9 ms·

Cybersecurity and the curse of binary thinking

153 points by kiyanwang 5y ago

dmbaggett 5y ago
I’m sure this article will get some hate from parts of the cybersecurity world, but to me —- who started in cyber in the 80s (when it was called “trusted computing”) and then came back to it decades later — it really resonates. The binary fallacy is endemic in cybersecurity. At INKY we do active blocking of phishing emails, so people automatically assume that we must take the position, as many of our peer companies do, that “simulated phishing awareness training is worthless”. What we’ve actually found is that phishing awareness training is useful in that it trains users to be rightly suspicious of the identities of email senders. It doesn’t really train users to spot phish, no, but that doesn’t make it worthless! On the subject of end users I agree with the author as well. What we’ve found is that if you give users useful guidance they truly understand, on a minority of emails, they actually follow it and click on far fewer bad links, pay fewer fake invoices etc. On the other hand, if you slap a static banner on every incoming email that says “external: be super careful!” and nothing else, users quickly learn to ignore this useless information and ultimately become completely blind to it. (And no, making the banner really fugly doesn’t help any.) In our experience with email security over the last 6 years, escaping the tyranny of binary thinking is absolutely critical to getting users properly engaged.
- judge2020 5y ago
  The banners can be more intelligent than just ‘this email is external’ - eg. Google Workspace does a red ugly banner when incoming emails match names of people in your organization, while the default external banner is small and orange.
- tialaramex 5y ago
  What fraction of the phishing you see was just harvesting credentials? Because every such incident becomes irrelevant if you have unphishable credentials, and yet companies are going to spend a bunch of money on phishing prevention/ training and not move to unphishable credentials.
  - dmbaggett 5y ago
    I don’t know the percentage off hand but it’s certainly quite high and we do see huge numbers of fake O365 login sites in particular (often tailored to the intended victim’s company). The problem, though, is that the less frequent fake invoice or malware drive-by phish does a lot more damage, so frequency isn’t a great gauge of overall implied risk. Many of these other kinds of phish originate from third party accounts that have themselves been taken over. So it’s critical to deploy MFA to protect yourself, but that doesn’t help with all your third party contacts who don’t require MFA themselves. There have also been, in the last 6-9 months, more published on attacks that subvert MFA. You’d also be surprised how many “please buy gift card” kinds of phish we see. And yes people do fall for them if they get through.
- rcurry 5y ago
  Trusted computing. Oh man, those were heady days. We really thought we could lick that shit with type enforcement and all that jazz. Spending months analyzing covert channels and trying to hard to build safe systems. Now days all you have to do is send one damned email and you own the whole enterprise. So sad, it’s like it was all for naught. But hey, I still have a pristine copy of the rainbow books if you want one :-)
  - mikewarot 5y ago
    >We really thought we could lick that shit with type enforcement Why would type enforcement do any good? When do operating systems enforce types? My money is on capability based security, Genode and Fuchsia and GNU Hurd when it comes out. Give the users a safe way to run a program without exposing everything to danger, and you'll save everyone a ton of grief. The present scenario is analogous to building more and more layers of security out of crates of explosives. Any little reaction anywhere becomes a reaction everywhere, because all the code in our systems is trusted.
    - contextfree 5y ago
      object-capability security and type enforcement can go together - require programs to use some kind of hardened JVM/CLR-like typed runtime, then use the type system to model capabilities. A bunch of research operating systems from the 90s and 00s were based on this kind of design. Microsoft had a largeish engineering team working on one for 9 years (with a notion that it might some day supplant Windows; it was even briefly used in production to run some services, before the project was shut down in 2015). If you're curious about how it worked and why, one of the designers wrote some fascinating posts: http://joeduffyblog.com/2015/11/03/a-tale-of-three-safeties/ http://joeduffyblog.com/2015/11/03/a-tale-of-three-safeties/ (on how type safety worked) http://joeduffyblog.com/2015/11/10/objects-as-secure-capabilities/ http://joeduffyblog.com/2015/11/10/objects-as-secure-capabil... (on how the type system was used to model capabilities)
    - lokedhs 5y ago
      Trusted Solaris did. It was very complicated to use, so only organisations that really needed it were using it. The product was discontinued in the late 90's and its core features such as RBAC was included in standard Solaris in later versions. However, the more advanced stuff like tagging of connections, etc, was never included and was dropped with the demise of Trusted Solaris. I think it says a lot that I worked at Sun at the time and I actually never used it.
OrvalWintermute 5y ago
I take issue with part of this, as do many other actual technical security professionals. What is said: certifications like CISSP don’t represent the full spectrum of skills a professional needs therefore certifications are a waste of time. Reality: certifications represent a foundational body of knowledge for new entrants to the field - to start the "scaffolding" of their knowledge. It helps employers test a candidate’s commitment to the career and so is useful as long they don’t mandate it above all else. However, what does the ISC2 marketing material say? Let's take a peek! Earning the CISSP proves you have what it takes to effectively design, implement and manage a best-in-class cybersecurity program. With a CISSP, you validate your expertise and become an (ISC)² member, unlocking a broad array of exclusive resources, educational tools, and peer-to-peer networking opportunities. Prove your skills, advance your career, help earn the salary you want and gain the support of a community of cybersecurity leaders here to support you throughout your career From https://www.isc2.org/Certifications/CISSP https://www.isc2.org/Certifications/CISSP So, basically, a nontechnical certification that is shallow and broad has managed to insinuate itself as the way towards being able to run a security program, and more valuable than any technical security degree, or a CS degree, or a PHD in Cryptography. It claims to be both for security pros with many years experience, but others say it is foundational material. This has then led to a negative cycle of incompotence, bringing in nontechnical types into a field that is uniquely demanding for broad technical skills normally gained through years in the trenches (SRE/development/administration/network engineering) Is there any wonder why we have a security problem?
- Jotra7 5y ago
  College cybersecurity programs are utter trash. CS programs do not address security properly. This is why we have problems. Passing the CISSP is a way better guage of general security knowledge than any college cyber degree.
- yodelshady 5y ago
  > It claims to be both for security pros with many years experience, but others say it is foundational material > Is there any wonder why we have a security problem? You're absolutely right, but it hurt to read. I know the management/technical divide has existed for a while, and yes, I know management sometimes has a point in stopping technicals focusing on irrelevant details. But... jesus. I'm currently tasked with evaluating "what an attacker could do" having compromised <X> on a <Y> system. No, I'm not allowed to evaluate a specific <X>'s likely vulnerability, or even an exact specification of <Y> - because that's losing the bigger picture. What do I even say?
jasonhansel 5y ago
I think there's another sort of binary thinking that's even worse: thinking that systems are either "secure" (because no bugs have been identified) or "insecure" (because a serious bug has been found). In reality, all systems contain bugs, but the presence of a single bug shouldn't be enough, on its own, to render a system insecure: defense in depth should ensure that a system remains secure even in the presence of minor bugs in any one layer.
waihtis 5y ago
Mostly agree except for security ratings. Not only is it a wildly inaccurate measure of any organizations security, but it's potentially actively harmful also. Example: ratings vendors do a false assessment of the vulnerable state of assets you have, and refuse to correct the information on notice, therefore ruining your reputation with completely false information. It needs to die a painful death and re-emerge in a different form to be useful.
- CleverLikeAnOx 5y ago
  Completely agree. All of the incentives are wrong for security rating companies. Rating vendors are incentivized to have a rating for every company regardless of whether or not they have any insight. Rating vendors cannot act like real attackers, so they must rely on passively collecting some surface level information. This is often no better than you would get by walking through a website with Burp on and checking the list of alerts. You can pay rating vendors to help you "improve." That is to say, they are incentivized not to fix false assessment data. They can get you to pay for that.
  - teknopaul 5y ago
    I think on every point this article experessed pros and cons. That's what's needed. If you read and think "yes, but, this one thing is absolutely unacceptable" , you are at risk of missing the point.
    - CleverLikeAnOx 5y ago
      Yeah, I really liked the article overall. I see it as saying that these things people think in a binary fashion about should be treated with more nuance. The author addresses why these binary-style mantras exist and how they are not always true. There are two where I disagree with the author (not saying it's unacceptable; the author may be correct and me wrong): the CISSP one, and also the rating vendor one. The author takes a deeper view than the binary thinking, and I want to take it deeper yet to refute the author's view. This arrives at the same conclusion as the binary groupthink in the infosec community, but does so by explaining why the binary idea became de-facto standard. In case anyone is interested, my beef with CISSP is that the curriculum for CISSP certs promote a highly bureaucratic approach to security. I feel like it is largely a waste of time and money to get that cert. It rubs me the wrong way because once things like CISSP become required for some employment, it is hard to go back to more "lax" standards. Of course, it having a baseline of useful information like the author says is true. I just think CISSP is a net negative for society even so.
_trampeltier 5y ago
Last week when I heard about the Kapersky password manager thing (single source of entropy was the current time [1]), I asked myself, why is everybody allowed to write software. If you do a job like electrician or plumber, you have to learn and do tests in pretty much the whole world before you are allowed to work. Since I'm electrician myself, I know how stupid it can be sometimes to follow all the rules. But then if something happens, you are happy everything was installed in the right way. [1] https://donjon.ledger.com/kaspersky-password-manager/ https://donjon.ledger.com/kaspersky-password-manager/
- Forbo 5y ago
  I largely agree, although I would say it's less "stupid" and more "cumbersome". Nobody wants to take the time to do things right because of the effort costs, but this is going to ultimately be more beneficial in the long run. I think my favorite phrase from recent happenings that encapsulates this concept is "Ransomware actors are just technical debt collectors."
DJBunnies 5y ago
Lost me at promoting security through obscurity.
- easterncalculus 5y ago
  This is an attitude that I really hope leaves the industry eventually, because in truth people use security through obscurity all the time. Using it exclusively or in place of real measures is when it becomes a problem. Ask any IT professional who's had to patch zero days on internet-exposed systems whether they think changing the default port is useless, and practically all of them will tell you that it at least cuts down on logs, and means that you almost definitely won't get hit that first day with all the other people by script kiddies scanning the internet. Not posting your internal network diagrams, even though your security is 'open design', means that when someone sends the right email and breaches your perimeter, they still have to scan for what to go after. Additionally, this belief is almost exclusively held dogmatically by the private sector - classified government networks don't get hacked nearly as often as even your air-gapped corporate ones. Obscurity is never a replacement for 'true' security measures, and should only be added on after, but for a system you actually want to protect in the long term some amount of is often very useful.
  - AlexAndScripts 5y ago
    Just changing my SSH port to 900 has reduced the amount of brute force by a fraction.
    - AlexAndScripts 5y ago
      *too a fraction, not by a fraction
    - easterncalculus 5y ago
      That is reason enough, in my view. If you're going to install fail2ban for instance I feel that you might as well also change the port.
  - TameAntelope 5y ago
sharklazer 5y ago
The only way to look at security is to ask: “How many US Dollary-doos does it take to break this?” And if something costs more of them US Dollary-doos to break, then it is “more secure”.
- sharklazer 5y ago
  Replace the Dollary-doos with your favorite currency or medium of exchange.
- MauranKilom 5y ago
  It takes zero US dollars to walk onto my lawn and take a flower pot with you. Yet putting the flower put onto the sidewalk would drastically increase the odds of someone actually taking it. Opportunity and convenience do matter in terms of security. Maybe more in the physical world, but it's not irrelevant in the digital world either.
  - Karliss 5y ago
    Convenience aspect quckly turns into money at scale either directly or indirectly through time. It takes zero dollars to take single flowerpot but if you want to take 10000 you will need car, fuel and longer it takes to walk onto and away from lawn less flowerpots in an hour single person can collect. Same applies to computersecurity entering single captcha costs zero dollars but at scale you will have to hire someone doing it at x dollars per 1000 captchas.
    - sharklazer 5y ago
      So, you can't account for that the cost of scale? I guess that makes sense. I'll never ever ever measure things in dollars again because apparently I can't account for the effects of economies of scales... Or I could, you know, take the time to inform myself about these things.
habibur 5y ago
These are relevant within security professionals. But for the rest of us, the question more is about balancing between security vs usability+productivity+accessibility. Where you draw the balance is based on individual judgement, leading to endless debate and "binary thinking". > [...] if something isn’t perfect then it must be terrible, or that if you don’t fully agree with something then you must therefore absolutely disagree with it.
blfr 5y ago
> Reality: most end users make fully rationale [sic] decisions to optimize their time and energy to get their work done. Not true in my experience. Most end users act in ways that are both less secure and less convenient than they could. Either because they don't want to make the upfront investment (in setting up a password manager for example) or because they simply don't know any better. Wore still, surprisingly many more advanced end users believe in security through inconvenience: rotating passwords, timed logouts, etc.
- jnovek 5y ago
  Not using a password manager is completely consistent with “optimizing time and energy”. If you already know how to use a password manager, yes, it will easily improve productivity. But for a non-technical end-user who has never used a password manager before, learning to use one is neither straightforward nor is it convenient. Not only is it learning a skill which is not critical to their core deliverables — which virtually no one has time for — it also has the worst kind of failure mode: if the user needs technical support, it’s likely that they are locked-out of a service and at a standstill until they receive that support.
  - TameAntelope 5y ago
    Learning to use a password manager to improve your productivity is the "optimal" path, so I'd disagree with this. It is optimal if the time spent learning it is saved by using what you've learned, which is almost certainly the case over the span of even a moderate amount of time. The irrational thing to do would be to refuse to learn about a password manager. Your argument works if you focus narrowly, but when you see a fuller picture, your argument falls apart.
    - user5994461 5y ago
      The optimal path is for companies to have single sign on. Password managers are a poor substitute. They don't work well and they are not consistent across websites.
tprynn 5y ago
I agree with the principle, but the way these arguments have been summarized here has led to near-complete strawmanning. It's like the author started from the blog title and then came up with their own contextless, binary arguments. Certifications: The typical arguments against security certifications are not that they "don’t represent the full spectrum of skills a professional needs" but instead that many of them teach outdated, useless, or actively negative practices. Then they're used as an advertising tool and organizations with less security expertise are told they must hire based on certifications rather than actual skill. Compliance: "compliance is counterproductive for security." Most security practitioners don't necessarily like compliance primarily because it's not enjoyable for them. It distracts them from the tasks that they want to be working on. In most cases compliance is orthogonal to security. In some cases it can certainly be counterproductive (e.g. government compliance programs requiring outdated crypto). Management: The typical refrain "management doesn't spend enough on security / take risks seriously" has been turned into "management doesn’t care about security because they don’t fund every single thing the security team asks for". I mean, it's obvious that the argument wasn't taken seriously by the author just based on how they wrote that.
- bitexploder 5y ago
  I have been doing infosec consulting, appsec, penetration testing, threat modeling, risk asssesment, etc. for 15 years and that was my take on the article. It is a nice discussion piece but a little one sided. They kept erecting straw men that don’t really reflect the nuanced opinion of most of my peers. On Twitter and social media some luminaries are really prone to hot takes and it could be easy to assume that is reflective of the industry as a whole (and especially the authors opinion). Often it is neither. One other vexing thing in this industry, is that it is very deep. You will often see folks with a deep background in say, reversing, come out with really strong opinions on some other topic such as phishing even though they are little more than observers to that aspect of infosec. Reversing doesn’t qualify you to be a CISO, etc. I just made my own straw man there, but it’s a truism in my opinion. The core thrust of the article is reasonable though. Often we want an amazing solution or a big win when improving something even a little is a real improvement from a security perspective. A lot of little wins in an organization can really add up to changing its security culture, etc. I would ultimately agree the saying “perfect is the enemy of good” applies in the security world.
motohagiography 5y ago
I don't disagree with these. However, I would add on compliance being necessary but not sufficient, I would say it is not necessary either. Compliance is a kind of virus that infects organizations. It's a tool to get people aligned certainly, and a set of principles you can use as a foundation for a program, but if the problem you are solving for is how to get people aligned, security is orthogonal to that. On the skills crisis, it just means that security professionals are both expensive and not worth it. As if they (we) were creating value, nobody would say they were expensive, or say that they didn't have the skills to solve the problem. It's not unlike insurance, where you make sacrifices at the altar of compliance and hope the authorities are kind if calamity hits. While I appreciate the creative cognitive tools for finding alternatives to percieved limits and principles, this dissolving of binary thinking is also a trend to destabilize concreteness and logical thinking and convert issues into an unstable managed consensus, which is effectively a political struggle. It is a cognitive style with a whole bunch of tactics wrapped up in it that are designed for managing groups and not for making things, fixing things, and getting people things they want. We would benefit from some of this in security, and in fact I have used it and seen it work. However, the entire approach resembles how a mother might tell her children to share something, which assumes the thing already exists and what needs resolution is the rights to it as governed by her, which is certainly appropriate in some organizational contexts and situations, but as a single note cognitive style that includes things like non-violent communication, narrative controls and some other tactics, the method sets off a bunch of alarms. The instinct to subvert and subordinate problems as a means to manage them instead of solving them concretely is a powerful tool, but one that we should acknowledge as critically as we do so-called binary thinking.
- CleverLikeAnOx 5y ago
  I had not considered a link between being against binary thinking and political-style management. Thank you for writing it, because I found it very thought provoking. Another way to look at it is that the author isn't attacking concreteness. Instead, the author is taking generalizations and adding context for why that generalization exists. This helps identify when the generalization applies and when it does not.
haberman 5y ago
One bit of binary thinking in cybersecurity that surprised me a lot is when DJB came out against the "principle of least privilege" (http://cr.yp.to/qmail/qmailsec-20071101.pdf http://cr.yp.to/qmail/qmailsec-20071101.pdf) > I have become convinced that this “principle of least > privilege” is fundamentally wrong. Minimizing privilege > might reduce the damage done by some security holes but > almost never fixes the holes. Minimizing privilege is not > the same as minimizing the amount of trusted code, does not > have the same benefits as minimizing the amount of trusted > code, and does not move us any closer to a secure computer > system This is from almost 15 years ago, and it's possible I am misunderstanding him as I am far from a security expert, but I found it surprising. I wrote a bit about my surprise at the time: https://blog.reverberate.org/2007/11/djb-hating-on-principle-of-least.html https://blog.reverberate.org/2007/11/djb-hating-on-principle...
- UncleMeat 5y ago
  DJB is famously "extreme" in a lot of his positions and although his work is incredibly valuable is not a good representation of the typical beliefs of the community.
  - teknopaul 5y ago
    Ask yourself if you use this principle IRL? Do you give your cleaner the house keys and make yourself scarce so they can work in peace or do you treat them like an evil maid and watch their every move? Which approach has better long term outcomes for your security?
    - haberman 5y ago
      Counterpoint: do you give a cleaner the key to the house, or do you hand them a box with your whole keyring, your website passwords, the combination to the safe in the bedroom, etc?
- unethical_ban 5y ago
  Yep. "It isn't the one solution, so it is worthless". Or even, "It isn't the best solution, so it is worthless". Defense in depth, people!
tptacek 5y ago
Phil Venables is a smart dude but he is dead wrong about certifications.
- brutusborn 5y ago
  Why?
  - tptacek 5y ago
    Certifications don't represent foundational knowledge in security and don't evaluate commitment to the field, nor is commitment to this particular field a reasonable thing for employers to measure; regardless, if anything, certifications represent the opposite. Many further comments on this thread: https://news.ycombinator.com/item?id=27494450 https://news.ycombinator.com/item?id=27494450
    - dogman144 5y ago
      They provide solid scaffolding, which seems to be his main point. I wouldn’t call that dead wrong.
      - tptacek 5y ago
        They do not, but see the link above; this all got argued a couple weeks ago.
        dogman144 5y ago
        Your argument in the other link is that they’re not the only thing thats required to get in. I totally agree. Plainly stating that they do not provide scaffolding is nonsensical. Newbies have to learn the boundaries of the field IOT target their prep. Certs basically excel at this (and IMO otherwise useless aside from HR speedbumps). Otherwise, you see a very common situation like this (verbatim example): someone wants to do cloudSec. They decide a good prep area for that is hosting a DVWA in the cloud and pentesting it is good cloudSec home lab work. Very rarely, short of a cert in AWS for instance to start off with, is it easy to ID that cloudSec prep is actually configuring IAM and hardening some servers, and there are a ton of jobs here and the future of SOC work. Certs provide scaffolding. If you don’t think this, you’re giving your mentees pretty bad advice and should try to open up your view point here. I’ve helped lead fairly large 0->Sec Job 1 volunteer/non-profit groups, and have seen X000’s of success stories and failures. Failures always share three things, successes always share the inverse - don’t understand people-networking matters - don’t understand certs won’t get a job, and they’ll only help re: credentials to get past basic HR boundaries. The field of Sec+/CySa is crowded as hell. - do projects that veer very basic red team and overall fairly outside the territory of what they’ll actually be hired for. If they’d have taken a cert, a job description, and a cloud or SIEM localhost home lab, they could instead do very simple, almost out-of-the-box projects they’d work on immediately once hired.
nuker 5y ago
Compliance: all internal traffic must SSL too! Reality: Cert errors, cert expiry, stuff starts breaking Compliance: Encryption at rest! Me, designing for AWS: wtf?!?
- jjav 5y ago
  > Compliance: all internal traffic must SSL too! Let's not forget that by not encrypting internal connection is how google internal traffic was stolen by the NSA (see Snowden revelations), which is why they now (reportedly, I'm not there) encrypt everything in transit.
  - nuker 5y ago
    Yea, I use AWS, subnets, Sec Groups, IAM Roles, different case
dogman144 5y ago
The author of this is ex-Board of Goldman Sachs Infosec, current GCP CISO, and is about the only security thought leader who puts up LI content that is not total garbage (Ron Ross of NIST is the other I can think of). Yet, in the comments, people are explaining Phil’s view of the job to Phil, because Phil is apparently not an “actual technical security expert.” … what? People like PV build and lead very competent security programs because they see nuance, and focus on biz value. Sec engs, aka “actual technical security experts” who burn out or their companies burn out on them usually don’t. Edit: I just double checked his resume, forgot to add board if h1, BISO/CISO of a few other banks, former SWE, so on. Security culture is it’s own worst enemy sometimes when evaluating content like this.
- dredmorbius 5y ago
  What is "LI" in this context?
  - drenvuk 5y ago
    linkedin. if you ever hear "thought leader" in a sentence you should default to "virtue signaling gas bag", the majority of which congregate on LinkedIn, trying to attain a weird sort of guru status and build a following. Sometimes you get people with a good point a view, like this guy. Most times not.
    - dredmorbius 5y ago
      I was having flashbacks to stuck LILO bootloader prompts.
- OrvalWintermute 5y ago
  Thought Leader & Ron Ross. Big Nope. I think one of my actually business oriented colleagues put it best, "I've read through 20,000 pages of NIST security material, and there is no sense of business prioritization, or cogent strategy between all of it." Truth be told, some of this came out much later. As in, 5 - 7 years later. In the interim a huge amount of abstract security controls that significantly lag actual defensive industry, and the paper A&A / NIST 800-37 process. Read about two sections that I thought were relevant, the rest was fluff. LI is not normally a place for security thought leadership.
unethical_ban 5y ago
I agree with most of this, but want to throw my two cents in. Re: The cloud I used to say that snarky thing proudly, and then I worked on AWS services for a year. Yes, many of them are seemingly overcomplicated. No, you should not go to the cloud to save money. Yes, you should go to the cloud for a host of potential reasons. One example is IAM. In AWS, every single thing that one can do is controlled by the same policy language and user/role/action framework. Even if the policy is (very woefully) expressed in JSON and not one of a dozen more appropriate languages, it is an incredible feat of IAM to have so many disparate tools controlled with the same language. Re: Security through Obscurity I put my SSH ports for lab boxes on port 222. My auth logs drop by orders of magnitude. It doesn't mean I weaken my password or SSH cert, but it means my logs are cleaner, the chance of getting pwned by a 0day are just that much less, and those are benefits. Re: Open source I love FOSS. I don't think it is the end-all and be-all of security, though. And when it comes to cybersecurity tooling, I would much rather use certain closed-source NGFWs than opnsense/snort at the perimeter of a large organization. Disclosure: I work for one of the NGFW companies. Point is, seeing the code isn't the last bastion of security. Re: Compliance Yes, yes. OP is correct. It is needed, but is not the end-all. A competent audit/compliance regime sets up requirements and recommendations specific to your organization based on government regulation and industry best practice. They will work with you on what is a hard requirement and what can be justified as a mitigated measure, balancing the law, the threat risk, threat likelihood, and compensating controls. At best, they are partners with Infosec, pushing management to do what Infosec knows needs more focus, and slows down management that doesn't want to spend money, or just wants to "move fast and break things". So yeah, this person knows what they're talking about.
smoldesu 5y ago
> Reality: certifications represent a foundational body of knowledge for new entrants to the field - to start the "scaffolding" of their knowledge. It helps employers test a candidate’s commitment to the career and so is useful as long they don’t mandate it above all else. Sure, that's the intended outcome. But I work with equally as many certified idiots as I do uncertified geniuses, so at this point it means effectively nothing to me.
MonaroVXR 5y ago
>Reality: certifications represent a foundational body of knowledge for new entrants to the field - to start the "scaffolding" of their knowledge. It helps employers test a candidate’s commitment to the career and so is useful as long they don’t mandate it above all else. I'm not sure how I could get a certificate and by that I mean, without the employers money.
quench 5y ago
Blaming users for clicking links in emails I also agree is stupid. Many company systems require (or at least offer) the users to click on links in emails, Jira, service now, workday, gmail meetings. So if you don't want people clicking on links in emails then stop sending email with bloody links in them for everything PS. I always get my annual security training by a link in an email
OrvalWintermute 5y ago
One of the more insightful ways to think about Compliance vs Security is best addressed by a British Security dude's video on it https://www.youtube.com/watch?v=CBdg0682Qzg https://www.youtube.com/watch?v=CBdg0682Qzg
IshKebab 5y ago
Great list. Lots of stuff that is repeated a lot on HN. Another one is: "biometrics are usernames, not passwords". The reality is they are neither usernames nor passwords. They are something else.
staticassertion 5y ago
I think there's two things at work here. 1. It's extremely frustrating how much bad security work is done, and how much of it is justified in the name of "defense in depth". So many useless hours spent on mitigation without understanding the threat. 2. Everyone talks in hyperbole. It's shorter and more to the point, and nuance is usually not important in conversation among experts - we already know the nuance. The difficult bit is if you're not an expert, but talk with them, the implicit nuance is lost. There's also a lot of resentment. I resent compliance. It is a massive waste of both time and money at my company, and is driven purely by sales. We would be safer without compliance because we could have spent that time elsewhere. > In reality there can be a lot of value in keeping an attacker guessing and creating uncertainty by using deception or a variety of other techniques that could be described as obscurity. This isn't security through obscurity. I see this all the time, really. If you're keeping an attacker guessing, that's not obscurity, that's a secret. If you're doing it via deception, that's not obscurity, that's a trap. Security through obscurity is "the implementation is less popular, therefor safer", which is nonsense. I agree with many of the statements though.
efitz 5y ago
Good article. I would summarize as “don’t let the perfect be the enemy of the good.”
_carbyau_ 5y ago
The single best IT security approach I have seen was (paraphrased): - IT Security is not allowed to say "No" to Business. It was like the "Yes and.." drama game. IT Security had to accept that business had a need to do a thing. That people didn't just think up dumb shit to do, despite appearances. And it was Security's job to help to enable that thing rather than simply saying "No". Of course, they might end up saying no to a particular process, but then they had to work with the Business for a better process that both sides were happy with. A rebalancing of the tradeoffs regarding speed and security, which can often sacrifice very little speed in the IT world. It meant that any project or even simple day to day stuff could be run past IT Security with no fear. It helped of course that IT Security employed sociable helpful people too.

153 points by kiyanwang 5y ago

I’m sure this article will get some hate from parts of the cybersecurity world, but to me —- who started in cyber in the 80s (when it was called “trusted computing”) and then came back to it decades later — it really resonates. The binary fallacy is endemic in cybersecurity. At INKY we do active blocking of phishing emails, so people automatically assume that we must take the position, as many of our peer companies do, that “simulated phishing awareness training is worthless”. What we’ve actually found is that phishing awareness training is useful in that it trains users to be rightly suspicious of the identities of email senders. It doesn’t really train users to spot phish, no, but that doesn’t make it worthless! On the subject of end users I agree with the author as well. What we’ve found is that if you give users useful guidance they truly understand, on a minority of emails, they actually follow it and click on far fewer bad links, pay fewer fake invoices etc. On the other hand, if you slap a static banner on every incoming email that says “external: be super careful!” and nothing else, users quickly learn to ignore this useless information and ultimately become completely blind to it. (And no, making the banner really fugly doesn’t help any.) In our experience with email security over the last 6 years, escaping the tyranny of binary thinking is absolutely critical to getting users properly engaged.

judge2020 5y ago
The banners can be more intelligent than just ‘this email is external’ - eg. Google Workspace does a red ugly banner when incoming emails match names of people in your organization, while the default external banner is small and orange.
tialaramex 5y ago
What fraction of the phishing you see was just harvesting credentials? Because every such incident becomes irrelevant if you have unphishable credentials, and yet companies are going to spend a bunch of money on phishing prevention/ training and not move to unphishable credentials.
- dmbaggett 5y ago
  I don’t know the percentage off hand but it’s certainly quite high and we do see huge numbers of fake O365 login sites in particular (often tailored to the intended victim’s company). The problem, though, is that the less frequent fake invoice or malware drive-by phish does a lot more damage, so frequency isn’t a great gauge of overall implied risk. Many of these other kinds of phish originate from third party accounts that have themselves been taken over. So it’s critical to deploy MFA to protect yourself, but that doesn’t help with all your third party contacts who don’t require MFA themselves. There have also been, in the last 6-9 months, more published on attacks that subvert MFA. You’d also be surprised how many “please buy gift card” kinds of phish we see. And yes people do fall for them if they get through.
rcurry 5y ago
Trusted computing. Oh man, those were heady days. We really thought we could lick that shit with type enforcement and all that jazz. Spending months analyzing covert channels and trying to hard to build safe systems. Now days all you have to do is send one damned email and you own the whole enterprise. So sad, it’s like it was all for naught. But hey, I still have a pristine copy of the rainbow books if you want one :-)
- mikewarot 5y ago
  >We really thought we could lick that shit with type enforcement Why would type enforcement do any good? When do operating systems enforce types? My money is on capability based security, Genode and Fuchsia and GNU Hurd when it comes out. Give the users a safe way to run a program without exposing everything to danger, and you'll save everyone a ton of grief. The present scenario is analogous to building more and more layers of security out of crates of explosives. Any little reaction anywhere becomes a reaction everywhere, because all the code in our systems is trusted.
  - contextfree 5y ago
    object-capability security and type enforcement can go together - require programs to use some kind of hardened JVM/CLR-like typed runtime, then use the type system to model capabilities. A bunch of research operating systems from the 90s and 00s were based on this kind of design. Microsoft had a largeish engineering team working on one for 9 years (with a notion that it might some day supplant Windows; it was even briefly used in production to run some services, before the project was shut down in 2015). If you're curious about how it worked and why, one of the designers wrote some fascinating posts: http://joeduffyblog.com/2015/11/03/a-tale-of-three-safeties/ http://joeduffyblog.com/2015/11/03/a-tale-of-three-safeties/ (on how type safety worked) http://joeduffyblog.com/2015/11/10/objects-as-secure-capabilities/ http://joeduffyblog.com/2015/11/10/objects-as-secure-capabil... (on how the type system was used to model capabilities)
  - lokedhs 5y ago
    Trusted Solaris did. It was very complicated to use, so only organisations that really needed it were using it. The product was discontinued in the late 90's and its core features such as RBAC was included in standard Solaris in later versions. However, the more advanced stuff like tagging of connections, etc, was never included and was dropped with the demise of Trusted Solaris. I think it says a lot that I worked at Sun at the time and I actually never used it.

OrvalWintermute 5y ago

I take issue with part of this, as do many other actual technical security professionals. What is said: certifications like CISSP don’t represent the full spectrum of skills a professional needs therefore certifications are a waste of time. Reality: certifications represent a foundational body of knowledge for new entrants to the field - to start the "scaffolding" of their knowledge. It helps employers test a candidate’s commitment to the career and so is useful as long they don’t mandate it above all else. However, what does the ISC2 marketing material say? Let's take a peek! Earning the CISSP proves you have what it takes to effectively design, implement and manage a best-in-class cybersecurity program. With a CISSP, you validate your expertise and become an (ISC)² member, unlocking a broad array of exclusive resources, educational tools, and peer-to-peer networking opportunities. Prove your skills, advance your career, help earn the salary you want and gain the support of a community of cybersecurity leaders here to support you throughout your career From https://www.isc2.org/Certifications/CISSP https://www.isc2.org/Certifications/CISSP So, basically, a nontechnical certification that is shallow and broad has managed to insinuate itself as the way towards being able to run a security program, and more valuable than any technical security degree, or a CS degree, or a PHD in Cryptography. It claims to be both for security pros with many years experience, but others say it is foundational material. This has then led to a negative cycle of incompotence, bringing in nontechnical types into a field that is uniquely demanding for broad technical skills normally gained through years in the trenches (SRE/development/administration/network engineering) Is there any wonder why we have a security problem?

Jotra7 5y ago
College cybersecurity programs are utter trash. CS programs do not address security properly. This is why we have problems. Passing the CISSP is a way better guage of general security knowledge than any college cyber degree.
yodelshady 5y ago
> It claims to be both for security pros with many years experience, but others say it is foundational material > Is there any wonder why we have a security problem? You're absolutely right, but it hurt to read. I know the management/technical divide has existed for a while, and yes, I know management sometimes has a point in stopping technicals focusing on irrelevant details. But... jesus. I'm currently tasked with evaluating "what an attacker could do" having compromised <X> on a <Y> system. No, I'm not allowed to evaluate a specific <X>'s likely vulnerability, or even an exact specification of <Y> - because that's losing the bigger picture. What do I even say?

jasonhansel 5y ago

I think there's another sort of binary thinking that's even worse: thinking that systems are either "secure" (because no bugs have been identified) or "insecure" (because a serious bug has been found). In reality, all systems contain bugs, but the presence of a single bug shouldn't be enough, on its own, to render a system insecure: defense in depth should ensure that a system remains secure even in the presence of minor bugs in any one layer.

waihtis 5y ago

Mostly agree except for security ratings. Not only is it a wildly inaccurate measure of any organizations security, but it's potentially actively harmful also. Example: ratings vendors do a false assessment of the vulnerable state of assets you have, and refuse to correct the information on notice, therefore ruining your reputation with completely false information. It needs to die a painful death and re-emerge in a different form to be useful.

CleverLikeAnOx 5y ago
Completely agree. All of the incentives are wrong for security rating companies. Rating vendors are incentivized to have a rating for every company regardless of whether or not they have any insight. Rating vendors cannot act like real attackers, so they must rely on passively collecting some surface level information. This is often no better than you would get by walking through a website with Burp on and checking the list of alerts. You can pay rating vendors to help you "improve." That is to say, they are incentivized not to fix false assessment data. They can get you to pay for that.
- teknopaul 5y ago
  I think on every point this article experessed pros and cons. That's what's needed. If you read and think "yes, but, this one thing is absolutely unacceptable" , you are at risk of missing the point.
  - CleverLikeAnOx 5y ago
    Yeah, I really liked the article overall. I see it as saying that these things people think in a binary fashion about should be treated with more nuance. The author addresses why these binary-style mantras exist and how they are not always true. There are two where I disagree with the author (not saying it's unacceptable; the author may be correct and me wrong): the CISSP one, and also the rating vendor one. The author takes a deeper view than the binary thinking, and I want to take it deeper yet to refute the author's view. This arrives at the same conclusion as the binary groupthink in the infosec community, but does so by explaining why the binary idea became de-facto standard. In case anyone is interested, my beef with CISSP is that the curriculum for CISSP certs promote a highly bureaucratic approach to security. I feel like it is largely a waste of time and money to get that cert. It rubs me the wrong way because once things like CISSP become required for some employment, it is hard to go back to more "lax" standards. Of course, it having a baseline of useful information like the author says is true. I just think CISSP is a net negative for society even so.

_trampeltier 5y ago

Last week when I heard about the Kapersky password manager thing (single source of entropy was the current time [1]), I asked myself, why is everybody allowed to write software. If you do a job like electrician or plumber, you have to learn and do tests in pretty much the whole world before you are allowed to work. Since I'm electrician myself, I know how stupid it can be sometimes to follow all the rules. But then if something happens, you are happy everything was installed in the right way. [1] https://donjon.ledger.com/kaspersky-password-manager/ https://donjon.ledger.com/kaspersky-password-manager/

Forbo 5y ago
I largely agree, although I would say it's less "stupid" and more "cumbersome". Nobody wants to take the time to do things right because of the effort costs, but this is going to ultimately be more beneficial in the long run. I think my favorite phrase from recent happenings that encapsulates this concept is "Ransomware actors are just technical debt collectors."

DJBunnies 5y ago

Lost me at promoting security through obscurity.

easterncalculus 5y ago
This is an attitude that I really hope leaves the industry eventually, because in truth people use security through obscurity all the time. Using it exclusively or in place of real measures is when it becomes a problem. Ask any IT professional who's had to patch zero days on internet-exposed systems whether they think changing the default port is useless, and practically all of them will tell you that it at least cuts down on logs, and means that you almost definitely won't get hit that first day with all the other people by script kiddies scanning the internet. Not posting your internal network diagrams, even though your security is 'open design', means that when someone sends the right email and breaches your perimeter, they still have to scan for what to go after. Additionally, this belief is almost exclusively held dogmatically by the private sector - classified government networks don't get hacked nearly as often as even your air-gapped corporate ones. Obscurity is never a replacement for 'true' security measures, and should only be added on after, but for a system you actually want to protect in the long term some amount of is often very useful.
- AlexAndScripts 5y ago
  Just changing my SSH port to 900 has reduced the amount of brute force by a fraction.
  - AlexAndScripts 5y ago
    *too a fraction, not by a fraction
  - easterncalculus 5y ago
    That is reason enough, in my view. If you're going to install fail2ban for instance I feel that you might as well also change the port.
- TameAntelope 5y ago

sharklazer 5y ago

The only way to look at security is to ask: “How many US Dollary-doos does it take to break this?” And if something costs more of them US Dollary-doos to break, then it is “more secure”.

sharklazer 5y ago
Replace the Dollary-doos with your favorite currency or medium of exchange.
MauranKilom 5y ago
It takes zero US dollars to walk onto my lawn and take a flower pot with you. Yet putting the flower put onto the sidewalk would drastically increase the odds of someone actually taking it. Opportunity and convenience do matter in terms of security. Maybe more in the physical world, but it's not irrelevant in the digital world either.
- Karliss 5y ago
  Convenience aspect quckly turns into money at scale either directly or indirectly through time. It takes zero dollars to take single flowerpot but if you want to take 10000 you will need car, fuel and longer it takes to walk onto and away from lawn less flowerpots in an hour single person can collect. Same applies to computersecurity entering single captcha costs zero dollars but at scale you will have to hire someone doing it at x dollars per 1000 captchas.
  - sharklazer 5y ago
    So, you can't account for that the cost of scale? I guess that makes sense. I'll never ever ever measure things in dollars again because apparently I can't account for the effects of economies of scales... Or I could, you know, take the time to inform myself about these things.

habibur 5y ago

These are relevant within security professionals. But for the rest of us, the question more is about balancing between security vs usability+productivity+accessibility. Where you draw the balance is based on individual judgement, leading to endless debate and "binary thinking". > [...] if something isn’t perfect then it must be terrible, or that if you don’t fully agree with something then you must therefore absolutely disagree with it.

blfr 5y ago

> Reality: most end users make fully rationale [sic] decisions to optimize their time and energy to get their work done. Not true in my experience. Most end users act in ways that are both less secure and less convenient than they could. Either because they don't want to make the upfront investment (in setting up a password manager for example) or because they simply don't know any better. Wore still, surprisingly many more advanced end users believe in security through inconvenience: rotating passwords, timed logouts, etc.

jnovek 5y ago
Not using a password manager is completely consistent with “optimizing time and energy”. If you already know how to use a password manager, yes, it will easily improve productivity. But for a non-technical end-user who has never used a password manager before, learning to use one is neither straightforward nor is it convenient. Not only is it learning a skill which is not critical to their core deliverables — which virtually no one has time for — it also has the worst kind of failure mode: if the user needs technical support, it’s likely that they are locked-out of a service and at a standstill until they receive that support.
- TameAntelope 5y ago
  Learning to use a password manager to improve your productivity is the "optimal" path, so I'd disagree with this. It is optimal if the time spent learning it is saved by using what you've learned, which is almost certainly the case over the span of even a moderate amount of time. The irrational thing to do would be to refuse to learn about a password manager. Your argument works if you focus narrowly, but when you see a fuller picture, your argument falls apart.
  - user5994461 5y ago
    The optimal path is for companies to have single sign on. Password managers are a poor substitute. They don't work well and they are not consistent across websites.

tprynn 5y ago

I agree with the principle, but the way these arguments have been summarized here has led to near-complete strawmanning. It's like the author started from the blog title and then came up with their own contextless, binary arguments. Certifications: The typical arguments against security certifications are not that they "don’t represent the full spectrum of skills a professional needs" but instead that many of them teach outdated, useless, or actively negative practices. Then they're used as an advertising tool and organizations with less security expertise are told they must hire based on certifications rather than actual skill. Compliance: "compliance is counterproductive for security." Most security practitioners don't necessarily like compliance primarily because it's not enjoyable for them. It distracts them from the tasks that they want to be working on. In most cases compliance is orthogonal to security. In some cases it can certainly be counterproductive (e.g. government compliance programs requiring outdated crypto). Management: The typical refrain "management doesn't spend enough on security / take risks seriously" has been turned into "management doesn’t care about security because they don’t fund every single thing the security team asks for". I mean, it's obvious that the argument wasn't taken seriously by the author just based on how they wrote that.

bitexploder 5y ago
I have been doing infosec consulting, appsec, penetration testing, threat modeling, risk asssesment, etc. for 15 years and that was my take on the article. It is a nice discussion piece but a little one sided. They kept erecting straw men that don’t really reflect the nuanced opinion of most of my peers. On Twitter and social media some luminaries are really prone to hot takes and it could be easy to assume that is reflective of the industry as a whole (and especially the authors opinion). Often it is neither. One other vexing thing in this industry, is that it is very deep. You will often see folks with a deep background in say, reversing, come out with really strong opinions on some other topic such as phishing even though they are little more than observers to that aspect of infosec. Reversing doesn’t qualify you to be a CISO, etc. I just made my own straw man there, but it’s a truism in my opinion. The core thrust of the article is reasonable though. Often we want an amazing solution or a big win when improving something even a little is a real improvement from a security perspective. A lot of little wins in an organization can really add up to changing its security culture, etc. I would ultimately agree the saying “perfect is the enemy of good” applies in the security world.

motohagiography 5y ago

I don't disagree with these. However, I would add on compliance being necessary but not sufficient, I would say it is not necessary either. Compliance is a kind of virus that infects organizations. It's a tool to get people aligned certainly, and a set of principles you can use as a foundation for a program, but if the problem you are solving for is how to get people aligned, security is orthogonal to that. On the skills crisis, it just means that security professionals are both expensive and not worth it. As if they (we) were creating value, nobody would say they were expensive, or say that they didn't have the skills to solve the problem. It's not unlike insurance, where you make sacrifices at the altar of compliance and hope the authorities are kind if calamity hits. While I appreciate the creative cognitive tools for finding alternatives to percieved limits and principles, this dissolving of binary thinking is also a trend to destabilize concreteness and logical thinking and convert issues into an unstable managed consensus, which is effectively a political struggle. It is a cognitive style with a whole bunch of tactics wrapped up in it that are designed for managing groups and not for making things, fixing things, and getting people things they want. We would benefit from some of this in security, and in fact I have used it and seen it work. However, the entire approach resembles how a mother might tell her children to share something, which assumes the thing already exists and what needs resolution is the rights to it as governed by her, which is certainly appropriate in some organizational contexts and situations, but as a single note cognitive style that includes things like non-violent communication, narrative controls and some other tactics, the method sets off a bunch of alarms. The instinct to subvert and subordinate problems as a means to manage them instead of solving them concretely is a powerful tool, but one that we should acknowledge as critically as we do so-called binary thinking.

CleverLikeAnOx 5y ago
I had not considered a link between being against binary thinking and political-style management. Thank you for writing it, because I found it very thought provoking. Another way to look at it is that the author isn't attacking concreteness. Instead, the author is taking generalizations and adding context for why that generalization exists. This helps identify when the generalization applies and when it does not.

haberman 5y ago

One bit of binary thinking in cybersecurity that surprised me a lot is when DJB came out against the "principle of least privilege" (http://cr.yp.to/qmail/qmailsec-20071101.pdf http://cr.yp.to/qmail/qmailsec-20071101.pdf) > I have become convinced that this “principle of least > privilege” is fundamentally wrong. Minimizing privilege > might reduce the damage done by some security holes but > almost never fixes the holes. Minimizing privilege is not > the same as minimizing the amount of trusted code, does not > have the same benefits as minimizing the amount of trusted > code, and does not move us any closer to a secure computer > system This is from almost 15 years ago, and it's possible I am misunderstanding him as I am far from a security expert, but I found it surprising. I wrote a bit about my surprise at the time: https://blog.reverberate.org/2007/11/djb-hating-on-principle-of-least.html https://blog.reverberate.org/2007/11/djb-hating-on-principle...

UncleMeat 5y ago
DJB is famously "extreme" in a lot of his positions and although his work is incredibly valuable is not a good representation of the typical beliefs of the community.
- teknopaul 5y ago
  Ask yourself if you use this principle IRL? Do you give your cleaner the house keys and make yourself scarce so they can work in peace or do you treat them like an evil maid and watch their every move? Which approach has better long term outcomes for your security?
  - haberman 5y ago
    Counterpoint: do you give a cleaner the key to the house, or do you hand them a box with your whole keyring, your website passwords, the combination to the safe in the bedroom, etc?
unethical_ban 5y ago
Yep. "It isn't the one solution, so it is worthless". Or even, "It isn't the best solution, so it is worthless". Defense in depth, people!

tptacek 5y ago

Phil Venables is a smart dude but he is dead wrong about certifications.

brutusborn 5y ago
Why?
- tptacek 5y ago
  Certifications don't represent foundational knowledge in security and don't evaluate commitment to the field, nor is commitment to this particular field a reasonable thing for employers to measure; regardless, if anything, certifications represent the opposite. Many further comments on this thread: https://news.ycombinator.com/item?id=27494450 https://news.ycombinator.com/item?id=27494450
  - dogman144 5y ago
    They provide solid scaffolding, which seems to be his main point. I wouldn’t call that dead wrong.
    - tptacek 5y ago
      They do not, but see the link above; this all got argued a couple weeks ago.
      - dogman144 5y ago
        Your argument in the other link is that they’re not the only thing thats required to get in. I totally agree. Plainly stating that they do not provide scaffolding is nonsensical. Newbies have to learn the boundaries of the field IOT target their prep. Certs basically excel at this (and IMO otherwise useless aside from HR speedbumps). Otherwise, you see a very common situation like this (verbatim example): someone wants to do cloudSec. They decide a good prep area for that is hosting a DVWA in the cloud and pentesting it is good cloudSec home lab work. Very rarely, short of a cert in AWS for instance to start off with, is it easy to ID that cloudSec prep is actually configuring IAM and hardening some servers, and there are a ton of jobs here and the future of SOC work. Certs provide scaffolding. If you don’t think this, you’re giving your mentees pretty bad advice and should try to open up your view point here. I’ve helped lead fairly large 0->Sec Job 1 volunteer/non-profit groups, and have seen X000’s of success stories and failures. Failures always share three things, successes always share the inverse - don’t understand people-networking matters - don’t understand certs won’t get a job, and they’ll only help re: credentials to get past basic HR boundaries. The field of Sec+/CySa is crowded as hell. - do projects that veer very basic red team and overall fairly outside the territory of what they’ll actually be hired for. If they’d have taken a cert, a job description, and a cloud or SIEM localhost home lab, they could instead do very simple, almost out-of-the-box projects they’d work on immediately once hired.

nuker 5y ago

Compliance: all internal traffic must SSL too! Reality: Cert errors, cert expiry, stuff starts breaking Compliance: Encryption at rest! Me, designing for AWS: wtf?!?

jjav 5y ago
> Compliance: all internal traffic must SSL too! Let's not forget that by not encrypting internal connection is how google internal traffic was stolen by the NSA (see Snowden revelations), which is why they now (reportedly, I'm not there) encrypt everything in transit.
- nuker 5y ago
  Yea, I use AWS, subnets, Sec Groups, IAM Roles, different case

dogman144 5y ago

The author of this is ex-Board of Goldman Sachs Infosec, current GCP CISO, and is about the only security thought leader who puts up LI content that is not total garbage (Ron Ross of NIST is the other I can think of). Yet, in the comments, people are explaining Phil’s view of the job to Phil, because Phil is apparently not an “actual technical security expert.” … what? People like PV build and lead very competent security programs because they see nuance, and focus on biz value. Sec engs, aka “actual technical security experts” who burn out or their companies burn out on them usually don’t. Edit: I just double checked his resume, forgot to add board if h1, BISO/CISO of a few other banks, former SWE, so on. Security culture is it’s own worst enemy sometimes when evaluating content like this.

dredmorbius 5y ago
What is "LI" in this context?
- drenvuk 5y ago
  linkedin. if you ever hear "thought leader" in a sentence you should default to "virtue signaling gas bag", the majority of which congregate on LinkedIn, trying to attain a weird sort of guru status and build a following. Sometimes you get people with a good point a view, like this guy. Most times not.
  - dredmorbius 5y ago
    I was having flashbacks to stuck LILO bootloader prompts.
OrvalWintermute 5y ago
Thought Leader & Ron Ross. Big Nope. I think one of my actually business oriented colleagues put it best, "I've read through 20,000 pages of NIST security material, and there is no sense of business prioritization, or cogent strategy between all of it." Truth be told, some of this came out much later. As in, 5 - 7 years later. In the interim a huge amount of abstract security controls that significantly lag actual defensive industry, and the paper A&A / NIST 800-37 process. Read about two sections that I thought were relevant, the rest was fluff. LI is not normally a place for security thought leadership.

unethical_ban 5y ago

I agree with most of this, but want to throw my two cents in. Re: The cloud I used to say that snarky thing proudly, and then I worked on AWS services for a year. Yes, many of them are seemingly overcomplicated. No, you should not go to the cloud to save money. Yes, you should go to the cloud for a host of potential reasons. One example is IAM. In AWS, every single thing that one can do is controlled by the same policy language and user/role/action framework. Even if the policy is (very woefully) expressed in JSON and not one of a dozen more appropriate languages, it is an incredible feat of IAM to have so many disparate tools controlled with the same language. Re: Security through Obscurity I put my SSH ports for lab boxes on port 222. My auth logs drop by orders of magnitude. It doesn't mean I weaken my password or SSH cert, but it means my logs are cleaner, the chance of getting pwned by a 0day are just that much less, and those are benefits. Re: Open source I love FOSS. I don't think it is the end-all and be-all of security, though. And when it comes to cybersecurity tooling, I would much rather use certain closed-source NGFWs than opnsense/snort at the perimeter of a large organization. Disclosure: I work for one of the NGFW companies. Point is, seeing the code isn't the last bastion of security. Re: Compliance Yes, yes. OP is correct. It is needed, but is not the end-all. A competent audit/compliance regime sets up requirements and recommendations specific to your organization based on government regulation and industry best practice. They will work with you on what is a hard requirement and what can be justified as a mitigated measure, balancing the law, the threat risk, threat likelihood, and compensating controls. At best, they are partners with Infosec, pushing management to do what Infosec knows needs more focus, and slows down management that doesn't want to spend money, or just wants to "move fast and break things". So yeah, this person knows what they're talking about.

smoldesu 5y ago

> Reality: certifications represent a foundational body of knowledge for new entrants to the field - to start the "scaffolding" of their knowledge. It helps employers test a candidate’s commitment to the career and so is useful as long they don’t mandate it above all else. Sure, that's the intended outcome. But I work with equally as many certified idiots as I do uncertified geniuses, so at this point it means effectively nothing to me.

MonaroVXR 5y ago

>Reality: certifications represent a foundational body of knowledge for new entrants to the field - to start the "scaffolding" of their knowledge. It helps employers test a candidate’s commitment to the career and so is useful as long they don’t mandate it above all else. I'm not sure how I could get a certificate and by that I mean, without the employers money.

quench 5y ago

Blaming users for clicking links in emails I also agree is stupid. Many company systems require (or at least offer) the users to click on links in emails, Jira, service now, workday, gmail meetings. So if you don't want people clicking on links in emails then stop sending email with bloody links in them for everything PS. I always get my annual security training by a link in an email

OrvalWintermute 5y ago

One of the more insightful ways to think about Compliance vs Security is best addressed by a British Security dude's video on it https://www.youtube.com/watch?v=CBdg0682Qzg https://www.youtube.com/watch?v=CBdg0682Qzg

IshKebab 5y ago

Great list. Lots of stuff that is repeated a lot on HN. Another one is: "biometrics are usernames, not passwords". The reality is they are neither usernames nor passwords. They are something else.

staticassertion 5y ago

I think there's two things at work here. 1. It's extremely frustrating how much bad security work is done, and how much of it is justified in the name of "defense in depth". So many useless hours spent on mitigation without understanding the threat. 2. Everyone talks in hyperbole. It's shorter and more to the point, and nuance is usually not important in conversation among experts - we already know the nuance. The difficult bit is if you're not an expert, but talk with them, the implicit nuance is lost. There's also a lot of resentment. I resent compliance. It is a massive waste of both time and money at my company, and is driven purely by sales. We would be safer without compliance because we could have spent that time elsewhere. > In reality there can be a lot of value in keeping an attacker guessing and creating uncertainty by using deception or a variety of other techniques that could be described as obscurity. This isn't security through obscurity. I see this all the time, really. If you're keeping an attacker guessing, that's not obscurity, that's a secret. If you're doing it via deception, that's not obscurity, that's a trap. Security through obscurity is "the implementation is less popular, therefor safer", which is nonsense. I agree with many of the statements though.

efitz 5y ago

Good article. I would summarize as “don’t let the perfect be the enemy of the good.”

_carbyau_ 5y ago

The single best IT security approach I have seen was (paraphrased): - IT Security is not allowed to say "No" to Business. It was like the "Yes and.." drama game. IT Security had to accept that business had a need to do a thing. That people didn't just think up dumb shit to do, despite appearances. And it was Security's job to help to enable that thing rather than simply saying "No". Of course, they might end up saying no to a particular process, but then they had to work with the Business for a better process that both sides were happy with. A rebalancing of the tradeoffs regarding speed and security, which can often sacrifice very little speed in the IT world. It meant that any project or even simple day to day stuff could be run past IT Security with no fear. It helped of course that IT Security employed sociable helpful people too.