3 ms·

I work on building security hardended systems, and often see the opposite problem. Engineers, even ones who should really know better, will see a feature like t

I work on building security hardended systems, and often see the opposite problem. Engineers, even ones who should really know better, will see a feature like this and assume it creates an actual security boundary. Then they design something that relies on it for a security requirement. At that point, you need to hope someone catches the mistake, but even then, you can spend a week arguing with a non-technical manager that you need to start over, because that thing that sounds like it does exactly what you want actually provides 0 security guarantees.

noodlesUK 3y ago
I completely agree with this. If something seems at first blush to enforce a security control, but does not in reality, it should somehow be made very clear that it is just disabling a footgun rather than actually enforcing a security control. Either the setting in the config file needs to be named something silly like disable_alter_system_not_a_security_feature, or it needs to be overridable with something like "WITH FORCE", to make it really clear that all it is is a stumbling block rather than a control.
qalmakka 3y ago
This exactly. It's hard to properly understand security, even for educated professionals. IMHO security features should be the default only if they are demonstrably correct or hard to misuse. Otherwise, the often wiser thing to do is to make the danger of doing something as obvious and blatant as possible. It's like the debate around having a root account or not: IMHO it's better to have a superuser that everybody perceives as an obvious danger, that's easily recognizable and never really ok to use for mundane tasks. I've seen people misunderstanding Windows ACLs way too often because of this.
mrguyorama 3y ago
The reality is that your average engineer should not be considered an expert in security. You need dedicated security people with the authority to reject commits or code changes.

noodlesUK 3y ago

I completely agree with this. If something seems at first blush to enforce a security control, but does not in reality, it should somehow be made very clear that it is just disabling a footgun rather than actually enforcing a security control. Either the setting in the config file needs to be named something silly like disable_alter_system_not_a_security_feature, or it needs to be overridable with something like "WITH FORCE", to make it really clear that all it is is a stumbling block rather than a control.

qalmakka 3y ago

This exactly. It's hard to properly understand security, even for educated professionals. IMHO security features should be the default only if they are demonstrably correct or hard to misuse. Otherwise, the often wiser thing to do is to make the danger of doing something as obvious and blatant as possible. It's like the debate around having a root account or not: IMHO it's better to have a superuser that everybody perceives as an obvious danger, that's easily recognizable and never really ok to use for mundane tasks. I've seen people misunderstanding Windows ACLs way too often because of this.

mrguyorama 3y ago

The reality is that your average engineer should not be considered an expert in security. You need dedicated security people with the authority to reject commits or code changes.