7 ms·

Blue teams do get lots of funding (edit: I am speaking in general, not on government spending). It is just that their strategies are so so unbelievably bad no a

by Veserv 5y ago

Blue teams do get lots of funding (edit: I am speaking in general, not on government spending). It is just that their strategies are so so unbelievably bad no amount of money can produce an adequate system. Blue teams with a $1 Billion/year budget can not prevent total compromise by red teams with a $1 Million/year budget. If you must outspend you attackers by 1000x you are doomed. For instance, in 2015 Microsoft committed to spending $1 Billion/year in security research and development to securing their cloud, the second largest cloud in the world [1]. What is the result of such spending? A little over a month ago the default management agent they ship for managing Linux on Azure had a security defect that allowed local privilege escalation by sending an empty password [2]. Their processes are so bad that despite spending $1 Billion/year they can not detect and prevent themselves from releasing security 101 defects in default installs of widely deployed products. This is indicative of a grossly inadequate process in much the same way that a car factory delivering cars with no brake lines would indicate that factory and manufacturing process needs to be completely redesigned from the ground up and the entire team overseeing it replaced. The outrageous part is not that security is not being funded, it is that organizations and systems displaying such fundamental errors continue to get vast sums of money poured into them. [1] https://blogs.microsoft.com/blog/2015/11/17/enterprise-security-for-our-mobile-first-cloud-first-world/ https://blogs.microsoft.com/blog/2015/11/17/enterprise-secur... [2] https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution https://www.wiz.io/blog/secret-agent-exposes-azure-customers...

alisonkisk 5y ago
Why hire a red team if you can't afford to fix the problems they find?
nixpulvis 5y ago
So what do we do? Just admit that it's all doomed forever? Perhaps the only question left at that point would be exactly what even needs to be blue and red team'd. In other words what is worth using at the risk of being abused. If you also assume infinite extent, then nothing is worth it because everything can cause harm. Otherwise, we actually do learn ways to converge towards more generally secure systems. Safer programming languages and safer hardware will lead the way, but it seems much slower this round than the stories we hear about the origins of everything.
- Veserv 5y ago
  No, we just need systems 100-1000x better than prevailing commercial IT systems. Systems that do not quake in their boots at the thought of a single dedicated hacker, but are designed and expected to resist competent teams of tens or hundreds working full time for years since that is what is needed to reach basic parity. However, we will not find those techniques by following the standard commercial IT methodologies which were not designed for such a task. Just ask any architect of these systems if they could stop a team of 10 people working full time for 3 years. If even the people making it think it is absurd to defend against such a minimal effort there is no chance it is actually adequate. In fact, there is little reason to assume that the methodologies that can only get 0.1% of the way to solving the problem despite decades of work and tens of billions of dollars will ever converge to an adequate solution. It could be like trying to use the knowledge of horse buggy makers to determine how to make a machine faster than the speed of sound. And even if it could eventually get there it would require 100% improvements year over year for an entire decade to get there from existing commercial methodologies. No, it is far more reasonable to use systems that were actually designed for these environments and have actually demonstrated success, such as systems certified to Orange Book A1, and make them more practical since, as everybody knows, it is far easier to make a cheap, working design by starting with something that works and making it cheap than starting with cheap components and figuring out how to make something that works. As for how you can identify proven success you can just start with a $1 million red team exercise. If they are able to find any material defects that means that there are likely many such defects and your processes can not prevent the occurrence of such trivial flaws and needs to be rethought. Only when there are zero material defects are you at the starting line. Note that this is not an exhaustive test, rather it should be treated like the fizzbuzz of security design, a trivial softball to weed out the the people that know nothing and the systems that do not work.
  - ddingus 5y ago
    An Apollo program for information systems? This isn't a bad idea.
    - GekkePrutser 5y ago
b112 5y ago
The real problem is, security needs to be inherent to how developers, managers, work. Instead, security is often a bolt on, after thought, or put off until "thing $x is done". One example, many popular frameworks. How do you audit every single piece of code brought in by, say, laravel? And how do you do it, if developers want to be able to reuse code? Answer? You cannot. At all. You can't even reliably handle license compliance. Yet, we use such frameworks, because security is not first, or even last sometimes. It's not part of the process, it's a thing to think about when a dev, a department has free time. Many companies have a security team, an audit team. What?! You don't get secure by having people look at security after development, and then spend time fighting over fiscal concerns, to get a code re-write. I think none of this will ever be fixed, until the CTO position becomes like the CFO position. Mandatory requirements, jailtime for CTOs if they breach certain regulations, and the authority for a CTO to tell everyone from board to CEO "no, thing X will be done". Yet no one wants that, because of cost, and a desire to get to market first.
- smaddox 5y ago
  This is only true in our existing software ecosystem, where no one bothers to prove any of their assumptions hold (if they even realize they're making assumptions). In a software ecosystem designed with provable correctness in mind, open source software would be at least as viable as it is now, while being provably correct with respect to high level specifications which could much more feasibly be audited.
- brigandish 5y ago
  I'm in so much agreement, though I would disagree with the last line. I've seen people wave away security concerns because they don't want to be bothered. Developers waste plenty of time (we're all on here chatting away for one!) but ask someone to even think about security seems to offend them in the way that asking a teenager to clean their bedroom would.
- lumost 5y ago
  As long as the solution demands radically slower development there will be problems. Do you really believe that a team of 5 overworked devs will re-implement all functionality pulled in by laravel and their app without introducing yet more vulnerabilities?
umvi 5y ago
Which is harder: sneaking across the US border anywhere or preventing anyone from sneaking across the US border everywhere? Sure seems like a 1000:1 problem to me.
- pwnguin 5y ago
  What stops someone from designing a blue team technique that is just red team techniques applied to your own product prior to release? I suspect MS does exactly that, but red team productivity varies.
  - thaumasiotes 5y ago
    Nothing stops that; it is one of the most routine things you could do. NCC Group exists to provide this service. HackerOne exists to provide this service. Having an external team periodically attempt to penetrate your defenses is legally required for anyone who processes payment card information (in the US; I don't know what PCI requirements are like elsewhere).
  - bostik 5y ago
    This is known as "purple teaming". You have security team segments actively trying to attack your own systems, using both established tooling/techniques, but also developing bespoke attacks that are specific to your systems. Then, and this is crucial, they not only teach the blue team from their findings - they also rotate out to blue teams, to become the defenders themselves. At the same time, some of the blue team rotates in. Rinse and repeat. The whole point is that you have to understand both sides properly, and continuously work with the teams involved. Otherwise you're nothing more than a consultant.
  - dr-detroit 5y ago
    MS are too busy "revitalizing their culture" throwing out their computers for linux/mac and hiring devs for minimum industry wage creating pseudo-electron apps that don't even work in other words sudo-apt-getting sh*t done they dont have time for that egghead stuff.
- echelon 5y ago
johnny53169 5y ago
> What is the result of such spending? Did they actually spend $1 billion? Or they did and spent on overpriced services? Without knowing what they did the amount is meaningless
solarkraft 5y ago
You present it like the people in charge of doing these things are incompetent, but a lot points towards the domain just being that hard to control.
- peteradio 5y ago
  In OPs precise instance wouldn't that be some form of incompetence given the stated goals of that funding? A competent reviewer would potentially be able to see these things in the code without tools.

by Veserv 5y ago

alisonkisk 5y ago

Why hire a red team if you can't afford to fix the problems they find?

nixpulvis 5y ago

So what do we do? Just admit that it's all doomed forever? Perhaps the only question left at that point would be exactly what even needs to be blue and red team'd. In other words what is worth using at the risk of being abused. If you also assume infinite extent, then nothing is worth it because everything can cause harm. Otherwise, we actually do learn ways to converge towards more generally secure systems. Safer programming languages and safer hardware will lead the way, but it seems much slower this round than the stories we hear about the origins of everything.

Veserv 5y ago
No, we just need systems 100-1000x better than prevailing commercial IT systems. Systems that do not quake in their boots at the thought of a single dedicated hacker, but are designed and expected to resist competent teams of tens or hundreds working full time for years since that is what is needed to reach basic parity. However, we will not find those techniques by following the standard commercial IT methodologies which were not designed for such a task. Just ask any architect of these systems if they could stop a team of 10 people working full time for 3 years. If even the people making it think it is absurd to defend against such a minimal effort there is no chance it is actually adequate. In fact, there is little reason to assume that the methodologies that can only get 0.1% of the way to solving the problem despite decades of work and tens of billions of dollars will ever converge to an adequate solution. It could be like trying to use the knowledge of horse buggy makers to determine how to make a machine faster than the speed of sound. And even if it could eventually get there it would require 100% improvements year over year for an entire decade to get there from existing commercial methodologies. No, it is far more reasonable to use systems that were actually designed for these environments and have actually demonstrated success, such as systems certified to Orange Book A1, and make them more practical since, as everybody knows, it is far easier to make a cheap, working design by starting with something that works and making it cheap than starting with cheap components and figuring out how to make something that works. As for how you can identify proven success you can just start with a $1 million red team exercise. If they are able to find any material defects that means that there are likely many such defects and your processes can not prevent the occurrence of such trivial flaws and needs to be rethought. Only when there are zero material defects are you at the starting line. Note that this is not an exhaustive test, rather it should be treated like the fizzbuzz of security design, a trivial softball to weed out the the people that know nothing and the systems that do not work.
- ddingus 5y ago
  An Apollo program for information systems? This isn't a bad idea.
  - GekkePrutser 5y ago

b112 5y ago

The real problem is, security needs to be inherent to how developers, managers, work. Instead, security is often a bolt on, after thought, or put off until "thing $x is done". One example, many popular frameworks. How do you audit every single piece of code brought in by, say, laravel? And how do you do it, if developers want to be able to reuse code? Answer? You cannot. At all. You can't even reliably handle license compliance. Yet, we use such frameworks, because security is not first, or even last sometimes. It's not part of the process, it's a thing to think about when a dev, a department has free time. Many companies have a security team, an audit team. What?! You don't get secure by having people look at security after development, and then spend time fighting over fiscal concerns, to get a code re-write. I think none of this will ever be fixed, until the CTO position becomes like the CFO position. Mandatory requirements, jailtime for CTOs if they breach certain regulations, and the authority for a CTO to tell everyone from board to CEO "no, thing X will be done". Yet no one wants that, because of cost, and a desire to get to market first.

smaddox 5y ago
This is only true in our existing software ecosystem, where no one bothers to prove any of their assumptions hold (if they even realize they're making assumptions). In a software ecosystem designed with provable correctness in mind, open source software would be at least as viable as it is now, while being provably correct with respect to high level specifications which could much more feasibly be audited.
brigandish 5y ago
I'm in so much agreement, though I would disagree with the last line. I've seen people wave away security concerns because they don't want to be bothered. Developers waste plenty of time (we're all on here chatting away for one!) but ask someone to even think about security seems to offend them in the way that asking a teenager to clean their bedroom would.
lumost 5y ago
As long as the solution demands radically slower development there will be problems. Do you really believe that a team of 5 overworked devs will re-implement all functionality pulled in by laravel and their app without introducing yet more vulnerabilities?

umvi 5y ago

Which is harder: sneaking across the US border anywhere or preventing anyone from sneaking across the US border everywhere? Sure seems like a 1000:1 problem to me.

pwnguin 5y ago
What stops someone from designing a blue team technique that is just red team techniques applied to your own product prior to release? I suspect MS does exactly that, but red team productivity varies.
- thaumasiotes 5y ago
  Nothing stops that; it is one of the most routine things you could do. NCC Group exists to provide this service. HackerOne exists to provide this service. Having an external team periodically attempt to penetrate your defenses is legally required for anyone who processes payment card information (in the US; I don't know what PCI requirements are like elsewhere).
- bostik 5y ago
  This is known as "purple teaming". You have security team segments actively trying to attack your own systems, using both established tooling/techniques, but also developing bespoke attacks that are specific to your systems. Then, and this is crucial, they not only teach the blue team from their findings - they also rotate out to blue teams, to become the defenders themselves. At the same time, some of the blue team rotates in. Rinse and repeat. The whole point is that you have to understand both sides properly, and continuously work with the teams involved. Otherwise you're nothing more than a consultant.
- dr-detroit 5y ago
  MS are too busy "revitalizing their culture" throwing out their computers for linux/mac and hiring devs for minimum industry wage creating pseudo-electron apps that don't even work in other words sudo-apt-getting sh*t done they dont have time for that egghead stuff.
echelon 5y ago

johnny53169 5y ago

> What is the result of such spending? Did they actually spend $1 billion? Or they did and spent on overpriced services? Without knowing what they did the amount is meaningless

solarkraft 5y ago

You present it like the people in charge of doing these things are incompetent, but a lot points towards the domain just being that hard to control.

peteradio 5y ago
In OPs precise instance wouldn't that be some form of incompetence given the stated goals of that funding? A competent reviewer would potentially be able to see these things in the code without tools.