Slashdot Mirror
Antivirus Inventor Says Security Pros Are Wasting Time
talkinsecurity writes "Earlier this week Peter Tippett, chief scientist at the ICSA and the inventor of the progam that became Norton Antivirus, had some interesting things to say about the state of the security industry. In a nutshell, Tippett warned that about a third of the work that security departments do today is a waste of time. Tippett goes on to systematically blow holes in a lot of security's current best practices, including vulnerability research/patching, strong passwords, and the product evaluation process. 'If a hacker breaks into the password files of a corporation with 10,000 machines, he only needs to guess one password to penetrate the network, Tippett notes. "In that case, the long passwords might mean that he can only crack 2,000 of the passwords instead of 5,000," he said. "But what did you really gain by implementing them? He only needed one."' Some of his arguments are definitely debatable, but there is a lot of truth to what he's saying as well."
Software / Hardware security is not too difficult to achieve. If an admin is truly competent they will have no problem getting their lab workstations up and running cleanly and bug free with pretty solid security.
The issue is usually the idiot that becomes the victim of a well done social hack.
As usual, the company is only as strong as it's weakest link.
I "gained" 3,000 passwords that the hacker won't get. So we should all have short passwords, huh? Since there's obviously no point.
Why would the hacker need to guess one password from a list of password hashes when he already broke in and was able to elevate his rights to read the password hashes file? He might was well add his own password entry.
That story has more car analogies than an average /. thread.
I've had enough of the Security Vendors and their rhetoric. I'm constantly bombarded with requests to attend sales presentations on the latest intrusion detection pizza box appliance, or spam firewall thingy, etc. The value of these products are only so that the execs can point to their "security initiatives" and "best practices" when a breach of security is discovered. If they look like they've made an effort to curtail the risk, then they still get their big bonus.
Dominant Meme
Why does my company have a list of passwords again? We need to get out of the thought that each individual device needs a password, and get to the point where passwords are part of an account a user has. Then we don't need to keep a list, we just need to enforce security on the directory storing passwords.
Tim
See... and you thought your sig was boring - TT
No. If you mandate long passwords on the server, there are no short passwords. That's sort of the point.
But then, I read on in the article (yeah, I know, it's
Now, don't get me wrong, *any* protection is obviously better than none, but this is basically a surrender - instead of selling the common (wrong, but common) "I have an up-to-date anti-virus package, I am protected" perception, they're now moving towards "Hey, we did the best we could; all those *old* virus's/virii(+) are *definitely not getting through". Woo Hoo.
So perhaps I'm being overly cynical, but it seems to me like a corporate piece with quotable sound-bites (so it gets wide distribution) that tries to deliver the message "hey, we suck, but keep on buying our software", in a more acceptable-to-the-people manner...
Simon
(+) And with this, I hope to equally annoy the grammar and spelling nazis out there. [insert random deity] those people piss me off.
Physicists get Hadrons!
About 3/4 of the work done by the average corporate department is useless. Congrats on the efficency, security people.
Wow,
10 years ago he was saying exactly the same thing. It's still relevant, but nobody has been listening.
Tippett is right on with this, and I'd venture we could go further. Think of how much money is wasted on redundant security and the people to operate it, now add to that all the time and productivity wasted b/c rank and file employees have to navigate under such redundant incumberments.
I honestly feel like 9/11 and it's aftermath has *something* to do with how several sectors of our country are tripping over themselves to implement unnecessary, bloated, counterproductive measures in the name of 'security'.
Existence is insecurity. The only way for something to be 100% secure is for it not to exist.
Thank you Dave Raggett
is stupid because somebody can just kick in a window
except it isn't stupid. if someone is determined enough, they will break into my house, no doubt. most of the security features on my house are meant to deter those with a casual interest
same with all of the efforts that tippett pokes holes in. well yeah, duh: every single security effort in the world is surmountable. what's the value in pointing that out? none
that someone can get over your security measures with effort is not an argument against the lowest level of security. the lowest level security practices always has value: against casual transgressions
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
dont even bother reading tfa..
No one is trying to create an Iron Curtain. Security departments (most of them hopefully) are taking numerous measures to prevent breaches. Including access controls preventing one compromised computer from getting all the marbles via role-based or well-configured discretionary access controls, appropriate traffic filtering and intrusion detection techs.
Risk management is the specific practice of minimizing the greatest risks (what will do the most harm and will be the most likely to happen). And for the most part everyone realizes that no risk can be completely eliminated, so we mitigate them as best we can and rely on fundamentally sound access controls et. al. to limit the effect of any breach and hopefully know about and plan for unforeseen circumstances by planning for certain categories of attacks.
Hopefully I'm right, because if I'm not... I'm scared.
The 2000 vs 5000 password problem is not really clear to me. Anyone can explain better ? And I partially agree on the other things he said, basically inbound and outbound default DROP/DENY and investing on teaching to workers rather than spending money on antivirus software only ..but does that mean he is out of antivirus business ? Why would HE suggest that ?
a small poem (haiku style), it is difficult to type correctly because of intentional typos and a few numbers substituting for letters, i even get it wrong myself about 1/3 of the time even though i know it by heart...
Politics is Treachery, Religion is Brainwashing
2) You're only as secure as your weakest password. We knew that.
3) This guy shouldn't talk about seatbelts.
.. paranoid crackpot leftover from the days of Amiga.
"Security teams need to rethink the way they spend their time, focusing on efforts that could potentially pay higher security dividends, Tippett suggested. "For example, only 8 percent of companies have enabled their routers to do 'default deny' on inbound traffic," he said. "Even fewer do it on outbound traffic. That's an example of a simple effort that could pay high dividends if more companies took the time to do it."
This is on every Pix ever made. What is the point of any firewall if it does not block all then let some through.
I agree that education is probably the best security practice! There does not exsist a product that can secure stupid.
However you MUST have AV/long passwords/IDs/IPS and a host of other things to create layers and let you know what is going on in your network. If you just throw your hands up you are not doing your job!
One of the silliest things I've seen in my IT career was an old memo regarding some employees' desire to upgrade their Macs to OS X 10.2 (from OS 9.x). One of the notable objections was along the lines that "OS X is very new and we don't have Symantec AV for it, so computers running OS X would be at-risk".
Nevermind how pointless an AV program is on a *nix platform to begin with, I'm a bit horrified at the false sense of security that having an AV program installed on a Macintosh provides as well. Sure, there have been some recent exploits found, but most of them still rely on the end user making exceptionally poor choices and being tricked into granting escalated privileges to malware. If anything, the fallacious impression of being somehow "protected" could encourage users to make even more risky choices.
And yes, FWIW, the memo was produced by MCSEs...
Seems I wasted my time reading this article. Lots of hyperbole and zero information.
It is funny how these analogies are totally flawed..
"If I sat up in a window of a building, I might find that I could shoot an arrow through the sunroof of a Ford and kill the driver,"
And if I put a bomb in the basement of your IT company, I could destroy all your data. This is critical.
"But automobile seatbelts only prevent fatalities about 50 percent of the time. Are they worthless? Security products don't have to be perfect to be helpful in your defense."
If automakers could build seatbelts with 100% efficiency, they would. And they improved seatbelts by putting airbags.
"If we made seatbelts out of titanium instead of nylon, they'd be a lot stronger. But there's no evidence to suggest that they'd really help improve passenger safety."
They would be stronger, and raise the fatalities number. Seatbelts are voluntarily made distortable so they can help diffusing kinetic energy.
I gave up with the idea of an useful sig...
Sort of reminds me of Bruce Potter's "8 Dirty Little Secrets of Information Security." The premise of that talk was pretty much that anti-virus, firewalls, IDS, etc., were all just band-aids that masked the real problem: We write (and buy) crappy products. He even showed an extensive quote regarding current threats and the inadequacy of counter-measures, and after everyone in the audience had finished nodding their heads, revealed it was from 1972.
:)
We've been fighting the same problem, in the same way, for 35 years. It's time we regrouped and found a better way to attack it.
Here is a copy of the DefCon version of the speech (I think he's given it a few different places, so there are subtly different versions out there). I'm sure the video is floating out there somewhere, too (though I couldn't find it on YouTube). He's fun to watch.
There may be something of value here.. it's really hard to say as the article author chose to take a bunch of analogies out of context, and give few details. Essentially this article is useless. The only thing I got out of it is "we're focusing on the wrong things in security, for example passwords and viruses." That's probably true, but it sure doesn't tell me much.
AccountKiller
But he's confusing ATTACKING a specific company with INFECTING various machines.
They are not the same. The defenses are not the same. There may be overlap (a workstation at a company gets infected and sends out spam vs a workstation at a company gets cracked and is used to crack other boxes at that company) but that is all.
All in all, he's 100% backwards on his comments. Just what you'd expect from someone trying to push a specific product from a specific company.
Okay, so long passwords don't work - why make a cracker have to work to get that one password out of 5000 that lets him in? Go ahead, use your last name and birthday for a password or your puppy's name.
Open sun-roof's on cars are not protected because there's not an archery community out there bent on slinging an arrow thru every sunroof they see. However, there are many very sophisticated organizations and individuals out there that take great glee at finding and exploiting software flaws. We lock our doors to keep intruders out because there are intruders that may want in. We leave our sunroof's open when we drive because, well, no one is firing arrows thru them. Just wait until this speech of his inspires and creates an anti-sunroof arrow-shooting community and suddenly sunroof-hair will cease to be in short order...
His criticism of the tossing of buggy security software, comparing it to seatbelts that only save most lives but not all, illuminates his desire for us to all come back to Norton, even tho it is abysmally flawed and often is the root cause of many of the problems I've had to repair.
He says "studies" have shown that giving time to keeping your system patched and updated doesn't correlate to higher security - however omits any references to those "studies".
Ironically, his last paragraph illuminates EXACTLY why we SHOULD pay attention to fixing flaws and proper passwords and whatnot. It's not about 100% bulletproof security, which is impossible unless you leave your Microsoft servers turned off, but about not making it easy for intruders in the first place. He's acting like we need to toss bug-fixes and smart password policies altogether, and yet he recommends routers to deny inbound traffic. Er... what if those same routers have, say... an exploitable flaw???? Cough. His argument is scattered and poorly made and without any legitimate basis. Security covers a wide range of topics from ensuring your secretary doesn't brainlessly give out passwords to crackers-posing-as-techs to ensuring that your software is up to date, ensuring your firewalls are set correctly, routers are updated and secure, passwords are not easy-to-guess abominations, and your employee's don't run every executable that comes thru their inbox.
Oh - and it means that you most certainly run, not walk, but run screaming wildly away from anything Norton.
After all, while there's only the most remote chance that we'll get in an accident, we still put on our seat-belts every time we drive.
"Peter Tippett, chief scientist at the ICSA and the inventor of the progam that became Norton Antivirus"
I'd be more prone to listen to security practices from the guy who...say...invented cheese string...
What Tippett is saying is already well known by security professionals (at least the ones who know what they are doing...risk analysis is part of the CISSP exam, is it not?). The problem is that despite this, we are forced to do expensive and less useful (useful at all?) stuff by management because they are the "decider". Companies that actually have a CISO with competent staff have a decent chance at doing it right, but in my experience, many companies don't, so you end up deploying stuff just because management likes to deploy new 'security systems' rather than actually address the security posture of the company.
http://www.schneier.com/paper-attacktrees-ddj-ft.html
Bruce also wrote about "attack trees". Having long passwords ONLY helps if the attacker has unlimited access to crack them. A simple WordNumberWord combination can give you enough security as long as each login attempt is noted and tracked.
If there is a 15 minute delay between every 3 attempts to login, and a HUMAN reviews the logs every work day, your online security should be sufficient.
You only need the 1024bit security when the attacker can download the file and crack it at his leisure. But then, the failure is that you did not prevent the attacker from downloading that file.
There will ALWAYS be some risk. What's to stop the attacker from kidnapping your CEO's daughter and demanding that he let the attackers use his laptop to access your databases? The key is REDUCING the threat. If 99.99% of the attackers out there are not skilled enough or motivated enough to get through your security, are you "secure"?
Hate to blow everybodies arse right off the map, but I don't use any anti-virus software at all.
I find it to be resource-hoggish, slow-loading bloatware that is better off-loaded onto a seperate processor. I say these things, because I actually know a dev lead at symantec, and I recommend this solution to him, and he said his company is already working on it.
Anyways, you're probably asking yourself, what is my IP, and how do I protect myself. I hide behind a good router, have a bit of a honeypot setup, and am very careful what I download. So, no russian pron for me.
Serious people, viruses are for suckers.
Hi, I Boris. Hear fix bear, yes?
I see it being more related to the medical field, prevention is great idea (and has been a popular topic lately), but treatment is just as important and not to be forgotten.
I think he's really suggesting that business practices slow down--for instance, sure it's a painful to have a 15 letter password, but I'm pretty sure using 1 15 letter password for all your 7 important accounts is more secure that 7, 5 letter passwords...
That is/was the most crappy "anti-virus" application I have ever used. It sucked up resources like a high-paid prostitute. It tried to take over my whole system like a wife takes over a mans life. I don't think anyone that created Norton Anti-Virus should be given a platform to stand on and talk about "security". I guess he got his payday from Norton and now can spew bunk?
Last time I checked, I couldn't go out and buy a box of "security". It is a process. Implementing different safeguards and educating users. End of story.
The problem I see with the entire "computer security" issue is that there are lucrative jobs and big money to be had, hawking it to people.
.scr files, costs you nothing but a few minutes of your time, yet can prevent all sorts of potential issues for your Windows users in a corporate setting.)
The best examples I can think of of genuinely valid and useful security practices all involve things that don't cost much, if anything. (EG. TrueCrypt 5.0 is free software, yet you can encrypt a whole notebook computer's drive with boot-time password protection with it. This adds an obvious and practical layer of security. Configuring a proxy server to disallow downloading of files with "high risk" extensions on them, such as
Yet, like you say, the people at the top of the corporate ladder, who have the most to risk from security breaches (but conversely, have the least "technical knowledge" about such situations) want to essentially "pay for scapegoats". Free, practical security solutions don't give you someone you can demote/fire, file a lawsuit against, or at least point a finger at as responsible if something does go wrong. A highly paid "security consultant" or "I.T. Security Specialist" in the firm, however, can be the "fall guy", and an expensive network appliance that's supported under a paid contract? Again, there's a place to direct blame.
I found this figure rather implausible as well. I suppose it's possible that only 8% of routers connected to the Internet deny inbound traffic by default, but I thought that was a fundamental aspect of firewall design as well. Even consumer routers are designed this way.
But if the base for the 8% figure is all routers in, say, the top 2000 companies, then I might believe it. It's not uncommon to trust all internal traffic, even though a stricter security model might be more appropriate there as well. Converting internal routers from accept to deny raises the possibility that applications will suddenly stop working. For overworked network administrators this alone probably provides a sufficient disincentive to implementing internal security. The miscreant Tippett describes in TFA who spreads out across a network after breaking a single password will have a harder time if the internal routers block his path.
I'm also not surprised to hear that "techie" stuff like vulnerability testing gets a disproportionate share of security spending while employee training gets short shrift. Code vulnerabilities have an empirical reality about them that training doesn't offer. You can fix a hole in code or install anti-virus software on all your workstations. Your chances of "fixing" employees by making them adopt better security practices is a lot more hit or miss.
Actually, he seems to be more clear thought than you.
He's saying "aim for as much security as you can get" not "aim for 100% impregnable", there is no such thing. Even Open BSD isn't impregnable, despite their claims. Nothing is impregnable to a determined and resourceful attacker.
He is correct in saying, "rather than bunkering up, strive to be indigestible to AS many potential predators and parasites as you can"... i.e. he is admitting the one fact of the universe... "there is an exception to every rule, just because you haven't found it, doesn't mean it doesn't exist somewhere else, in some form.
The arrow through the roof, for those with the intellectual openness to understand the metaphor is an unlikely incident, but if it does happen, what then. Peter is using that concept, to teach those willing to learn/understand, that for a car to be 100% impregnable, it would have to be arrow, bullet, cannon, nuclear weapon, weather and everything proof, including driver and other driver error proof, road proof, etc. However, the COSTS involved, and the final results are out of reach of even the rich, would make for a rather heavy, expensive and CLUMSY vehicle, and judging by risk, the benefits would far outweigh the costs. Its like flu shots. I travel, talk, do meetings, etc. I get sick very rarely, yet I see so many immediately taking "flu vaccines" out of fear that the flu will kill them. I've never had a relative who either died of the flu or had complications. Neither have I known anyone in my personal life who had these complications, and I have associates who have lived in first, second as well as third world scenarios.
Thus, in similar vein, driver training gives better results than building the bullet proof car. Don't surf porn with internet explorer is FAR better advice than installing the latest antispyware, and "don't accept email except in plaintext format" is far better advice than trying to balance a proper load of antivirus (which the user might not allow to update, or might become broken, etc). There have been plenty of virus samples that hijacked the latest Symantec and McAfee antivirus, why? Because they tried to be everything to everyone, and when you over extend your coverage, you end up leaving holes in your defenses.
Properly trained users is like having the original Citizen Militia, not truly powerful, but if properly trained in guerilla warfare and survival, and properly equipped, they can make ANY invading army's life, VERY difficult, to the point where the invading country finds the "host" or "prey" country to be "indigestible."
Nothing is unassailable, but plenty of plants are poisonous to their consumers, so as to make it a known thing that they are indigestible. The one size fits all solution, from antivirus, to security departments, to everything else, is STILL the same age old problem. No risk can be reduced to 0%. But it can be minimized and compensated for. This is what Peter talks about.
Its disappointing, I expected that those frequenting this board would've had the ability to apply metaphors in design. Good book for all to read. The Art of War. Get it bundled with The Prince. Good way to learn how to think.
" What luck for rulers that men do not think" - Adolf Hitler
Instead of long passwords, how about random user names. Not usernames based on their real names or on a simple sequential number. If they cannot figure out a person's user name, password cracking is pretty hard.
Help! I'm a slashdot refugee.
As I understand it, the first antivirus program ever to have existed (although not marketed as such at the time) was the UNIX rm command. This was followed by clones in other UNIXes, and in the popular DOS operating system in which it was invoked with del.
Used in conjunction with the killall command, it is a very powerful tool indeed. Beats Norton anyways.
Those using pirated Tinysoft signatures(TM) are a real threat to society and should all be thrown in jail.
This author is a moron. Antivirus is amost worthless at this point. In 5 years it will be of no use. Antivirus is good for catching old viruses that were made for the masses. Antivirus will NOT stop custom made viruses, targeted viruses, new viruses.
And on top of that, its very very easy to bypass antivirus if you know what you're doing.
I can make any virus pass through AV in with about 15 minutes of work.
In summary, the author is a moron.
If a security researcher is bummed out about how they are wasting their time, perhaps it's just because he recalls allowing the FBI to record keystrokes using his product- ie. Magic Lantern http://en.wikipedia.org/wiki/Magic_Lantern_(software)
oh, is that a hacker recording our keystrokes? nah, it's just the FBI. they would never steal our passwords. they're so cuddly.
Does this guy know the program he made created one of the worst sappers of computer processor and hard drive performance seen in the anti-virus market? http://www.thepcspy.com/read/what_really_slows_windows_down/5
"They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety" Franklin
The comparison of shooting an arrow into a Ford sunroof is interesting, but to take the thought process to conclusion, you have to think about script kiddies. In this analogy, someone has created a machine that you can mount in the window, which will keep firing arrows down into the street at random, 24hours per day. Eventually, someone IS going to get killed. That's the problem with information security - it's so easy to keep trying to break in.
Our company ordered one, and we didn't receive it within thirty minutes. So we got it for free.
Password rules have long been a specific complaint of mine. Multiple, changing, complex passwords mean that 2/3 desks here have their PWs written down on their monitor, under their KB, etc; And service accounts, some of the most powerful, are immune to the resetting requirement and, often, fail the password strength rules.
Even worse, some of the password rules are counter-productive. I know of a company that requires a specific special character be in their 8-charater passwords. Know it (easy enough to find), and it's functionally a 7-letter password.
There's a saying about exercise that I think applies to security: The best exercise is which ever one you will actually do. We are attempting ever more complex technical solutions to what is an increasingly human problem.
Make sure that your passwords can sync across all of your systems. Make passwords complex but easy to remember. Let's be honest, if 5 failed logins locks you out, and I've assigned you a password like "bluefish", how likely is that password to be hacked by an automated system? About zero. But since it's short, simple, memorable, and universal: I can train you to not write it down. I'm convinced that's better security.
As Bruce Schneier recently commented, the unfortunate reality of this world is that we not only need real security, but also the perception of security. Some of the "best practices" that we often see only provide the perception half of security.
Examples:
Forcing users to change their password regularly. The new password is never any stronger that the previous one. Usually, it's the same as the previous one, but with one digit incremented.
Fingerprint scanning. Current fingerprint technology simply doesn't provide anything more than the perception of security. Which is more difficult: brute forcing a strong password, or forming a gelatin mold from a lifted fingerprint?
I am glad someone from the security industry is talking a least some sense.
Security has become a mantra and almost a religion. I have been in the industry for many years and even worked on C1/B2 secure systems in the past.
In industry people seem to forget the cost benefit. What is the cost of an intrusion set against the cost of bringing your systems down once a month to patch them?
Obviously it can depends. However, the risk of a seriously damaging intrusion is significantly less than just an inconvenient one and even that is low with basic security policies in place. This calculation is rarely made and consideration of the negative effect on users less so.
Really tight security is extremely expensive to the business who are often shown dramtic examples of grabbing a users web sessions to basically instill a largely unrealistic fear. For a few oraganizations extreme security measures maybe profitable but for most, basic security and good firewalling is probably all that is required.
I write my passwords that I can't remember on my whiteboard - in runes.
-Clio
Karma: Bad (mostly from not giving a fuck)
Blog: http://clintjcl.wordpress.com
That's what I hate most in security guys - they are out of reality.
Because any real guy from real world with functioning brains would have said:
It's just little hint that the guy - Peter Tippett - is not with us (mere mortal users) but with the "security pros."
All hope abandon ye who enter here.
So you wouldn't be able to guess one password, but you'll have to guess a specific password for a specific user. Since you cannot get indication if the password was okay but the username isn't (and also otherwise), it's either you have both, or have only the username (incase you have the user-name, at all). I think this guy thinks it's 1993 or so.
Read and Comment at my BLOG
!!!
That is not obvious. It's even wrong.
There are several examples of protection software which actually weakened the host PC because the software added new vulnerabilities which were open for remote exploits. A quick Google search revealed these examples:
Norton Anti-virus: http://blogs.zdnet.com/threatchaos/?p=334
Clam Anti-virus: http://www.zerodayinitiative.com/advisories/ZDI-05-002.html
Kerio and Tiny Personal Firewall: http://www.derkeiler.com/pdf/Mailing-Lists/securityfocus/bugtraq/2003-05/0099.pdf
NOD32 Anti-virus: http://www.frsirt.com/english/advisories/2007/1911
Check Point Firewall-1: http://secunia.com/advisories/10794/
"In that case, the long passwords might mean that he can only crack 2,000 of the passwords instead of 5,000," he said. "But what did you really gain by implementing them? He only needed one."
Strawman argument spotted!
Long passwords are not designed to stop this attack. They are designed so that jsmith in accounting doesn't have the password "1234" or "password" so no one can guess a valid account (let's say, authenticating against some edge device like a vpn termination point) and waltz right into your network.
Then he goes on to say:
"But automobile seatbelts only prevent fatalities about 50 percent of the time. Are they worthless? Security products don't have to be perfect to be helpful in your defense."
This guy is walking contradiction. Clearly flamebait. Nothing to see here, move along.
Read Foiling the Cracker; A Survey of, and Improvements to Unix Password Security - I published it nearly 20 years ago, and people are still arguing over password security? My personal password is 15 characters long. My root password is 20 characters long. Both are trivial for me to remember, and effectively impossible to crack (they're passphrases containing upper ad lower case, numbers, punctuation and obfuscation of multiple words not found in any permutation dictionary. Users on my system are REQUIRED to have strong passwords of their own devising (so that they can remember them). What's so hard for people to understand about that? You can't have good security and be lazy.
Software / Hardware security is not too difficult to achieve. If an admin is truly competent they will have no problem getting their lab workstations up and running cleanly and bug free with pretty solid security.
The issue is usually the idiot that becomes the victim of a well done social hack.
As usual, the company is only as strong as it's weakest link.
Dumb Idea #3
#3) Penetrate and Patch
There's an old saying, "You cannot make a silk purse out of a sow's ear." It's pretty much true, unless you wind up using so much silk to patch the sow's ear that eventually the sow's ear is completely replaced with silk. Unfortunately, when buggy software is fixed it is almost always fixed through the addition of new code, rather than the removal of old bits of sow's ear.
"Penetrate and Patch" is a dumb idea best expressed in the BASIC programming language:
10 GOSUB LOOK_FOR_HOLES
20 IF HOLE_FOUND = FALSE THEN GOTO 50
30 GOSUB FIX_HOLE
40 GOTO 10
50 GOSUB CONGRATULATE_SELF
60 GOSUB GET_HACKED_EVENTUALLY_ANYWAY
70 GOTO 10
In other words, you attack your firewall/software/website/whatever from the outside, identify a flaw in it, fix the flaw, and then go back to looking. One of my programmer buddies refers to this process as "turd polishing" because, as he says, it doesn't make your code any less smelly in the long run but management might enjoy its improved, shiny, appearance in the short term. In other words, the problem with "Penetrate and Patch" is not that it makes your code/implementation/system better by design, rather it merely makes it toughened by trial and error. Richard Feynman's "Personal Observations on the Reliability of the Space Shuttle" used to be required reading for the software engineers that I hired. It contains some profound thoughts on expectation of reliability and how it is achieved in complex systems. In a nutshell its meaning to programmers is: "Unless your system was supposed to be hackable then it shouldn't be hackable."
"Penetrate and Patch" crops up all over the place, and is the primary dumb idea behind the current fad (which has been going on for about 10 years) of vulnerability disclosure and patch updates. The premise of the "vulnerability researchers" is that they are helping the community by finding holes in software and getting them fixed before the hackers find them and exploit them. The premise of the vendors is that they are doing the right thing by pushing out patches to fix the bugs before the hackers and worm-writers can act upon them. Both parties, in this scenario, are being dumb because if the vendors were writing code that had been designed to be secure and reliable then vulnerability discovery would be a tedious and unrewarding game, indeed!
Let me put it to you in different terms: if "Penetrate and Patch" was effective, we would have run out of security bugs in Internet Explorer by now. What has it been? 2 or 3 a month for 10 years? If you look at major internet applications you'll find that there are a number that consistently have problems with security vulnerabilities. There are also a handful, like PostFix, Qmail, etc, that were engineered to be compartmented against themselves, with modularized permissions and processing, and - not surprisingly - they have histories of amazingly few bugs. The same logic applies to "penetration testing." There are networks that I know of which have been "penetration tested" any number of times and are continually getting hacked to pieces. That's because their design (or their security practices) are so fundamentally flawed that no amount of turd polish is going to ke
I may not be a smart man, but I know what an inode is.
"Only 3 percent of the vulnerabilities that are discovered are ever exploited," he said. "Yet there is huge amount of attention given to vulnerability disclosure, patch management, and so forth."
And it does not occur to you that this may not be part of the reason that only 3% of vulnerabilities disclosed are exploited. In fact, I would say that three percent is a rather high number considering how many vulnerabilities are patched before being disclosed (at least in the open source world). Concluding that the success of vulnerability management is a sign that it's wasted effort does not seem to be entirely justified.
These vulnerabilities are not at all similar to "firing an arrow through the sunroof of a Ford and kill the driver". An automobile body is not designed to stop arrows, in the first place, and there's little incentive for someone to make such an attack, and there are mechanisms to deter any such potential attacker in other ways. Computer vulnerabilities are similar to being able to push a button and have the car send the contents of its trunk or glove compartment to the attacker... untraceably. Shoudl automobiles suffer such flaws, I am sure that people would be most interested in having them discovered and fixed!
My wife is impregnable!
They're comments on the IT guys and the company's new password policy. I log on to my Windows box with WhatALoadofCrap! (apropos of both Windows and the policy), onto the intranet with IT-sucketh-mightily and into some of the restricted applications with PassThis,MF and IhatelamePWPolicies.
Of course, I've carefully written each password on a PostIt affixed to the side of my monitor.
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
_
\\/ are accustomed' - First Lensman
Your club analogy. Ok, you're talking about one club. What I (and TFA) are talking about is putting 1 Club on your car steering wheel vs. putting 15 Clubs on your steering wheel. There's a point of diminishing returns. Then there's a tipping point where security measures are so bloated they actually have *negative* effects. That's the topic under discussion.
Thank you Dave Raggett
But if everybody knew runes they wouldn't be obscure, thus defeating the purpose....
Furthermore, people don't know it's a password. Do you go around translating every foreign character you see? Didn't think so.
-Clio
Karma: Bad (mostly from not giving a fuck)
Blog: http://clintjcl.wordpress.com
Seriously - it's more like the logic you see in global warming denial than anything else I've seen. To start with he compares something that I've never heard of (Knocking an arrow through the sunroof of a car) which could only be done deliberately by someone with consummate skill to something that happens on a regular basis (Exploiting a security hole in software) which can be done by any scriptkiddy.
The password length thing is just silly too. If guessing passwords was an arithmetical progression (i.e, it was twice as hard to guess a 16 letter password as an 8 letter password) it would make sense, but it's not - a minor change in length makes a major change in password security. Even assuming that, of all the passwords used, the one the hacker cracks *has* network access - better security increases the chance that this isn't the case.
This sounds like someone trying to sound like he's thinking ahead of the curve and brilliant, but the info presented here just doesn't follow. Or maybe I'm just not smart enough.
Pug
An Invisible Entity of Vast Power whose existence must be taken on faith alone: Liberal Media
I can't see anything in the article that suggests he's saying that. And I don't see him pushing a product either.
About passwords, if you've enforced strong passwords, and used a non-shitty hashing algorithm, it doesn't matter if someone gets your password file. With the best passwords, it doesn't mean a cracker will "only get 2000 of the 5000", it means he will be lucky to get ONE in his LIFETIME.
As for the "arrow in the sunroof" analogy, I'm sure this possibility would get plenty of attention if, say, you had an average of thousands of arrow-assassination attempts per day. "If a product can be cracked, it's sometimes thrown out and considered useless," he observed. "But automobile seatbelts only prevent fatalities about 50 percent of the time." If a product can be cracked, it will result in "security fatalities" 100% of the time. Given those odds, we wouldn't be using seat-belts.
The article was dull, and mendacious(that car analogy is entertaining for a few seconds until you try and draw a parallel with anything other than whether Chewbacca lives on Endor or Kashyyk.) Sure, there is crap security out there, but anyone who calls out 'best practice' as flawed is being deliberately obtuse. Bodies of Knowledge like ISO17799 and COBIT aren't pills to be swallowed whole, they are frameworks, and picking out recommendations within them with the purpose of showing them as ineffective is not very challenging. Hey here's one; your wifi must have WPA enabled, but 'we havent got wifi in our dept' ...How we all laughed.... crazy IT monkeys!
Nothing to see here people.... oh, and don't bang on about the books you've read either mate, especially Sun Tzu and Machiavelli, if you're going to be a prick, be creative about it, don't rip it off from the business aisle!
You may not agree with what I say, but you should fight to the death to allow me to say it, by modding me up.