Slashdot Mirror
How Security Companies Peddle Snake Oil
penciling_in writes: There are no silver bullets in Internet security, warns Paul Vixie in a co-authored piece along with Cyber Security Specialist Frode Hommedal: "Just as 'data' is being sold as 'intelligence', a lot of security technologies are being sold as 'security solutions' rather than what they really are: very narrow-focused appliances that, as a best case, can be part of your broader security effort." We have to stop playing "cops and robbers" and pretending that all of us are potential targets of nation-states, or pretending that any of our security vendors are like NORAD, warn the authors.
Vixie adds, "We in the Internet security business look for current attacks and learn from those how to detect and prevent those attacks and maybe how to predict, detect, and prevent what's coming next. But rest assured that there is no end game — we put one bad guy in prison for every hundred or so new bad guys who come into the field each month. There is no device or method, however powerful, which will offer a salient defense for more than a short time. The bad guys endlessly adapt; so must we. Importantly, the bad guys understand how our systems work; so must we."
Vixie adds, "We in the Internet security business look for current attacks and learn from those how to detect and prevent those attacks and maybe how to predict, detect, and prevent what's coming next. But rest assured that there is no end game — we put one bad guy in prison for every hundred or so new bad guys who come into the field each month. There is no device or method, however powerful, which will offer a salient defense for more than a short time. The bad guys endlessly adapt; so must we. Importantly, the bad guys understand how our systems work; so must we."
No point product or product line of point products is a 'security solution.' They are part of the equation, but only a holistic approach that encompasses user training, proper design, constant vigilance, and yes the right point products can really be called a 'solution', and even then I tend to avoid the term. I'll speak to solutions for particular problems, for example web filtering or fire-walling, but I try to lead my clients to understand that only a complete top to bottom approach will even come close to providing them with the security they need. Even then, it's a game of leap frog. The bad actors will always be back with sneakier malware, more artful attacks, etc.
Can somebody buy that guy some clippers or tweezers to solve his problem of having only a single eyebrow?
Jesus was all right but his disciples were thick and ordinary. -John Lennon
"pretending that all of us are potential targets of nation-states,"
umm... we ARE all targets of nation-states- no pretending required.
maybe he meant 'priority targets' or some such...
then it's all about the species, and this rock, and space-based solar power and asteroid mining.
The cognitive dissonance you nerds have is impressive.
Security isn't a product. It's really that simple. Security comes from properly implemented instruction in code. ie that isn't riddled with bugs. Unless your selling me a service which audits the software's source code I use and/or configurations (for example Apache's configuration, SSL enabled, up-to-date, good configuration for Drupal, etc ) I'm not convinced that there is any value in your security product. Your not going to be safer unless the software your using isn't riddled with bugs and poor default settings and/or configuration.
I have to admit that I would pay for a subscription to an auditing service for GNU/Linux. I wouldn't pay for an anti-virus solution as anti-virus software is an outright fraud. The companies can't fix bugs in the code (on proprietary platforms) and at best there is a slight chance some malicious software might get picked up (the risk and costs vs reward though isn't worth it). It won't stop new malware from exploiting old un-patched bugs and most malicious software in the will get through. 99.8% detection isn't going to do shit when 98.8% of malicious software isn't actually spreading and/or has been patched years ago.
Yea- I don't use MS Windows or Mac OS X or any proprietary software (well, except, unfortunately a proprietary BIOS, and possibly other low-level microcode, but drivers/firmware for individual components are mostly free in my systems, ie ThinkPenguin.com).
fukyea
Excellent, I need help with a stubborn glitch we are having. How do I contact them?
Table-ized A.I.
So that's what he means by "integrated solution".
Table-ized A.I.
Joe Sixpack is incapable of using an unrestricted computer securely, which leads to inevitable calls to "do something". The something is to remove control of computers from their owners, because that's the only way to event begin to improve Joe Sixpack's safety - by not letting him fuck with the damned thing beyond logging onto his facebook and play some Candy Crush.
Welcome to Computing 2.0, where everything is centrally controlled for your own good.
The problem is impractical to solve, if you have any brains whatsoever, and anyone with a brain knows this! Duh!
The security problem is just like how Air cannot get out of the way of your airplane when you go beyond a certain speed, and going faster than that speed is suicide..
This is why anyone with an IQ above 50 knows that Chuck Yeager guy, was a snake oil salesman too! Duh!
Stop interviewing, Slack off, quit your jobs.. it is all pointless!
"Security" isn't a product.
It's a process, aided by tools.
Unfortunately, the "security industry" is also abetted by "tools" too.
Chas - The one, the only.
THANK GOD!!!
No, we certainly are not all targets of nation states. But there are more potential targets of nation states than that currently actually have proper IT security measures in place. I'm talking about you, waterworks / electricalworks / etc. To say you can 'predict' an attack is to say that you can 'predict' Putin's next move. You can only anticipate statistically. And how do you do that? By using security products to fill in a security plan.
Religion is what happens when nature strikes and groupthink goes wrong.
Install my security software at http://nsa.gov/download/backdoor.exe it is guaranteed to reduce hacking attempts on your systems by 99%.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
From the highly statist article:
Perhaps if a few (decision makers) voters can be convinced that they've been mesmerized by color animation that has no real meaning, by threat "intelligence" that isn't, by security "solutions" that aren't, then 2015 could be a much-needed turning point in the history of (Internet security) mankind.
FTFY
It is not an arms race, its a race to zero. Bad actors exploit weaknesses in network facing code. There might be 10 weaknesses (known or unknown), then 9, then 8 then 7... once the vendor gets to 0 then its fixed.
It's not that bad actors can then get a bigger weapon to attack. All they can ever do is find previously unknown weaknesses until no more exist.
Any grafted on product for security is just a patch over a hole, the underlying weakness is still there with software stuck over it. Worse, they add modes-of-failure all of their very own, add false positives that in turn add failures which in turn do damage like an attacking agent.
Not so much 'hollistic' as 'homeopathic'. The fix for security is the same as the fix for all bugs.
So many users (and a lot of IT departments, unfortunately) viewed their anti-virus products as a magic forcefield to protect them from threats. That's how they were marketed always will be. It's not just security vendors; salespeople from any vendor will tell you that it dishes out soft-serve ice cream if that's what it takes to get you to buy it. What amazes me is how so many companies still buy into it and turn to new security products looking for that same non-existent magic force-field. I had hoped the mindset would get better in the current threat landscape, but I'm not so sure it is. I still hear customers asking "Why didn't product X protect me?" in situations where they should have already known full well that it wouldn't do jack sh*t against the particular threat that was encountered, and they didn't have other crucial pieces of the security puzzle in place. (Social engineering, anyone?).
Security technologies are adequate and capable in a laboratory environment.
The problem is when you introduced carbon-based lifeforms into the picture. Then, all hell breaks loose.
no. that ship sailed a long time ago.
you're just a dupe.
Sleep your way to a whiter smile...date a dentist!
I've exited the security industry after 15 years, no longer believing that it does any good. And TFA is pretty spot on.
The issue is that security is both wide and deep. You need to cover all your weak spots, and you need to cover them completely. As an industry, we have succeeded in finding technical solutions to almost every challenge, but we've failed in creating a systematic approach to the field. Look at the "best practice" documents - they are outdated and mostly a circle-jerk. I did a quick study some months ago checking the top 100 or so for what the academic or scientific or just substantiated-through-sources basis is, and the result is pretty much: None at all.
Even the different standards, including the ISO documents, are collections of topics, not systematic wholes. It's like high school physics: This month you get taught optics, next month Newton mechanics, the third month electromagnetism. The only thing they have in common is the class room.
Nowhere is it more visible than our treatment of the user. It's clear that most security professionals treat users as disturbances, as elements outside their field of security. I imagine what roads would look like if their planners would look at accidents and say "cars are a threat to our road system. They clog it up and very often they crash into each other and cause serious issues to traffic. We need to protect the road system against cars. Can we automate roads so they work without cars as much as possible?"
We need a much more systematic, holistic view on the whole field than we have right now. In a pre-scientific field, snake oil is the norm. It was the same in medicine (where the term originates), in chemistry (alchemy), in psychology (astrologie, numerology, one hundred other primitive attempts at understanding and predicting human behaviour) and virtually every other field, even many non-scientific areas, such as religion/magic.
Assorted stuff I do sometimes: Lemuria.org
Historically, Snake oil often contained high proof alcohol, narcotics, or cocaine. For McAfee anti virus to be comparable to snake oil, it has to support pornographic minecraft set to illegally downloaded music.
Our enemies are innovative and resourceful, and so are we. They never stop thinking about new ways to harm our country and our people, and neither do we.
The grass is always greener on the other side of the light cone.
All that talk about security and you are still using php?
For most companies, there are two main threats:
1) Script Kiddies who are running programs against your network looking for security holes. If your network is secured enough, these attackers will just move on to the next target.
2) Internal Employees who are either disgruntled, looking for "side income", or just careless/clueless These are the people who, with access to your HR database, download a list of your employees and their SSNs to sell for cash. They also are the people who know they are going to be fired and so sabotage systems. Finally, these are the people who open NEKKID_PHOTOS_OF_CELEBRITIES.ZIP.exe in their e-mail, who give out their passwords when "IT" calls them out of the blue from a non-company number, or who take their laptop (connected to the company's network) home but leave it in the car visible to all so it gets stolen.
In the case of internal employees, you can lock down access so they only have access to systems they need for their job and educate your users as much as possible about security threats and how to react. If an employee is a chronic security threat, you can take corrective action. Of course, this becomes difficult when said employee is also a company executive. (e.g. The CFO insists on connecting his virus-laden personal laptop to the network and has enough political pull to fire anyone who tells him that's not company policy.)
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
In my experience, a company with a next-generation firewall doesn't know where they stand. A company with no firewall knows *exactly* where they stand.
I couldn't get past his unibrow. Jesus man! Don't you have a mirror?
Solving Unix problems since 1989...
Upper management at most companies view IT as a set of tasks or items you can check off as "done", requiring no further investment or maintenance. I blame them for the sorry state of affairs that allows these "security" companies to advertise and sell "in a box" products that are supposed to "take care of your security."
If upper management would realize that things like security and infrastructure are things that need constant maintenance, enhancement, and upgrades, we wouldn't be in this pickle. Nor would we be stuck with applications that are running on three-major-revision-old vendor products, subject to a whole raft of security issues that could be addressed by upgrading them.
I do not fail; I succeed at finding out what does not work.
Companies did that repeatedly. The Burroughs B5000 (1961) had bounds checks, pointer protection, and code/data separation. The System/38 and Intel 432 were capability secure from hardware up. There were type-safe platforms for high level languages such as LISP or Java. There were (are) highly secure systems designed under Orange Book B2/B3/A1 or Common Criteria EAL5-7. What do these have in common? People ignored them to buy PC's, DOS, Windows, UNIX, and so on. Intel and Siemens lost around a billion dollars building secure, maintainable stuff for the market. So, with the market trading away security for everything else, why should anyone spend several hundred million building a whole stack? That's why they peddle Win/UNIX/Lin-compatible bullshit instead of stuff that's secure, which has to be clean slate.
Nick P, High Assurance Security Engineer/Researcher