5 ms·

Safety Last: Software firms' incentives to take security seriously are too weak

34 points by martincmartin 10y ago

jaypaulynice 10y ago
This is the reason we're working on RESTfender https://restfender.co https://restfender.co We're in semi stealth mode but more to come soon!
- SteveNuts 10y ago
  That 4MB background image though
  - jaypaulynice 10y ago
    Haha...the original is 12MB. I reduced it to 1MB...it's hard to keep the details if the image is any smaller...
YCode 10y ago
One message I hear repeatedly from cyber security pros is their organizations claim security is critical... That its, until you show them the price tag. So long as they aren't willing to resource to security and they aren't held accountable for breaches this trend will basically continue.
- ksk 10y ago
  Yes, security is a practical reality and firms should be spending more on it. But I don't quite understand the victim blaming. Why should a company that gets attacked be held accountable?
  - deleted 10y ago
    [deleted]
  - Eridrus 10y ago
    Because their negligence results in harm's to entities other than the company. Often to the firm's customers, either because the firm directly lost control of private data or because their customers got hacked through their software.
    - ksk 10y ago
      I don't follow. Are you saying that a company should be blamed for flaws in products which they simply purchased?
      - milesrout 10y ago
        If you provide a product or service to your customers you are entirely responsible for it. If I buy a laptop and it craps out I don't send it back to the manufacturer, I take it back to the retailer.
        ksk 10y ago
        Okay, but a service and product has a warranty, and most software comes with a limited warranty allowing you to return it so I'm not sure what you mean. If Apache has a 0-day, what you want the bank to do about it if their website gets hacked?
        milesrout 10y ago
        >Okay, but a service and product has a warranty, and most software comes with a limited warranty Products have warranties, but this isn't really what I'm talking about. That was just an example of who is responsible: the person that you deal with is responsible. You buy a product or a service? The person you bought it from is 100% responsible. >If Apache has a 0-day, what you want the bank to do about it if their website gets hacked? The bank shouldn't be relying on software that it can't be sure is secure. If it's using Apache, and Apache has a 0-day, that shouldn't let people get all the way into their cluster and then into all their systems. They should have security in depth. The bank is responsible for the security of their customers' data. If they rely on Apache, an open source software product that they have put no funding into, have no security checked, have not audited and have not actually put any real effort into securing, then that's their responsibility. If they don't want to be susceptible to Apache 0-day vulnerabilities, they should figure out what they need to do to not be susceptible to a 0-day. That's their problem, not mine. Never mine. Always theirs. That's how responsibility works. That's how it's always worked. If a lawyer provides poor legal advice because a contracted investigator got something wrong, the responsibility lies with the lawyer.
- borplk 10y ago
  Yep. This is generally true in business about a lot of things and especially in software because of the virtual nature of things it creates an incentive for people to pretend things and inflate their claims so they get put in the same bucket as the big guys. That's how you end up with a weak site run by 2 people on a shared hosting with outdated software but they put up a polished home-page with "military-grade 256-bit encryption" on it and a lock icon and a chunk of people will not know better. I'm sure there's a proper term in economic theory for this concept someone can point out. No one says "security of our users is our 158th priority". However their behaviour very clearly shows it. They just want the benefits of a perception of security without actually putting in the effort. And when the chances of getting punished for it is low enough they can get away with it. This attitude also creates opportunity for a certain class of employees/contractors to shine. The type that does a very shallow job but claims that "everything is done". Business people love that and think that person is so smart and effective. Want backups? No problem he'll drop a single line in a cron file to generate unverified nightly backups sitting in /var/backups and says "I have taken care of backups." in 20 minutes. Chances are nothing goes wrong for years and he'll be the super efficient hero. But it's also possible that the business will suffer catastrophic data loss and finds out the true cost of their decisions. The person who wants to tackle the problem more deeply gets punished because they think he/she is too slow or makes things complicated. It can get pretty frustrating because what happens is you end up getting asked to achieve something and when you attempt to do it people will be like "no no no we didn't mean like that ... can't you just install a security plugin or something in there in an afternoon and move on to the next task?". So you will be forced to do it in a way that is not effective/full-proof and when things go bad you still have to take the blame because it was your responsibility. At some point I started calling people out on it.
ksk 10y ago
I think security in general has gotten so bad that keeping things secure by putting them under lock and key is much more practical than using any of the myriad different useless security products that claim to protect you.
- jaypaulynice 10y ago
  Security hasn't gotten any worse than it's been. It's much more visible now and all systems are practically connected through APIs.. Lack of security knowledge is the problem I think. In fact most companies that are hacked don't know it and don't have the knowledge to detect and mitigate them. Security was much worse in the beginning of 2000's with dial ups. Also don't forget about social engineering...that's a bigger concern than physical hacks...
  - ksk 10y ago
    Well it depends on how you look at it. Today we have many more devices connected to the internet, and like you mentioned, the interconnected nature of devices, increases the surface area for exploits (and other non-exploits like denial of service attacks). Also back in the day the people using computers were more savvier about tech in general, making the whole situation much more worse IMO.
- maxxxxx 10y ago
  I recently have to deal with code security. I am very experienced developer but this topic is just overwhelming. Almost no one can give you a definitive answer and there are plenty of "experts" who are happy to give you conflicting advice. With a lot of other code you can test your assumptions but how do you know you are secure? How do you test that?

34 points by martincmartin 10y ago

This is the reason we're working on RESTfender https://restfender.co https://restfender.co We're in semi stealth mode but more to come soon!

SteveNuts 10y ago
That 4MB background image though
- jaypaulynice 10y ago
  Haha...the original is 12MB. I reduced it to 1MB...it's hard to keep the details if the image is any smaller...

YCode 10y ago

One message I hear repeatedly from cyber security pros is their organizations claim security is critical... That its, until you show them the price tag. So long as they aren't willing to resource to security and they aren't held accountable for breaches this trend will basically continue.

ksk 10y ago
Yes, security is a practical reality and firms should be spending more on it. But I don't quite understand the victim blaming. Why should a company that gets attacked be held accountable?
- deleted 10y ago
  [deleted]
- Eridrus 10y ago
  Because their negligence results in harm's to entities other than the company. Often to the firm's customers, either because the firm directly lost control of private data or because their customers got hacked through their software.
  - ksk 10y ago
    I don't follow. Are you saying that a company should be blamed for flaws in products which they simply purchased?
    - milesrout 10y ago
      If you provide a product or service to your customers you are entirely responsible for it. If I buy a laptop and it craps out I don't send it back to the manufacturer, I take it back to the retailer.
      - ksk 10y ago
        Okay, but a service and product has a warranty, and most software comes with a limited warranty allowing you to return it so I'm not sure what you mean. If Apache has a 0-day, what you want the bank to do about it if their website gets hacked?
        milesrout 10y ago
        >Okay, but a service and product has a warranty, and most software comes with a limited warranty Products have warranties, but this isn't really what I'm talking about. That was just an example of who is responsible: the person that you deal with is responsible. You buy a product or a service? The person you bought it from is 100% responsible. >If Apache has a 0-day, what you want the bank to do about it if their website gets hacked? The bank shouldn't be relying on software that it can't be sure is secure. If it's using Apache, and Apache has a 0-day, that shouldn't let people get all the way into their cluster and then into all their systems. They should have security in depth. The bank is responsible for the security of their customers' data. If they rely on Apache, an open source software product that they have put no funding into, have no security checked, have not audited and have not actually put any real effort into securing, then that's their responsibility. If they don't want to be susceptible to Apache 0-day vulnerabilities, they should figure out what they need to do to not be susceptible to a 0-day. That's their problem, not mine. Never mine. Always theirs. That's how responsibility works. That's how it's always worked. If a lawyer provides poor legal advice because a contracted investigator got something wrong, the responsibility lies with the lawyer.
borplk 10y ago
Yep. This is generally true in business about a lot of things and especially in software because of the virtual nature of things it creates an incentive for people to pretend things and inflate their claims so they get put in the same bucket as the big guys. That's how you end up with a weak site run by 2 people on a shared hosting with outdated software but they put up a polished home-page with "military-grade 256-bit encryption" on it and a lock icon and a chunk of people will not know better. I'm sure there's a proper term in economic theory for this concept someone can point out. No one says "security of our users is our 158th priority". However their behaviour very clearly shows it. They just want the benefits of a perception of security without actually putting in the effort. And when the chances of getting punished for it is low enough they can get away with it. This attitude also creates opportunity for a certain class of employees/contractors to shine. The type that does a very shallow job but claims that "everything is done". Business people love that and think that person is so smart and effective. Want backups? No problem he'll drop a single line in a cron file to generate unverified nightly backups sitting in /var/backups and says "I have taken care of backups." in 20 minutes. Chances are nothing goes wrong for years and he'll be the super efficient hero. But it's also possible that the business will suffer catastrophic data loss and finds out the true cost of their decisions. The person who wants to tackle the problem more deeply gets punished because they think he/she is too slow or makes things complicated. It can get pretty frustrating because what happens is you end up getting asked to achieve something and when you attempt to do it people will be like "no no no we didn't mean like that ... can't you just install a security plugin or something in there in an afternoon and move on to the next task?". So you will be forced to do it in a way that is not effective/full-proof and when things go bad you still have to take the blame because it was your responsibility. At some point I started calling people out on it.

ksk 10y ago

I think security in general has gotten so bad that keeping things secure by putting them under lock and key is much more practical than using any of the myriad different useless security products that claim to protect you.

jaypaulynice 10y ago
Security hasn't gotten any worse than it's been. It's much more visible now and all systems are practically connected through APIs.. Lack of security knowledge is the problem I think. In fact most companies that are hacked don't know it and don't have the knowledge to detect and mitigate them. Security was much worse in the beginning of 2000's with dial ups. Also don't forget about social engineering...that's a bigger concern than physical hacks...
- ksk 10y ago
  Well it depends on how you look at it. Today we have many more devices connected to the internet, and like you mentioned, the interconnected nature of devices, increases the surface area for exploits (and other non-exploits like denial of service attacks). Also back in the day the people using computers were more savvier about tech in general, making the whole situation much more worse IMO.
maxxxxx 10y ago
I recently have to deal with code security. I am very experienced developer but this topic is just overwhelming. Almost no one can give you a definitive answer and there are plenty of "experts" who are happy to give you conflicting advice. With a lot of other code you can test your assumptions but how do you know you are secure? How do you test that?