Slashdot Mirror
How Security Companies Peddle Snake Oil
penciling_in writes: There are no silver bullets in Internet security, warns Paul Vixie in a co-authored piece along with Cyber Security Specialist Frode Hommedal: "Just as 'data' is being sold as 'intelligence', a lot of security technologies are being sold as 'security solutions' rather than what they really are: very narrow-focused appliances that, as a best case, can be part of your broader security effort." We have to stop playing "cops and robbers" and pretending that all of us are potential targets of nation-states, or pretending that any of our security vendors are like NORAD, warn the authors.
Vixie adds, "We in the Internet security business look for current attacks and learn from those how to detect and prevent those attacks and maybe how to predict, detect, and prevent what's coming next. But rest assured that there is no end game — we put one bad guy in prison for every hundred or so new bad guys who come into the field each month. There is no device or method, however powerful, which will offer a salient defense for more than a short time. The bad guys endlessly adapt; so must we. Importantly, the bad guys understand how our systems work; so must we."
Vixie adds, "We in the Internet security business look for current attacks and learn from those how to detect and prevent those attacks and maybe how to predict, detect, and prevent what's coming next. But rest assured that there is no end game — we put one bad guy in prison for every hundred or so new bad guys who come into the field each month. There is no device or method, however powerful, which will offer a salient defense for more than a short time. The bad guys endlessly adapt; so must we. Importantly, the bad guys understand how our systems work; so must we."
No point product or product line of point products is a 'security solution.' They are part of the equation, but only a holistic approach that encompasses user training, proper design, constant vigilance, and yes the right point products can really be called a 'solution', and even then I tend to avoid the term. I'll speak to solutions for particular problems, for example web filtering or fire-walling, but I try to lead my clients to understand that only a complete top to bottom approach will even come close to providing them with the security they need. Even then, it's a game of leap frog. The bad actors will always be back with sneakier malware, more artful attacks, etc.
"pretending that all of us are potential targets of nation-states,"
umm... we ARE all targets of nation-states- no pretending required.
maybe he meant 'priority targets' or some such...
Security isn't a product. It's really that simple. Security comes from properly implemented instruction in code. ie that isn't riddled with bugs. Unless your selling me a service which audits the software's source code I use and/or configurations (for example Apache's configuration, SSL enabled, up-to-date, good configuration for Drupal, etc ) I'm not convinced that there is any value in your security product. Your not going to be safer unless the software your using isn't riddled with bugs and poor default settings and/or configuration.
I have to admit that I would pay for a subscription to an auditing service for GNU/Linux. I wouldn't pay for an anti-virus solution as anti-virus software is an outright fraud. The companies can't fix bugs in the code (on proprietary platforms) and at best there is a slight chance some malicious software might get picked up (the risk and costs vs reward though isn't worth it). It won't stop new malware from exploiting old un-patched bugs and most malicious software in the will get through. 99.8% detection isn't going to do shit when 98.8% of malicious software isn't actually spreading and/or has been patched years ago.
Yea- I don't use MS Windows or Mac OS X or any proprietary software (well, except, unfortunately a proprietary BIOS, and possibly other low-level microcode, but drivers/firmware for individual components are mostly free in my systems, ie ThinkPenguin.com).
Excellent, I need help with a stubborn glitch we are having. How do I contact them?
Table-ized A.I.
No, we certainly are not all targets of nation states. But there are more potential targets of nation states than that currently actually have proper IT security measures in place. I'm talking about you, waterworks / electricalworks / etc. To say you can 'predict' an attack is to say that you can 'predict' Putin's next move. You can only anticipate statistically. And how do you do that? By using security products to fill in a security plan.
Religion is what happens when nature strikes and groupthink goes wrong.
So many users (and a lot of IT departments, unfortunately) viewed their anti-virus products as a magic forcefield to protect them from threats. That's how they were marketed always will be. It's not just security vendors; salespeople from any vendor will tell you that it dishes out soft-serve ice cream if that's what it takes to get you to buy it. What amazes me is how so many companies still buy into it and turn to new security products looking for that same non-existent magic force-field. I had hoped the mindset would get better in the current threat landscape, but I'm not so sure it is. I still hear customers asking "Why didn't product X protect me?" in situations where they should have already known full well that it wouldn't do jack sh*t against the particular threat that was encountered, and they didn't have other crucial pieces of the security puzzle in place. (Social engineering, anyone?).
The fix for security is the same as the fix for all bugs.
The fix for security is architectural simplicity, good cryptography and formally analyzable behaviors.
That's why TLS and X.509 must die.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
I've exited the security industry after 15 years, no longer believing that it does any good. And TFA is pretty spot on.
The issue is that security is both wide and deep. You need to cover all your weak spots, and you need to cover them completely. As an industry, we have succeeded in finding technical solutions to almost every challenge, but we've failed in creating a systematic approach to the field. Look at the "best practice" documents - they are outdated and mostly a circle-jerk. I did a quick study some months ago checking the top 100 or so for what the academic or scientific or just substantiated-through-sources basis is, and the result is pretty much: None at all.
Even the different standards, including the ISO documents, are collections of topics, not systematic wholes. It's like high school physics: This month you get taught optics, next month Newton mechanics, the third month electromagnetism. The only thing they have in common is the class room.
Nowhere is it more visible than our treatment of the user. It's clear that most security professionals treat users as disturbances, as elements outside their field of security. I imagine what roads would look like if their planners would look at accidents and say "cars are a threat to our road system. They clog it up and very often they crash into each other and cause serious issues to traffic. We need to protect the road system against cars. Can we automate roads so they work without cars as much as possible?"
We need a much more systematic, holistic view on the whole field than we have right now. In a pre-scientific field, snake oil is the norm. It was the same in medicine (where the term originates), in chemistry (alchemy), in psychology (astrologie, numerology, one hundred other primitive attempts at understanding and predicting human behaviour) and virtually every other field, even many non-scientific areas, such as religion/magic.
Assorted stuff I do sometimes: Lemuria.org
Upper management at most companies view IT as a set of tasks or items you can check off as "done", requiring no further investment or maintenance. I blame them for the sorry state of affairs that allows these "security" companies to advertise and sell "in a box" products that are supposed to "take care of your security."
If upper management would realize that things like security and infrastructure are things that need constant maintenance, enhancement, and upgrades, we wouldn't be in this pickle. Nor would we be stuck with applications that are running on three-major-revision-old vendor products, subject to a whole raft of security issues that could be addressed by upgrading them.
I do not fail; I succeed at finding out what does not work.