5 ms·

I'm married to an attorney. I like to think she's generally honest. She has put together some form contracts for software businesses I've been in, and they have

I'm married to an attorney. I like to think she's generally honest. She has put together some form contracts for software businesses I've been in, and they have the nice attribute that everybody says "this is a fair deal" and signs them. I can say that the legal code of ethics has some bright lines in it. If a client gives you funds to hold for some reason, and you put them into your own account, and you get caught doing that, you get disbarred : you lose the right to call yourself a lawyer and/or appear in court for your clients. If you give another lawyer money to induce him to tell his client to sue your client so you both get fees, you get hauled up before the bar overseers on charges. If you talk about your clients' business without their permission, you get hauled up on charges. To say "lawyers are unethical" is to fall prey to the availability heuristic. We all know about scumbag pols who happen to be lawyers. I think gregwtmnto has a point. If we software people had something like Professional Engineer (PE) registration (civil engineers have that), it would help. Companies gathering sensitive information could ask for a PE to sign off on the security measures. That would serve them as a defense should somebody sue them for damages after a leak. The same is true for bridge designers. PEs sign off on the designs, after making sure the bolts are strong enough and the pilings are deep enough and all that stuff. This cyber security subject is near to me; my present (small) company finished our PCI (payment card industry) audit yesterday. We've worked hard to avoid the stupid webdev tricks in Troy's article, and even some not-so-stupid vulnerabilities. These stupid tricks erode confidence in all of us. Hold my beer. Watch this!

greyfox 10y ago
can you please link to troy's article? i'm interested in reading it.
- pcl 10y ago
  I expect he's referring to the post from yesterday: https://www.troyhunt.com/reckon-youve-seen-some-stupid-security-things-here-hold-my-beer/ https://www.troyhunt.com/reckon-youve-seen-some-stupid-secur... https://news.ycombinator.com/item?id=14218270 https://news.ycombinator.com/item?id=14218270
dsacco 10y ago
Security is near and dear to me too, so I'll use that example for my rebuttal. Would you like to know how many companies I have found serious vulnerabilities in which had previous audits for things like PCI and ISO 27001? Their CISOs had cute certifications, too. They could talk all day about what XSS is, what a good business continuity plan looks like, all the different types of "risk treatment"... I've sat on the other side of an audit, as an internal security engineer for a bank. Our QSA literally said to my team one day, "That sounds great, now can we switch gears and talk about your cyber program?" I like to think we honestly did well on those PCI audits, but I also know that we didn't have to do well. We could bullshit our way through it. And even if you try hard, it has little to no signal. Requiring engineers to know OWASP, or to memorize organizational risk facts doesn't work. Requiring your company to get a third party audit sort of works, if you know what a reputable firm actually looks like. Requiring your company to get third party "network segmentation scans" is a waste of time that will leave you wondering how a company stays in business that reports false positives all over your infra. The security industry is a rabbit hole of oblivion. Vendors don't know what they're doing. Consulting firms barely know what they're doing. What you suggest will not meaningfully change that. As I repeat time and time again, the most talented and effective individuals I've known in the security industry have no certifications, or reluctantly get them to shut HR up. Some of them never even went to college. You would need to dramatically rethink what an enforcing agency looks like to have effective certifications without allowing them to be the rent-collecting they currently are. I would be genuinely interested in hearing a concrete proposal for what an effective certification or licensing body would look like and how it would fairly enforce its requirements. If it's a model that could work, then fine; hit reset on the current organizations or dramatically improve their processes. But comparisons to other industries aren't good enough, and thus far the evidence is stacked against it.
- OliverJones 10y ago
  You are right about the porousness of certifications. I guess part of the problem is the legalistic approach we take to security, in practice. A crude example: to be secure, passwords have to be changed every 90 days. Check. If the QSA firm finds we're following all the rules, we get certified. But rules lull us into complacency. Rules give cybercreeps an accurate roadmap of our cyberdefenses. If they know ways around our defenses, we're pwned. So, adhering to the letter of the security regulations, while not actually bad, isn't enough. Dealing with the OWASP top ten is good. But, if I were a cybercreep, I'd be working on the down-chart problems, OWASP 13, 14, 15 etc. A related question: How do we frame laws to outlaw corruption among politicians? Laws create loopholes. As you point out, lots of charlatans and idiots hold themselves out as cybersecurity experts. How do we deal with the problem? My immediate objective is to keep cybercreeps outside my firewall and away from my customers. And if they get in, my objective is to expel them quickly. I argue that transparency is key. We can only defend against what we can see. The open source movement helps. I argue that a registered professional engineer certification provides at least some transparency about qualifications and ethical motivation, a transparency our industry now lacks.

greyfox 10y ago

can you please link to troy's article? i'm interested in reading it.

pcl 10y ago
I expect he's referring to the post from yesterday: https://www.troyhunt.com/reckon-youve-seen-some-stupid-security-things-here-hold-my-beer/ https://www.troyhunt.com/reckon-youve-seen-some-stupid-secur... https://news.ycombinator.com/item?id=14218270 https://news.ycombinator.com/item?id=14218270

dsacco 10y ago

Security is near and dear to me too, so I'll use that example for my rebuttal. Would you like to know how many companies I have found serious vulnerabilities in which had previous audits for things like PCI and ISO 27001? Their CISOs had cute certifications, too. They could talk all day about what XSS is, what a good business continuity plan looks like, all the different types of "risk treatment"... I've sat on the other side of an audit, as an internal security engineer for a bank. Our QSA literally said to my team one day, "That sounds great, now can we switch gears and talk about your cyber program?" I like to think we honestly did well on those PCI audits, but I also know that we didn't have to do well. We could bullshit our way through it. And even if you try hard, it has little to no signal. Requiring engineers to know OWASP, or to memorize organizational risk facts doesn't work. Requiring your company to get a third party audit sort of works, if you know what a reputable firm actually looks like. Requiring your company to get third party "network segmentation scans" is a waste of time that will leave you wondering how a company stays in business that reports false positives all over your infra. The security industry is a rabbit hole of oblivion. Vendors don't know what they're doing. Consulting firms barely know what they're doing. What you suggest will not meaningfully change that. As I repeat time and time again, the most talented and effective individuals I've known in the security industry have no certifications, or reluctantly get them to shut HR up. Some of them never even went to college. You would need to dramatically rethink what an enforcing agency looks like to have effective certifications without allowing them to be the rent-collecting they currently are. I would be genuinely interested in hearing a concrete proposal for what an effective certification or licensing body would look like and how it would fairly enforce its requirements. If it's a model that could work, then fine; hit reset on the current organizations or dramatically improve their processes. But comparisons to other industries aren't good enough, and thus far the evidence is stacked against it.

OliverJones 10y ago
You are right about the porousness of certifications. I guess part of the problem is the legalistic approach we take to security, in practice. A crude example: to be secure, passwords have to be changed every 90 days. Check. If the QSA firm finds we're following all the rules, we get certified. But rules lull us into complacency. Rules give cybercreeps an accurate roadmap of our cyberdefenses. If they know ways around our defenses, we're pwned. So, adhering to the letter of the security regulations, while not actually bad, isn't enough. Dealing with the OWASP top ten is good. But, if I were a cybercreep, I'd be working on the down-chart problems, OWASP 13, 14, 15 etc. A related question: How do we frame laws to outlaw corruption among politicians? Laws create loopholes. As you point out, lots of charlatans and idiots hold themselves out as cybersecurity experts. How do we deal with the problem? My immediate objective is to keep cybercreeps outside my firewall and away from my customers. And if they get in, my objective is to expel them quickly. I argue that transparency is key. We can only defend against what we can see. The open source movement helps. I argue that a registered professional engineer certification provides at least some transparency about qualifications and ethical motivation, a transparency our industry now lacks.