4 ms·
Realistically in my experiences every large company has "skeletons", which are primarily known to insiders and of which outsiders have less knowledge. Be that
by raesene4 12y ago
Realistically in my experiences every large company has "skeletons", which are primarily known to insiders and of which outsiders have less knowledge.
Be that a product which is known not to have as rigorous a security regime as others, or perhaps a service which is considered "legacy" and not developed actively.
When offensive companies start hiring people to get access to that information to use against their prior employers, I think that's not great for overall security.
I didn't think I was implying that keeping flaws secret in the long term was desirable, I don't think it is.
Also whilst I agree it's naive to suggest that only insiders know most flaws, I feel that it's also reasonable to suggest that insiders have information which would be useful to attackers, and that could be tapped by hiring them.
As I said originally that was just one example of where I think potential problems could arise from "vulnerabilities as a product", but I'd be interested to hear what you think are the downsides to vulnerability markets.
- tptacek 12y agoYou seem to be describing companies that are institutionally concealing serious product flaws from their customers, and suggesting that overall security as a public policy goal is improved by a strategy of just hoping that reverse engineers won't notice.
- raesene4 12y agothat's not what I was intending to describe. I was suggesting that insiders have inside information and sometimes that is relevant to attacking companies, such that hiring those insiders could be useful to them. and definitely not hoping that reverse engineers won't notice, I've been in security long enough to see all my pronouncements of "you know someone could do x" and more come true...
- tptacek 12y agoI'm not sure that you've clarified anything with this comment. "Insider knowledge of information relevant to attacking software" is "insider knowledge of product flaws". Flaws need to be fixed, not concealed.
- Spooky23 12y agoInstitutional knowledge is about process as well as the software. Knowing the magic words and people can make social engineering or avoiding countermeasures much easier, even in the absence of an explicit software flaw.
- tptacek 12y agoNow we're playing Six Degrees of Kevin Bacon. We start out with moles inserting vulnerabilities. Then it's insiders who know about flaws. Then insiders who know about weak spots to look for flaws in. Now it's magic words to help with social engineering. At some point, these stop being important considerations for public policy.