Data
Online Attack Puts 1.4 Million Records At Risk
Hacker Faces Extradition Over 'Biggest Military Computer Hack Of All Time'
Laptop Theft Puts Data Of 98,000 At Risk
Medical Group: Data On 185,000 People Stolen
Hackers Grab LexisNexis Info on 32000 People
ChoicePoint Data Theft Widens To 145,000 People
PIN Scandal 'Worst Hack Ever'; Citibank Only The Start
ID Theft Hit 3.6 Million In U.S.
Georgia Technology Authority Hack Exposes Confidential Information of 570,000 Members
Scammers Access Data On 35,000 Californians
Payroll Firm Pulls Web Services Citing Data Leak
Hacker Steals Air Force Officers' Personal Information
Undisclosed Number of Verizon Employees at Risk of Identity Theft

can be blamed on companies who have failed to follow their security team's advice. Not on the security team itself.

The story makes some good points, but blames the wrong people.

Re:Failure of security professionals?

[BorgDrone]

Furhtermore, the list of data losses (...) can be blamed on companies who have failed to follow their security team's advice. Not on the security team itself.

Not entirely correct. Yes, users are morons, and yes they often fail to follow the advice of the security team. However, it's the security team's responsibility to get proper behaviour into the users stupid little heads.

Security is not just the technical part, educating your users is huge part of it and if users fail to follow advice the security team has failed in this part of their job. You can whine how stupid users are, but that doesn't change reality, it's the security team's responsibility to make them less stupid.

Re:Failure of security professionals?

[Anonymous Coward]

Excuse me? "drum up business"? Those of us within the field of InfoSec hardly have to drum up business. Count on sheer user stupidity and ignorance for that. There's more than one reason snopes.com exists. Selling Good Security in a corporate environment is MUCH harder than you think. As far as your Security horror stories? Pure FUD that flys over the top of execs heads who are still staring at the bottom line proposal of Firewall/IDS/IPS systems you have proposed with NO real ROI for the business. You need to realize that Functionality will always reside over Security unless you have a legal requirement. As much as it pains me to say this, lawyers (ugh) are going to be the only savior on this crusade to the ultimate ISO17799/BS7799 Corporate Security utopian envioronment. Until it is made illegal, it will remain unsecure. You want an example? Pick any Microsoft product. 'Nuff said.

Re:Failure of security professionals?

[Bacon Bits]

I don't think that's what he saying. That is, users are not to blame. The decision makers are.

Let's say, as an IS professional, you explain to managment the need to restrict user accounts with Administrator rights, the need to implement an intrusion detection device, the need to eliminate spam, the need to make the network infrastructure fault tolerant, the need to update the antivirus client to something that can detect modern threats, and the need to educate users on how to operate their systems securely. Management denies budgeting these things on the basis that they are not necessary, and would you please increase maximum mailbox size again?

If the company is unwilling to do what is necessary to secure the environment, then as an IS professional you are largely helpless.

Re:Failure of security professionals?

[symbolic]

That all depends...many organizations have positions that are characterized by "all of the responsibility but none of the authority". This means that as a security professional, you may be able to recommend certain practices, but unless one has the authority to see to it that these recommendations are implemented, there really isn't a whole lot more that can be done.

Re:Failure of security professionals?

[Whiney Mac Fanboy]

Furhtermore, the list of data losses (...) can be blamed on companies who have failed to follow their security team's advice. Not on the security team itself.

Not entirely correct. Yes, users are morons, and yes they often fail to follow the advice of the security team. However, it's the security team's responsibility to get proper behaviour into the users stupid little heads.

Agreed - but what I was talking about is not failures of the end users, but failure of the company's management to implement security policies (including user education).

Re:Failure of security professionals?

[Linker3000]

Bad perspective.

If you consider the users to be morons and know that they will fail to follow security advice than you plan for this. You can implement training to 'un-moron' them to a degree, but it is not wise to consider that the post-training person will do what they have been told all of the time.

*ANYONE* in any support or consultancy role that starts to say to themselves (about the users) "You'd think that they would/wouldn't...." (eg: You'd think that they would know not to login as someone else") is totally missing the point about human behaviour and is not approaching the problem or their role in the correct way.

Re:Failure of security professionals?

[WgT2]

However, it's the security team's responsibility to get proper behaviour into the users stupid little heads.

Well, that can be slightly difficult when you have the VP of engineering subtly criticizing you for putting a '|' in the CEO's LDAP password. Which is only indicative of the laziness and low expectations and standards of those who hire security professionals. Not to mention there not being a means for the CEO to create or change his own password.

Re:Failure of security professionals?

[kfg]

. . .it's the security team's responsibility to make them less stupid.

You can make them less ignorant. You cannot make them less stupid. You can train the ignorant. You cannot train the stupid, because, well, they're stupid. Stupid is forever. That's the definition of stupid.

Security has to take the stupid into account, because they're out there, in your organization.

And boy, are they stupid.

KFG

Re:Failure of security professionals?

[zuluechopapa]

Er. I think I'd call bullshit. A security team is responsible for keeping infrastructure as secure (and still usable) as possible. Training is another issue in and of itself, and no amount of hand holding can overcome the problems of those who are going to be willfully ignorant.

Re:Failure of security professionals?

[Anonymous Coward]

Your users are so stupid they DVDs in their CDROMs, then complain that the drive wont play their movie.

Your users are so stupid they tryed to plug their new phone into a ethernet port.

Your users are so stupid they keep laughing at the "your users are so stupid...." jokes.

You users are so stupid, when they go to "your" computer they think its theirs computer just because its in "their" cubbie.

Your users are so stupid they mixed up SIMM, DIMM, and RIMM.

Your users are so stupid they call you everytime they need to use a computer.

Your users are so stupid they think BOFH articles you post are not a warming.

Your users are so stupid they open all files marked "fr33 Pr0n, angelina jolie, BriTneY Spears, CHRISTINA AGUILERA, Lesbian Celeb orgy.mpeg.exe", and wonder why its not playing.

Your users are so stupid they put their password and login name on the computers background image.

Your users are so stupid they gave out their username and password for a file named "free lesbian ogry.mpg.exe".

You so stupid you actually read all this!

Re:Failure of security professionals?

[hackstraw]

If the company is unwilling to do what is necessary to secure the environment, then as an IS professional you are largely helpless.

Measures against security just like safety are directly proportional to the level of perceived threat.

So in other words it will take a massive breach in their world or to someone they know before the proper measures are taken.

Nobody protects a piggy bank with an armored tank. Fort Knox has an Army base beside it.

Re:Failure of security professionals?

[kfg]

Your users are so stupid they DVDs in their CDROMs, then complain that the drive wont play their movie.

Your users are so stupid they tryed to plug their new phone into a ethernet port.

This is ignorance, not stupidity. The people who wrote the jokes were too stupid to know the difference.

I like LBJ's line about stupidity:

They couldn't pour piss out of a boot if the instructions were written on the heel."

KFG

Re:Failure of security professionals?

[Nutria]

execs heads who are still staring at the bottom line proposal of Firewall/IDS/IPS systems you have proposed with NO real ROI for the business.

What you need to to is quantify the costs of the last 2 or 3 security breaches and worm/virus infestations, and those of other companies, and also the rules and fines and PR black eyes for exposing private information to the world.

Then compare those costs to to the cost of your proposed Firewall/IDS/IPS systems.

You need to realize that Functionality will always reside over Security unless you have a legal requirement.

Or a monetary imbalance.

Re:Failure of security professionals?

[Anonymous Coward]

Bzzzt! It's not up to the security professional to enforce rules and common sense on the users. It's up to management, and management gets their recommendations from their security pro's. Management often chooses not to implement these recommendations...which is fine, that's while they're called management. If you want to lay the blame at someones feet, it has to be those who make the final judgement call on what to and not to do. This is, more often than not, at a management level. There are very few places where management can be overruled by the security dept. (the federal government is one). Not much can be done.

Re:Failure of security professionals?

[SillyNickName4me]

A security team is responsible for keeping infrastructure as secure (and still usable) as possible.

Sure, educated users are an extremely important part of keeping the infrastructure as secure as possible however.

Re:Failure of security professionals?

[Kalzus]

I have to disagree. There are two parallels:

- Saying that it's a teacher's responsibility to make certain a child grows up to be a responsible member of society. But, in most of the Western world at least, this is bollocks.
- Saying that it's a parent's responsibility to make certain a child grows up to be a responsible member of society, and that they are directly attributable for the failure. This, at least for me personally, is a Truth. However, there will be plenty of children who will grow into misanthropic, withdrawn or downright evil people.

There will not be success in this regard as per the OP's link's author's definition until the users themselves shape up. If "security professionals" attempt to force them, those users will generally arrange to nullify the efforts of said professionals. Because those users do not see a need to.

Observations of current behavior suggest that, frankly, most people don't handle cause-and-effect well and can't be bothered to take responsibility for their own actions without gross displays of effect. After all, there does not yet exist any way to directly kill or otherwise physically harm a person through their web browser.

Re:Failure of security professionals?

[Kirth]

The source of (the vast majority of) botnets is Microsoft's security failures in the late 90's/early 00s.

Yes, so what am I supposed to do? Shoot every Windows-salesman, electrocute all PCs running windows and blow up the Microsoft-campus. I'm pretty sure I could increase security in the long term by doing that... Would give nice headlines too: "Security professionals blow up Microsoft campus".

Re:Failure of security professionals?

[Billosaur]

That all depends...many organizations have positions that are characterized by "all of the responsibility but none of the authority". This means that as a security professional, you may be able to recommend certain practices, but unless one has the authority to see to it that these recommendations are implemented, there really isn't a whole lot more that can be done.

It's too often the case that titles come with very little power. You would think that security people would be in demand now and that people would actually listen to them, but business is still driven by the bottom line, and a company is going to handle security like anything else: the most bang for the least buck. It comes down to the "how little do we have to use and still consider ourselves safe" mentality.

Re:Failure of security professionals?

[scoove]

The story makes some good points, but blames the wrong people.

Exactly. Senior management (aka the "C level positions" like CFO, COO, CEO) just refuse to integrate information assurance, integrity and control into their practices. It is no different than rejecting GAAP and instead using creative accounting ala Worldcom and Enron. Yea, this stuff is hard and complex. But so is the world of finance, and yet we are required to figure it out there.

I work for a firm that consults to smaller financial institutions for their IT audits, security and risk management areas. These smaller organizations lack a lot in resources but the senior managers are usually committed to improvement (it helps that they're regulated to do so).

But regulation doesn't always help. I just turned down a job offer for the senior information security position for a large insurance company in our area after going through several interviews. I discovered that they wanted someone to sit in an office, use a proprietary security suite to generate reports to make sure they were in the file when the regulators come, and otherwise leave things alone. Zero access to C people. They were shocked (and the headhunter pissed since he thought he was getting a commission out of this one) but I refuse to be the certified auditor who signs off on a broken system with unaccountable senior managers.

I asked the Senior VP of Operations what he thought information security was, and as expected, I got a technical answer - "managing firewalls, IDS, making sure people are using good passwords, staying on top of the directory services, etc." Not a single comment about the administrative area, let alone risk issues. If we security professionals are remiss, it is in accepting a paycheck from firms that refuse to operate ethically in this area.

Re:Failure of security professionals?

[SonOfThor]

That all depends...many organizations have positions that are characterized by "all of the responsibility but none of the authority". This means that as a security professional, you may be able to recommend certain practices, but unless one has the authority to see to it that these recommendations are implemented, there really isn't a whole lot more that can be done.

This is one of the reasons I refuse to ever work as anything less thant Chief Information Security Officer - I have seen SO many directors, administrators, etc.. that are "responsible" for information security, but have little or no authority to implement the changes that they feel are required to achieve their security goals. I prefer to work as a consultant - often on the side of those with limited authority but maximum responsiblity, to give credibility and support to their cause. It seems to me that Management is more willing to listen to a highly-paid 3rd party's recommendations, even when their own guys may have been screaming the same thing for years!

Re:Failure of security professionals?

[alexandreracine]

Security is not just the technical part, educating your users is huge part of it and if users fail to follow advice the security team has failed in this part of their job. You can whine how stupid users are, but that doesn't change reality, it's the security team's responsibility to make them less stupid.

Yes and no. The one who is in charge should be the one responsable. Who is it? The boss!

You are in a working enviroment. Why should you have access to the Internet if your job is to type some letters and answer the phone? You need 3 websites? Good, put a proxy and a white list. 95% of users don't need to install softwares, then why can they? And trust me, they do. SuperSearch applications (they have clic yes on a webpage somewhere), desktop wallpaper changer, etc. Actually, they should have a white list of applications, period. They should not be able to listen to music, etc. Go back 40 years in business and compare.

In a working place, better be restrictive then permissive.

This is exactly what the boss should say and write in the security policy.

Re:Failure of security professionals?

[Arandir]

Most corporate decision makers have been thoroughly brainwashed by Microsoft. If Microsoft made doors instead of Windows, here is what would happen: the decision makers would require the doors NOT to be locked, becuase it would inconvenience them should they choose to work late. They would post a security guard at each window, but none at the doors. When they got robbed, they would say "oh well, there's nothing we can do about it except hire another MCSE, because that's just how doors are."

Re:Failure of security professionals?

[Kazoo the Clown]

Security professionals who think the solution is control or even education of users, are the ones who are "stupid.". If your ratio of IT personnel:users is at least 2:1 then maybe, IF you can keep your users from looking for better jobs. A "secure" system must be one where it doesn't matter what the users do, and at the same time still be "usable". Control-freak IT edicts merely motivate users to view IT staff as adversaries and look for convenient workarounds, which often the IT people are completely oblivious to.

Security fails because many of the problems are essentially intractible given 1) security pros do not have control over all aspects that govern security (such as user behavior, or design of the software and network, or connection with outside networks), and 2) more than one computer connected together can relatively easily produce mathematically chaotic and complex behaviors, and especially when there are bugs or misconfigurations involved.

That's not to say there is no hope in the future of security, but it's one hell of a tougher problem than many people seem to think it is.

Re:Failure of security professionals?

[rstrickster]

I do not think he meant the users in the CORP are the ones failing to follow the security warnings. I would imagine many companies simply defer to the bean counters that say many of those security measures would cost too much in the short term and therefore never get implemented.

Sounds a bit harsh to me

[giorgiofr]

We as security professional are drastically failing ourselves, our community and the people we are meant to protect.

This is quite harsh. While it is true that more could be done, it also true that it is thanks to security professionals that things are not as bad as they could be. Yeah, Norton and McAfee are doing their best to scare consumers into buying software that provides ridiculous security. But this is not what we mean by "professionals".
Also, I am not a "security professional" but I have done my fair share of configuring and securing other people's computers; sometimes thay might have been compromised anyway, but if I had done nothing, many more systems would have been at danger.
The article lists a long series of threats that endanger our systems everyday - but I fail to see how they are related to security professionals not doing their job. I'd rather blame the criminals.

Re:Sounds a bit harsh to me

[Crayon Kid]

This is quite harsh. While it is true that more could be done, it also true that it is thanks to security professionals that things are not as bad as they could be.

As opposed to what?! Bad is bad, especially in security, where one breach is all you need. I don't think there's any such thing as "secure to a degree". You're either secure or you're not.

Perhaps you meant that "the consequences are not as bad as they could be". But how much worse do you want it to get? So far the bad guys have been using victims' computers to send spam, DDoS attacks, phishing, empty bank accounts, steal email and IM accounts, spy your surfing, or bring the computer to a crawl with malware. What more do you want?

The article lists a long series of threats that endanger our systems everyday - but I fail to see how they are related to security professionals not doing their job. I'd rather blame the criminals.

In that case, you're in serious need of some required reading. Try this for size: The Six Dumbest Ideas in Computer Security.

I think you'll find that the state of security today is bad, because it's being designed poorly from the ground up. Why blame the criminal who breaches the system when you can blame whoever made the system? A system of any kind should only allow break-ins if it was meant to, not by accident.

Why blame viruses and play catch-up with antivirus definitions instead of making the OS virus resistant? Why blame whoever sent you a self-executable IM or email message instead of the dumbass who allowed your IM or email client to execute it? Why blame phishing attacks instead of designing the DNS system properly? Why blame spammers instead of the happy-go-lucky thing called SMTP? Need I go on? If a system has potential for abuse, it will be abused, period.

Re:Sounds a bit harsh to me

[hyfe]

I'd rather blame the criminals.

Well. It's an extreemely good point.. however, I think the police / criminals analogy works on another level too; at first glance, you'd think it's the criminals that's making the streets unsafe, and not the police. Start looking around a little in the real world though, and you'll find plenty of countries where it's more or less debatable wether the police are solving more problems than they create (Russia, most parts of Africa and some parts of South America)..

Likewise, as bad as some internet security products are, it's atleast debatable wether they're causing more problems than they solve. How many geeks do you know that run Norton Antivirus (or whatever it's called nowadays)? (and yes, these products are by definition created by security profesionals (ie; people making a living by doing security)).

Re:Sounds a bit harsh to me

[SillyNickName4me]

I don't think there's any such thing as "secure to a degree". You're either secure or you're not.

Ah.. absolute security exists you believe?

You disqualified yourself from having an in any way relevant opinion about information security if you really believe that.

Re:Sounds a bit harsh to me

[Crayon Kid]

Ah.. absolute security exists you believe?

You disqualified yourself from having an in any way relevant opinion about information security if you really believe that.

Yes, absolute security can exist. It is more easily attainable the simpler the security system, and the less security systems involved. As they grow more complex and interact with each other, unforeseen consequences are more likely to appear.

But I can see where you come from. It's "not possible" to build a perfectly secure system, so why even try, right? No wonder we have security failure.

Re:Sounds a bit harsh to me

[SillyNickName4me]

Yes, absolute security can exist.

No it can not. No matter what you do, if someone wants your information badly enough and it is somehow worth the effort for them, they can get it. That is why absolute security doesn't really exist (yeah, you can argue it does exist, just is infinitely expensive, but that means that for all practical purposes it does not exist)

It is more easily attainable the simpler the security system, and the less security systems involved. As they grow more complex and interact with each other, unforeseen consequences are more likely to appear.

2 different problems. You are absolutely right with regards to complexity usually being a problem for making things secure, but that has nothing to do with absolute security not existing.

But I can see where you come from. It's "not possible" to build a perfectly secure system, so why even try, right? No wonder we have security failure.

No, you have no fucking clue where I am comming from.

You can make things secure enough that it is not feasable for people to break your security (not feasable means it would be too expensive/time consuming, not that it is impossible). Going beyond that is extremely expensive usually, and achieves extremely little in increased security.

Re:Sounds a bit harsh to me

[buck_wild]

As long as humans are part of the solution, they'll be part of the problem. And having solutions as part of the problem inicates a point of failure. So no, a 'perfectly secure' system is not possible, as there will always be someone smarter / more resourceful / better equiped / etc.

Social engineering (to pick but the most glaring of security issues), regardless of policies and procedures, will always prevent perfection.

A real failure!

[VincenzoRomano]

Information security is failing also because information needs to be managed and addressed by non technical people! Also known as "normal people".
Techniques like phishing or social engineering, as well as a good dose of stupidity and ignorance, can make security technologies useless!
Like writing down on leaflets PINs and passwords or communicating them via email.

Re:A real failure!

[fatmal]

Agree 100%. The issue is we as technologist often don't (can't?) communicate 'safe' behaviours, and quite often the end-user doesn't realise the importance of those behaviours until their information (or even personal) security is compromised.

Safe behaviour, in the real world or in technology, is a learned behaviour - you often need to get hurt first. Hopefully, that first experience isn't too damaging, but is just enough to allow people to learn from the experience.

Re:A real failure!

[vhogemann]

I wish I could mod you up!!!

You can build the environment as safe as it gets... but if you can't enforce a secure behavior to your user, you can't be 100% secure.

Also, management end doing poor decisions based on the average user skills, like using Windows desktops ... or won't bother doing some sort of training to ensure that the users knows the security policy.

The average user must understand their role within the security plan, understand that good security has much more to do with good pratices and habits than with anti-virus software.

Re:A real failure!

[kfg]

Like writing down on leaflets PINs and passwords or communicating them via email.

How about walking around telling everyone your password to demonstrate how clever you were in devising it (out of dictionary words).

Yes, a member of my own family, with a degree from Harvard (bit of local men's room grafitti: "At Skidmore we teach people to wash their hands after using the restroom." Somebody wrote under it: "At Harvard we teach them not to piss on their hands.").

The only effective security measure I know for behavior like this is to apply an LBI.

Some people like the LBIs that come from Louisville, but I'm a New England boy and prefer the LBIs from New Britain. The FatMax(r) incorporates tuning fork technology to reduce harmful vibrations that can cause arm and wrist injuries.

I like the 16 oz. myself, but I only go 130 lbs with dripping wet clothes on. You might acheive better results with the 20 oz.

KFG

Re:A real failure!

[kegon]

as well as a good dose of stupidity and ignorance, can make security technologies useless

I disagree. It is the job of security technologies to protect ourselves from our own stupid actions. If people write down passwords then switch to a system that doesn't authenticate using passwords.

You can't just keep blaming users. Think, if for every bug you found in my software I said "That damn Microsoft!" or "That damn C++!". Saying my users shouldn't find the bugs is blinkered.

Re:A real failure!

[buck_wild]

"Like writing down on leaflets PINs and passwords or communicating them via email."

Here's how my passwords at work have to be modeled:

1. at least 8 characters.
2. at least on capital
3. at least on numeric
4. at least one symbol
5. the same digit/numeric/symbol cannot be used consecutively
6. pasword must go through 99 iterations to prevent repeats
7. no two passwords, for any system, can be the same

I have a (security through obscurity) method for keeping track of my passwords. How would YOU keep track, while staying in line with the above mandates?

Re:A real failure!

[dgatwood]

I suggest passwords that follow an obvious pattern. They also do a good job of expressing your displeasure at the idiot who set up the password policy:

fuck.you.69
screw,you,666
bite.me.69
eat,me,666
fuck.off.69
the,sysadmin,is,an,idiot,666
the sysadmin.is.an.idiot.7

After you run out of these, simply write a script to repeatedly change your password, incrementing the number and alternating the period for a comma each time until you reach the.sysadmin.is.an.idiot.99. Then set it back to the first password on your list.

Next question?

Re:A real failure!

[Arandir]

As a word of defense for the stupid people in the world, a lot of times its supid IT policies that cause this. If you make it so the user cannot remember their password, they WILL write it down.

If you require passwords to have lower case AND uppercase AND numbers AND symbols AND be more than eight characters, then the user is going to write it down.

If you require a different password for every program, service, etc., then the user will write them all down.

If you require changing passwords every six weeks, then the user will write it (or part of it) down. Especially if they're not allowed to rotate in old passwords.

My company does all of the above, which forces me to write down my passwords. I know better, but since there's no way to remember them all, I write them down. My workstation password rotates, so I write down the numeric suffix on my computer case, and use a standard password. Every webapp requires a different password, because each of them have a different password scheme, and a few of them rotate. Consequently I write these down, particularly the ones I only use once a year.

Re:A real failure!

[buck_wild]

Niiiice. Hahaha!

My particular problem is that I have 38 passwords. Without duplication, how do I keep track of them without violating any of the policies?

Wrong

[Anonymous Coward]

It is definitely not our duty to protect companies.

It is our duty to protect our fellow human being and the job market.

This requires plenty of need for technical support to help stymie the massive influx of computer based attacks.

We have already come so far. We are enjoying a surge in business and growing salaries thus it is our mandate, first and foremost, to protect our fellow workers.

Free a port today.

Interesting but...

[datafr0g]

I've read the article and while it's a very informative collection of statistics, I don't believe that Security Professionals are responsible for many of the "Security Failures" listed, nor can they fix the problems. Security Consultants already know most of this stuff and can say what they like to a business, but they do not make the final decision. The holes are in the OS's and the platforms businesses choose and generally the priority isn't security - it's usability, ROI, cost, etc.

Another point: What are we comparing this to anyway. What I mean is, "bad security" compared to what? How many millions of attempts at compromising security are foiled vs those that get through? The times when businesses actually follow what a security consultant recommends, I guarantee they become a hell of a lot more secure than those that don't.

Re:Interesting but...

[Beryllium Sphere(tm)]

>Security Consultants already know most of this stuff and can say what they like to a business, but they do not make the final decision.

What I see in my practice is that even clients who are in the crosshairs of statutes that set infosec standards will ask in effect "what is the *minimum* we have to do to comply with the latter of the law?"

>Another point: What are we comparing this to anyway.

Good point. The current situation is somewhere between no security (Windows machine on the Internet without a firewall) and unbeatable security against all threats. That's not possible, and I guarantee that I can point out enough real-world threats that protecting against them all would bankrupt you.

The Human Factor

[CortoMaltese]

I think TFA pretty much ignores the fact that for the average user, security is just a warm fuzzy feeling they get after they've installed a virus scanner, a firewall, and checked that there's an image of a closed yellow lock somewhere. For security professionals and the like (including myself) it's usually much easier to tackle the technical threats, while it's all too easy ignore the user, which is typically the weakest link in any security critical system.

I know I am stating the obvious here, but I still think the human factor is almost always greatly underestimated.

Re:The Human Factor

[Caledai]

Bold Text = Me
Italic Text = Boss

In relation to giving access to a share for large files. [> 200GB]

Ok, give me the names you want to have write access to this share..
"I can't be bothered to give u all the names, just give them all access" - [Hundreds of Users]
You realise that defeats the purpose of having home folders & quota's & that they can delete anything on the drive, and that we have no backup policy or the facilities to back up that drive [> 200 GB]
So...Just Do It
Sound familiar anyone?
This is just basic NTFS and share access rights - nothing complex.
And I am just a technician - not a security consultant. If they ignore us when we say this - what makes you think they are going to listen to a consultant telling them something they have already dismissed?

Re:The Human Factor

[avasol]

While I agree with you, your comment is too superficial to be of real value. The problem is always with the (l)user, just like a vast majority of airline crashes depend foremost on the human factor. But, in the case of an airline crash, or f.e car-crash, or tanker run aground, or ICMB missile exploding at base - there's always a recurring investigation that, while pinning the blame on some human factor, always finds reasons to stipulate further demands on the manufacturers/vendors.

In the case of software, this never happens. Why? Why is Microsoft not under official scrutiny each time Bank of America loses 1 million accounts? Yes boss, we all understand that users/retailers have willingly forfeit their right to sue for compensation of these losses that inevitably hurt the end-user. My question is, for how much longer will this be tolerated and when will the government (any government!) act on this.

Ultimately, the software industry has been able to entirely block off external pressure from legislators. It's a free license to print your own money, which is quite evident because everyone knows if Microsoft could be held liable for their sometimes downright idiotic software, it would not be a fraction of the colossus it is today. Perhaps wouldn't even exist.

One can always dream.

Re:The Human Factor

[CortoMaltese]

While I agree with you, your comment is too superficial to be of real value.

Yes, I know my comment was superficial and downright obvious, but yet it was something totally missing in TFA. It was just something I wanted to point out, and I wasn't really disagreeing with the article.

I also agree with you that the software industry should take (or be forced to take) more responsibility for the products. Security is not something the consultants or security professionals can patch later as an add-on.

But there's another aspect: in general, software is not simple. Software products are not simple. If you fly a plane or drive a car, you're expected to know how to do it, to have some sort of training in it, and no security features will ever be able to compensate if you don't know how to do it.

Software should probably be simpler and easier to use, so that you could handle it with less knowledge and training. Simpler is often, but not always, also more secure. But, as they say, if you create a product that an idiot could use, only an idiot would want to use it... And there are tasks where no simple solution will do.

Re:The Human Factor

[sendtwogrey]

A response to that sort of ignorant mentality is Yes, Sure, No problem, I just need you to send me a memo resolving me of an internal and external legal action and contractual reasonability I have when corporate information IS lost or maliciously changed. (Yes, it'll also work with the company owner).

If you want a securer system and reduce your work load by 50% then upgrade your admin status to B*st*rd.

Have users agree to your terms and conditions every time they log on, yes it a pain but make it happen, point out that even schools and universities are being held accountable for their user's actions.

Adding or removing software: disciplinary matter

Using company email for personal use: disciplinary matter

Turn off internet access (you pay people to work) if they get round the system: disciplinary matter

download music or software : disciplinary matter

giving out your password : disciplinary matter

check management machines for porn/e-cards/funnies etc, then the next time they kick off about system problems, blame the problem an a virus from one above items.

Re:The Human Factor

[foniksonik]

Oh they'll listen to the consultant of course... cause they paid him/her 40k to tell them what to do to fix their shit, 40k for 2 weeks work.

If you were the consultant they paid to tell them what to do they'd also listen... yes it's idiocy, the consultant knows less about the problems than you do, probably doesn't know more about the solution. But they paid for this advice... and they don't want to look like idiots by paying 40k and then doing nothing with the results.

Unfortunately as part of the bargain the consultant will most likely make all the technicians look like idiots and downplay the managers part in it cause he/she signs the check.

So if you're ever in this position, go ahead and write up your proposal for fixing all the problems.... submit it to your manager via email and printed, before the consultant does the eval... then wait to see the look on the bosses face when he compares the two proposals and realizes he could have saved 40k by simply trusting his staff and listening to their recommendations.

Re:The Human Factor

[Kazoo the Clown]

Yes, you cannot ignore the user, but you must protect him from himself without his knowing about it. Otherwise you become an adversary as soon as that protection gets in the way of usability.

Another problem is that the jury is still out on the effectiveness of a lot of security measures IT pros have become accustomed to. There are lots of conflicting goals. Passwords that expire often and in so doing cause users to have to write them down and/or invent ways to defeat login timeouts so they can stay always logged-in. Remote administration tools that induce additional vulnerabilities into the system. Restricting software updates in order to maintain more software control. Using "master" admin passwords in all users systems, that don't expire (IT pros often can't keep track of dozens of passwords any better than users can). Antivirus software that by its very nature can't keep up with the latest viruses in the wild. And I'm sure there are plenty more...

Professional Regulation

[jtvisona]

It seems to me that if the computer networks and computer industry enjoyed real regulation, any yahoo who passes a CompTIA test wouldn't be able to claim to be a computer consultant, or a security expert, and be allowed to set up crap that allegedly puts our nation at risk via cyberterrorism. as the trumpeters keep blaring. Imagine if anyone could just say he was a lineman and start modifying the power grid, or a police officer and start arresting people. If data is as important as power and control (they are all important types of busses, no?), then data people have to be better trained and regulated like power and control people. Ah, but it's a nascent profession...

Re:Professional Regulation

[Niet3sche]

It seems to me that if the computer networks and computer industry enjoyed real regulation, any yahoo who passes a CompTIA test wouldn't be able to claim to be a computer consultant, or a security expert, and be allowed to set up crap that allegedly puts our nation at risk via cyberterrorism. as the trumpeters keep blaring. Imagine if anyone could just say he was a lineman and start modifying the power grid, or a police officer and start arresting people. If data is as important as power and control (they are all important types of busses, no?), then data people have to be better trained and regulated like power and control people. Ah, but it's a nascent profession...

I assume that you refer to the CISSP exam (or the Cisco CCxx security track?) in the first statement above. That's not really what I'd like to respond to, but the exams are fairly comprehensive and give a good "flavor" of what to look for as well as a "painting with broad strokes" overview of threat models and the like that face security personnel. However, I'm more concerned with the other point in your comment, which seems to point to a conclusion that the exams exist in a vacuum and are the only means/metric by which security personnel may be judged. This is just not the case. Depending on what you want in a "consultant", and depending on your approach (e.g. basic vs. applied research bent), there are exams and degree programs that exist, but the best measure of a security consultant is - I believe - the same as any other field:

* Do they come recommended?

* Do they appear to know what they're doing?

* Finally, do they appear to genuinely understand where security sits in the larger framework of an organization's infrastructure and develop a solution accordingly?

Just summing it up - unless I've misunderstood the grounding and guiding tenure of your post - with a flippant anyone can take a CompTIA exam and be a security consultant does not take into account the true nature of how things are done when individuals have a clue. (Yes, the last part is important)

I see the call for regulation that you are making here, but I think there are other (e.g. "market") forces involved. I am uncertain that regulation would in itself be able to fully cover this, as people's social and business networks have proven difficult to trump in applied practice.

Re:Professional Regulation

[fireboy1919]

You have to take a security test to be a consultant? So...if I'm going to be designing a webpage for a washing machine company I have to take a security test?

Very silly.

Having to take a test for actual security people are as well.

The fundamental principals of security aren't that hard. Not hard enough to require a test:
1) Validate all inputs coming from insecure ports. Assume that all data from them is untrustworthy. Don't allow any kind of write access to your data on insecure ports. Don't allow password validation at all on insecure channels.
2) Store all authentication information in a salted one-way hash. Don't write the algorithm that does this yourself. Use one that's already had a hundred thousand eyeballs look at it and no one who found its flaw (so not MD5).
3) Know and inform everyone that any time you do public key passing via an unsecure channel (i.e. http) you're creating a point of entry for man-in-the-middle attack so that you need to use switches rather than hubs. Other than that its up to the internet service providers to keep that sort of thing from happening.

Those are the "be a good sysadmin" rules. Then there's the programmer rules:
1) Same as rule #1 above, but replace "insecure ports" with "anywhere outside the program." Also included in this - most especially - is making sure that the length of null terminated data can not exceed its available space. Nearly all exploits begin as buffer overflows.
2) Don't make up any algorithms of your own to handle security. Don't bolt security things on to an existing security algorithm. You'll get it wrong like WEP did. Use existing algorithms exactly the way that they were intended to be used with no creativity on your part. Preferably by using someone else's code that has already been inspected highly. Invented things aren't secure until they've had a few hundred thousand eyes look at 'em.

The rules to security are simple. Having a certificate is not going to do much to increase the likelihood that you follow the simple rules. The problem is that all it sometimes takes is one moment of weakness to cause a huge problem - not that people don't know the rules.

At least I hope this is true, and tend to think that it is.

Joint Stewardship of Earth

[Anonymous Coward]

The Coming Singularity compells us to get our security act together before all is lost and our technological world collapses.

Security in artificial intelligence is approaching a winner-takes-all moment of truth on which hangs the fate of the world.

The Joint Stewardship of Earth under human and robot control requires mutually assured defusing (MAD) of security issues for the legacy human society and the supervenient robot society.

PEBKAC

[Opportunist]

I live and thrive on the inability of people. It's my job to find and eliminate trojans, worms and other malware.

Time and again I see proof that people, smart people, people with a masters degree and Ph.D., lawyers and bankers, managers with a six to seven figure annual income, become mumbling fools in the presence of a computer. I don't know what it is that those magical boxes emit, but it must be akin to the stupidity ray used in Zak McCracken. Lucas got it wrong there, it's not transmitted through the phone line, it comes out of your computer screen.

Now the argument comes "Then don't allow them to f... up the system, lock them down and take away their permissions". Anyone who ever said that statement never worked with managers that have egos that require their own offices. Don't you, grunt, DARE to take away any options from him! He is the master of the world, he is the chieftain of chieftains, and YOU dare to tell HIM what he may and what he may not do?

Security is nice on paper, but it is very hard to do in reality. Not so much because its technicalities. The human factor is by far underrated in IT sec.

Re:PEBKAC

[$RANDOMLUSER]

One minor quibble: it's PEBCAK (Problem Exists Between Chair And Keyboard).

Re:PEBKAC

[Opportunist]

I learned it as "Problem exists between keyboard and chair"

Either way, doesn't really matter I guess. It doesn't solve the problem, the only good solution I found for this problem is vitriol.

Re:PEBKAC

[sshutt]

The best any of us can do is set up systems to minimise any problems caused by our users, managers think they need admin rights to all systems, in a lot of cases its just easier to set everyone up as an admin as so much seems to depend on it lately. You cant set up decent security because the users complain, make screens lock if they go into screen saver? cant have that because it takes time to unlock enforce complicated password policies? they get written down the best we can do is protect a system with anti virus, and catch any intrusions that happen before they have any serious effects

Re:PEBKAC

[Old Thrashbarg]

I always though it was PEBKAC, but I prefer PICNIC as an acronym - Problem In Chair, Not In Computer

Re:PEBKAC

[ObsessiveMathsFreak]

One minor quibble: it's PEBCAK (Problem Exists Between Chair And Keyboard).

Either is fine. The product of stupidity and computers is commutative.

Re:PEBKAC

[Beryllium Sphere(tm)]

>stupidity ray

That way of looking at it is a bad start on communications.

How long would you live in the jungle in Papua New Guinea? The Arctic? South Central LA? Yet you can go through the worst neighborhoods of the Internet unscathed. It's a matter of adaptation and experience.

Your users may adapt better if you find a way to anchor the new knowledge they need for Internet survival onto their existing knowledge. Someone here on Slashdot said he got fewere return visits from spyware-infested people after he explained that there was monetary value in taking over their computers and a whole market full of people who wanted to infect them. His users understood already about predation and bait.

My House isn't 100% secure!

[rolfwind]

It must be someone's fault it's not perfect. Okay, I don't want a tomb but be able to interact with the outside world, so I still want doors and windows. But I think the contractors are secretly conspiring together and failing us security wise, because there should be completely unbreakable windows & non-pickable locks on the marketplace. WAAAAH!

Re:My House isn't 100% secure!

[surprise_audit]

Forget the doors and windows, anyone who really wants in will bring along a chainsaw and go straight through the wall...

Re:My House isn't 100% secure!

[Anonymous Coward]

I have yet to see a house that Ty Pennington couldn't break into. All it takes is the right tools!

Re:My House isn't 100% secure!

[Spy der Mann]

This is why houses have something called BARS, and there are more advanced key locks that you can purchase. As an added measure, you can use TWO locks to enter your house (3 or 4 if you're paranoid), PLUS an alarm.

The problem with Windows machines is not only that new backdoors are found constantly, but that then they can be used to attack other computers. It's like an "insecurity virus", it multiplies. If we use the house analogy, every broken house would become a thieve's HQ.

Having said that, I have to clean my father's computer of spyware EVERY WEEK. I just hope it's not been rootkitted YET.

Re:My House isn't 100% secure!

[Beryllium Sphere(tm)]

Polycarbonate windows and Medeco locks.

Locks can be completely bypassed though. If you call 911 and tell them you're having a heart attack, if the door is locked when they arrive, they maydeploy a gadget easily found in first responder catalogs that goes into the doorframe horizontally and jacks the frame open wider enough that the bolt from the lock doesn't engage eny more.

Organize a block watch group in your neighborhood.

(This has nothing to do with the point you're making but I love talking about physical security).

Corporate mentality

[Aceticon]

The management level corporate posture towards IT security goes like this:
- We want to have our machines and network secure as long as it doesn't cause too much hassle to people and we don't pay a lot for it.

In other words, forget about big hardware changes, forget about changing the OS/E-mail client/Word editor/Web browser on the desktops of the staff, forget about getting all laptop users in their own sub-network and forget about retraining our staff to use computers in a way that helps improve our IT security. Oh, and by the way, if the CEO or some other VIP has some funky new program on his laptop that can't connect to the Net, just open those ports in the firewall.

And now IT Security professionals are to blame?

What's next? Maybe the cleaning lady at Enron was the one responsible for defrauding the investors????

Re:Corporate mentality

[Demerara]

The management level corporate posture towards IT security goes like this:
- We want to have our machines and network secure as long as it doesn't cause too much hassle to people and we don't pay a lot for it.

Spot on. Corporations who are legally mandated to secure their information systems will spend the mimimum to achieve compliance. Absent this, they'll spend nothing unless it effects the bottom line and shareholder value.

Information security professionals are no more responsible for the consequences of ignored advice than are weather forecasters for damage caused by hurricanes.

At first, I thought the article was flamebait but it is an interesting read - a good overview of the harsh environment.

Re:Corporate mentality

[surprise_audit]

Around here, we're standardising on Windows XP, with Outlook/Exchange for email and Internet Explorer for browsing. A fair proportion of internal web pages are broken in any other browser, even going as far as to redirect you to a page with a link to download the approved version of IE. Oh, and everyone is slowly being upgraded to laptops when their desktop systems become old enough to warrant it....

And yet there's annual, mandatory, Security Awareness training. One year I was able to get a perfect score by using right-click->view-page-source, because the multiple-guess questions came loaded with the correct answers...

Re:Corporate mentality

[Anonymous Coward]

I once went to a customer that was having problems with their internal systems transmitting SPAM. After spending a couple days I handed in a report that detailed architectural, policy and physical security changes that would remediate the worst of their security problems. Many of them would have required minimal investment other than time. This would have been a first step towards having reasonable assurance that the enterprise was secure. The customer IT staff opposed the changes because they had set up the systems in the current insecure architecture. Last I heard they had bought a SPAM filtering system and put it inline to filter OUTGOING emails so they wouldn't end up on dns blacklists anymore.

But somehow according to the article I'm responsible for their decision because I didn't take hostages and insist on re-architecting the network...

Re:Corporate mentality

[Arandir]

Holy crap! You work for the same company I do!

Failing

[mulhall]

"We as security professional are drastically failing ourselves, our community and the people we are meant to protect"

BS

You cannot solve cultural problems with technology:

http://news.bbc.co.uk/2/hi/technology/3639679.stm

Re:Failing

[Maximum Prophet]

Sure you can. I have locks on my doors and trained dogs. If a criminal were to select my house, these simple technologies will send him to a softer target most of the time.

Now if you are taking about the existence of crime itself as the "cultural problem", then I'm more likly to agree with you, but pyschology is making leaps and bounds in determining why people commit crimes. Think "Gattaca" or "Minority Report" and others where technology solved problem X, and created a much bigger problem Y.

In conclusion, yes sir, technology can solve all your problems, but then it's up to you to deal with the Giant Killer Robots(tm). (Which in my opinion, are long overdue (:-)

Hmmm...

[Mostly a lurker]

Microsoft has had over two billion downloads of its malicious software removal tool in the last year, which tells us something about the overall size of the malicious software problem.

Yep: it tells us exactly nothing about the overall size of the malicious software problem. It does, however, indicate that users are using Windows Update (either automatically or manually). [The malicious software removal tool is a critical update.] It is good news that Microsoft has persuaded users to keep up to date on critical updates, I guess.

Security bullsh*t :)

[xdesk]

Security is pretty much at the point where we want and are prepared to pay ... and in a world not quite perfect :)

It's not the professionals...

[bulldogzerofive]

... it's the end users who are responsible for this dismal state, IMHO. The article makes the case that despite a growing amount of software designed to protect us, it is not working as well. I would argue that the software and implementations probably ARE working better than they used to. However, as software gets better and easier to use, people spend less time learning how to use it simply because they think that it is better and easier to use than what they used to have. So, firewalls are not configured properly, AV programs are not run frequently with the user paying attention, and of course people install crap thinking their security software will protect them. Then there is the old social engineering problem. And there is nothing that security professionals can do against lazy users. Of course, I am not addressing some of the higher level network-security-in-a-corporate-setting arguments the author makes, but I myself am just an end user, so anything I could say to that would be, well, irrelevant.

An Important Note

[Effugas]

In the Summer of 2003, the Internet suffered three major worms: Blaster, Nachi, and SoBig.

We haven't had a worm since. There have been no systemic outbreaks in over three years. Sure, we've had mild rashes, but Zotob vs. Nachi isn't even a comparison, nor is Blaster vs. WMF.

IE attacks are deeply problematic -- they're wonderfully targetable, among other things. But there's really no replacement for zero-interaction, receive-a-packet-and-you're-owned style vulnerabilities. SP2 put a firewall on every desktop that cared. Since then, no worms.

That's not to say we're not fighting a painful battle. Really, every day we get to still bank online is another day I'm surprised. But the fact that SP2 was written, was free, and was actually deployed enough to matter is one hell of a win.

Re:An Important Note

[Maximum Prophet]

Gack... That's because those worms were simply malicious. The newer cybercriminal is getting paid for his work, so he's more likely to lie low. Once he's compromised a machine, he doesn't want to get caught by interfering with the owner. Formatting the hard drive, or deleting files is sure to get you noticed. Most of the time these days, users don't know anything is wrong until they have multiple bots on their machine whose combined impact makes their machine impossibly slow.

Re:An Important Note

[popeyethesailor]

SP2 put a firewall on every desktop
The other most important thing they did; turned on Windows Update by default. Those 2 decisions were probably the best MS has taken in a long time.

Take a look at the real world

[SmallFurryCreature]

How many people bother to protect their house UNTIL they been burgled? How much inconvenience are we willing to accept to avoid being mugged. (Camera surveillance, random searches, etc)

In the real world a society has only got to deal with a limited set of criminals. The criminals in that society. Not that many nigerian cat burglars who hop over to europe for a quick breakin (I am not going to touch immigration problems today thank you, it is to hot for a flamewar).

But on the net the society is 6 billion and anyone of them can try to see if you left your window unlocked.

Yes it is sad that in the real world you have to put your bike behind a locked fence and the bike itself locked and chained or be told of by the police for leaving your bike to be stolen in your own garden but that is the way it is.

Either we are willing to pay for massive more police, more restrictive laws and larger jails (and some might say freedom again a subject I am not going to touch today) or we have to live with crime.

We could easily secure our computers and the information they contain but to do so would require a lot more work on our part, remove some easy access as well as require measures against people who leave things open.

Did you know that in the real world the police spends time informing people about house safety? That there are even laws against making theft to easy? That is the reason why all shoes on display outside are either left or right ONLY (I never remember wich). Cause a shopowner that has both outside and gets them stolen will receive very little sympathy from the police.

Yet we keep runnings windows, install every flashing free program we find and open emails that promise us naked pictures.

When the user wants to do insecure stuff there is little you can do to stop them.

A ridiculous article

[rann]

I usually don't post but this article is really too much.

In other news, firefighters KEEP fighting fires worldwide! Despite their work, fires seem to keep burning stuff all over the world! Shock!

News at 11! Ambulance personnel and hospital staff are fighting an uphill battle! patients keep coming in! Where does it end?

Seriously, as long as you have people using any mechanism (computer/car/whatever) there will be people who break it, people who benefit from breaking it and people who try their utmost to KEEP it from breaking.

I'm *really* looking forward to the followup article which will tell us all how to "fix" this. Mayhaps a rant on buffer overflows? the virtues of "safe" languages? sane input validation? sigh.

Re:A ridiculous article

[Anonymous Coward]

you miss the point.

A better comparison is "Jail warden and guards let another 100 prisoner walk free because they didn't lock the prison door properly again"

Re:A ridiculous article

[Spy der Mann]

I'm *really* looking forward to the followup article which will tell us all how to "fix" this. Mayhaps a rant on buffer overflows? the virtues of "safe" languages? sane input validation? sigh.

Good point. IMO, all operating systems from now on should implement mandatory virtualization/caging. No HD access outside the program's installed path, no registry (or equivalent) access outside the program's parameters, and using a warning for programs which would do said access.

This would keep us at least protected from trojans posing as games or DRM stuff.

Re:A ridiculous article

[kadathseeker]

A better comparison would be construction workers realizing that building collapse and/or burst into flames far too often, or lock and door manufacturers ralizing that a toddler can get through thir products with just a little effort.

But essentially you are right, security has sucked for so long, it is hardly news. Call me when it doesn't suck anymore (when there is mass Linux/BSD migration? When Satan buys ice skates?).

Re:A ridiculous article

[robertjw]

A better comparison is "Jail warden and guards let another 100 prisoner walk free because they didn't lock the prison door properly again"

No, actually a better comparison would be "Judge lets criminal go free on technicality". The problem isn't that the doors aren't locked or the system isn't airtight enough. The problem is that people still want to live and function under the system.

Our judicial system has rights for the accused that result in some criminals going free. Why? So the system is more usable and bearable. If everyone was considered guilty until proven innocent it would be much easier to lock criminals up.

In the same way IT security must allow users to function. There is a balance between security and usability as well as a balance between cost and benefit. Many solutions that are affordable are too intrusive. Other solutions are too expensive for their application. I could EASILY lock down anyone's machine and remove 99% of vulnerabilities, but the user might not be able to access their favorite blog, porn or music download site.

Short Story of Security and Seatbelts

[Teacher's Pet]

a few of the replies are already pointing to the human element. a while back, someone made an information security analogy to the use of seat belts.
it went kinda like this:

- used to be that seat belts did not exist, yet cars could travel pretty fast (40-50mph). back then, if you crashed you pretty much assumed you ate the dash.
- then seat belts were created, but people still ate the dash.
- then belts were required in all cars, but the dash still tasted good.
- then belts were required for use,
- and air bags came out (ha ha).

--> ok. i got no stats, but it's possible that less people eat dash today because of better default "security" settings in cars *and* better use by the users. oh, and some where along the way, drinking and driving was considered bad.

(pretty sure i first saw this example in a presentation by m. ranum)

--
"I promise to be different..."

This makes no sense

[Mr_Tulip]

As someone who is responsible in part for network security where I work, I would disagree that we are not doing 'enough'.

The sad reality is that information security is rather hard to achieve in an imperfect environment and without unlimited resources.

To make a bad analogy, it is hard to physically protect your client/employer if they insist on partaking in high-risk pursuits, and the environmaent is harsh and dangerous. Email-header spoofing, bot-nets, vulnerabilities in 3rd part software - these are not under the control of the admin, at least not if you are committed to the Microsoft platform.

The same could be said that a doctor cannot be held responsible for their patients health, if their patient is a chain-smoking, alcoholic base-jumper who rides his a monocycle down the freeway at 100 km/h.

Re:This makes no sense

[sshutt]

Drunk base-jumping on a motocycle :)

Re:This makes no sense

[Anonymous Coward]

Where I live, try riding a motorcycle at 100km/h (62mph) on the freeway you will eventually be run over by a large SUV doing 85mph... Ride faster and you should be ok.

Is it really that hard?

[Phemur]

I'm honestly not trying to flame or be sarcastic; I truly don't understand the issue from a user's point of view. My computers have been infected once by spyware in the last 10 years. No viruses, no rootkits, no malware nothing. Since I'm not an information security expert, I don't have l33t skills to help me stay secure, so why have I not been affected?

Seriously, I'm asking. :-)

Here's what my wife and have been doing. We both have computers, and we use it for very different things. Mine is games, programming, internet, and my wife's is for CAD, photoshop, internet.

They're both pretty much setup the same, other than the OS. My wife's runs Windows 2000 and mine runs XP. Both are connected to the Internet via a Linksys wired router. Both run Firefox only as the web browser. The Windows 2000 box runs ZoneAlarm as the firewall, and mine runs Windows firewall. We both use GMail as our email tool.

Other than that, there isn't much security software installed. I don't even have an anti-virus.

I am pretty diligent at applying patches however. Firefox and ZoneAlarm both notify me when a patch is available, so I apply them when they popup. I run Windows update weekly. I also have Adaware and Spybot Search and Destroy that I run weekly as well. Other than the usual ad cookie (Double-Click, etc), they've yet to discover something.

The only problem I've had with machines is with a bit of spyware that got installed. It was one of my wife's first online experiences, and she clicked on something she shouldn't have, AND she was running IE. I ended up reinstalling the OS, and after a very short Firefox tutorial, it was the end of spyware on her computer.

(As an amusing side effect, she's now become quite the advocate for secure online habits and for Firefox. Most of her family and friends are all Firefox users now. Can we get a free T-Shirt :-) ).

So what's the problem? Is it bad habits, or is it really that bad out there?

Phemur

Re:Is it really that hard?

[sshutt]

I'd say its a bit of both theres people with bad habbits and theres alot of viruses worms and trojans out there.
Last year (I dont know if its any better now) if you connected directly to the internet with an unpached unfirewalled system, chances are that you'd have some kind of virus/worm infect your computer within 30 seconds.

It sounds like you have a pretty good set up there though, and some good habits but I'd still recommend getting some free antivirus just in case, not that any of my machines ever find anything, but its extra peice of mind.

Our biggest dificulty is teaching everyone with a computer good practices, so they can protect themselves so we don't have to, but that would put a lot of support staff out of their jobs.

Re:Is it really that hard?

[mikehilly]

I do a lot of side work helping people with computer both in a home and office arena....

You and your wife spent some time preparing and getting some type of defense up AND maintaining it. The great majority of people I deal with think that they can install Windows update once and they will be good. Or my favorite, "I have XP (windows) so I don't know what could have gone wrong." People click where they shouldn't click, go where they shouldn't go and do things without thinking.

The only good analogy to help people understand the importance of security updates is vaccines for children. They may have to go back periodically to the Doctor to make sure all their shots are up to date. And if you think of the web as a disease ridden place, then it would make sense to wear some type of protection when you muck through it.

You hit the nail on the head here. Three things are needed for a mostly safe computer experience:

1: Some basic user education (could be the hardest one)

2: Tools like Firefox, AdAware, Windows update, Firewall. Get em, use em.

3: UPDATES!!! what good is a vaccine if it is out of date? Get regular updates for Windows, Firefox, and other tools.

Most people are clueless when it comes to all three.

Re:Is it really that hard?

[Anonymous Coward]

Don't have kids, do you?

Most security problems do not enter the company through the company firewall/mail gateway. They are *carried* into the building on employees (surprisingly often: managers) laptops. Laptops that are used at home for the kids to play with, browse the web or whatever. Or for the own employees entertainment.

I don't have kids but a while ago I had a friend visit me, together with her 12-year old daughter. We kinda lost track of her whereabouts and found her behind my company laptop (in my study) on MSN or something like that. I run Linux and was logged in as myself, not as root, so the damage that she could have done to the OS was minor, but she got told off anyway. She now knows next time she'll have to ask and she's got her own account now on my private desktop. But how many people will happily let their or other peoples kids use a company laptop while being logged in as Administrator?

Another poster suggested that all laptops should be on a separate network, and I presume he also meant that this network should be firewalled off from the rest of the company network in such a fashion that only the standard applications/protocols are allowed. (Better yet: firewall each laptop off from the other laptops.) Unfortunately, in large companies with a mixed desktop/laptop environment, this is incredibly difficult to achieve.

Re:Is it really that hard?

[raind]

Yes, think about the majority of internet users who just want get online and do their thing....

Re:Is it really that hard?

[SillyNickName4me]

The idea is to indeed seperate laptops into their own network segment, firewalled from the rest.

Ideally you go a bit further then that.. any laptop comming onto the network will be isolated in a segment with only that laptop and an authentication server. Before being allowed to use any servives, the laptop has to be checked on mandatory protection software being active, and has to be authenticated. After this it will still be on its own seperate network, away from 'normal' workstations.

Re:Is it really that hard?

[Bender0x7D1]

I am a security professional, and I would recommend you do the following:

Create a backup of all your data. (In case installs or removals go badly.)

Turn on automatic updates if you haven't already. Install all updates.

Install Zone Alarm.

Install AVG Free and run a complete scan of your system.

Install Spybot and run a complete scan of your system. Also, look under Tools --> System Startup in the menu to see if there is anything "odd" being run at startup. (Requires advanced view mode.)

Install AdAware Personal. Perform a complete scan of your system.

You may be right about only having 1 spyware infection in 10 years, but the odds are against you. Better to check and know you are clean than assume you are.

Re:Is it really that hard?

[deinol]

So what's the problem? Is it bad habits, or is it really that bad out there?

You don't know what the problem is, but you take a lot of steps to prevent them.

You have a firewall. That protects you already from a lot of worms or other things that are out there.

You don't use IE. You may not be a security expert, but you are still better off that 80% of users out there. A lot of spyware comes from questionable sites with ActiveX content. Too many users click on any old pop up claiming to have a useful tool or widget or whatever and get a trojan installed instead.

You don't use Outlook. You don't have an e-mail client that will execute macros or executables.

You learned not to click on things from questionable sources. This the major difference between you and the "average" user. Most people just click OK to any random window that pops up, they want to get to whatever site they are trying to get to.

So yes, if we are talking spyware/virus infection, it really is just bad habits. Not knowing what it looks like when a website or e-mail is trying to install something.

Now, if we are talking corporate security, that is another story. If you are a company running a website that allows people to log in and stores sensitive data about those users, you should have a security expert dealing with the code and server security. That's where you need the experts. Home network behind a firewall? Just a few safe habits is all you need. Mostly a distrust of any executable you don't know for sure is legit.

Re:Is it really that hard?

[booch]

You might not be a security expert, but you've LISTENED to security experts, and you are following better security practices than 95% of the home users out there. (Probably better than 80% of the companies out there. Heck, probably better than 50% of the security professionals out there.) By using Firefox and a NAT router, you've reduced your attack surface by probably 90%. Keeping your software up to date, and running scans adds probably another 9%.

You're definitely an educated user, doing the right thing. And perhaps you provide good evidence that the majority of posters here are right -- it's not the security professionals who are at fault. But why is it that we can't convince more people to be as conscientious as you? Why can't we make it even easier?

Looking at my first paragraph, I think I have to place the blame squarely on Microsoft. I'm not typically a Microsoft basher. I think they do a lot of things well, but like anything, there are a lot of problems as well. (And I generally prefer Linux, although I do prefer Microsoft Office apps.) But it's Windows and IE's "insecure by design" that's really at fault. Why should a Windows client have any ports open by default? Or at least without asking if I want to open them during the installation wizards.

I went to a presentation last night on web application vulnerability/penetration testing. They said that they are able to gain full access to about 40% of the web apps they test. And by full access, they mean access to system accounts and arbitrary database read/write. Incredible. Mostly due to programmers not validating input.

So while I agree that security professionals are doing a lot, and largely being ignored, I think that we need to make it clear why and how things need to change. Largely, I think this will mainly require treating security as a process involving people, not as technological products.

Not only information security

[houghi]

Also other security. Things are getting stolen Learn to live with it. That does not mean nothing must be done. We must do things, but also realize that things will get stolen, no matter what.

The thing I see is that almost nobody deals with what to do IF things get stolen. I had a talk with somebody and asked him what he would do if he knew that his database was stolen and competistion got hold of it. His answer was: nothing.

Perhaps there lies the problem. People are not being punisched if they do something wrong. They get fired when they watch pr0n at their job, but no real ssue if they use an usnsecure password. Instead the company sues 'the hacker'.

No resposabilty is taken.

Where is our backup?

[Anonymous Coward]

The failings of information security are (99.99% of the time) not the fault of the officers within that department. The lack of management buy-in to support policies is our number one problem. The technical teams (server managers, network support etc) see us as a hinderence which must be battled and argued with (sometimes just for the hell of it) every step of the way. We offer numerous suggestions on how we can integrate our teams and communicate better, and then we're promptly ignored. We offer to help develop secure baseline builds for OS installs and router/switch configs and then are basically told to "get stuffed" by the people in those teams. Management have little to no interest in the concerns we document and supply to them, and even when the issues are taken up the food chain they get sidelined as it is always deemed too much hassle. We invite external vendors in to help us develop a patching procedure and customise our backup processes to suit our environment, then the server admins do something completely different claiming that they don't want to be responsible for maintain the supporting documentation. HR refuse to update their AUP acceptance process because they don't want to manage the overhead, despite us advising them numerous times that if the users have not acknowledged the policies then prosecuting "unauthorised access" under the Computer Misuse Act is made so much more difficult.

US Govt IT security - waste waste waste

[Anonymous Coward]

I work in USG IT - in the dissemination area (websites). We are spending more on IT security paperwork then anything else. Security documentation "C&A" packages are written in the field, rewritten, reviewed at a regional HQ, rewritten, reviewed at a national HQ, rewritten, reviewed by a 3rd party contractor, rewritten, reviewed again at HQ, rewritten, then passed up to the next level of government and the process starts all over again. We are a line office, so there is the bureau layer, then the cabinet agency level before the C&A package goes to GAO for grading.

Bet for every $100 spent on the paperwork, less then $1 is spent actually securing systems. The IT security officer's budget dwarfs the dissemination budget and our information saves lives.

We have more contractors reviewing C&A's then programers creating code to deliver our information. Out of this army of contractors, there is a single USG employee who is an outstanding system security engineer and is someone we can go to for a technical solution. And the line outside this guy's cube is long.

And the joke of it all is after all this review, GAO still gives us a grade of D-.

Re:US Govt IT security - waste waste waste

[Anonymous Coward]

Reminds me of a fortune quote I saw on /. the other day:

If you took all the grains of sand on a beach, and laid them in a row, you'd be working for the government!

Failure to adjust to the system.

[Anonymous Coward]

The problem these security experts have is that they have workmanship pride, and human decency. These things are drawbacks in the capitalist (especially the US) system. It is designed to maximise capital growth. It does not maximise human happiness or the growth of humanity, though a lot of people who benefit from the system to the detriment of others would like you to believe that.

The perfect slave is one that has been convinced that the shackles are for his own good.

Then change it

[sl4shd0rk]

The worst thing you can do when you find yourself in a hole is to keep digging. If you are unhappy with your security infrastructure, then change it. Don't just 'accept' it as 'dismal' because your software vendor pimps that out as your only option. For all I know the person reading this right now has my personal information on their network somewhere, and the only thing between my information and some cracker is a piss poor security decision they've 'accepted'.

Eternal Vigilance

[digitaldc]

Your security is only as good as how thorough your actions are in combating the problem.

Unfortunately, you must protect your data constantly and train your staff accordingly. One weak link can ruin everything.

Most security "pro"s are still tech noobs

[BadassJesus]

We as security professional are drastically failing ourselves, our community and the people we are meant to protect.

Most of them just fish on securityfocus.com and keep all the machines with the latest patches, thats all they can do. They do not have the knowledge or tools to further explore the realm of computing and networking underneath the watched OSses, no way to gain further insight of what is really happening there, they can't ever be sure any data leakeage isn't occuring.

because I.T. Security Pro = scapegoat

[ManyLostPackets]

I've specifically decided not to go for any security certs because of hoo-haw attitudes demonstrated in articles like this. As a regular sys-admin, no one listens to my recommendations in the first place, why ratchet up the accountability by being a certified scapegoat?

This article is a riot act equivalent to calling out doctors to take accountability for people who run with scissors.

Noam looking for a job again?

[grindcorefan]

Aha, so Noam Eppel is craving for attention again. What is it he needs this time, then? Job, money, 53x, foot massage?

Or has he finally realised that They Are Out To Get Him(tm)?

His doomsday scenario reminds me of an "interesting" article on uncoclypedia: http://uncyclopedia.org/wiki/Bird_Flu

Only, the article on uncoclypedia is funnier...

Not trolling in anyway but . . .

[ElephanTS]

There is no way security can really improve while MS Windows is on the majority of the desktops out there. I'm sure everyone of these security professionals must know this but why kill the golden goose?

This is a failure of capitalism!

[Anonymous Coward]

Think of all the money that flows through the world economy because of Crime, this is why crime prevention is usually doublethink. Take the AV companies, how could they be in the business of fixing the virus problem, when they would have no business model without viruses? Neither do Microsoft have any interest in ever fixing windows, especially whilst they can generate additional revenue from anti virus products.

Once you create economic opportunity under this system, you create dependants who will fight to maintain it.

Crime prevention:

Ensuring that society encourages crime and maintains it at levels where people continue to make money.
 
See also: Protection Racket

Won't change anytime soon...

[duh_lime]

Security is HARD when it's architected into a system from the beginning. Security is impossible when it's an afterthought. Translation: The situation will not improve until the the current crop of operating systems, applications, utilities, etc., are completely replaced by attrition with new code that has security at its core and foundation - that was *architected* to be secure. Of course, security architecture needs to start at the top. 99% of what's out there now, if it has any security at all, had security "bolted on" as an afterthough. This problem is not going away anytime soon. I'm not holding my breath. But, in the meantime, I just consider it "job security" and constant triage.

Failure of management

[192939495969798999]

It's not the failure of the security professionals, it's the failure of management to not respect the wishes of the system security. I can't tell you how many times I've seen a perfectly good security solution just get circumvented by management, or else the security people are fired. If management people took security seriously, rules would not be broken that way.

we are failing?

[Abstract_Me]

how about doing the best job we can with what we are presented. Security can't happen over night and with firms just now starting to hire security professionals we have to go into their business and first geta grasp on their current practises. from there you have to work at changing years of insecure procedures while at the same time working on the security of the tech side with the very little funding you are allocated.

I guess what im asking is are we actually failing at our job? or are we just taking longer to do it then we would like.

Ignorance Is Bliss?

[LanMan04]

If you don't have any anti-virus software installed, or at least a scanner, how would you know whether your computer is infected or not? If your machine belongs to a bot net, you probably don't know about it.

To put it another way: Just because you have no symptoms doesn't mean you don't have cancer.

Is this little traffic light on your router blinking 24/7? :)

Re:Ignorance Is Bliss?

[popeyethesailor]

There's a difference between plain ignorance and actually knowing what you're doing. Now I'd agree there are a few arcane ways of getting viruses without user intervention, but are relatively easy to avoid when behind following safe procedures.

Viruses arent magical genies that pop into your computer; they need a vector for propagation and execution. Having sane firewalling rules, patching operating systems regularly, using safe browsers and internet tools pretty much cover most of the attack vectors. My guess is that GP knows what he's doing, and I'd wager he doesnt have viruses in his systems.

Re:Ignorance Is Bliss?

[Sven Tuerpe]

If you don't have any anti-virus software installed, or at least a scanner, how would you know whether your computer is infected or not?

How would he if he had? Anti-virus software is designed to appear successful: when it finds something, it will post big messages to your screen regardless of the real danger. If it doesn't, it won't tell you. Not having seen any warning from the virus scanner doesn't mean your computer is clean, and seeing one doesn't imply there was any real danger.

Re:Ignorance Is Bliss?

[roystgnr]

Is this little traffic light on your router blinking 24/7? :)

Mine has been blinking 24/7 for years, since the first IIS worm. Tcpdump suggests the reason: even if your computer isn't part of a botnet, if you're on a cable modem you can expect to be continually swamped by arp requests as a side effect of other bots' subnet scans.

Re:Ignorance Is Bliss?

[ahodgson]

No kidding. My cable-modem blinks 24x7 even when all it's plugged into is a switch with nothing else attached.

Re:Ignorance Is Bliss?

[Lost Race]

I don't have any antivirus software installed on my computers, but I do occasionally (about once a year) take image copies of the hard drives and run them through virus scanners in single-purpose sandboxes. This procedure has never detected any malware over the last 10 years.

What I absolutely do not ever trust is a virus detector running on a potentially compromised system to give accurate results. I also don't particularly trust antivirus software itself, which is why I only run it on disk image copies. This level of "paranoia" is probably what has kept the malware out for so long.

Re:Ignorance Is Bliss?

[Phemur]

Good point. It's the obvious ones I miss.

The only reason I don't have an anti-virus at home is because of the one we have at the office. It's very aggressive, and it completely degrades my system's performance. The network light may not be on, but my hard drive is constantly being accessed, and my CPU is rarely below 50%. Filemon and Task Manager reports that scan32 and mcshield are the culprits.

But your post made me realize I can still have some sort of virus protection without that hasstle. I can just install an anti-virus, and run a quick scan once or twice a week instead of leaving it on all the time.

Phemur

How about if they refuse to "do as they're told"?

[Anonymous Coward]

Especially when they're senior management types? You can bitch all you want to anybody you can find who'll listen to you but at the end of the day most companies place senior management and they're desires ahead of those of the IT department: if Company Director X declines to follow IT dept guidlines on security procedures, there is nothing IT can do to him and his activities which won't result in the IT guys being fired.

So some Top Dog asshat opens a gaping hole into the company's system and there's not a damn thing IT can realistically do about it, bacause in most cases they are too far down the pecking order to get their way, but will still be blamed for the breaches and disasters that follow anyway.

Missing the Point

[vtcodger]

Seems to me that most of the responses miss the point. The point is that the computer industry to a very great extent does not know HOW to build a secure system. At least not if the system is hooked up to an external network. And things are, it is asserted, getting worse, not better.

I think the article's case for eventual total security breakdown is a bit overstated, but not wildly so.

The question that we should be asking is ... If current trends continue, ten years from now will we be able to safely connect to the Internet (or any similar network) for any purpose whatsoever? IMHO, That's a really good question.

Re:Missing the Point

[Maximum Prophet]

the computer industry to a very great extent does not know HOW to build a secure system

Well, I know how to build a secure system. For a bunch of money, I'll tell you. We've know for years how to do security right, but when it is done right, it's a hassle, and not percived as being worth it.

Re:Missing the Point

[vtcodger]

***Well, I know how to build a secure system. For a bunch of money, I'll tell you. We've know for years how to do security right, but when it is done right, it's a hassle, and not percived as being worth it.***

I suppose that at the limit, I know also. On the back of most every PC today is an 8 pin RJ-45 connector or occasionally a BNC or 4 pin RJ-11. Unplug it. Cut the wire connected to it. Put the plug back in. You now have near perfect communications security.

Short of that, I don't think you can really secure a modern system. You apparently think differently ... which is fine. I'm sure whatever you would do would be vastly better than nothing. But don't be too suprised if you find out in coming years that your best isn't anywhere near good enough.

Re:Missing the Point

[Maximum Prophet]

Cut the wire connected to it. Put the plug back in. You now have near perfect communications security

Not even close. Given the resources, I could break into such a system from some distance away.

You forgot to put the computer in a Faraday cage, with armed Marine guards outside. Make sure the Faraday cage is in a room near the center of a large, secure building. Encrypt all communications with one time pad onto physical media, and make sure the other end of the communications channel is just as secure. Yes, security is possible, just very, very inconvenient.

Securely Stupid

[BoredWolf]

It is time to admit what many security professional already know: We as security professional are drastically failing ourselves, our community and the people we are meant to protect. Too many of our security layers of defense are broken.

Most of the listed issues are a result of user stupidity. Clicking on banner ads, links in e-mails, porn sites, etc. The real failure lies in user ignorance/stupidity and company infrastructure. The reason we hear so much about identity theft is simply that companies comply with only the minimum standards for encryption and user information security. For this, it is the responsibility of the company to go above and beyond what the government requires, and provide security which might at least pose a challenge to hackers. The best solution for IT professionals is to inform users of the risks posed by their internet usage, and to urge the higher-ups that a more robust security plan helps to foster a sense of trust in customers (maybe they'll buy that). However, I do not feel that it is solely the fault of IT departments for security breaches. To paraphrase Drew McDermott: Artificial Intelligence is no match for Natural Stupidity.

Re:Securely Stupid

[Anonymous Coward]

This raises an important point concerning why the article is a bit of scaremongering. Security isn't just the responsibility of The Security Department. After all, you driving the speed limit isn't just the responsbility of the police, is it?

Further, security should never be absolute: it should always be a balancing act between risk and controls. If it wasn't then we would just turn off the Internet and everything would be fixed.

I work for a global company with very good security which has so many third parties on our network that even our competitors have IDs in our Active Directory domain. Its because of all the joint ventures we execute with them and the situation reflects our business deciding that we can use alternative controls to achieve the risk level they want.

I blame the companies and management

[denjin]

I work in an industry that should take security more seriously...

However, we didn't even get any MONEY last year from the budget, and this year I imagine it gets axed as well. No matter how hard we try, things stay in reactive mode. Yes, I suppose it is good that we've done our job well enough to stave off any disaster, but given the pittance we get budget-wise, I doubt this continues forever.

I also doubt I'm alone. We have little to no upper management support, and jobs that should be in security like some VPN, web filtering, malware softare, etc. are in other groups.

It's a bit hard to do your job when people think security doesn't deserve any support, right?

Re:I blame the companies and management

[Maximum Prophet]

Unfortunatly, a hero isn't a guy who designs a building so it doesn't catch fire, a hero is the fireman who goes into the burning building to save the dozen infants in the nursery.

This will never change, because the burning building is a rarity, and there are laws to keep you from having 12 unsupervised infants in the same room, thus when it happens, it's news. The millions of buildings that don't burn down aren't news.

If you want real change in the industry, do like the Japanese, and make the CIO get a big reward every year there isn't a breakin, and if there is, the CIO should be forced to commit seppuku. http://www.win.net/ratsnest/archive-articles21/fog 0000000384.html

Now, *that* would improve information security.

Coincidence?

[LaughingCoder]

So I go to read the article, and I notice my browser window title bar reads:

Security Absurdity.com > Security Absurdity; The Complete, Unquestionable, And Total Failure of - Microsoft Internet Explorer"

Now was this an accident or did the authors deliberately lengthen their article title to make this happen?

Shrinkage is inevitable

[Maximum Prophet]

What many computer professionals don't realize is that a certain amount of loss due to crime is inevitable at any medium to large business. Stores like Walmart and Target have huge "shrinkage" problems, many times due to the employees themselves. Banks are constantly the victim of their own people all the way up to the VP level. Because of this, businesses are forced to make the calculation about how much security will save, vs. how much will be lost due to crime. If you want Military level security, you can buy it, but even the Military has had to deal with stolen information.

The trick is getting a better crystal ball and figuring out how much a breakin will cost. Since the IT people often can't properly predetermine the cost of normal projects, predicting the cost of a hypothetical crime will be less acurate than predicting the weather. Perhaps instututes like SANS could put dollar number formulas on each threat type. Even though the formulas would require too many assumptions to be accurate to us, management types could plug in what they think and have the OMG moment w.r.t. security or lack thereof.

Re:Shrinkage is inevitable

[SeeMyNuts!]

I think the main difference, lately, is scale. Some of the data "misplacements" at the companies listed above resulted in millions of records of data going to mysterious places. That represents a very large percentage of our population. It is nearly guaranteed that every one of us knows someone whose data was not contained, whether they know about it or not. Sort of like nearly everyone carries Toxoplasmosis, but doesn't know it.

It bothers me that if I have an insurance policy with company A, who outsources customer service to company B, who outsources data services with company C, and, if company B or C have "shrinkage", would I ever learn about it?

Re:Shrinkage is inevitable

[happyemoticon]

Yep. Plain old cost-benefit analysis. If the cost of preventing the mess is greater than the cost of cleaning it up (recalling products, fixing security, etc), you don't prevent the mess.

The flaw in this equation is that a lot of companies consider the potential harm to themselves, rather than the potential harm to their customers. It is here that they should be held liable. If the law required the offending parties to pay damages to the tune of every red cent stolen, and do the grunt work in restoring their credit rating and clearing their good name, I bet a lot more banks and information brokers would be following good security practices.

Re:Shrinkage is inevitable

[Bacon Bits]

Hey, as long as the CEO is willing to stake his SOX compliance on it. But don't come crying to me when he gets sent to PMITA prision for letting your financial information get mucked about with by some fifteen-year-old in Idaho.

You don't expect a carpenter to build a house with just a hammer. Don't expect me to protect your data with just a router and a tape backup.

salary?

[Tom]

Security professionals are enjoying a surge in business and growing salaries

Uh? Since when? Security has been undervalued for years and there are two main reasons why the security of almost every company is shoddy at best: a) not enough budget and b) the human factor (i.e. invent a foolproof system and the world will invent a better fool).

Information Security is impossible

[Anonymous Coward]

Information Risk Managers didn't fail; their profession matured to the point that they realized that there is no such thing as "Security" and attempting to secure information from all commers is doomed to failure. The goal of our profession is "Risk Management" which involves:

Identifying what is at risk.
Identifying the threats to the assets.
Assisting the business assign value to those assets. (Yes the business and not the Security prof. is end decider on value)
Analizing the risk to those assets from identified threats
Assitsting the business in a risk assessment.

Information Risks are just that Risks. Business have been making decisions around business risks for ages and the successful ones stay in business. Nothing new here move along move along.

If you still think you can provide "Security" then you are indeed a failure; however, with some new training and a slight ego reduction you can start over as a Information Risk Manager.

Re:Information Security is impossible

[texaport]

Equate business laptops with company-provided vehicles.

People hardly change their own oil in personal cars, so don't expect them to get under the hood of yours.
You're lucky if they take 10 minutes every three months to have Kwik-E-Loob charge it to your Amex card.
No way can you expect them to watch the odometer and change it every 3000 miles.

People hardly rotate their own tires in personal cars, so don't expect them to fix a flat on a fleet vehicle.
It doesn't take 10 minutes, but you're lucky if they don't drive on it thirty miles and damage the wheel.
No way can you expect them to regularly monitor tire pressure and to steer clear of obvious road hazards.

There isn't much point in equipping a tachometer, oil pressure readout, or even a basic temperature gage.
Not when there are people who keep driving with idiot lights on until steam escapes from the radiator.
Just hope they don't have the radio blaring too loud as they drive 70mph with high revs in second gear.

Why care for a disposable $1500 work computer if they don't care about their own $15,000 disposable car?

Failure of security professionals?

[frankencat]

As an IT professional and someone responsible for systems all over the US I must emphatically say - BULLHONKERS.

The elephant in the room

[stinky wizzleteats]

If you ask a building design engineer to tell you the most important part of a building, they'll say the foundation. If you ask a historian to tell you the most important part of the U.S. government, they'll say the Constitution. Aircraft - airframe. Car - chassis. And so on.

When you build anything, you make certain fundamental underlying decisions that affect how the rest of the system works - forever. If something is fundamentally broken about any of these core decisions, the structure will be irreparably and irrecoverably broken. It is universally understood that you can't really fix a building with a flawed foundation or a ship with a broken keel. If those parts aren't right, nothing else matters.

In the 1990s, the world decided to base virtually all computer systems upon an operating system designed by Microsoft. Systems were changing radically over the span of months. Millions of dollars in computer investment could be rendered completely useless if the computer world changed direction. The panic led to sort of a terrified groupthink - we had to make sure we were on the garden path to computer goodness as soon as possible. We didn't choose Microsoft because it was better, or because it was secure, but because in 1992, it looked like the only thing that would work. Now, in 2006, we know (as will be attested by the numerous Microsoft astroturfers who will undoubtedly respond to this posting) that you really can use any operating system to get the job done. The fear of total obsolescence has turned out to be unfounded. We had more of a choice in 1992 than we really thought.

The question is not whether or not we made the right choice. It is rather how far the fragments of the ship have to sink before we decide to abandon it. How much of the building has to collapse before we evacuate it? How many wheels have to fall off of the car before we pull over and call for a tow truck? The thing we most feared back in the 90s - total system failure for making the wrong crucial underlying choices, is happening every single day. When will we wake up and respond accordingly?

Re:The elephant in the room

[Anonymous Coward]

Now, in 2006, we know (as will be attested by the numerous Microsoft astroturfers who will undoubtedly respond to this posting) that you really can use any operating system to get the job done. The fear of total obsolescence has turned out to be unfounded. We had more of a choice in 1992 than we really thought.

While your rambling may have some merit, what in the world does it have to do with information security? If you mean to imply that other operating systems besides Windows are even close to being secure, then you are seriously delusional. And I am far from a Microsoft fan boy. When given the choice, I run Linux, but I'm not so blinded by rhetoric that I can't recognize the fact that the Linux security model is decades-old garbage sprinkled with pathetic hacks on top of that garbage to try to make it more secure.

Do as I say not as I do

[Anonymous Coward]

From TFA:

Security is a full time job which requires hiring skillful and dedicated security professionals and purchasing a deluge of costly technology systems and devices.

If only the management and "IT" dept at my place of work could be convinced of this fact. A security professional, with a useful budget could have a field day in finding issues here - hell, I could show them a few myself.

Despite having been told that various passwords are insecure, said passwords still haven't been changed "because it is easier". This is even the case where such passwords do not even conform to their OWN password and computer security documentation. Or where the method of implementation is poor - not enabling shadow passwording, having max significant characters of 8 on a linux box, using telnet for logins oven the LAN rather than ssh, lack of coherent security policy for laptops until about last year, etc, etc.

You can lead a horse (yourself) to water, but you cannot make them (yourself) drink.

sigh troll story

[Anonymous Coward]

since when is this news, this is repeating what weve already known since windows 95.....

Comprimising security

[ZonkerWilliam]

Often information security is a comprimise, we try to secure a company as much as they will allow. I've found that politics is a major factor and very few of a companies employee's like to be reigned in. Add to the fact that many software applications can't be locked down very much or they will cease to function, and you have a comprimised security. It's balancing game, try to secure as much as possible, within the limits a company sets for you. Besides, as we all know, there is no perfect security system/method, if a hacker wants to get in bad enough, he will find away. We just try and make it as hard as possible.

The real problem...

[bingbong]

It is all too easy to point the finger. The 'vulnerabilities' listed are in fact many tiered and go back to the founding of the 'internet.'

It is affected by all the layers of the 'net

Transport:

Remember that the net was designed to be an alternate method of communication for the US Defense Dept in the event of a nuclear conflict. This means it was designed with the (then quite valid) assumption that all those connected were 'trusted' as it was an entirely closed system.

OS Architecture:

Consider that the number one (in terms of number of users) OS company didn't consider security as part of their OS architecture until their 2000 release. Even then it was limited by the 'need' for backwards compabitility with previous systems.

Application Code:

Ever notice that the SDLC doesn't have any security concepts as part of it? While there are now methodologies (such as CLASP) that help introduce security into the dev process, we still have a culture that is blissfully uninterested in security. A lot of developers have no idea what race conditions, overflows are - much less how to prevent their occurance.

Management Layer:

Product managers only care about getting something 'shippable' out the door by their magical ship date. Bugs and such can be fixed 'later.' Most suits only started caring about security (other than as a marketing tool) when their firms started getting slammed in the mainstream media and it started to affect the value of their stock options.

End users: While we absolutely have to have pity for grandma who just bought her new computer, somehow people shut their brains down when they get infront of the monitor. If someone walked up to you in the street and said 'hey - give me your bank account information so i can wire you some money from my country and you get to keep some' they would call the police. But when it's in an email...

Media: The media has had some good benefits in terms of making security an issue, but they are also good at causing the management teams to focus their energies on the wrong problems. Remember a few years back when the DDoD attacks started happening? the news reported that the big content providers were getting hammered. The real story at the time was the botnet that launched the attack. Botnets are in the media now - but a couple years too late.

Basically there is no one person or group to blame. The entire system is fundamentally flawed on all the levels, and the results are cummulative.

Security Personel suck

[KlomDark]

Just about every one of them are clueless arrogant blowhards, with no understanding of the world around them. Sitting around staring at BugTraq each day and then going into an apoplectic frenzy when a new issue shows up.

"Here here here here here!!! There's a new threat! We have to put this untested patch on our servers immediately!!!"

"Uh, this patch is for Windows. Our servers are running Linux."

"Linux can run Windows apps through em-em-emulation. We have to patch it!"

"Yes, that's true, you can install an emulator on Linux and run Windows apps. However, these are production servers and we AREN'T RUNNING any Windows apps."

Next thing you know, you're spending the rest of the afternoon installing Wine or VMware, just so you can apply the patch. Fucking 'security' guys. All lame ass grabbers. "Oh crap, make sure you hold onto your butthole. Otherwise it's possible you might shit your pants unexpectedly. I saw it on BugTraq."

Pass the buck...

[Anonymous Coward]

Anything that is beyond a certain level of complexity is very likely to be insecure, in my opinion. Most human beings are not smart enough to violate the KISS principle regularly and get away with it, but programmers tend to think they are infallible. Building one's code on top of someone else's more complex code doesn't really help in terms of security, as you have to either blindly trust the simplified abstractions of the more complex code or so thoroughly know it that it might as well be your own. Please stop making frameworks which make it "easy" to make complex and insecure and SLOW systems. You are saving in development costs at the programmer level, but everyone ELSE is paying for that 100-fold. Computers are tens of thousands more times more powerful than when I started using them, but "professional" programmers have reduced the potential increase in utility to a factor of maybe a hundred, due to lost productivity. Thanks programmers, great job there. As a final fitting ending to the article, the comment system on that site does not work.

Hey, do you know why some programmers now want to use web based applications? Because java simply isn't slow enough to overcome recent hardware performance increases. Damn I hate you.

Failure of Security

[SPonYou]

The fault lies on many fronts for the failure of information security, and all of the other disciplines of security. In the past the security profession had a limited scope. The industrial park security guard was the American stereotype for the profession. Since, the security profession has become more specialized. The multiple disciplines like information, personnel, industrial, education and training, intelligence, and system security engineering are only a few examples of the specialization. With the specialization, more training and education is required to fill these more technical positions. So where does security start to fail. From my experience I have seen all of the specialized security positions create single point failures. What this means is only one person can do this function and when they are away TDY, vacation, or home sick, the position becomes a single point failure because there is no reach back. With limited personnel due to doing more with less, and the one position one person mentality, the failure of security becomes apparent. This also impacts the ability for security managers to discipline the only person they have doing the job, because the risk of losing the employee and the time replacing them could outweigh the benefit of losing them. It also creates time impacts and inhibits security professional the ability to conduct reviews of there contractors, and their own processes to ensure compliance. This leads the contractors to complacency. It impacts the ability to allow security professionals to receive training on new culture changes and stay current with the latest policies and directives. The truth is management needs to step back and realize that doing more with less is really doing less with less and creates failure.

TFA should read TFA he quotes

[enbody]

TFA says "AvanteGarde deployed half a dozen systems...average time until successful compromise was four minutes." If you read the AvanteGarge article you find that the systems with a firewall either ZoneAlarm or SP-2 were not compromised (neither were the Linux or Mac machines). He totally missrepresents the article. While he has some valid points he starts out his article like a troll.

strike me down . . .

[Maradine]

Speaking as an Information Security Professional:

If more IS professionals spent their time actively understanding their clients' business drivers and protecting their interests, rather than submitting links to Slashdot for their Google Ads-linked blogs, mayhaps we'd be in a slightly better position.

We don't need more Steve Gibsons. My two incendiary cents.

M

Errare humanum est.

[abb3w]

A response to that sort of ignorant mentality is Yes, Sure, No problem, I just need you to send me a memo resolving me of an internal and external legal action and contractual reasonability I have when corporate information IS lost or maliciously changed.

You may need to first draft a memo, spelling out the potential security consequences you anticipate, and insist that the boss provide a responding memo that specifically lists them, states that he has considered them, and that you are completely absolved of internal and external responsibility for any of the consequences. If you get one in response, be sure to forward a "file copy" to the company's legal department (which may result in a panicky highest-level countermanding order), and keep a personal copy off-site in the file with your copy of your employment agreements and NDA. (You do have such a file, right?) If your company has an internal audit department that handles security audits, forwarding a copy of it in their direction may also generate abrupt entertaining activity.

More troublesome is if a problem happens later, and although you are not held responsible (having sensibly covered your ass beforehand as above), you're told to "cover it up". If your company has an omsbudsman, a rapid visit is in order; otherwise, lawyer up and find a new job... fast.

Only Part 1

[zenray]

I'm waiting for part 2. I assume that will be the recommedations to "fix" the security mess we are in. We should see some good anti-MicroSoft bashing then.

standard certifying authority

[chrisranjana.com]

What with more and more banks in India becoming online, some are truly online i.e you can do whatever you want as thought you are present physically at their branch. Security needs to be given prime importance

1) All ecommerce websites created should be certified by a TESTING authority before they are allowed to go online

2) Even after certifying The TESTING authority should carry random unannounced remote tests once every 3 months

Information Society

[SixArmedJesus]

I first read the headline as "The Failure of Information Society", and I thought to myself, "Nah, they didn't do too badly. You still hear one of their songs once in a while." *doing*

EGBT

[abb3w]

I don't know what it is that those magical boxes emit, but it must be akin to the stupidity ray used in Zak McCracken. Lucas got it wrong there, it's not transmitted through the phone line, it comes out of your computer screen.

According to my contact in R&D at Evil Geniuses for a Better Tomorrow, the ray also works quite well over CAT-5 ethernet, due to the similarity to phone wire. Adapting it to run over 802.11a/b/g/pre-n wireless took more work.

Noam Eppel is a Genius... at marketing.

[Watchman_ds]

Congratulations, Noam, you did it! You registered a domain for the purposes of posting a little rant to indict the entire Security Profession. Then you got Slashdotted. Bravo.

Good thing you included a link to your consulting services in the article byline. Otherwise, people wouldn't know where to go to hire such an insightful luminary. You were also smart enough to make your article inflammatory against the entire security profession, just to drive readership. Again, well done.

The truth is, this could have been a half-decent article that I might share with my C-level folks if it weren't so full of accusations against security professionals. In fact, it would have made a half-decent rant if it weren't so full of inconsistencies and half-truths. What we are left with is drivel, and marketing-driven drivel at that. At least have the courage to post it on your site or your company's site so people can identify it for what it is.

After reading your article, you were so successful in getting me enraged that I had to know, "Who is this jerk, Noem Eppel?" I did a little research.

Are you the same Noem Eppel who said:

The onus should be on the software and security industry - those that are responsible for designing the products - to make software which is not only safe to use by default, but easy to secure.

  In 2004?

But today says:

We as security professional [sic] are drastically failing ourselves, our community and the people we are meant to protect.

Who next will you point your finger at?

I think we can all agree that the state of security is bad, but your insinuation that security professionals are some kind of slackers, content with their own failure because there are "enjoying a surge in business and growing salaries" is disgusting. If you want to indict the character of a profession, you'd better have stronger ground than that to stand on. If you said the same thing about doctors being slackers who are content with their failure because diseases are on the rise, you would be mocked and scorned.

Do you know what gave you away, Mr. Eppel? The constant barrage of unrelated statistics loosely stitched together to reinforce your 'expertise'. Having a day job myself, I don't have time to refute your editorial line by line, so here's my favorite from your article:

In some cases, even our best recommended security practices are failing.

In a recent experiment, AvanteGarde deployed half a dozen systems in honeypot style, using default security settings. It then analyzed the machines' performance by tallying the attacks, counting the number of compromises, and timing how long it took an attack to successfully hijack a computer once it was connected to the Internet. The average time until a successful compromise was just four minutes!

Which information security professional thinks that "our best recommended security practices" includes deploying systems "using default security settings".

Of course, we are assuming that you are an information security professional. I think it telling that you post no CV, no credentials, not even an email address to offer up your authority to speak on the subject. You use the pronoun, "we", to claim your place among the accused, but offer no evidence, convincing or otherwise, as to why you should be considered a peer among the noble practitioners of this worthy vocation.

Mr. Eppel, you have done what no other journalist, blogger, cyber-idiot, or troll has managed to do. You have insulted my profession and me beyond excuse. I've never felt the need to respond to anything as strongly as your piece of drivel.

I'm posting this reply to Slashdot rather than your site, because I don't believe you have earned the traffic your article has already generated. Although I may be modded down, I would gladly give every bit of karma I have to see this garbage ripped from the web and you forced to apologize publicly for your outrageous remarks.

Go read COBIT or something and leave those of us who are trying to make things better alone.

Warmonger. Troll. Charlatan.

Re:THE FUTURE OF TROUTS!

[Wikipedia]

Give a hoot! Care about IT!

nitpicker's paradise

[Dg93]

From TFA: . It was able to perform 256 DES operations in 56 hours.

Wow. 256 operations in 56 hours - that's what 4.57 operations per hour, give or take?

Security is about MANAGING risk

[Anonymous Coward]

Contrary to what people think, security is about managing risk--not getting rid of it in its entirity.

Have you tried to get a CEO to use a secure password even while running libcrack? Good luck. They will tell you that you work for them, and you have to do what they want.

So you always have at least one user who is an exception to the rule and considers what they do to be an ACCEPTABLE risk.

Social Networking / Security

[lon3st4r]

Most security breaches happen because of social networking "hacks".

I got a call from "citibank" the other day on my office phone. They said they have a pretty good offer to give me and went ahead and gave me a fantastic offer. Then they asked me my full name (ahem!). And then they asked some more details (innocuous ones) until finally they asked my credit card number. That's exactly when I hung up. I know people who would happily give out this information without even realising what's happening!

There are also instances of people being asked to fill up some forms with ask too many personal details, and I have seriously wondered - "what if this falls in the wrong hands".. they could use that info to break open *most* passwords to my mail and other internet accounts.

Infact my Manhattan card account personnel only asks for my name, address and telephone number for verification! Jesus!

So my question is, that if somebody does a security breach via social networking; how is it that "information security" has failed?

Botnets grow ever larger, numerous

[JimmytheGeek]

I don't have any stats for DDoS attacks, but the evidence suggests that recruitment of bots has not diminished. Tens of thousands of bots for a low skilled bot herder is common. Hundred K botherds exist.

One vector for bot recruitment is browser exploits. An astonishingly high proportion of websites host hostile pages - by design or through being compromised themselves.

When will things will change

[Arandir]

I'm wondering what it will take, how much the loss will have to be, before companies start wising up to security. Maybe a multi-billion dollar class action suit against the credit card company that let their CEO carry home everyone's account on his laptop. Nah, not even then. Companies will continue their bonehead insecurity practices until the day civilization collapses to pre-1969 levels.

Those who do not study history...

[abb3w]

Remember that the net was designed to be an alternate method of communication for the US Defense Dept in the event of a nuclear conflict.

No, it wasn't. There are many scholarly books that detail the complicated conditions that brought about the Internet; I suggest you find and read a few. While intertwined with the cold war, and the product of research into how such resiliant communication might be possible, that wasn't the intent of the effort that began ARPAnet and the Internet. Hafner's "Where Wizards Stay Up Late: The Origins Of The Internet" is lay-readable and on my bookshelf, but there are others.

The claim that the Internet could survive a nuclear strike has been refuted several times. In theory, the construction of the internet could be expanded to withstand a nuclear strike; in practice, there are currently too many single points of failure in routing and operation located too close to prominent nuclear targets. It probably wouldn't die outright (many small LANs might still work, assuming they survive the initial EMP, especially where a paranoid Sysadmin still maintains an /etc/hosts file), but I doubt you'd have any nodes able to connect to more than 25% of the surviving machines... if that.

The initial nodes were "trusted", but not because they were secure military machines. Most of the earliest (pre-1970) network sites were universities.

As for your claims about the media greatly understates the depth of their cluelessness. The last mass media piece about computing that got it right was "SPACEWAR : Fanatic Life and Symbolic Death Among the Computer Bums," published by Rolling Stone in 1972. I've seen nothing with comparable understanding published in national newspapers, magazines, or broadcast (TV/Radio) that's gotten the details so consistently right since.

Take the kid gloves off.

[GregNorc]

Personally, I think the best way for a company to deal with user stupidity is twofold. First, give a class that teaches basics such as password security, how to use a virus/spyware scanner, polite email etiquitte. Have it catered, pay for their time. Then at the end, pass out printed material that matches what was covered, and announce anyone who causes a loss of productivity due to not following the guidlines of the acceptable use policy will be warned once, then fired. I have a pet theory. I call it the "Shit Smeared Stall Effect". No one would smear their home bathroom with feces. They have to [i]live[/i] there after all. But a public restroom will probably be used only once per day. If you defile it, it won't effect you since the cleaning crew comes in that night and pretties it up. These people don't care about their work computers. What's the worst that can happen? IT takes their comp off to be re-imaged, and they sit and twiddle their thumbs for a while? That's hardly a deterrent.

Other methods of logging on

[Anonymous Coward]

Im fairly new in the world of IT. How do eye scanners or fingerprint scanners fare?

Other forms of Authentification

[junir]

Im fairly new in the world of IT. How do eye scanners or fingerprint scanners fare? Will diversity not solve alot of these problems? At least to a certain extent. And if Linux was used it would also save a hell of alot of money... \forgive me im not an expert but isn't it possible to secure linux much more than say Windows. Why isn't Linux being presented as a business case by these CIOs?

It has to be fixed in the OS (i.e. Windows)

[MrMrBen]

I agree with other comments that it's ridiculous to blame "security professionals". By the way, who are security professionals? Aren't they the people who have to try to make existing software secure? He's not talking about software developers, he's talking about IT staff. The reason there's no security is that the OS everyone uses doesn't provide much. He mentions that if you buy a brand new computer off the shelf and plug it in to the Internet, it will immediately get hacked. That's not the "security professional's" fault, that's Microsoft's fault. The fundamental problem is that the software that underlies the entire infrastructure wasn't designed with security in mind. The security professionals can work as hard as they want and they're never going to fix the problem. The solution is to fix the infrastructure, which means replacing Windows with something built with security in mind. Windows is too big and complicated to just tack security on somehow. The various products (Mcafee, etc.) that try to filter everything Windows does are too intrusive and cumbersome and half the time when Microsoft tries to fix the OS itself they break something.