Slashdot Mirror
How Security Companies Peddle Snake Oil
penciling_in writes: There are no silver bullets in Internet security, warns Paul Vixie in a co-authored piece along with Cyber Security Specialist Frode Hommedal: "Just as 'data' is being sold as 'intelligence', a lot of security technologies are being sold as 'security solutions' rather than what they really are: very narrow-focused appliances that, as a best case, can be part of your broader security effort." We have to stop playing "cops and robbers" and pretending that all of us are potential targets of nation-states, or pretending that any of our security vendors are like NORAD, warn the authors.
Vixie adds, "We in the Internet security business look for current attacks and learn from those how to detect and prevent those attacks and maybe how to predict, detect, and prevent what's coming next. But rest assured that there is no end game — we put one bad guy in prison for every hundred or so new bad guys who come into the field each month. There is no device or method, however powerful, which will offer a salient defense for more than a short time. The bad guys endlessly adapt; so must we. Importantly, the bad guys understand how our systems work; so must we."
Vixie adds, "We in the Internet security business look for current attacks and learn from those how to detect and prevent those attacks and maybe how to predict, detect, and prevent what's coming next. But rest assured that there is no end game — we put one bad guy in prison for every hundred or so new bad guys who come into the field each month. There is no device or method, however powerful, which will offer a salient defense for more than a short time. The bad guys endlessly adapt; so must we. Importantly, the bad guys understand how our systems work; so must we."
No point product or product line of point products is a 'security solution.' They are part of the equation, but only a holistic approach that encompasses user training, proper design, constant vigilance, and yes the right point products can really be called a 'solution', and even then I tend to avoid the term. I'll speak to solutions for particular problems, for example web filtering or fire-walling, but I try to lead my clients to understand that only a complete top to bottom approach will even come close to providing them with the security they need. Even then, it's a game of leap frog. The bad actors will always be back with sneakier malware, more artful attacks, etc.
"pretending that all of us are potential targets of nation-states,"
umm... we ARE all targets of nation-states- no pretending required.
maybe he meant 'priority targets' or some such...
Oh. Dear. Lord.
That has to be the most pronounced unibrow I have ever laid eyes upon.
Unlike porn, which yada yada rimshot hey-ooh!
Security isn't a product. It's really that simple. Security comes from properly implemented instruction in code. ie that isn't riddled with bugs. Unless your selling me a service which audits the software's source code I use and/or configurations (for example Apache's configuration, SSL enabled, up-to-date, good configuration for Drupal, etc ) I'm not convinced that there is any value in your security product. Your not going to be safer unless the software your using isn't riddled with bugs and poor default settings and/or configuration.
I have to admit that I would pay for a subscription to an auditing service for GNU/Linux. I wouldn't pay for an anti-virus solution as anti-virus software is an outright fraud. The companies can't fix bugs in the code (on proprietary platforms) and at best there is a slight chance some malicious software might get picked up (the risk and costs vs reward though isn't worth it). It won't stop new malware from exploiting old un-patched bugs and most malicious software in the will get through. 99.8% detection isn't going to do shit when 98.8% of malicious software isn't actually spreading and/or has been patched years ago.
Yea- I don't use MS Windows or Mac OS X or any proprietary software (well, except, unfortunately a proprietary BIOS, and possibly other low-level microcode, but drivers/firmware for individual components are mostly free in my systems, ie ThinkPenguin.com).
Jesus christ Ed grew up to be a Computer Scientist...
A bullet may have your name on it but splash damage is addressed "To whom it may concern."
Excellent, I need help with a stubborn glitch we are having. How do I contact them?
Table-ized A.I.
So that's what he means by "integrated solution".
Table-ized A.I.
Joe Sixpack is incapable of using an unrestricted computer securely, which leads to inevitable calls to "do something". The something is to remove control of computers from their owners, because that's the only way to event begin to improve Joe Sixpack's safety - by not letting him fuck with the damned thing beyond logging onto his facebook and play some Candy Crush.
Welcome to Computing 2.0, where everything is centrally controlled for your own good.
"Security" isn't a product.
It's a process, aided by tools.
Unfortunately, the "security industry" is also abetted by "tools" too.
Chas - The one, the only.
THANK GOD!!!
No, we certainly are not all targets of nation states. But there are more potential targets of nation states than that currently actually have proper IT security measures in place. I'm talking about you, waterworks / electricalworks / etc. To say you can 'predict' an attack is to say that you can 'predict' Putin's next move. You can only anticipate statistically. And how do you do that? By using security products to fill in a security plan.
Religion is what happens when nature strikes and groupthink goes wrong.
Install my security software at http://nsa.gov/download/backdoor.exe it is guaranteed to reduce hacking attempts on your systems by 99%.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
It is not an arms race, its a race to zero. Bad actors exploit weaknesses in network facing code. There might be 10 weaknesses (known or unknown), then 9, then 8 then 7... once the vendor gets to 0 then its fixed.
It's not that bad actors can then get a bigger weapon to attack. All they can ever do is find previously unknown weaknesses until no more exist.
Any grafted on product for security is just a patch over a hole, the underlying weakness is still there with software stuck over it. Worse, they add modes-of-failure all of their very own, add false positives that in turn add failures which in turn do damage like an attacking agent.
Not so much 'hollistic' as 'homeopathic'. The fix for security is the same as the fix for all bugs.
So many users (and a lot of IT departments, unfortunately) viewed their anti-virus products as a magic forcefield to protect them from threats. That's how they were marketed always will be. It's not just security vendors; salespeople from any vendor will tell you that it dishes out soft-serve ice cream if that's what it takes to get you to buy it. What amazes me is how so many companies still buy into it and turn to new security products looking for that same non-existent magic force-field. I had hoped the mindset would get better in the current threat landscape, but I'm not so sure it is. I still hear customers asking "Why didn't product X protect me?" in situations where they should have already known full well that it wouldn't do jack sh*t against the particular threat that was encountered, and they didn't have other crucial pieces of the security puzzle in place. (Social engineering, anyone?).
no. that ship sailed a long time ago.
you're just a dupe.
Sleep your way to a whiter smile...date a dentist!
I've exited the security industry after 15 years, no longer believing that it does any good. And TFA is pretty spot on.
The issue is that security is both wide and deep. You need to cover all your weak spots, and you need to cover them completely. As an industry, we have succeeded in finding technical solutions to almost every challenge, but we've failed in creating a systematic approach to the field. Look at the "best practice" documents - they are outdated and mostly a circle-jerk. I did a quick study some months ago checking the top 100 or so for what the academic or scientific or just substantiated-through-sources basis is, and the result is pretty much: None at all.
Even the different standards, including the ISO documents, are collections of topics, not systematic wholes. It's like high school physics: This month you get taught optics, next month Newton mechanics, the third month electromagnetism. The only thing they have in common is the class room.
Nowhere is it more visible than our treatment of the user. It's clear that most security professionals treat users as disturbances, as elements outside their field of security. I imagine what roads would look like if their planners would look at accidents and say "cars are a threat to our road system. They clog it up and very often they crash into each other and cause serious issues to traffic. We need to protect the road system against cars. Can we automate roads so they work without cars as much as possible?"
We need a much more systematic, holistic view on the whole field than we have right now. In a pre-scientific field, snake oil is the norm. It was the same in medicine (where the term originates), in chemistry (alchemy), in psychology (astrologie, numerology, one hundred other primitive attempts at understanding and predicting human behaviour) and virtually every other field, even many non-scientific areas, such as religion/magic.
Assorted stuff I do sometimes: Lemuria.org
Our enemies are innovative and resourceful, and so are we. They never stop thinking about new ways to harm our country and our people, and neither do we.
The grass is always greener on the other side of the light cone.
For most companies, there are two main threats:
1) Script Kiddies who are running programs against your network looking for security holes. If your network is secured enough, these attackers will just move on to the next target.
2) Internal Employees who are either disgruntled, looking for "side income", or just careless/clueless These are the people who, with access to your HR database, download a list of your employees and their SSNs to sell for cash. They also are the people who know they are going to be fired and so sabotage systems. Finally, these are the people who open NEKKID_PHOTOS_OF_CELEBRITIES.ZIP.exe in their e-mail, who give out their passwords when "IT" calls them out of the blue from a non-company number, or who take their laptop (connected to the company's network) home but leave it in the car visible to all so it gets stolen.
In the case of internal employees, you can lock down access so they only have access to systems they need for their job and educate your users as much as possible about security threats and how to react. If an employee is a chronic security threat, you can take corrective action. Of course, this becomes difficult when said employee is also a company executive. (e.g. The CFO insists on connecting his virus-laden personal laptop to the network and has enough political pull to fire anyone who tells him that's not company policy.)
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
I couldn't get past his unibrow. Jesus man! Don't you have a mirror?
Solving Unix problems since 1989...
Upper management at most companies view IT as a set of tasks or items you can check off as "done", requiring no further investment or maintenance. I blame them for the sorry state of affairs that allows these "security" companies to advertise and sell "in a box" products that are supposed to "take care of your security."
If upper management would realize that things like security and infrastructure are things that need constant maintenance, enhancement, and upgrades, we wouldn't be in this pickle. Nor would we be stuck with applications that are running on three-major-revision-old vendor products, subject to a whole raft of security issues that could be addressed by upgrading them.
I do not fail; I succeed at finding out what does not work.
If you can't find a picture of me online with 30 seconds on the googles, you need to stop eating the paintchips.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
Companies did that repeatedly. The Burroughs B5000 (1961) had bounds checks, pointer protection, and code/data separation. The System/38 and Intel 432 were capability secure from hardware up. There were type-safe platforms for high level languages such as LISP or Java. There were (are) highly secure systems designed under Orange Book B2/B3/A1 or Common Criteria EAL5-7. What do these have in common? People ignored them to buy PC's, DOS, Windows, UNIX, and so on. Intel and Siemens lost around a billion dollars building secure, maintainable stuff for the market. So, with the market trading away security for everything else, why should anyone spend several hundred million building a whole stack? That's why they peddle Win/UNIX/Lin-compatible bullshit instead of stuff that's secure, which has to be clean slate.
Nick P, High Assurance Security Engineer/Researcher