4 ms·

I’m a security auditor. I dont think many security auditors think like that.

dylan604 4y ago
That's a really sad statement, and proves to me that security audits are just another scene within the grand play that is security theater
- phpisthebest 4y ago
  Having been in a number of audits (it, insurance, financial, etc) over the the years.... all audits are theater
  - dylan604 4y ago
    Yeah, but security theater is the only one that makes you take all of your stuff out of your bags and then take off your shoes.
    - other_herbert 4y ago
      Audience participation! ………..
    - ineedasername 4y ago
      Yes, in air travel alone it has given us the war on liquid volumes above 3.4oz and the war on shoes. Luckily by 2009 the fervor & public willingness to go along had died down a bit so we all go to keep our underwear after NWA Flight 253.
- hsbauauvhabzb 4y ago
  I don’t think it’s theatre. It’s difficult to audit applications when you lack context, it could also be seen and assumed benign / intentional. I think that the industry is immature and severely conflicted on the quality:profit ratio.
  - dylan604 4y ago
    Looking at the capabilities of the default users created by the software after fresh install is difficult to wonder if it should be audited to ensure nothing hinky has occurred? Fuck me, if that's truly the case, we're all doomed. If the system modified anything, then those modifications should obviously be checked out to have done exactly and only what they were expected to have done. Installers typically have elevated privileges, and are known vectors for oopsies let alone maliciousness. Hell, Zoom left an elevated binary because it was simply easier for them to do things vs malicious. To have an "audit" not inspect these things is such an obvious error on the auditor's behalf.
    - hsbauauvhabzb 4y ago
      Applications have default admin users. Nobody saw log4j for 15 years. Hindsight is a great thing to have. This has nothing to do with elevated binaries or anything else. To be clear, security is assurance. It’s not just security who screwed up here, it’s also the devs that shipped it, the testers for not raising it, and product managers for not ensuring better quality assurance didn’t occur.
      - dylan604 4y ago
        >Applications have default admin users. Yup. And after install, they should be tested. Default non-admin users should also be tested for the basic thing to ensure they are actually restricted and can't do admin things. >Nobody saw log4j for 15 years. Hindsight is a great thing to have. You are moving goalposts here. Nobody mentioned log4j issues. The issues being discussed here do not require hindsight. Confluence left a hardcoded password. At the point a dev is harcoding an f'ing PASSWORD, alarms should be going off with flashing lights and everything. If an auditor isn't searching the codebase for something simple like 'password = ' to see a hardcoded string, then that's a weak audit. The fact no internal code review didn't catch this is also not a good sign. 100% agree no single person can imagine every single scenario that would potentially cause problems down the road. However, when new things pop up, they should be added to a list of things to check for not an immediate throwing of hands in the air with a "we don't do that kind of thing". Instead, admitting it was checked for because it was such an out of consideration thing, but then saying "we'll keep that in mind for future testing" would have been a much better thing response than a bunch of whataboutisms.
mhh__ 4y ago
Security people seem to vary from proper devs with an interest in security to "I used to be a marine now I'm a security contractor" methodology-obsessed types. My faith in the former is strong, the latter category worries me.
- hsbauauvhabzb 4y ago
  I came from dev. I agree.
- darkerside 4y ago
  The ideal is you have both types taking different approaches
- Hizonner 4y ago
  Actually, "devs" are typically not technically qualified either. You have to really understand how things work, not just be able to write a program. But you're basically right. And now there seems to be a meme going around that it's elitist and inappropriate to expect people to have any technical understanding at all before they start dictating technical decisions around security, and all you need is a willingness to learn the alphabet soup of requirements and mindlessly apply the checklists.
  - mhh__ 4y ago
    I said proper devs, in my defense. The people I hang around with tend to know how things work.

That's a really sad statement, and proves to me that security audits are just another scene within the grand play that is security theater

phpisthebest 4y ago
Having been in a number of audits (it, insurance, financial, etc) over the the years.... all audits are theater
- dylan604 4y ago
  Yeah, but security theater is the only one that makes you take all of your stuff out of your bags and then take off your shoes.
  - other_herbert 4y ago
    Audience participation! ………..
  - ineedasername 4y ago
    Yes, in air travel alone it has given us the war on liquid volumes above 3.4oz and the war on shoes. Luckily by 2009 the fervor & public willingness to go along had died down a bit so we all go to keep our underwear after NWA Flight 253.
hsbauauvhabzb 4y ago
I don’t think it’s theatre. It’s difficult to audit applications when you lack context, it could also be seen and assumed benign / intentional. I think that the industry is immature and severely conflicted on the quality:profit ratio.
- dylan604 4y ago
  Looking at the capabilities of the default users created by the software after fresh install is difficult to wonder if it should be audited to ensure nothing hinky has occurred? Fuck me, if that's truly the case, we're all doomed. If the system modified anything, then those modifications should obviously be checked out to have done exactly and only what they were expected to have done. Installers typically have elevated privileges, and are known vectors for oopsies let alone maliciousness. Hell, Zoom left an elevated binary because it was simply easier for them to do things vs malicious. To have an "audit" not inspect these things is such an obvious error on the auditor's behalf.
  - hsbauauvhabzb 4y ago
    Applications have default admin users. Nobody saw log4j for 15 years. Hindsight is a great thing to have. This has nothing to do with elevated binaries or anything else. To be clear, security is assurance. It’s not just security who screwed up here, it’s also the devs that shipped it, the testers for not raising it, and product managers for not ensuring better quality assurance didn’t occur.
    - dylan604 4y ago
      >Applications have default admin users. Yup. And after install, they should be tested. Default non-admin users should also be tested for the basic thing to ensure they are actually restricted and can't do admin things. >Nobody saw log4j for 15 years. Hindsight is a great thing to have. You are moving goalposts here. Nobody mentioned log4j issues. The issues being discussed here do not require hindsight. Confluence left a hardcoded password. At the point a dev is harcoding an f'ing PASSWORD, alarms should be going off with flashing lights and everything. If an auditor isn't searching the codebase for something simple like 'password = ' to see a hardcoded string, then that's a weak audit. The fact no internal code review didn't catch this is also not a good sign. 100% agree no single person can imagine every single scenario that would potentially cause problems down the road. However, when new things pop up, they should be added to a list of things to check for not an immediate throwing of hands in the air with a "we don't do that kind of thing". Instead, admitting it was checked for because it was such an out of consideration thing, but then saying "we'll keep that in mind for future testing" would have been a much better thing response than a bunch of whataboutisms.

mhh__ 4y ago

Security people seem to vary from proper devs with an interest in security to "I used to be a marine now I'm a security contractor" methodology-obsessed types. My faith in the former is strong, the latter category worries me.

hsbauauvhabzb 4y ago
I came from dev. I agree.
darkerside 4y ago
The ideal is you have both types taking different approaches
Hizonner 4y ago
Actually, "devs" are typically not technically qualified either. You have to really understand how things work, not just be able to write a program. But you're basically right. And now there seems to be a meme going around that it's elitist and inappropriate to expect people to have any technical understanding at all before they start dictating technical decisions around security, and all you need is a willingness to learn the alphabet soup of requirements and mindlessly apply the checklists.
- mhh__ 4y ago
  I said proper devs, in my defense. The people I hang around with tend to know how things work.