Slashdot Mirror
Rethinking Security: Securing Activities Instead of Computers
An anonymous reader writes: Security is not a property of a technical system," says independent security consultant Eleanor Saitta. "Security is the set of activities that reduce the likelihood of a set of adversaries successfully frustrating the goals of a set of users." But software development teams that understand what users want and what adversaries they face are very rare. And security engineers forgot — or misunderstood — what their job is: not securing computers, but securing activities that lead to the realization of greater goals.
If you can describe your goals, and avoid terms like "security" and "protection", you will focus on results, not simply repeating marketing catch phrases.
Live long and prosper...
Security is a property of a technical system, and may be increased with a set of activities.
So in otherwords, you're talking about basic Kerberos Authentication we've had since Windows 2000, and MIT invented in the 1980's. Wow, amazing stuff. Using this new pioneering technology, we'll be able to finally treat individual services, functions and resources in those services as "security resources" that are controlled by access tokens verified and given out by a "domain controller."
What's next, promote synergy?
After reading the 'article', I am not sure what is being said or the point is for that matter. I don't understand WTF is being said.
"A threat model is a formal, complete, human-readable model of the human activities and priorities and of the security-relevant features of in-scope portions of a system," Saitta defines. "An engineering tool that will help use define what we are trying to get the system to do."
Huh? That sounds like a REAL fancy way to say social engineering.
In my years in this shitty fucking business, there are a lot of BS artists who get away with bullshit because the IT/engineering industry is almost exclusively filled with people who are afraid of appearing 'stupid' to say he looks naked and charlatans get away with selling shit. The Emperor may have no clothes, but everyone is too afraid to appear stupid or have some arrogant asshole say, "You don't belong here!" because HE thinks there are clothes.
Is this article different? I don't know.
independent security consultant Eleanor Saitta
Ah 'consultant'.
Because people need houses, not foundations.
There's a Venn diagram in the article. I think we better listen to the author.
that the user has put themselves in a dramatically unsecured situation. FTA "As she vividly put it: if you're on a rooftop, trying to get a connection and successfully send out an encrypted message because your life or freedom - or that of others - depends on it, and you know that there are snipers waiting to take a shot at you - there is simply zero room for using a tool as complex as PGP." Physical security is the foundation of software security.
Nobody can predict what kind of extra, para and non legal adversaries a set of business processes face during their lifetime. Mapping the risk and reacting to legal adversaries is also called "keeping up with the society" and "reading government bulletin boards, newspapers and publications." In other words, a cubic fuckton of sets of activities inside sets of activities strictly inside unbounded fuzzy sets of adversaries.
Take a word and mince up the definition, and call it something else. Security is not a thing that people can do, it's things people do to stop other people from accessing things... Sadly people pay to drink this kind of KoolAid.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Step 1: Increase the security of the software development activity, by allowing programmers to do their job without being overworked and overstressed and rushed to ship their code now now now don't worry we'll patch it later.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Not all of them are well thought out from the get-go, I think is the point. If you can remove the need for a potential vulnerability, you remove a security need.
Look, I know the guys in suits buy into this crap, but there's really no reason to spread it on our walls.
If you're going to provide a solution to a problem do it, describe it in clear concise english. This person hasn't actually said anything at all. They simply used a larger than necessary amount of words to do it.
This signature has Super Cow Powers
That's one of the most pedantic definitions of Security I've ever seen. It follows then that malware that mines a few bitcoins in the background for Hacker Group X doesn't violate a user's Security as long as grandma can still check her email and Powerball tickets?
People want an attempted computer intrusion to look like The Matrix combined with William Gibson novels combined with red alert klaxons and people in military uniforms running around in a war room. They want it to be free, fool proof, and not require them to know or remember anything.
Good luck!
"I asked everyone to look at their systems from the perspective that they would need to detect, track, and limit a privileged access breach"
I didn't see how what I had said was unreasonable, but it was like I turned a long tailed cat loose in a rocking chair convention. What is wrong with assuming the worst and seeing what you can do about it? If you can't admit that your administration level accounts can be hacked, I don't believe you understand what you are up against.
You are full of ...... It...
(/sarcasim)
Look, ANYBODY can claim to be an " independent security consultant" and it's stuff like this that sounds complex enough to be true. You can baffle people with BS if you know the buzz words, and even get consultant gigs from time to time, just hang out a shingle, buy a website and go to a couple of symposiums.
Security is about common sense and risk management. You need to understand the risks (which means you need to know what they are) and that takes some domain knowledge, plus you need to know what the possible techniques are to manage the risks, but once you know what the risks are and what tools you have to manage these risks, doing the actual *work* is decidedly easy and not that hard.
The moral of the story here is that if it sounds complicated coming from your "expert" then you need to fire them. If you cannot understand what they are suggesting needs to be done, they are just trying to separate you from your money, not provide you with security.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
If I'm understanding TFA, it seems like a restatement of one aspect of the three laws of security -- of Confidentiality, Integrity, Availability, the last one. That if "security" results in legitimate users not having sufficient access (availability) to achieve assigned goals, it's not really security. Kind-of the opposite, actually.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
In all reality its the internet and what we use it for that makes our devices at risk. Its email, rogue web sites, click jacking, malware laced ads, lousy security with servers and so much else. But the common thread in all this is the internet. If you had a PC that was never connected in anyway to the internet you would probably have a very secure PC. Unless of course you install a virus or malware from a external source. But that's not very common these days, and it get's worse as even our climate system, alarm systems and other home systems get onto the internet. A potential for any one of them to be a open invitation for hackers. My advice is fixed the internet and don't waste time fixing every single device and OS that accesses it.
For IT systems:
- Software developers and Vendors need to write secure code that isn't vulnerable to buffer overflows or code injection
- Users and managers need to beware of social engineering and phishing attacks and maintain good practices.. passwords, screen locks etc.
- Specialized IT Security needs to be notified by users when suspicious things happen and need to monitor the network for suspicious activity
- Police/Feds investigate crime syndicates, terrorists, corporate espionage and foreign intelligence
And don't forget physical security...
Devil's advocate here:
Securing a task is one thing, but if the endpoint hardware is compromised on any level, nothing you can do higher up on the chain matters. This is the same reason why DRM tends to fail on the PC unless it uses a very elaborate system of obfuscation.
Yes, task security is important, but what the task depends on is also critical.
Take sending secure E-mail for instance. The task requires the computer, the storage medium, RAM, the CPU, and anything on the bus that can read/interfere with the encryption/decryption to be "clean". However, once the encrypted data is on the wire, the only real protection needed is to keep a bad guy from blocking packets, since they can't tamper with the contents.
This is a different task from sending normal E-mail, but both require the same security (clean endpoint) to function.
FTFA:
As she vividly put it: if you're on a rooftop, trying to get a connection and successfully send out an encrypted message because your life or freedom - or that of others - depends on it, and you know that there are snipers waiting to take a shot at you - there is simply zero room for using a tool as complex as PGP.
"We forgot that our job was really to stop bad things from happening to good people," she pointed out.
- well fuck, a system that sends messages shouldn't require that you know how PGP works, it should just apply it without forcing you to do anything you wouldn't do on a 'non-secure' system. Login, write a message and push the send button. Login could even be an option, your equipment could login by itself.
So, how do we go about doing that? The answer is: in an organized manner - with threat modeling, adversary modeling, and operational planning.
- sure. Or you could sanitise your inputs, follow sound practices, like not pass parameters in the open and if you do, ensure that the information they represent actually can be accessed by whoever passes them, prevent people from using bad passwords, set permissions on resources in such a way that only authenticated and authorised users can see and modify them.
Basically TFA is somebody trying to sell the same thing with a set of buzzwords.
You can't handle the truth.
Stuxnet showed that line of thinking can be wrong. Even though the Internet has made it easy for attackers to do a lot of damage for relatively little work (compared to getting boots on the ground), one still needs defense in depth. All it takes is a MicroSD card gotten in or out of a secure facility.
Whether one agrees or not is irrelevant. Eleanor has advanced the collective by causing thought and discourse. I find her thesis curious.
The worst security definition that I have seen is the one currently used by the US Security communities. Geer stated it as: "..the absence of unmitigatable surprise." This definition is horrible. It offers you no guidance on prioritization or limits. This definition says you are insecure until you have achieved omniscience and omnipotence.
The best definition of security that I have found is: "Security is a MEANINGFUL assurance that YOUR most important goals are being accomplished." This is easily understood by everybody and it guides you to effective action. Using this definition you are guided to create and maintain the potential for success. The other definitions ultimately force you to focus your efforts on less important objectives.
How about designing a computer that can't be compromised by opening an email attachment or clicking on a URL. Design a system that runs on embedded hardware, that can't be overwritten and provides full usability to the end users.
People did get computer virus infections before the wide use of the internet. It came from people sharing floppies or other portable media. Also, you'd get the odd LAN viruses. The Internet just made it far easier to both spread and make use of the intrusions.
Oddly enough, people used to write virus programs with nothing more than the malicious desire to crash your computer or the completely amoral idea of wanting to see what would happen, because it was difficult to get your computer to phone home before people had "always on" Internet connection, so you couldn't really use infected machines for DDoS attacks or for reliably sending back information to the virus writer/operator.
I remember having to be worried about infected disks long before I ever owned a modem at home.
I am 67 years old.
I do not do anything using my data without being safe.
If you folks cannot secure you systems not my fault. The amout of money spent is crazy . Laws will be made to hold
folks for mistakes. You should held accountable for systems that are not safe .
Where I get where you are coming from...
The internet is NOT really the biggest source of risk, users are. The internet is just the vehicle most often used to do direct and indirect attacks, there are a number of other sources of problems for the security expert. Most systems that sit behind any kind of firewall and a NAT address are generally perfectly safe from a direct attack, at least until the user logs in.
Users, once authenticated, are able to download stuff, do stupid things to the system configuration and/or copy data off the system. For most security risks, the BIG money risks are not directly coming from the internet.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
THIS was the result (his annihilation) -> http://tech.slashdot.org/comme... in his Bouldin's "GOLDEN" top 10 greatest security 'fail' hits as I called it... & on SIMPLE & WIDELY KNOWN topics in security that DOLT should've known but didn't, lol!
AND?
Yes, there's YET another blowhard ALLEGED 'security engineer' on /. named raymorris I did even WORSE too -> http://it.slashdot.org/comment... PROVING HIS UTTER LACK OF KNOW-HOW on a single point he TOTALLY BLEW IT ON!
Later?
Yes, folks - I >b>absolutely & TRULY fried him here regarding computer security & ads (which he works for an ad redirector no less it turned out) -> http://it.slashdot.org/comment...
* LITERALLY BURNING HIM WITH 100's of proofs to the contrary vs. his utter BULLSHIT...
(Some 'security engineers' we get around here, eh? Not!)
APK
P.S.=> I'm not "too impressed" with the "security engineers" (wannabes) that often show up here - especially if "lil' ole' me" can SCORCH them the way I did, with ease, mind you... lol!
... apk
When facing a nearly unprovable situation (e.g, the security or insecurity of a system), we often resort to deities and idolatry.
It's much easier to believe in magic pixie dust called security protection that you can apply to some activity which is insecure to make it secure, than to face the reality that the activity itself might be inherently insecure and we must modify our activity to make it secure.
You have a virus, there must exist anti-virus protection, you have malware, there must exist some anti-malware protection, just a little more encryption, and a little more authentication will always help too (just like sunblock and contraceptive devices, you gotta apply that stuff correctly or it doesn't work as advertized). However, as we have seen, the belief in these artifacts are mostly a mirage. It's not to say these things aren't useful to a limited extent, but we want to believe we can use technology to "solve" a problem that is intrinsic. Hope springs eternal.
How did this article make the front page?
How about we train people not to click shit in emails, and how about OS/app vendors write their code to not allow the shit that people clicked in emails to take over the entire system because EVERYTHING runs in Kernel space (because it's easier)...