Securityblog

I gave a talk at OSCON 20 about security. It’s not a typical security talk though. I’ve given and attended a lot of what I would call “typical” security presentations. It’s generally about some big security idea, there’s likely some amount of blaming everyone except the security industry itself. We should make sure we throw in some analogies, maybe comparing cars to buggies or bridge safety. Blockchain is pretty hip now so that can probably solve the problem, maybe with AI. In general these presentation aren’t overly exciting and tend to play to the audience. They are fun, but that’s not the point this time. ...

A lot of what we call security is voodoo. Most of it actually. What I mean with that statement is our security process is often based on ideas that don’t really work. As an industry we have built up a lot of ideas and processes that aren’t actually grounded in facts and science. We don’t understand why we do certain things, but we know that if we don’t do those things something bad will happen! Will it really happen? I heard something will happen. I suspect the answer is no, but it’s very difficult to explain this concept sometimes. ...

As of late I’ve been seeing a lot of grumbling that security return on investment (ROI) is impossible. This is of course nonsense. Understanding your ROI is one of the most important things you can do as a business leader. You have to understand if what you’re doing makes sense. By the very nature of business, some of the things we do have more value than other things. Some things even have negative value. If we don’t know which things are the most important, we’re just doing voodoo security. ...

After my last post about security spending, I was thinking about how most security teams integrate into the overall business (hint: they don’t). As part of this thought experiment I decided to compare traditional security to something that in modern times has come to be called helicopter parenting. A helicopter parent is someone who won’t let their kids do anything on their own. These are the people you hear about who follow their child to college, to sports practice. They yell at teachers and coaches for not respecting how special the child is. The kids are never allowed to take any risks because risk is dangerous and bad. If they climb the tree, while it could be a life altering experience, they could also fall and get hurt. Skateboarding is possibly the most dangerous thing anyone could ever do! We better make sure nothing bad can ever happen. ...

I was watching a few Twitter conversations about purchasing security last week and had yet another conversation about security ROI. This has me thinking about what we spend money on. In many industries we can spend our way out of problems, not all problems, but a lot of problems. With security if I gave you a blank check and said “fix it”, you couldn’t. Our problem isn’t money, it’s more fundamental than that. ...

This week I’ve been thinking about how security people and non security people interact. Various conversations I have often end up with someone suggesting everyone needs some sort of security responsibility. My suspicion is this will never work. First some background to think about. In any organization there are certain responsibilities everyone has. Without using security as our specific example just yet, let’s consider how a typical building functions. You have people who are tasked with keeping the electricity working, the plumbing, the heating and cooling. Some people keep the building clean, some take care of the elevators. Some work in the building to accomplish some other task. If the company that inhabits the building is a bank you can imagine the huge number of tasks that take place inside. ...

Earlier today I ran across this post on Reddit Security but not Privacy (Am I doing this right?) The poster basically said “I care about security but not privacy”. It got me thinking about security and privacy. There’s not really a difference between the two. They are two faces of the same coin but why isn’t always obvious in today’s information universe. If a site like Facebook or Google knows everything about you it doesn’t mean you don’t care about privacy, it means you’re putting your trust in those sites. The same sort of trust that makes passwords private. ...

I’m getting ready to attend Black Hat. I will miss BSides and Defcon this year unfortunately due to some personal commitments. And as I’m packing up my gear, I started thinking about what these conferences have really changed. We’ve been doing this every summer for longer than many of us can remember now. We make our way to the desert, we attend talks by what we consider the brightest minds in our industry. We meet lots of people. Everyone has a great time. But what is the actionable events that come from these things. ...

The topic of hacking back keeps coming up these days. There’s an attempt to pass a bill in the US that would legalize hacking back. There are many opinions on this topic, I’m generally not one to take a hard stand against what someone else thinks. In this case though, if you think hacking back is a good idea, you’re wrong. Painfully wrong. Everything I’ve seen up to this point tells me the people who think hacking back is a good idea are either mistaken about the issue or they’re misleading others on purpose. Hacking back isn’t self defense, it’s not about being attacked, it’s not about protection. It’s a terrible idea that has no place in a modern society. Hacking back is some sort of stone age retribution tribal law. It has no place in our world. ...

If you’ve not read my previous post on thought leadership, go do that now, this one builds on it. The thing that really kicked off my thinking on these matters was this article: Security liability is coming for software: Is your engineering team ready? The whole article is pretty silly, but the bit about liability and open source is the real treat. There’s some sort of special consideration when you use open source apparently, we’ll get back to that. Right now there is basically no liability of any sort when you use software. I doubt there will be anytime soon. Liability laws are tricky, but the lawyers I’ve spoken with have been clear that software isn’t currently covered in most instances. The whole article is basically nonsense from that respect. The people they interview set the stage for liability and responsibility then seem to discuss how open source should be treated special in this context. ...