3 ms·

> As many observers have pointed out to us, we made a mistake by not finding a way to consult with the community and obtain permission before running this study

> As many observers have pointed out to us, we made a mistake by not finding a way to consult with the community and obtain permission before running this study; we did that because we knew we could not ask the maintainers of Linux for permission, or they would be on the lookout for the hypocrite patches. In some ways this reminds me of a phishing exercise at work that was done under the guise of security awareness training. Is it just me or is there a pattern of behavioral issues among security people and a lack of empathy.

suramya_tomar 5y ago
Please note that the senior management is always in the loop for the phishing tests along with some of the security team. It's just the users who are not told. You can't just send out a phishing email without telling anyone about it, you are liable to get fired for it. Remember the first rule of cybersecurity testing is to get written permission and then establish rules of engagement. All these researchers had to do was reach out to Greg, loop him in the study to get his go ahead for it. Now that several of these 'patches' are now in stable and in fact did introduce issues is a big problem and a major waste of time for the maintainers.
hn8788 5y ago
In my experience, it's not a lack of empathy, but trying to prove to management that they shouldn't get rid of the security team. At most companies I've done security testing at, telling management that you didn't find any vulnerabilities immediately puts you and your team on the chopping block because they think you're a waste of money if you don't find anything. I've noticed it's mostly new people who aren't confident they can easily find a job are the ones most often going out of their way to report security issues that aren't actually a big deal.
litoorachure 5y ago
At least those phishing exercises are done with the informed consent of the organization. If they go too far and impact day-to-day work, or if people complain, the executives understand what is going on and who they can talk to about improving the process. And if it feels lacking in empathy, consider that the company's management needs to sign off on any (legal) phishing tests that their employees are subjected to.

suramya_tomar 5y ago

Please note that the senior management is always in the loop for the phishing tests along with some of the security team. It's just the users who are not told. You can't just send out a phishing email without telling anyone about it, you are liable to get fired for it. Remember the first rule of cybersecurity testing is to get written permission and then establish rules of engagement. All these researchers had to do was reach out to Greg, loop him in the study to get his go ahead for it. Now that several of these 'patches' are now in stable and in fact did introduce issues is a big problem and a major waste of time for the maintainers.

hn8788 5y ago

In my experience, it's not a lack of empathy, but trying to prove to management that they shouldn't get rid of the security team. At most companies I've done security testing at, telling management that you didn't find any vulnerabilities immediately puts you and your team on the chopping block because they think you're a waste of money if you don't find anything. I've noticed it's mostly new people who aren't confident they can easily find a job are the ones most often going out of their way to report security issues that aren't actually a big deal.

litoorachure 5y ago

At least those phishing exercises are done with the informed consent of the organization. If they go too far and impact day-to-day work, or if people complain, the executives understand what is going on and who they can talk to about improving the process. And if it feels lacking in empathy, consider that the company's management needs to sign off on any (legal) phishing tests that their employees are subjected to.