4 ms·
"A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now
by zer00eyz 7y ago
"A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one."
No one in management wants the expense or the overhead of actual security. They want the "theater" of security, the good feeling, the box to check on their resume (as management) so everyone can pretend everything is fine and go back to the business at hand. Then something real happens, a leak of user data, or credit cards or internal memos... suddenly everyones job is security and no one knows what to do. The last problem gets solved, there is more "theater" and a few quickly forgotten changes that get worked around or just ignored in the long run.
Furthermore your average engineer wouldn't eat a ham sandwich handed to them on the street by a stranger but will happily run code from 100's of other people on their servers with out even looking at it. Note: I too am guilty as charged. Sure you can vendor it, and miss out on future security patches (it was already broken). Or you could just pull it from whatever repo you got it from to begin with and pick up new flaws. Never mind the fact that pulling from random places assumes that all those other chains of trust remain un-compromised.
Management and Engineers should be the ones most concerend and most thoughtful regarding security and both seem to ignore it for cost and convenience reasons till it is (far too late and) a REAL problem.
- antihero 7y ago> Furthermore your average engineer wouldn't eat a ham sandwich handed to them on the street by a stranger We would however eat one provided by a café that our colleagues recommended.
- CathedralBorrow 7y agoThat's true, and a good point, but a big part of that trust comes from the knowledge that no one can run a café without some kind of oversight and inspection on food safety. I probably wouldn't eat a sandwich from a bootleg café.
- TheOtherHobbes 7y agoDefine "bootleg." http://heartbleed.com/ http://heartbleed.com/
- CathedralBorrow 7y agos/bootleg/unlicensed/g
- solidasparagus 7y agoI would if the alternative was to grow all my own food.
- gorgoiler 7y agoOr one from the company cafeteria. I’m not sure if this is the point you were making, but trust, insight and ability to get things done is quite different when working internally in an org versus working with an outside-org, and it’s a big deal. My biggest burnout was when internal teams I worked with started to feel like external teams. That was more about engineering teams but another example: I strongly discouraged internal IT from adopting vendor/client language and mentality. Relationships like that put them on the back foot, become defensive, and when you encounter problems the sense of being able to honestly ask what’s actually going wrong here? evaporates.
- Proven 7y ago> B, multiply by the average out-of-court settlement, > If X is less than the cost of a recall, we don't do one. Pray tell - what do you propose? Keep fiddling until no one but government officials and high level executives can afford to buy or rent a car? > No one in management wants the expense or the overhead of actual security. Wrong. Almost no one wants (and can afford) to _pay_ for the cost overhead you're (completely subjectively) implying would be sufficient. This fantasy thinking has been going on ever since Ford Pinto, as if safe cars aren't available and everyone is forced to buy unsafe cars. Is there a law that bans Benz or Volvo?
- mschuster91 7y ago> No one in management wants the expense or the overhead of actual security. They want the "theater" of security, the good feeling, the box to check on their resume (as management) so everyone can pretend everything is fine and go back to the business at hand. Then something real happens, a leak of user data, or credit cards or internal memos... suddenly everyones job is security and no one knows what to do. The last problem gets solved, there is more "theater" and a few quickly forgotten changes that get worked around or just ignored in the long run. The incentive is that if every box was checked and shit hits the fan, insurance is on the hook to pay for stuff and not the company or the responsible party.
- 2rsf 7y ago> If X is less than the cost of a recall, we don't do one. We didn't take into account loss of sales and reputation, the equation is not (should not) be that simple
- beerandt 7y agoIt's a movie quote.
- vincent-toups 7y agoAlmost everything anyone does in business, as far as I can tell, is dramatically optimized for speed at the expense of almost everything else. This is a natural result of a very competitive market place and, as far as I can tell, its rational if you take that circumstance to be an immutable state of affairs. Its no good stopping to dot the i's and cross the t's if, in doing so, you get completely edged out of the market by a competitor who isn't doing so. And you haven't even made the world a better, safer, nicer place by doing so. You've just left the door open for someone less scrupulous to beat you with a shittier product. The solutions aren't palatable in the current philosophical mode: much more aggressive penalties (corporate death penalties, for instance, in which shareholders literally lose all their money) or much tighter and well enforced regulations. Move fast and break stuff truly is the philosophy of the day. If you don't want to break stuff, you have to make moving fast less competitive. As far as I can tell, that's the only way.
- LeonM 7y agoFor those who didn't get the reference: The OP is quoting Tyler Durden, a fictional character of the movie 'fight club'. So take it with a grain of salt.
- CelestialTeapot 7y agoThat is indeed fictional, but the real world Ford Pinto that was based on is real [1]. 1. https://www.tortmuseum.org/ford-pinto/ https://www.tortmuseum.org/ford-pinto/
- wrayjustin 7y agoOr, take it for what it is, a quote from a movie. But don't dismiss the merits of the idea. It's essential Risk Management[0], which is most certainly a relevant part of Information Security. Specifically, this is a form of Cost-Benefit Analysis (specifically, Qunatativie Risk Analysis[1]), a critical component in proper Risk Management; the reality is you cannot "fix" every issue. Take a look at methods like Single Loss Expectancy[2] and Annualized Loss Expectancy[3]; you'll find that the Fight Club quote is very close to the real-world methodology. I cannot speak for the Automobile Insurance industry, but given Insurance is founded in Risk Management, it seems likely to be closer to reality than not. [0] https://en.wikipedia.org/wiki/Risk_management https://en.wikipedia.org/wiki/Risk_management [1] https://csrc.nist.gov/csrc/media/publications/conference-paper/1999/10/21/proceedings-of-the-22nd-nissc-1999/documents/papers/p28.pdf https://csrc.nist.gov/csrc/media/publications/conference-pap... [2] https://en.wikipedia.org/wiki/Single-loss_expectancy https://en.wikipedia.org/wiki/Single-loss_expectancy [3] https://en.wikipedia.org/wiki/Annualized_loss_expectancy https://en.wikipedia.org/wiki/Annualized_loss_expectancy
- rangibaby 7y agoFight Club is referencing to a real document made by Ford, the "Pinto Memo"
- deleted 7y ago[deleted]
- tanseydavid 7y agoThe quote is resonant because anybody with first hand experience with the way "corporations" think internally about such matters KNOWS that this is EXACTLY how it plays out.
- xamuel 7y ago>They want the "theater" of security, the good feeling, the box to check on their resume (as management) so everyone can pretend everything is fine and go back to the business at hand. And don't forget the universal elixir that cures all security ills: adding even more rules about which passwords are allowed.
- olyjohn 7y agoMake sure you change your password every 30 days, too. That way I have to write it down, or use a sequential password just in order to be able to remember it.
- xamuel 7y agoNo worries, though: if you forget your password you can just call up IT and get it changed to "welcome1" :)
- singron 7y ago"Your password is too similar to one of your previous 24 passwords" -- an actual error message I've gotten before.
- hackinthebochs 7y agoGoogle started doing this. I spent an hour changing my password literally 100 times to clear their cache of the password I intended to set. It's insanity.
- greedo 7y agoThe biggest checkbox in any project/contract/initiative is the one marked "Plausible Deniability." Mgmt often goes by another dictum "Success has many fathers, failure is an orphan."