How Security Companies Peddle Snake Oil

penciling_in writes: There are no silver bullets in Internet security, warns Paul Vixie in a co-authored piece along with Cyber Security Specialist Frode Hommedal: "Just as 'data' is being sold as 'intelligence', a lot of security technologies are being sold as 'security solutions' rather than what they really are: very narrow-focused appliances that, as a best case, can be part of your broader security effort." We have to stop playing "cops and robbers" and pretending that all of us are potential targets of nation-states, or pretending that any of our security vendors are like NORAD, warn the authors.

Vixie adds, "We in the Internet security business look for current attacks and learn from those how to detect and prevent those attacks and maybe how to predict, detect, and prevent what's coming next. But rest assured that there is no end game — we put one bad guy in prison for every hundred or so new bad guys who come into the field each month. There is no device or method, however powerful, which will offer a salient defense for more than a short time. The bad guys endlessly adapt; so must we. Importantly, the bad guys understand how our systems work; so must we."

Comments

wait, what?

[Anonymous Coward]

"pretending that all of us are potential targets of nation-states,"

umm... we ARE all targets of nation-states- no pretending required.
maybe he meant 'priority targets' or some such...

Re:All "security" tech is outright fraud

[Gordo_1]

> I wouldn't pay for an anti-virus solution as anti-virus software is an outright fraud. The companies can't fix bugs in the code (on proprietary platforms) and at best there is a slight chance some malicious software might get picked up (the risk and costs vs reward though isn't worth it).

Do you think you might be overstating the case a bit?

It's not *that* bad. Believe it or not, most modern security technologies do indeed track behavior profiles and use reputation systems to catch lots of bad stuff that's never been seen before. If you take off your hate glasses for a moment, you might learn something.

> I don't use MS Windows or Mac OS X or any proprietary software

RMS, is that you?

Re:All "security" tech is outright fraud

[gweihir]

Security tech is not what creates security. The competent use of security tech can help to create security, and as such not all of it (but unfortunately a lot) is fraud. The basic problem is that most enterprises still try to do IT security on the cheap or by locking everything down tightly. The first approach fails for obvious reasons, and the second one fails because it prevents people from getting work done. In both approaches, "magic" boxes, techniques, policies, etc. play a key role, as the IT security people in most enterprises are incompetent and incapable of actually understanding the threats and risks. This is an invitation to a lot of more or less unscrupulous vendors to sell these "magic" things.

failed industry

[Tom]

I've exited the security industry after 15 years, no longer believing that it does any good. And TFA is pretty spot on.

The issue is that security is both wide and deep. You need to cover all your weak spots, and you need to cover them completely. As an industry, we have succeeded in finding technical solutions to almost every challenge, but we've failed in creating a systematic approach to the field. Look at the "best practice" documents - they are outdated and mostly a circle-jerk. I did a quick study some months ago checking the top 100 or so for what the academic or scientific or just substantiated-through-sources basis is, and the result is pretty much: None at all.
Even the different standards, including the ISO documents, are collections of topics, not systematic wholes. It's like high school physics: This month you get taught optics, next month Newton mechanics, the third month electromagnetism. The only thing they have in common is the class room.

Nowhere is it more visible than our treatment of the user. It's clear that most security professionals treat users as disturbances, as elements outside their field of security. I imagine what roads would look like if their planners would look at accidents and say "cars are a threat to our road system. They clog it up and very often they crash into each other and cause serious issues to traffic. We need to protect the road system against cars. Can we automate roads so they work without cars as much as possible?"

We need a much more systematic, holistic view on the whole field than we have right now. In a pre-scientific field, snake oil is the norm. It was the same in medicine (where the term originates), in chemistry (alchemy), in psychology (astrologie, numerology, one hundred other primitive attempts at understanding and predicting human behaviour) and virtually every other field, even many non-scientific areas, such as religion/magic.