3 ms·

"However, if one class of bugs is responsible for 80% of breaches, isn't it worth investigating to see what you can do about that one class of bug?" Fires beco

by jerf 7y ago

"However, if one class of bugs is responsible for 80% of breaches, isn't it worth investigating to see what you can do about that one class of bug?" Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. Arguably, the best solution wouldn't be to try to extinguish the sources of ignition, but greatly increase them so that it's just something that happens all the time. (Another thing they definitely don't share in common with security vulnerabilities.) Of course, the best solution is to hop in a suitably tricked-out De Lorean and start that policy a hundred years ago. The steady-state of this plan is probably pretty nice. However, getting there from here is a real problem. But I'm not sure there's any way around that problem anymore. That's another part of what I mean by "there's already a fire, it just isn't burning yet"; trying to pretend that there's some solution that doesn't involve fire is just fooling oneself. It's only a question of when, not if. If California could be trusted to do something useful with the time, enough so that they get meaningfully ahead of the still-accumulating fuel, "buying time" would be a viable option, but I see very little evidence that anything useful is being done. Links solicited to the contrary; I haven't gone looking. But if the solution is just "try to never ever spark anything and thus The Problem Is Solved!", yeah, that's not a solution. It does nothing to stop the fire-in-waiting from getting bigger.

dredmorbius 7y ago
One nit on an otherwise strong explanation: Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. I'd argue that this isn't the case. The threats of Big Data and Big Data Breaches is directly analagous to fuel-load accumulation, with the added bonus of attractive nuisance / induced risk. That is, we're seeing the same class of bugs we've always seen (ignition sources), but the consequences are vastly higher (international finance, national security, organised crime, personal details and blackmail on billions of souls, greatly expanded venues for long-standing frauds). Buffer overflows, viruses, worms, trojans, social engineering, phishing, and MITM all predated the past decade. Advanced-fee fraud, impersonation, Ponzi schemes, etc., all existed previously. Married through high-speed, high-capacity data networks, tied to comprehensive and deep data stores, the whole system is weaponised. And the stakes and consequences are huge. Rather like wildfires in California. By the way, I've got a Mr. Fusion cannister sitting in the garage, interested?
- jerf 7y ago
  Fair enough... I was speaking in a fairly limited sense where having one security vulnerability in a product doesn't necessarily impact another (assuming they can't be chained) on a single product, but there are dimensions in which it is similar, yes.
  - dredmorbius 7y ago
    Thinking cross-domain on various threats and risks is interesting and useful. I wouldn't have thought of the situation if you'd not made your assertion, so it was useful in that way ;-)
nostrademons 7y ago
> Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. Security vulnerabilities do have that property: if you find that buffer overflow, you can usually get an RCE, which will let you get root, which will let you compromise the network that the box is on, which will let you find additional vulnerabilities (human or otherwise) to compromise other systems. That's why competent security teams practice defense in depth, and have internal trip-wires and firewalls to limit the damage of any intrusion. That doesn't absolve you from trying to stop the intrusion in the first place. Similarly, getting PG&E to maintain their equipment is not mutually exclusive with other fire mitigation strategies like controlled burns, defensible space, homeowner education, etc. If anything it'll free up resources for those interventions by switching fire departments out of, well, firefighting mode and giving them some breathing space to focus on more long-term practices.

by jerf 7y ago

dredmorbius 7y ago

One nit on an otherwise strong explanation: Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. I'd argue that this isn't the case. The threats of Big Data and Big Data Breaches is directly analagous to fuel-load accumulation, with the added bonus of attractive nuisance / induced risk. That is, we're seeing the same class of bugs we've always seen (ignition sources), but the consequences are vastly higher (international finance, national security, organised crime, personal details and blackmail on billions of souls, greatly expanded venues for long-standing frauds). Buffer overflows, viruses, worms, trojans, social engineering, phishing, and MITM all predated the past decade. Advanced-fee fraud, impersonation, Ponzi schemes, etc., all existed previously. Married through high-speed, high-capacity data networks, tied to comprehensive and deep data stores, the whole system is weaponised. And the stakes and consequences are huge. Rather like wildfires in California. By the way, I've got a Mr. Fusion cannister sitting in the garage, interested?

jerf 7y ago
Fair enough... I was speaking in a fairly limited sense where having one security vulnerability in a product doesn't necessarily impact another (assuming they can't be chained) on a single product, but there are dimensions in which it is similar, yes.
- dredmorbius 7y ago
  Thinking cross-domain on various threats and risks is interesting and useful. I wouldn't have thought of the situation if you'd not made your assertion, so it was useful in that way ;-)

nostrademons 7y ago

> Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. Security vulnerabilities do have that property: if you find that buffer overflow, you can usually get an RCE, which will let you get root, which will let you compromise the network that the box is on, which will let you find additional vulnerabilities (human or otherwise) to compromise other systems. That's why competent security teams practice defense in depth, and have internal trip-wires and firewalls to limit the damage of any intrusion. That doesn't absolve you from trying to stop the intrusion in the first place. Similarly, getting PG&E to maintain their equipment is not mutually exclusive with other fire mitigation strategies like controlled burns, defensible space, homeowner education, etc. If anything it'll free up resources for those interventions by switching fire departments out of, well, firefighting mode and giving them some breathing space to focus on more long-term practices.