Slashdot Mirror
HackerOne CEO: Every Computer System is Subject To Vulnerabilities (cnbc.com)
An anonymous reader writes: Every computer system in the world is vulnerable to hackers and criminals, according to Marten Mickos, CEO of HackerOne. That's nothing new with major data breaches at Yahoo and the federal government. But not to worry, teams of ethical hackers could be an answer to the growing cybersecurity concerns. "There are far more ethical hackers, white hat hackers, in the world than criminals," Mickos told CNBC's "Squawk Alley" on Thursday. "So when you just invite the good guys to help you, you will always be safe. It's like a neighborhood watch. You're asking the good guys around you to help you see what's wrong with your system and help you fix it." Mickos has assembled 70,000 white hat hackers in his venture-backed company HackerOne. He explains the intent of white hat hackers is to hack for good and not for exploitation.
Keep waiting for the second coming of teams of ethical hackers. Not that this method could not work in principle, it is just corporations are not willing to pay for this, instead often choosing to lawyer up, and as a consequence ethical hackers are rare. On other hand, with a thriving black market for exploits, unethical hackers could easily monetize.
Ethical hacking is like a starving artist gig, you need a day job and could only do this as a side gig.
thanks hackerone ceo, nobody knew this until today
glad youre on the case
In other news: water is wet. I would like to sell you an umbrella in case you get rained on.
Therefore black hat hacking is ethical in all capitalist nations, and white hat hacking is unethical.
OP aims to exploit the labor of white hat hackers by selling their services at profit, so of course he will argue the other way.
As mentioned in the interview, they took 13 minutes to find a major vulnerability in the Pentagon systems. Heck you can have someone run a Nessus scan for you at a cost of about $50, and probably find some significant vulnerability.
Of course it's also possible to go overboard, to spend more on pen testing and security consulting than it's worth, but some really smart security people can be had for under $200 / hour, and in a couple hours they can do a lot of good for a company.
Along the same lines, I think it's definitely worth it to involve a security expert in a about three meetings for any major software project - once when the overall architecture is first being discussed, once when specific plans are in place, and once to review before going live on production. using my self as an example, I've been doing security full time for 20 years, and I know what the common mistakes are. I know what the "smells" are - if you mention certain words, I can tell you those are areas you need to be careful. You don't have to spend a lot to teleconference me for three one-hour meetings, and I can potentially save you millions.
Besides what most people think of as security, "confidentiality", my view of security is "the system continues to operate correctly - even when an attacker is trying to make it fail". That implies that it operates correctly when it's NOT being attacked. My suggestions give you better up time and more reliable results. A simple example is a government system I looked at which was subject to SQL injection on a name field - it had SQL like "INSERT INTO tbl lastname='$lastname'; ". Sure, that's SQL injection, but it also failed on names like O'Reilly - perfectly legitimate customers couldn't use the system. Applying security concepts (it should work correctly even when it's being attacked) made it work much more reliably every day, and at a very low cost.
How is this any different from locking down systems, ensuring security updates are installed. Setting up firewalls, port forwarding, NAT, VPN, etc?
So when you just invite the good guys to help you, you will always be safe. It's like a neighborhood watch.
More like mafia watch. If you just invite them for help, you will always be safe. Otherwise ...
How about we get ethical management instead so developers and IT staff are trained in security and given the resources to properly develop secure systems? Secure enough* system are possible. The entire software security industry doesn't need to exist if developers were better.
*Excluding spy level stuff like scanning the monitor's emissions to read the display.
Sure, people like you and I can save companies money. The problem is that companies don't pay millions to fix bugs, and don't generally pay penalties for bugs. Large companies can look at the trade off and see ROI and even immediate value to adding security staff to all phases of development, but small companies don't get the same bang for the buck as it were. Established companies have a potential to lose millions in revenue, small companies don't have the same amount of risk and startups have virtually none.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I've just checked. My ZX Spectrum, which is in a box under the stairs, is still secure. Never been hacked. Take that black hat hackers.
I would love him to address this news: https://www.quantamagazine.org...
It will be better to purchase from an owner who is a good farmer and a good builder.
In terms of dollar amounts, larger companies obviously work on a larger scale.
On the other hand, "mom and pop" businesses often have their whole life invested in their business.The server being out of commission for two weeks while you both secure it and clean up the mess from the hackers means they can't make their personal mortgage payment. The smallest companies have been my best customers. Of course my business is designed for small companies - low-priced, high value per dollar offerings, simple web ordering rather than spending time (money) in meetings and writing proposals, etc. A couple hundred bucks for a professional grade offsite backup can largely secure their personal livelihood.
I wouldn't say it's "different than", I'd say it's another item on the check list:
a) Ensure security updates are installed in a systematic way
b) Ensure up firewalls are set up and regularly reviewed
c) Review configuration port forwarding, NAT, VPN, etc annually
d) Annual security review by objective third-party security professional
We can also help you with A, AB, and C. Updates, for example, are important for confidentiality and integrity, but some upgrades can create problems for availability - they can break things. How can you ensure *all* systems are updated regularly and frequently, while at the same time ensuring that updates don't break important functionality, and if something does break, you can quickly identify the cause? A security professional can help answer that, or whatever other issues that come up as you security matures.
water is wet.
There is a massive amount of business between the two ends of the spectrum. Save the appeals to emotion because I agree with the premise, but not the statement that everyone justifies (or can justify) the costs. There is no legal requirement in almost all cases for them to do so, so they don't.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Agreed, it would be a great help if developers in general switched from thinking in terms of "how can this work" to "how can this be broken". That's the topic of the next OWASP meeting I plan to attend - how can we help developers become more security aware and develop more secure systems, given all the demands on them, deadlines, etc. Security is just one of many things developers need to think about. They need to learn security, but they also need to learn the Next Big Thing - another language, framework, whatever. How can we help them be secure in the limited time they have for training? More focused training? Knowing what they can do themselves and when to ask for help from a security professional?
On the other hand, your development team probably isn't a bunch of people with the exact same skills. You probably have someone who is good at databases, another who is good at GUI design, a software architect thinking about the big picture, maybe a scrum master or other lead person who is skilled at teamwork skills and facilitating work between people. Security is another specialty, like database design, GUI design, or leading a team.
Also, just as you may need a database *designed* very well once, then maintained by someone else, you can take advantage of security professional as-needed, they don't always have to be a full-time member of each team. At my last job, I was regularly called to join meetings of other teams, when security considerations were discussed. They might use me one or two hours per month, which was enough to prevwnt a lot of major mistakes and make their system more robust, both when under attack and when not under attack.
He assembled a team of 70,000 white hat hackers? That seems like a lot...
Cost is certainly a big consideration. As I said in my post, one reason that the smallest companies were my best customers was because I designed low-price offerings specific for their needs and budget - and I told them what to NOT buy from us, because it wasn't worth it for them.
One example of something that most any full-time business should have is backups. If the business is your sole source of income, you should probably spend a couple hundred bucks for serious offsite backups. Larger companies, with bigger budgets, will spend more to prevent the *need* to ever use backups, for those with a very small budget we can inexpensively make sure that backups are really solid, preventing many types of catastrophic loss.
> Save the appeals to emotion
It's interesting that you say that because I find my customers ARE often buying emotion. They are scared because their last hosting company went out of business overnight, leaving them high and dry, or hackers completely f*cked up their web site, which is their income. They want to rest easy knowing that their company won't be destroyed by the next event, but they have a very limited budget. Good offsite backups provide them the confidence that no matter what happens in terms of IT, things can be back to normal within a few hours. There is a big emotional component there - they are worried. My job is therefore threefold - a) provide solutions that *actually* protect them from disaster, b) provide visibility so they can see that they are protected and they don't need to worry c) do so at a low price point, so the cost of protection isn't causing them stress.
My point in saving the appeal to emotion arguments is because I have worked extensively in security and compliance in both the private and government (defense) sectors for over 25 years. Selling me on security is like selling a fish on water.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
CEO: let me sell you snakeoil!
Company: We got hacked using your snake oil
CEO: let me sell you some more snakeoil! I'm such a douche!
Yes, every system has breaches, but not all you can fix by yourself.
I spy so much shitty code. Most of the site doesn't even serve static content from a cookieless domain, and most of the site itself is scripting/code instead of media/text.
Exploitable from the bottom up.
Turn your own people against your site first before advertising out to others, eh?
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.