Slashdot Mirror
Former NSA Honcho Calls Corporate IT Security "Appalling"
Nerval's Lobster writes "Former NSA technology boss Prescott Winter has a word for the kind of security he sees even at large, technologically sophisticated companies: Appalling. Companies large enough to afford good security remain vulnerable to hackers, malware and criminals because they tend to throw technological solutions at potential areas of risk rather than focusing on specific and immediate threats, Winter said during his keynote speech Oct. 1 at the Splunk Worldwide User's Conference in Las Vegas. 'As we look at the situation in the security arena we see an awful lot of big companies – Fortune 100-level companies – with, to be perfectly candid, appalling security. They have fundamentally no idea what they're doing,' Winter said, according to a story in U.K. tech-news site Computing. During almost 28 years at the National Security Agency (NSA), Winter established the spy agency's Technology Directorate and served as the agency's first CTO. He also held positions as the NSA's CIO, its deputy chief of Defensive Information Operations and, oddly, as chief of Customer Response. He is currently managing director of Chertoff Group, the strategic management and security consultancy established by Michael Chertoff, secretary of the Dept. of Homeland Security under Pres. George W. Bush and co-author of the USA Patriot Act."
In companies great and small, a long history of appalling lack of and apathy for security. Goes back 30 years. Unfortunately I have to say so anonymously.
Given that half of Slashdot works in corporate IT I'm sure we're all shocked by this announcement.
You could just improve security, but that's hard. Alternately, you could just have such a shitty IT infrastructure that nothing ever works! This has many advantages! Lower IT costs, for one, and servers that are broken are in fact VERY secure! Very, VERY secure! So if you're in IT, next time someone bitches at you about some resource being down, just say it's "security hardening"!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
All it takes to break in is a hammer and 10 seconds.
Sure, they could put in bullet-proof glass and high-security doors. But those measures are prohibitively expensive for most businesses, and still aren't foolproof.
The same is true with computer security. There are basic precautions businesses should take, like putting all their equipment behind firewalls, for example. That's the equivalent of locking the front door. But security costs money, and makes life more difficult for those with legitimate access. These considerations must be balanced.
How many vulnerable systems are due to PHBs who don't want to listen to explanations that the remote access or network configuration they want is insecure?
The rest due to incompetent web developers who have no clue how to build secure web apps.
The real "Libtards" are the Libertarians!
Banks are still using "secret questions" and claiming that's a kind of two-factor authentication. Someone I know was once told by Citi something to the effect of "well, click on the links in the email, and if it gets you to a site with our logo, then it was from us."
And honestly, social engineering is still a huge and very easy target.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
It seems we are taking the position of a man who was part of an active and systematic attack on the security of network infrastructure through planned back dooring, lowering of quality of encryption systems, and intentional hacking?
Really? its the corps fault they are not secure, considering what the NSA has been up to?
Perhaps they should have spent 10% of the effort on informing corps of the holes they found instead of just squirreling them away i the grab bag of dirty tricks.
If suddenly matters so much, then please, make public the details of ALL known security holes, and inform all victims of the backdooring done to their systems..
No? Thought not..
He's keynoting at a major security vendor conference. Having done so myself, the goal and focus is ALWAYS to spread FUD to sell software and services. This industry survives off of fear mongering. That's not to say there aren't problems, but when you're paid tens/hundreds of thousands of dollars to keynote on behalf of a vendor, you generally have an unwritten agreement to paint the most dramatic picture possible.
Chase those, and you're in a never-ending cycle of reaction because you were so thrilled by the drama of firefighting that you left yourself exposed to the next specific and immediate threat.
Try to cover broad classes of threat, and you'll get some actual preventive value from your expenditures.
In my experience it is more about the managers and CxO's viewing it as a status issue. They are so important that they cannot be hampered by the demands of the lowly IT people. And the same goes for their people.
Security is IT's problem and if something goes wrong then it is the IT people who will be fired. Starting with the ones who were the loudest about there being a problem in the first place.
After all, other companies don't have those problems. So it must be because the IT people are incompetent.
Given the creator of Windows and US government can, sufficiently compelled, walk into any Windows system that is internet connected at any time they desire what's the frickin' point? Everything else is security theatrics. Do what the old security honcho of MS has done and drop out.
Four letters say it all: EULA. You can sell software that bricks a piece of hardware, and the worst you'll have to do is refund the purchase price. Most of the time, all you have to do is issue a credit, so the customer/sucker gives you more money.
Someone breaks into a server farm and steals credit card info and passwords that are stored in a non-encrypted format? Just send out a warning. It's not like you can get sued or anything.
Big defense contractors are leaking classified information like a sieve. It's so bad that the US President had to whine to the Chinese President about cyber spying industrial espionage. Has any defense contractor lost a contract or been fined for these screw ups? Of course not.
Heck, there were images this week from an exposition of Chinese built unmanned aircraft in Beijing, and they had a Predator drone! Not just a look alike, it had the same mounting for the optical sensor pod on the bulging nose, chines, V-tail, etc. It would be completely unsurprised if they stole the plans. Apparently they have the plans for all our major weapons systems. It save then vast effort in R&D, and they can build counter measures that they know will work. If there were any fines or actions against any corporations it was not reported anywhere.
So given that there's no down side to committing corporate software fraud, why is anyone surprised that security is a complete joke.
Why is Snark Required?
I have been doing IT for 30 years. I have been doing Security for a University for about the last 15 years. I have found that security is possible, but you have to focus.
The biggest problem is we are not taught how to do security. We are taught attack. But attack is not security. We are taught checklists, but checklists are not security.
Security is a meaningful assurance that your goals are being accomplished. The details are transitory. But, without goals, security has no point. Sticking to your goals when attacked is the heart of defense. Ultimately, it is the only thing that matters in security. Your organization adds value by sticking to it's goals. But this is more than just a matter of value added. Goals are the spirit of the organization. If you don't stick to your goals when attacked, then you have lost. The attacker may not have won, but you have lost.
But, security folks are not taught how to support institutional goals. Instead, we are taught myriads of other things. You can see examples of the mechanics of security defeating meaningful security all over the place. One striking example is the SANS 20 Critical Controls: http://www.sans.org/critical-security-controls/ While they contain many good points, they fail to teach security. When we analyzed them, we found that they tended to replace security process with checklist. When we had finished the evaluation process we had eliminated, reordered and replaced many of their controls. Our most important control was not even mentioned. It is:
Critical Control 1: Unity of Vision
Security is a MEANINGFUL Assurance that YOUR goals are being Accomplished. Most security failures are enabled and enhanced by disagreement of purpose. Are the fundamentals of management in place?
Another glaring omission is the complete lack of strategic thinking in the security community. Winning battles, but loosing the war is our way of life. Nothing in the SANS controls guides you to ask the important questions like: "Were am I going?" and "How did I get in this handbasket?" and "Do I HAVE to eat this crap?" For our analysis of the SANS Controls, we added another Control. We valued it at number 3:
Critical Control 3: Enable a Better Future
This control assumes that our actions affect the future. Do your actions enable a more secure future?
The SANS 20 Controls were originally written by the NSA for the Department of Defense: http://www.sans.org/critical-security-controls/history.php The recent NSA disclosures make me wonder if maybe they are flawed, because the NSA simply doesn't value effective security?
...Cackles Maniacally And Rubs Hands With Glee.
systemd is Roko's Basilisk.
So if Snowden can get at the NSA and the NSA calls companies weak, imagine how bad those companies actually are....
I was promised a flying car. Where is my flying car?
Is this the same company that employed Edward Snowden as a sysadmin, allowed him to elevate his authority and then download documents that he was not supposed to... So Prescott Winter was CTO and was finally responsible for internal IT security. Talk about a pot calling a kettle.....
A FSIC judge used that blame-the-victim security logic according to a new interview with Lavabit's ex-owner at Ars Technica, even though the judge wasn't sure if "unencrypted" is even a real word:
[Levison] continued to resist, arguing that by handing over the key, he would be compromising the security of all users. In an August 1 hearing, Judge Claude Hilton said that it was effectively Levison's fault that sites have only a single private SSL key.
"You're blaming the government for something that's overbroad, but it seems to me that your client is the one that set up the system that's designed not to protect that information, because you know that there needs to be access to calls that go back and forth to one person or another," the judge asked Levison's attorney, Jesse Binnall. "And to say you can't do that just because you've set up a system that ...has to be unencrypted, if there's such a word, that doesn't seem to me to be a very persuasive argument."
[sarcasm]Yeah, nothing wrong with being so over-intrusive since it's not like the guy really tried to make it secure...[/sarcasm]
Now mostly at Usenet:comp.misc & SoylentNews.org (it's made of people!)
Who would have thought?
Aside from everyone working in IT security. Or everyone working in IT. Or everyone with 3 working brain cells. So, basically, everyone except middle management.
What I've seen in IT security in most companies is pretty pathetic. They would fall to the first dedicated attacker. And, indeed, reports like the yearly Verizon report show that they do.
But here's the catch: A company is by definition an entity that exists for the sole purpose of making money. As long as the damage from security incidents is lower than the cost to reduce them, it is actually the correct business decision to not improve security. If you view security without risk management, you are a fanatic.
Assorted stuff I do sometimes: Lemuria.org
. . . .who want exceptions carved out, just for them.
Like the C-level people who "need" Facebook and Twitter.
Like the General Counsel who don't want to use the document check-in/check-out system, and THEN complain about losing files.
I could go on, but I'm sure the vast majority of us have had to deal with similar issues. . .
I work for a medium sized financial institution and the level of security is off the charts to the point where you can be fired from walking away from your workstation without first locking it. No computer that is connected or ever has been or will be connected to our internal network is allowed on the internet or to have a flash drive / CD put into it except by approved IT workers (the ports and drives are disabled too).