The Effect of Snake Oil Security

Trailrunner7 writes "Threatpost has a guest column by Robert Hansen (aka Rsnake) about the long-term effects of snake-oil security products. 'I've talked about this a few times over the years during various presentations but I wanted to document it here as well. It's a concept that I've been wrestling with for 7+ years and I don't think I've made any headway in convincing anyone, beyond a few head nods. Bad security isn't just bad because it allows you to be exploited. It's also a long term cost center. But more interestingly, even the most worthless security tools can be proven to "work" if you look at the numbers.'"

Comments

Good, Bad and Ugly

[hhawk]

I think it's also a very hard concept that Good security can fail some times as well, so it's hard for some managers and others to understand the difference between good security failing and bad security having really never worked at all...

Good security can fail when new venerabilities are found, when risk assessments are not up dated in a timely manner, to do human / operator errors, etc.

not just security

[Tom]

It isn't just security. I supervise the IT audits in our company, and I can't list anymore how often fake procedures have been tried to pass of as actual processes. Right now, our software development managers try to tell everyone how "agile" they are - but the real work their people do has nothing to do with agile development whatsoever. I've seen so-called "change management" that wasn't worthy of even being in the same room with actual change management, and "access controls" that were essentially bullshit in paper form.

There are usually two causes for this: Malicious people who are greedy for either power and/or money, or incompetent people who don't understand what they're doing (or managing) but are too afraid to ask for help and too stupid to find it on their own. Both kinds of people try to pass off what they're doing as the real thing and will respond to any attempts at questioning or changing it with hostility. In fact, that hostility is a pretty good indicator of both snake oil and incompetence.

Re:not just security

[Garwulf]

I can vouch for that...

I used to work in the public sector. A few months before I left to return to school, we changed computer consultants to a new guy, and to this day I swear he was deliberately creating problems so he could bill us for solving them.

It started off with a computer audit. Now, I'm not a professional computer consultant, but I've been around computers pretty much my entire life, and my father used to be a consultant. My idea of an audit is to generate a list of what programs are running, what anti-virus programs are in place, what firewall is in place, what processes are running, etc. So, when I found out that my computer was about to be audited, I was prepared to be away from it for half an hour to an hour.

Instead, he checked the Windows version, and moved on.

Now, to understand this story, one of the things you have to understand is that I was an unofficial IT guy in the office. And, I had taken a couple of steps for basic security (this was back around 2003), such as moving everybody away from Outlook Express and onto Netscape mail. It was a small Windows 2000 network in a small office, and so long as it was kept behind a hardware firewall and nobody did anything terribly stupid, it was fine aside from the occasional software glitch.

The first recommendation that he put in, and management enforced, was to take everybody off Netscape and put them back onto Outlook Express. Massive infection of the entire network followed. Then, as I was the guy who started complaining that something was wrong here, he tried to blame me for hacking the system.

Now, this wasn't the main reason I left to go back to school (one of the problems with working in social services is that it can be very soul destroying work, and I had reached the point where I just couldn't continue any further), but it definitely gave me a good dose of snake oil before I left...