6 ms·

These two statements contradict each other: > The underlying problem, IMO, is people. They just don't care about security, they want to deliver working device.

These two statements contradict each other: > The underlying problem, IMO, is people. They just don't care about security, they want to deliver working device. > This unassuming black box is [...] designed for networks with extreme requirements for data security. You can claim that nobody will buy Kaspersky's device, or that they did poor market research. But you can't claim that they don't care about security.

vbezhenar 10y ago
Kaspersky certainly care about security, it's their business. I'm talking about people who build routers or web cameras. I doubt that Kaspersky built OS for internal use, they want to license it to other manufacturers. But I'm not sure that other manufacturers will want to pay for this extra security (if they would want, they already have better options).
- nickpsecurity 10y ago
  "Kaspersky certainly care about security, it's their business." Their business is selling antivirus & other software, not security. They have no history whatsoever of building a piece of software immune to code injection by determined attackers. There are companies and academics that build stuff like that. Some were evaluated by pentesters of third parties. Kaspersky has neither that background nor evaluations by expert breakers. We should by default think they don't know what they're doing and the product is insecure until proven otherwise. Like always. People often mistake "company in security industry selling security products" with "knows how to secure software or systems." They're two very different things.
  - MichaelBurge 10y ago
    Can't you sue a company selling security products if it ends up being insecure? This is different from ordinary software, because most ordinary software isn't marketed with security as its primary selling feature. And if they're not getting it tested by independent experts, that could be negligence. If they're not liable in any way, then I agree it's nothing more than marketing to call it secure.
    - nickpsecurity 10y ago
      There's little to no liability in most situations. Security experts have been pushing for liability for a long time as a solution to this. Basically, we want a minimum level of responsibility like what exists in safety-critical industries. Schneier has a brief essay that explains it well: https://www.schneier.com/blog/archives/2004/11/computer_securi.html https://www.schneier.com/blog/archives/2004/11/computer_secu...
      - MichaelBurge 10y ago
        I suppose the other economic option is insurance. That works best in general with a lawsuit, but certain companies that would suffer great damages with a breach should be motivated to buy insurance. One example would be companies handling credit card information. If you leak a bunch of credit cards, Visa has to invalidate and reissue the cards, and the issuing banks have to spend a lot of money handling customer support. So they're motivated to punish companies when there are security breaches, and to write these punishments into the contracts. Thanks for the article.
        nickpsecurity 10y ago
        "I suppose the other economic option is insurance" If they hack you, you can loose all your secrets, loose availability of your service in a way that customers leave, loose an election, or be implicated in crimes when your system is a proxy. I've never believed insurance would really compensate for such losses like it would a stolen TV or fire damage to a building. "If you leak a bunch of credit cards, Visa has" That's actually a good example. Both the regulatory and lawsuit-related penalties over mishandling PII have led to a boom of vendors offering solutions to make it easier. Still plenty of BS in the market but solutions are there due to incentives.
mfukar 10y ago
You can care about security and still make totally wrong decisions.

vbezhenar 10y ago

Kaspersky certainly care about security, it's their business. I'm talking about people who build routers or web cameras. I doubt that Kaspersky built OS for internal use, they want to license it to other manufacturers. But I'm not sure that other manufacturers will want to pay for this extra security (if they would want, they already have better options).

nickpsecurity 10y ago
"Kaspersky certainly care about security, it's their business." Their business is selling antivirus & other software, not security. They have no history whatsoever of building a piece of software immune to code injection by determined attackers. There are companies and academics that build stuff like that. Some were evaluated by pentesters of third parties. Kaspersky has neither that background nor evaluations by expert breakers. We should by default think they don't know what they're doing and the product is insecure until proven otherwise. Like always. People often mistake "company in security industry selling security products" with "knows how to secure software or systems." They're two very different things.
- MichaelBurge 10y ago
  Can't you sue a company selling security products if it ends up being insecure? This is different from ordinary software, because most ordinary software isn't marketed with security as its primary selling feature. And if they're not getting it tested by independent experts, that could be negligence. If they're not liable in any way, then I agree it's nothing more than marketing to call it secure.
  - nickpsecurity 10y ago
    There's little to no liability in most situations. Security experts have been pushing for liability for a long time as a solution to this. Basically, we want a minimum level of responsibility like what exists in safety-critical industries. Schneier has a brief essay that explains it well: https://www.schneier.com/blog/archives/2004/11/computer_securi.html https://www.schneier.com/blog/archives/2004/11/computer_secu...
    - MichaelBurge 10y ago
      I suppose the other economic option is insurance. That works best in general with a lawsuit, but certain companies that would suffer great damages with a breach should be motivated to buy insurance. One example would be companies handling credit card information. If you leak a bunch of credit cards, Visa has to invalidate and reissue the cards, and the issuing banks have to spend a lot of money handling customer support. So they're motivated to punish companies when there are security breaches, and to write these punishments into the contracts. Thanks for the article.
      - nickpsecurity 10y ago
        "I suppose the other economic option is insurance" If they hack you, you can loose all your secrets, loose availability of your service in a way that customers leave, loose an election, or be implicated in crimes when your system is a proxy. I've never believed insurance would really compensate for such losses like it would a stolen TV or fire damage to a building. "If you leak a bunch of credit cards, Visa has" That's actually a good example. Both the regulatory and lawsuit-related penalties over mishandling PII have led to a boom of vendors offering solutions to make it easier. Still plenty of BS in the market but solutions are there due to incentives.

mfukar 10y ago

You can care about security and still make totally wrong decisions.