4 ms·

It’s not deliberate in the sense they want people to be vulnerable. It’s the path of least resistance in action. If you make it significantly more work to do

It’s not deliberate in the sense they want people to be vulnerable. It’s the path of least resistance in action. If you make it significantly more work to do something than not then people simply won’t do it. As the visible difference between secure and insecure is invisible to management it slides. As an industry we’ve failed all horribly at making secure the easy default option. And that’s going to haunt all of us.

bsder 7y ago
> As an industry we’ve failed all horribly at making secure the easy default option. This will never and can never happen. Security and sharing are at odds. If I don't want connectivity, I don't even buy a connected controller as it is more expensive. So, the fact that a connected controller got bought means someone wanted connectivity. Of course, the person who wanted connectivity didn't allocate any actual money to the person actually doing configuration, maintenance, auditing, updating, etc. Only at this point, do we have the fact that configuring a secured device is a pain. So, the default is to turn off all the security to get it up and running. After that, if someone can't tweak the software to turn the security back on in a couple of hours, it gets left off (remember--nobody actually allocated budget so these are unbillable, wasted hours). All of this together collides into a nice big pile of fail.
- lazulicurio 7y ago
  > > As an industry we’ve failed all horribly at making secure the easy default option. > This will never and can never happen. Security and sharing are at odds I don't think the GP was suggesting that products be made so secure to be functionally useless. There's a wide spectrum between completely open and completely locked down. But right now the gradient to go from open -> secure is so steep that most people aren't willing to put in the effort. For example, have you ever tried using OpenSSL to create a self-signed certificate? The defaults are probably not what you want. Adding on stuff like the proper certificate extensions is even more work. Products should be designed so that it's not a herculean task to add security when you're ready to take that step.
lazulicurio 7y ago
> It’s the path of least resistance in action This. Combined with the fact that the handful of people who have the knowledge/experience to properly secure the systems are probably too busy/overworked to expend the time to improve the situation. Note that the time to improve the situation includes not only the actual time to implement the changes, but also the time to play politics and get funding/resources. At least at the company I work at, management cared about security for about a month after Wannacry happened. Once all the PCs were patched for that specific issue, it was back to business as usual.
- nickpsecurity 7y ago
  "This. Combined with the fact that the handful of people who have the knowledge/experience to properly secure the systems are probably too busy/overworked to expend the time to improve the situation" That's not true. There's tons of people that could setup VPN's or whatever for them that are better than what we see. The actual problem is management doesn't care about security with no financial damages for that in most cases. So, they don't try to secure the project. I've known a few engineers doing embedded systems telling me how their customers almost always ignored warnings if dollars invested was somewhere above zero.
  - fuzz4lyfe 7y ago
    The above commenter said: > Note that the time to improve the situation includes not only the actual time to implement the changes, but also the time to play politics and get funding/resources. That's the problem. Explaining to the beancounters why this is needed and why Susan can't just RDP in from home anymore. The implementation of these things are fairly trivial, the hand holding takes forever. Add the fact that lots of us got into IT to avoid playing these games and you've got the current state of affairs. I work on a safety critical piece of software. To give QE more than a day or two to test it is a fight every single release. After many unsuccessful attempts I stopped swinging at windmills. We pulled about half of the software releases we made last year due to patient safety issues discovered by customers. Management still wants "agile"
    - 7y ago

bsder 7y ago

> As an industry we’ve failed all horribly at making secure the easy default option. This will never and can never happen. Security and sharing are at odds. If I don't want connectivity, I don't even buy a connected controller as it is more expensive. So, the fact that a connected controller got bought means someone wanted connectivity. Of course, the person who wanted connectivity didn't allocate any actual money to the person actually doing configuration, maintenance, auditing, updating, etc. Only at this point, do we have the fact that configuring a secured device is a pain. So, the default is to turn off all the security to get it up and running. After that, if someone can't tweak the software to turn the security back on in a couple of hours, it gets left off (remember--nobody actually allocated budget so these are unbillable, wasted hours). All of this together collides into a nice big pile of fail.

lazulicurio 7y ago
> > As an industry we’ve failed all horribly at making secure the easy default option. > This will never and can never happen. Security and sharing are at odds I don't think the GP was suggesting that products be made so secure to be functionally useless. There's a wide spectrum between completely open and completely locked down. But right now the gradient to go from open -> secure is so steep that most people aren't willing to put in the effort. For example, have you ever tried using OpenSSL to create a self-signed certificate? The defaults are probably not what you want. Adding on stuff like the proper certificate extensions is even more work. Products should be designed so that it's not a herculean task to add security when you're ready to take that step.

lazulicurio 7y ago

> It’s the path of least resistance in action This. Combined with the fact that the handful of people who have the knowledge/experience to properly secure the systems are probably too busy/overworked to expend the time to improve the situation. Note that the time to improve the situation includes not only the actual time to implement the changes, but also the time to play politics and get funding/resources. At least at the company I work at, management cared about security for about a month after Wannacry happened. Once all the PCs were patched for that specific issue, it was back to business as usual.

nickpsecurity 7y ago
"This. Combined with the fact that the handful of people who have the knowledge/experience to properly secure the systems are probably too busy/overworked to expend the time to improve the situation" That's not true. There's tons of people that could setup VPN's or whatever for them that are better than what we see. The actual problem is management doesn't care about security with no financial damages for that in most cases. So, they don't try to secure the project. I've known a few engineers doing embedded systems telling me how their customers almost always ignored warnings if dollars invested was somewhere above zero.
- fuzz4lyfe 7y ago
  The above commenter said: > Note that the time to improve the situation includes not only the actual time to implement the changes, but also the time to play politics and get funding/resources. That's the problem. Explaining to the beancounters why this is needed and why Susan can't just RDP in from home anymore. The implementation of these things are fairly trivial, the hand holding takes forever. Add the fact that lots of us got into IT to avoid playing these games and you've got the current state of affairs. I work on a safety critical piece of software. To give QE more than a day or two to test it is a fight every single release. After many unsuccessful attempts I stopped swinging at windmills. We pulled about half of the software releases we made last year due to patient safety issues discovered by customers. Management still wants "agile"
  - 7y ago