5 ms·

There are two kinds of security. Nearly all of corporate America practices security by checklist and certification. This is not real security, it’s just CYA fo

There are two kinds of security. Nearly all of corporate America practices security by checklist and certification. This is not real security, it’s just CYA for careerists and legal challenges. Actual security is hard and almost no one does it. The people capable of it are rare and expensive. They’re probably not jumping at the opportunity to work at Optum for $80,000.

Veserv 3y ago
And who does actual security? Certainly not Google, Apple, Microsoft, Palo Alto Networks, Crowdstrike, etc. If that is who you were going to bring up, none of those companies has ever developed and deployed a usable system secure against even middling adversaries with only a few million dollars of budget. You will find exactly zero people at those companies who would be willing to bet their job that a small team of say 3-5 skilled offensive specialists specifically targeting them and willing to expend a year of fulltime work (i.e. a few million dollars worth of personnel cost) would not be able to completely compromise any usable system they designed. Exactly zero of the recognized names can protect against economically-motivated professional criminals targeting you. All they even claim to do is make you the ROI of attacking you go from the industry average of 100x to a still wildly profitable 10x under the "You don't need to be faster than the hunters, you just need to be faster than the other dodos" theory. Unfortunately, that theory does not work when the hunters keep bringing more of their friends to eat mouth-watering dodos. I mean, the cyberattacks have only been increasing by like, 500% YoY for the last 10 years. Exponential growth that slow means you can keep outrunning the hunters for like 5-10 more years until they eat everybody.
- klabb3 3y ago
  This economic projection-simplification doesn’t sound right to me. Even if $1M gets you a successful attack, doesn’t mean that the next $1M will. A strong security culture patches up holes and reduces the surface area and damage radius over time. I agree there’s a ton of snake oil. Most of it is. I agree that actors like Google and Apple also have 0days and will continue to have them. However, there’s still a massive difference between not giving a shit and a strong security posture. Some industries (most?) are in the former camp. They’re the ones who grinds to a halt from WannaCry and friends.
  - Veserv 3y ago
    If the audit was only run once as a exploratory measure, then you are correct, but that is not the case. If you run a audit intended to detect defects at the 1 M$ level 10 times and literally every single time you find truckloads of defects then you have statistical evidence on the quality of your processes. As a simpler example, suppose you did a firing test of a bulletproof vest and the bullet went right through. They patch that up and then you fire again and it goes right through. They do that 10 times and literally every single time it goes right through. You can conclude that those failures were not a fluke, their bulletproof vest is just garbage. To use a slightly more complex variant, suppose they had bulletproof vest version 1 and during acceptance testing the bullet goes right through. They go back to the drawing board and produce bulletproof vest version 2 claiming it is bulletproof and then the bullet goes right through again. They do this 10 times and literally every time they claimed it was bulletproof and every time the bullet goes right through. You can conclude that their engineering or validation processes are garbage and, additionally, you can only trust them as far as you can throw them. Until they conclusively demonstrate robust protection against bullets in representative tests their products and "expertise" should be ignored. The thing in the cybersecurity industry is that they fail the audit every time across all fields across all products across all systems. This is not a one-off case where a company has never done it before and they failed once so it might be a fluke or they can improve. This is everybody doing thousands of audits each and literally every single one of them has never once demonstrated a defect rate better than the low M$ range no matter how many changes or "improvements" they make. And the entire time they have been issuing deceptive marketing making people think they can. That is about as clear cut statistical evidence of industry-wide quality control failures as you can find in any field. Just for reference, this is extremely abnormal in other industries. Only in cybersecurity and software are poor quality control and validation processes so rampant that obvious global process failures are viewed as just the way things are done. Yes, some parts of the software industry are even worse, but even the "best" parts are laughably inadequate. Engineering is not about subjective evaluations like better, it is about objective evaluations like fit for purpose. And commercial IT cybersecurity fails that with a resounding no.
    - klabb3 3y ago

Veserv 3y ago

And who does actual security? Certainly not Google, Apple, Microsoft, Palo Alto Networks, Crowdstrike, etc. If that is who you were going to bring up, none of those companies has ever developed and deployed a usable system secure against even middling adversaries with only a few million dollars of budget. You will find exactly zero people at those companies who would be willing to bet their job that a small team of say 3-5 skilled offensive specialists specifically targeting them and willing to expend a year of fulltime work (i.e. a few million dollars worth of personnel cost) would not be able to completely compromise any usable system they designed. Exactly zero of the recognized names can protect against economically-motivated professional criminals targeting you. All they even claim to do is make you the ROI of attacking you go from the industry average of 100x to a still wildly profitable 10x under the "You don't need to be faster than the hunters, you just need to be faster than the other dodos" theory. Unfortunately, that theory does not work when the hunters keep bringing more of their friends to eat mouth-watering dodos. I mean, the cyberattacks have only been increasing by like, 500% YoY for the last 10 years. Exponential growth that slow means you can keep outrunning the hunters for like 5-10 more years until they eat everybody.

klabb3 3y ago
This economic projection-simplification doesn’t sound right to me. Even if $1M gets you a successful attack, doesn’t mean that the next $1M will. A strong security culture patches up holes and reduces the surface area and damage radius over time. I agree there’s a ton of snake oil. Most of it is. I agree that actors like Google and Apple also have 0days and will continue to have them. However, there’s still a massive difference between not giving a shit and a strong security posture. Some industries (most?) are in the former camp. They’re the ones who grinds to a halt from WannaCry and friends.
- Veserv 3y ago
  If the audit was only run once as a exploratory measure, then you are correct, but that is not the case. If you run a audit intended to detect defects at the 1 M$ level 10 times and literally every single time you find truckloads of defects then you have statistical evidence on the quality of your processes. As a simpler example, suppose you did a firing test of a bulletproof vest and the bullet went right through. They patch that up and then you fire again and it goes right through. They do that 10 times and literally every single time it goes right through. You can conclude that those failures were not a fluke, their bulletproof vest is just garbage. To use a slightly more complex variant, suppose they had bulletproof vest version 1 and during acceptance testing the bullet goes right through. They go back to the drawing board and produce bulletproof vest version 2 claiming it is bulletproof and then the bullet goes right through again. They do this 10 times and literally every time they claimed it was bulletproof and every time the bullet goes right through. You can conclude that their engineering or validation processes are garbage and, additionally, you can only trust them as far as you can throw them. Until they conclusively demonstrate robust protection against bullets in representative tests their products and "expertise" should be ignored. The thing in the cybersecurity industry is that they fail the audit every time across all fields across all products across all systems. This is not a one-off case where a company has never done it before and they failed once so it might be a fluke or they can improve. This is everybody doing thousands of audits each and literally every single one of them has never once demonstrated a defect rate better than the low M$ range no matter how many changes or "improvements" they make. And the entire time they have been issuing deceptive marketing making people think they can. That is about as clear cut statistical evidence of industry-wide quality control failures as you can find in any field. Just for reference, this is extremely abnormal in other industries. Only in cybersecurity and software are poor quality control and validation processes so rampant that obvious global process failures are viewed as just the way things are done. Yes, some parts of the software industry are even worse, but even the "best" parts are laughably inadequate. Engineering is not about subjective evaluations like better, it is about objective evaluations like fit for purpose. And commercial IT cybersecurity fails that with a resounding no.
  - klabb3 3y ago