Information Security Is Becoming Infrastructure 75
Bruce Schneier has a story at Wired about his observations from the recent RSA conference. He noticed that the 350+ vendors who attended the conference were having difficulties selling their products or even communicating with potential buyers. Schneier suggests that the complexity of the security industry is forcing it away from end-users and into the hands of companies who can bundle it with the products that need it. Quoting:
"When something becomes infrastructure -- power, water, cleaning service, tax preparation -- customers care less about details and more about results. Technological innovations become something the infrastructure providers pay attention to, and they package it for their customers. No one wants to buy security. They want to buy something truly useful -- database management systems, Web 2.0 collaboration tools, a company-wide network -- and they want it to be secure. They don't want to have to become IT security experts. They don't want to have to go to the RSA Conference."
Comment removed (Score:5, Insightful)
Re: (Score:2, Insightful)
Now, its unheard of.
I've set my machines up with GPG and my wife's as well, and autoconfigured them to encrypt any and all email between the two of us, but my attempts to get others to do so has proven fruitless.
I harp the same line Zimm did--when you put a letter in the mailbox, you put it in an envelope, right? Why is email any different?
Re: (Score:2)
While in some sense I agree that the problem with encryption is that it isn't ubiquitous, isn't easy to use and isn't the default, I think part of the problem is that email isn't the functional equivalent of sending a letter in the mail. It's the functional equivalent of sending a postcard. Most the emails with my wife are at the level of "the puppy ate (insert another e
Re: (Score:2)
Re: (Score:1)
I also agree that the stuff does need to be transparent. The fact that I pre-configured my wife's computer to do it automatically is proof of that (because she doesn't have a clue)
The core problem is the lack of options right now. Unfortunately there doesn't seem to be a lot of importance placed on secure email so GPG is about all we have.
Re: (Score:2, Informative)
Yeah, good luck with that. In my experience, mail encryption is fundamentally difficult - like going from driving cars to planes. You have to know the basics of key management ie get someone's PUBLIC key, encrypt messages using HIS public key & he decrypts using HIS private key. That's already a dealbreaker for most people. Does he seriously expect they'll listen when he talk about ke
Re: (Score:1)
Re: (Score:1)
I completely agree (Score:1)
maybe the market is working (Score:5, Insightful)
Re:maybe the market is working (Score:5, Insightful)
I think they have it backwards. Security isn't a utility, it is a highly technical skill. You need a person, not a box.
HP??? (Score:1)
You've got to be kidding us
Re: (Score:3, Interesting)
The booths are filled with broad product claims, meaningless security platitudes and unintelligible marketing literature. You could walk into a booth, listen to a five-minute sales pitch by a marketing type, and still not know what the company does. Even seasoned security professionals are confused.
This is the state of security products for the most part nowadays, hoax products and snake oil salesmen "IT'S 2009 READY!!!1!".
Now, I do agree with you that security should lie at the foundation of a design, but security also works by constructing layers of defense. No matter how good your design/implementation is, software is very complicated and someone will slip somewhere.
Unless you write your own OS, design your hardware and write its firmware, then wr
Re: (Score:2)
a herd of tiny companies makes something to fix some obscure problem that 99% of people will never encounter but the marketing hype makes it seem like the end of the world
Comment removed (Score:4, Interesting)
Re: (Score:2)
However, since those salesmen have a product, not a redesign, to sell, none of their solutions really address the problem, but makes them a lot of money.
I'm mostly talking about smtp and spam here, but the same concept applies elsewhere, to a
NOOOOOOOOO (Score:5, Insightful)
Great, once again the tools I need to protect myself are being taken away given to "the professionals". So if all the security tools go to the ISPs and other infrastructure how do I protect myself from ISP spyware?
Re: (Score:2)
Re: (Score:2)
most security products are to fix poor admins (Score:2)
Nobody likes paying for "security" (Score:3, Insightful)
Good news. (Score:3, Interesting)
Self-serving horseshit (Score:2, Insightful)
The information security people are getting jealous because project managers have the certification/religious body (PMI) and a certification (PMP) that is basically required for many serious projects. That keeps the rates high by limiting the marketplace and mandating some prescribed process for doing everything.
Security consultants like to put that "CISSP" on email signatures and business cards because it mak
Re: (Score:3, Insightful)
The answer is not just to give more money to security consultants (like me, a CISSP + GSNA) nor hw/sw vendors.
The answer is to develop a good security management framework that works for the organization. Security is not a product or a consultant or a service. Security is a process. Invest into developing the process and the organization is set to survive whatever the Chinese/Government/God throws at it.
Re: (Score:2, Insightful)
It's remarkable how many PMPs are really risk-seeking, control-averse, self-declared security expert cowboys trying to impress the bosses on how many shortcuts they've taken to get the project out the door. Outlooks like this are far from scarce and unfortunately leads to the purchase of expensive common-control level solutions to compensate post-im
Re: (Score:1)
Re:Self-serving horseshit (Score:5, Interesting)
I've been doing infosec work for over 17 years now, and IMO, the "problem" as it were, is that the demand for expertise has utterly outstripped the experienced pool of talent.
Net result? Exactly what you observe: "cash cow security" that is more focused on implementing wildly expensive (and frequently Rube-Goldberg-esque) technology solutions. Why? Because the inexperienced security practitioner immediately and inevitably turns to vendors for "turn-key solutions" to every risk (and many non-risks
Conversely, the much smaller number of people with substantial experience in the trenches are the ones who might point out that a $50,000 security awareness campaign _just might_ reduce net risk a WEE BIT more than a $3million 17-tier-firewall-atrocity. Or that a 10-man-hour risk assessment by security professionals attached to EVERY project's design phase _just might_ have a better chance of reducing risk than a $30k penetration test of every project by an external vendor that is 9 times in 10 a glorified canned vulnerability scan by a junior drone.
Not much of this is likely to change anytime soon. Sad to say, information security is still a very young and immature science. Things won't get better until the experience-pool gets deeper.
--Bargeld
Re: (Score:1)
Re: (Score:1)
Wish I had a better answer. There might be one.
PS: My "drones" snark is directed more at consultancies selling BS than at inexperienced-but-learning security people trying to do their job. Used to be in charge of a security consulting practice, and was sabotaged endlessly by a sales force positioning my team as "all created equal", or promising that in a pinch _I_ would personally deliver every engagement, so boilerplate SOW's are just fine. It's all about the billable, baby...*sigh*
Re: (Score:2)
When people talk about the Mythical Man-Month, they usually refer to the assertion that throwing people on a project tends to delay the project. But another key point in that book was that the programming/implementation team was more
Re: (Score:1)
If you took a bright programmer on each team, and had her focus on security issues as a primary responsibility, I think you'd develop a fantastic core of security expertise on project teams. Certainly better than the drive-by security types that dominate the field.
Slowly but surely, I see more companies "getting this". It's been many years since I've had trouble finding "that guy", the bright dev or admin who also gives a shyt about security, who WANTS to be the evangelist, the translator, and work together with infosec from 'go'. The opposition to this approach is usually bureaucratic, rooted in upper management who historically view infosec as adversaries (and to be fair...many security professionals, even experienced ones, HAVE frequently been adversarial and aut
Transparent Tech is Better (Score:4, Insightful)
The biggest problem with security is that it's added afterwards as a "deluxe feature", rather than integrated with every design and implementation detail. Adding security afterwards means always catching up with the original insecure condition. It means creating an insecure system that the bad guys like, then fighting your own system along with the bad guys while you labor to secure it.
But the "built-in" tech shouldn't become completely invisible. The bundles should be transparent, not closed and opaque. Because nothing has a higher risk of insecurity than something unknown that you can't inspect. And no matter how well a vendor inspects their own secure component, if it's properly secured no extra scrutiny makes it less secure, only more. Leaving it transparent, visible only when you inspect it, is the best, safest tech.
Re: (Score:2)
Perhaps one reason why it's so hard to figure out what those guys are hawking at the RSA conference is that what they're really hawk
What you described is a quarantine. (Score:1)
Along the same lines, my general predisposition is to remove as much responsibility for security from users as is possible. That means scanning email for viruses before they reach the desktop, blocking users from downloading dangerous payloads (like executables) over the web, and so forth.
Your diligence is commendable, by the way, but if the client machines on your network were running professional-grade operating systems, that would not be necessary. Limited User accounts really should only be able to run executable programs which are located on a protected partition, which in turn should only be writable to the Administrator.
Security should be a part of infrastructure, not something tacked on at the users' end.
True. And if the operating system isn't computing infrastructure, then ffs, what is?
Connective Awareness? (Score:1)
Most security problems are a result of misunderstanding the purpose of an object in the infrastructure, and telling other components lies about its nature (permissions boosting). Bad admin does this with a human face. Poor products do this when out-of-the-box configurations don't match the user's requirements, allowing too much be begin with, or having options that bad admins change inappropriately.
So, how do we do this in a product-based environment? Do we need new module API, covering anything that comm
get out of jail free card (Score:1)
I contend that society needs to make a clear distinction between the two and force the industry through legislative action (because voluntary is clearly not working) to choose one or the other, but not both.
If
Re: (Score:2)
That is true, but it would also raise the price of an OS several fold and require more restrictions to be placed on application designers. Car manufacturers can require that you only use certain, high rated tires for their [stretcher.com]
Re: (Score:1)
Re: (Score:2)
Perhaps you should look at an s390. You'll get the warranty you want for orders of magintude more cash. Alas there is no "home edition". All bets are off if you run Adobe on it, that's a different vendor.
Still needed (Score:1)
Re: (Score:2)
Actually, Warranties are NOT going to help and are NOT practical in software as we know it.
For one, when is that last time you have seen anything that absolutely warrants against break-in? Certainly not your car or house. Risks digest has had several postings about keyfobs that unlock several cars in the same parking lot and even one where the physical key operated an identical car. The dirty secret of home security is that anyone with the ability to kick hard and a hammer can break in and disable most al
Ha! (Score:1)
You want a metric, the rest of all industry has one, it is very, very simple, you sell something and it is bogus and causes physical or financial har
Re: (Score:2)
I based the prices on the guesstimate of 100 times the price. That's the same as the liability markup on drugs but considerably less than the may not fail cost for space shuttle avionics software.
Please name any industry that warrants against criminal acts (such as breaking and entering) committed by a 3rd party (hint, there re none). Since there are none, there are also no metrics for it. Even safes and armored cars don't absolutely warrant that they won't be broken in to, only that they will "resist" fo
"Who do you blame?" (Score:1)
Re: (Score:2)
Just so you know, I agree a lot of software is crap, and soem of it in addition to being insecure is also unfit for it's purpose. I'm just saying that in order to bring law into it, there must be legal standards.
I *KNOW* that whoever wrote the crap part is to blame, I'm not stupid. I'm saying that if *you* buy an OS from one place, pay someone else to install python, and then buy my python program from me and install it, who gets the blame when you get hacked? You'll probably blame me and it'll cost me a
How do you fix it then? (Score:1)
Re: (Score:2)
There is one phenominon I have no explaination for. If we can figure that out, many of the stability and security issues would solve themselves.
MS (primarily, but others as well) repeatedly announces new improved versions just like Lucy holding the football for Charlie Brown. Like Charlie Brown, users everywhere for some reason fall for the hype and believe that the result will be different this time in spite of decades of history. When MS announces a new release I am nearly to the point of actually heari
Re: (Score:2)
It's one thing to make an OS fully secure. It's something else entirely to make it enforce security on other products. I want the former and not the latter. It is then my responsibility, delegated to the makers of the applications I add on, to make sure the applications themselves are secure. The OS only needs to provide the necessary facilities that applications might need. If an application specifically allows anyone that can reach that computer to login and erase crucial files, that is an issue of t
However, security is not like power (Score:2)
The correct amount and nature of security is very much relative to the risks the organisation is facing. Those risks are dependent on the kind of business they're doing and also on their business model.
However, as a security professional I still see people who say "It must be
Re: (Score:2)
No amount of "security as infrastructure" will help if organisations do not have a good risk management and analysis framework or do not understand what kind of security they need and how much. If they don't understand it, they cannot ask it of the vendors and thus they will get either nothing or something random.
I've only encountered a few companies that could even implement anything like "Best Practices" for security. Why? because currently INFOSEC is seen as a cost to the company without any type of revenue from it, like most of IT, only worse. When your blocking traffic from a poorly created application that a company depends on, or a mis-configured windows clustered server, INFOSEC is blamed for outages, because it's the one thing that actually does it's job, the rest of IT will see security as something preve
God I love Schneier (Score:1)
Security doesn't work that way (Score:2)
Unless everyone participates in security, the system is not secure. As we learned years ago, a password can be purchased for a candy bar. Millions of AO
Re: (Score:1)
Security is not infrastructure (Score:2)
They don't want to have to become IT security experts
Maybe not but someone will
Security a problem for someone else? (Score:1)
And what do these companies do, besides cry WOLF? (Score:4, Interesting)
- Antivirus: works by scanning files being written to/from disk, and by scanning I mean "run ~1 million instructions in an emulator then see if it matches a virus pattern". Requires weekly updates to latest definitions. One of the most successful "security" products
- Static code analysis tools (e.g. Coverity). They take your source code, run a heavy-duty static analysis program on it, and point out memory leaks / double frees, uninitialized variables, and other flaws. My educated guess is that 1/3 of viruses involve such a problem. Useful, but to a manager, you can find a different 1/3 of flaws with a manual code audit that costs about as much.
- Windows Vista (yeah, ha ha). Includes improved account control and privilage separation! Except that most users get so sick of the Allow box that is required for so many things on Windows that Vista has NOT fundamentally increased security.
- Network intrusion detection appliance - you plug this into your network, and it does something when it detects a malicious access pattern - I dunno, maybe it bakes cookies? But detecting malicious access patterns makes you more secure!!!
The security product that takes off will be one that says "with product X, you will never experience security problem Y". Unfortunately, the security products out there are crap (product X decreases chances of problem Y from 1% to 0.01%) and security folks are the most paranoid about providing any guarantees. (Use the word "impossible" at a security conference and watch what the blogosphere does to you. I dare you.)In other words: most security products provide a small marginal gain, while their vendors tout them as essential, must-have products.
The single most telling "security" trait I have seen is from the security group at my employer. They send out a feature proposal, and then flame anyone who disagrees with by saying "if you don't agree to this, we'll probably get hacked next year and it will be your fault for being against the security of our products!". Never mind the technical flaws (ASLR doesn't work when you map 1GB of contiguous memory in a 32-bit process) or performance implications. Security "sells" based on fear, and the security industry sales arm has yet to realize they have cried WOLF too many times for purchasers to take them seriously anymore.
Re:And what do these companies do, besides cry WOL (Score:2)
Re: (Score:1)
Re:And what do these companies do, besides cry WOL (Score:2)
Static code analysis tools (e.g. Coverity). They take your source code, run a heavy-duty static analysis program on it, and point out memory leaks / double frees, uninitialized variables, and other flaws. My educated guess is that 1/3 of viruses involve such a problem. Useful, but to a manager, you can find a different 1/3 of flaws with a manual code audit that costs about as much.
I'd argue that if your software is important enough to deserve a thorough manual audit, you should probably consider doing both as they tend to catch different sorts of problems. Witness all the code cleanup that has been done in FOSS code on the basis of bugs found through Coverity's DHS funded code scanning service [coverity.com]. Other than that, I'm pretty much in agreement with what you say.
Didn't he mean security is becoming a commodity? (Score:2)
Re:Didn't he mean security is becoming a commodity (Score:2)
Embedding security in other products may be hard (I don't entirely agree with this), but it is what is essential. Security should not be a separate product.
For example, if you have a router between your LAN and your link to the internet, that router should be performing the security function for you. If you want to block certain ports from being connected to via the internet, block it there. If you want to establish a VLAN tunnel to another office, you could do it there.
To the extent that any separate
From TFA (Score:3, Insightful)
And there you have it, ladies, gentlemen and slashdotters, the problem in a nutshell. People don't want to buy security because they don't think it's useful. And then what happens when their site gets defaced or their database hacked? They blame the admins, that's what. They never, ever admit that it happened because they wouldn't pay the price needed to secure their machines, they just blame somebody else for not keeping them safe even though they didn't have the tools to do the job.
Re: (Score:1)
They never, ever admit that it happened because they wouldn't pay the price needed to secure their machines, they just blame somebody else for not keeping them safe even though they didn't have the tools to do the job.
First, you admit that the price of keeping those machines secure exceeds the total value of the machines. As with any commodity, we blame the manufacturers of defective products for the damage done using those products for their advertised use. It's only Microsoft shirking their responsibility here, not Microsoft customers.
Re: (Score:2)
No I don't. Security software and the extra time to install, upgrade and maintain it isn't anywhere near that expensive, and if it is, it shouldn't be. Of course, we're probably talking Windows here, where security is nothing more than an afterthought tacked on at the last minute. If we're talking Linux, Unix or some other real OS, it's largely built in from the ground up, making your claim even le
Re: (Score:1)
First, you admit that the price of keeping those machines secure exceeds the total value of the machines.
No I don't. Security software and the extra time to install, upgrade and maintain it isn't anywhere near that expensive, and if it is, it shouldn't be.
You overestimate the "value-add" of the crappy machines then. "Security" should be an adjective we use to distinguish good software from insecure software. Any product that does require separate "security software" to become realistically usable for its advertised functions would not succeed in a free market any better than doors that unlock from both sides without a key.
Of course, we're probably talking Windows here, where security is nothing more than an afterthought tacked on at the last minute.
No, I was and am certainly talking about Microsoft. I specified that twice -- in the
Problem is not in infrastructure (Score:2, Interesting)
Why do we even have that lever? (Score:3, Insightful)
In "The Emperor's New Groove" there is a running gag where someone pulls the wrong lever and falls through a trap door into an alligator pit, then returns dripping water and kicking away alligators and asking "Why do we even *have* that lever?"
Why does Firefox have a mechanism to install extensions to Firefox from within a Firefox window?
Why does Internet Explorer have a mechanism to run native code downloaded from a website?
Why does Safari have an '
Re: (Score:1)
Are they doing it well? It's all over the map. Are they at least aware that they're doing it? One hopes so. But most of the attendees that I saw were clea
Is it 1998!? (Score:2)
No one wants to learn anything, especially if it has nothing to do with the task at hand. We want it to just work, and it should.
Just prevent it, don't make us think about it unless you want some of us to make mistakes.