Former NSA Honcho Calls Corporate IT Security "Appalling"

Nerval's Lobster writes "Former NSA technology boss Prescott Winter has a word for the kind of security he sees even at large, technologically sophisticated companies: Appalling. Companies large enough to afford good security remain vulnerable to hackers, malware and criminals because they tend to throw technological solutions at potential areas of risk rather than focusing on specific and immediate threats, Winter said during his keynote speech Oct. 1 at the Splunk Worldwide User's Conference in Las Vegas. 'As we look at the situation in the security arena we see an awful lot of big companies – Fortune 100-level companies – with, to be perfectly candid, appalling security. They have fundamentally no idea what they're doing,' Winter said, according to a story in U.K. tech-news site Computing. During almost 28 years at the National Security Agency (NSA), Winter established the spy agency's Technology Directorate and served as the agency's first CTO. He also held positions as the NSA's CIO, its deputy chief of Defensive Information Operations and, oddly, as chief of Customer Response. He is currently managing director of Chertoff Group, the strategic management and security consultancy established by Michael Chertoff, secretary of the Dept. of Homeland Security under Pres. George W. Bush and co-author of the USA Patriot Act."

Comments

I can confirm this

[Anonymous Coward]

In companies great and small, a long history of appalling lack of and apathy for security. Goes back 30 years. Unfortunately I have to say so anonymously.

Re:I can confirm this

[phantomfive]

In my experience, it's much more rare to find a company that knows about security than to find one that doesn't.

Most of them don't. Sometimes the companies that do know just consider it a risk of doing business, easier to pay when things go wrong than to try to secure it. An example of this is credit card companies. Bruce Schenier points out that he would never trust a credit card online because of the security holes, except they promise to reimburse him when things go wrong.

Re:I can confirm this

[hairyfeet]

Its really simple, REAL security costs good money, takes real time and effort and doesn't show immediate results on the bottom line so most companies? Just don't give a fuck. Call it "the rise of MBA (Major Buffons and Assholes) culture" or the "fuck everything but the quarterly earnings!" attitude or anything you like, if it doesn't show profits quickly? they don't care. See how frankly piss poor IT is treated by many corps, "cogs that suck money and don't generate profits" seem to be the way most PHBs treat IT, which is always underfunded, understaffed, and overworked.

Even with the downturn i don't think I could go back to dealing with that bullshit, I'd play C&W in a shitty redneck bar before i go back to the bad treatment and constant headaches that is IT in most of the big firms I've seen. There is ZERO loyalty, you could put in 80 hour weeks and they'd fuck you over or outsource your job the second they get a chance, and no matter what you do its not good enough....fuck that. If its like the way it was when i was working corporate, and I've seen nothing to make me think it isn't, its no wonder the security is poor, most are so overworked they are too busy fighting fires or worrying about whether their job will be sent to India or given to an H1-B to spend any real time worrying about security. and of course if you actually DO make changes that increase security? You'll have a dozen PHBs screaming at you because the ipad they picked up over the weekend doesn't magically work when they walk into the building. i wouldn't take another job in corp IT for all the tea in China, no way.

Re:I can confirm this

[phantomfive]

Even with the downturn i don't think I could go back to dealing with that bullshit, I'd play C&W in a shitty redneck bar before i go back to the bad treatment and constant headaches that is IT in most of the big firms I've seen.

Become a security consultant and charge four times as much. Then you can make money off their foolishness. The more foolish they are, the more you make. The less foolish they are, the more you help them.

Re:I can confirm this

[symbolset]

In my experience revealing what you really know about systems security is a guaranteed way to lose the job interview if you have any clue at all. The only way to help an organization get real operations security is to worm your way in under false pretenses and then gradually migrate them to a secure position. An MCSE cert helps here, as it drives away suspicion that you might actually know what you're doing.

Re:I can confirm this

[wisty]

It's not about "real security" (which is too nebulous). They do make an effort, and spend lots of money ... on a big firewall to protect the whole org.

It's about protecting specific assets. For example, you can take the whole NSA offline, which is a fantastic moat. But if one single insider can get root access to basically anything he wants, it's not protecting core assets.

Most businesses are even worse - high risk assets can be sitting on a shared drive where everyone in the company can access them.

Re:I can confirm this

[TheSeatOfMyPants]

There is ZERO loyalty, you could put in 80 hour weeks and they'd fuck you over or outsource your job the second they get a chance, and no matter what you do its not good enough.....

That's the corporate world regardless of what department someone is in. It's one of the big reasons that life here in the USA has changed for the worse, as the detrimental effects of living that way eventually invade just about every other aspect of daily life. Hard to care what happens to other people/families when some part of you is persistently fatigued from overwork/stress & worried that you could easily wake up tomorrow to find yourself unemployed and fighting for anything that might pay the bills...

Re:I can confirm this

[aaronb1138]

Don't forget the part where the MBAs aren't even afraid of security issues coming back to bite them. If the issues snowball hard enough, they just go on a huge spending spree for 6 months, bankrupt and phoenix the company. Ignoring security and legal liability in general has become status quo because being responsible has a negative cost to benefit ratio especially compared to the government backed reincorporation procedure.

Re:I can confirm this

[JaredOfEuropa]

In my experience it is rare to find a company that does IT well in general. Many aspects of IT are hard (including security), and hard to run well as an assembly line, i.e. managing by job compartimentalization, dashboards and processes (management "by the numbers"). I'm not sure why that is, but I often see two areas where IT does very, very poorly compared to other technical or engineering functions.
1) Poor middle management. Many of them are either IT people with poor management skills, or good general managers with no IT skills.
2) Failing talent management. Failure to attract top people, no coaching, poor training, lack of talent recognition (I don't just mean good pay, I mean knowing who your best people are and allocating that talent accordingly), and lack of a decent technical career ladder.

The biggest challenge in IT is not technology, and it hasn't been that in ages. It's management, or rather: figuring out how to do IT well, how to organize it.

Re:I can confirm this

[Tom]

In my experience, it's much more rare to find a company that knows about security than to find one that doesn't.

They are actually pretty easy to find.

If they have more than about 500 employees, check if they have an official IT security position. Might be some guy doing other stuff in addition, but he's got to be the official IT security guy.

If they have more than about 1000 employees, check if they have an IT security department with at least one full-time employee.

If they have more than 2000 employees, check if they have a CSO or CISO.

If they have, you just need to verify that it's not an alibi position to satisfy some compliance rules. If they don't have, you already know they got no clue.

Business can always be estimated by checking if they commit to a regular expense on a topic. Occasional security checks mean nothing, they're usually done when someone needs to cover their asses. A permanent financial commitment is the only thing that means something in a business context.

No Shit, Sherlock

[thatkid_2002]

Given that half of Slashdot works in corporate IT I'm sure we're all shocked by this announcement.

Re:No Shit, Sherlock

[Kazoo the Clown]

You got that right. Security is hard. Security is expensive. Security does not improve profits (as long as they continue to be lucky). The company that spends money on security while their competitors are not, will lose out. Therefore, who needs it? There's no sense of living dangerously without some really spectacular examples...

Re:No Shit, Sherlock

[girlintraining]

Given that half of Slashdot works in corporate IT I'm sure we're all shocked by this announcement.

Yeah, and we all know who to blame. (looks ominously upward) The irony here is that corporate IT is even more into surveillance and CYA than the former NSA guy is. I mean, the NSA has rules and shit to follow. Management at a company these days is like to be all "Yo, we do whatever we want. You dun like it? Dere's da fuckin' door." (sorry, Jersey accents are really hard to do on slashdot forum posts)

As an experiment I once sent an e-mail out from my last employer containing about 5KB of randomly generated gibberish to an e-mail address setup that had never been used before on a server that didn't have an SMTP server prior to the test balloon. Over the next three days, this previously unused and unloved honeypot got dozens of pings from the corporate network from people trying to login to the SSH, poke at the SMTP server, looking for web services. I sent it from a gmail account specially setup ahead of time, then logged in over a supposedly secure 'ssl' connection.

Similar has happened at 7 out of 10 employers I've worked for. They don't just monitor all your stuff...they actively go out and fuck with it. And the only reason this isn't a problem is because they're so terrifyingly bad at it.

Re:No Shit, Sherlock

[InTheSwiss]

Having worked at several blue chips all anybody cares about is the appearance of security (i.e. security theatre) enough to cover them for audits and compliance. There is no real security in place in most places. Like you say security is hard and expensive. They don't want to make life harder than the minimum.

Re:No Shit, Sherlock

[The_Other_Kelly]

Actually Man-in-the-Middle transparent proxies, which intercept
and monitor SSL/TLS traffic, are now standard in most corps.
You don't get a browser alert since the corporate "fake" CA
is pre-installed as trusted in your browsers by the corp's IT.

So, yes, basically ... there *is* no encryption and they look
at everything.

Oh! And using Cisco "policy based routing", or WCCP2 or
other networking mojo, you cannot decide to skip the proxy,
from your client.

And ... using Deep Packet Inspection, the protocol will not
just be matched versus the destination port, so your genius
attempts to ssh to your external server running on tcp/443,
will not only be blocked, you will be flagged and tagged.

Solution? Just use your own equipment with either built
in 3/4G connections, or just tether across your personal
phone.

Caesar and Rome ...

Couple Ways You Could Fix That

[Greyfox]

You could just improve security, but that's hard. Alternately, you could just have such a shitty IT infrastructure that nothing ever works! This has many advantages! Lower IT costs, for one, and servers that are broken are in fact VERY secure! Very, VERY secure! So if you're in IT, next time someone bitches at you about some resource being down, just say it's "security hardening"!

No, really?

[seebs]

Banks are still using "secret questions" and claiming that's a kind of two-factor authentication. Someone I know was once told by Citi something to the effect of "well, click on the links in the email, and if it gets you to a site with our logo, then it was from us."

And honestly, social engineering is still a huge and very easy target.

Re:No, really?

[MrNemesis]

You've been modded funny, but it's more +1 Insightful, -2 Depressing.

I've had several calls from my bank that basically go like this:
GB: "Hello, I'm calling from Generic Bank regarding your account, in order to verify your identity as the account holder can I ask you to confirm your name, date of birth and account number please?"
MN: "Sure"
GB: "..."
MN: "Well are you going to tell me?"
GB: "Sorry sir, you need to tell me that information"
MN: "And how do I know you're not a scammer?"
GB: "Because I'm calling from Generic Bank"
MN: "I'm not going to give any information to an unsolicited caller asking me for my bank details. Are you going to tell me what this call is about?"
GB: "I'm afraid I can only do that with the verified account holder"
MN: "And who is that?"
GB: "I'm afraid I can't tell you until you tell me, but I can assure you I am calling from Generic Bank"
MN: "And I can assure you I didn't take a shit in your cornflakes but that doesn't necessarily make it true, does it?"
*click*

Yes, these calls really were from the bank because every time this happens I walk into a branch and ask a) why I was called and b) why they still haven't fixed this utterly moronic behaviour. Don't even get me started on the almost complete and utter lack of two-factor auth for online banking as well as the utterly ridiculous password requirements. About 5 years back my bank said I could have a current account with an RSA key... the catch was it had to have at least £50,000 in it. I think it's only within the last year or so they've brought in two-factor auth for us mere peons, and yet you're apparently still able to reset your account with "security questions". When I tried to set answers that were purposefully incorrect (e.g. for "memorable place" you might choose to give "Marvin's turgid bowling average") I was told I wasn't allowed to do that so I cancelled the whole process. Asinine.

I haven't given the name of my bank, because they all seem equally shitty in this regard.

Re:SO WHY DID IT TAKE A SNOWDEN . . . !!`

[thesupraman]

It seems we are taking the position of a man who was part of an active and systematic attack on the security of network infrastructure through planned back dooring, lowering of quality of encryption systems, and intentional hacking?

Really? its the corps fault they are not secure, considering what the NSA has been up to?

Perhaps they should have spent 10% of the effort on informing corps of the holes they found instead of just squirreling them away i the grab bag of dirty tricks.

If suddenly matters so much, then please, make public the details of ALL known security holes, and inform all victims of the backdooring done to their systems..

No? Thought not..

My experience is slightly different.

[khasim]

In my experience, it's much more rare to find a company that knows about security than to find one that doesn't.

In my experience it is more about the managers and CxO's viewing it as a status issue. They are so important that they cannot be hampered by the demands of the lowly IT people. And the same goes for their people.

Security is IT's problem and if something goes wrong then it is the IT people who will be fired. Starting with the ones who were the loudest about there being a problem in the first place.

After all, other companies don't have those problems. So it must be because the IT people are incompetent.

With Windows Backdoored, What's the Point?

[Jimbookis]

Given the creator of Windows and US government can, sufficiently compelled, walk into any Windows system that is internet connected at any time they desire what's the frickin' point? Everything else is security theatrics. Do what the old security honcho of MS has done and drop out.

pot calling kettle

[Anonymous Coward]

Is this the same company that employed Edward Snowden as a sysadmin, allowed him to elevate his authority and then download documents that he was not supposed to... So Prescott Winter was CTO and was finally responsible for internal IT security. Talk about a pot calling a kettle.....