Cybersecurity Is Broken
crankysec.com
Cybersecurity Is Broken
1–10 of 83 posts
Re: Cybersecurity Is Broken
#2[dead]
Re: Cybersecurity Is Broken
#3"Memory unsafe languages" is maybe one percent of one percent of the problem.
As always, nobody actually gives a damn about "security" and uses it as a pretext to push something unrelated. (In this case, Current Year's stupid fad programming language.)
Re: Cybersecurity Is Broken
#4The ideal data protection law would prevent most of the data from being collected in the first place. Cybersecurity, on the other hand, is about protecting what you have collected anyway. So, maybe cybersecurity is broken, but fixing privacy is a great first step.
Re: Cybersecurity Is Broken
#5"When literally nothing happens when some stupid service gets popped and loses your data they had no business collecting in the first place, this kind of thing will happen over and over and over again."
Money quote, and he's right. In Europe, the GDPR helps stop random data collection, but there is still no penalty for getting hacked and losing customer data. There should be, and in egregious cases upper management should be personally liable for civil suits by affected people.
Re: Cybersecurity Is Broken
#6cybersecurity can mean many things.
a noun, a verb, a quality, attribute, or function.
In general, I don't see the noun, verb, or function as broken (despite being new(immature) fields relatively) but I definitely see the quality, or attribute as broken because it is subject to the whims of profit and doesn't have many of the guard rails of more mature industries.
The Body of Knowledge is not firmly established therefore there are huge asymmetries between developers, offensive and defensive practicioners, and resourcing/tooling plays a gigantic part of this.
Re: Cybersecurity Is Broken
#7This is a great summary of the economic problems perpetuating lax cybersecurity and the real political reasons we continue to suffer. The answer is clear, and there is precedent in other similar fields: we need data protection laws with teeth.
Re: Cybersecurity Is Broken
#8"Memory unsafe languages" is maybe one percent of one percent of the problem. As always, nobody actually gives a damn about "security" and uses it as a pretext to push something unrelated. (In this case, Current Year's stupid fad programming language.)
From what I've seen, we're going to rewrite everything in memory safe languages, miss all of the corner case logic and tests, and end up less secure than we were at the beginning.
Re: Cybersecurity Is Broken
#9"Memory unsafe languages" is maybe one percent of one percent of the problem. As always, nobody actually gives a damn about "security" and uses it as a pretext to push something unrelated. (In this case, Current Year's stupid fad programming language.)
Memory safe languages are nearly irrelevant. Last time I looked, freaking injection attacks still held the top place among vulnerabilities.
Even companies that take testing seriously rarely test for security problems. This needs to change.
Re: Cybersecurity Is Broken
#10> You see, cybersecurity is broken because of the lack of consequences. It's really that simple.
To put a slightly more explicit phrasing around the blog's message: Consequences fall on the wrong people. The ones screwing up chasing profit are not the ones feeling the pain.
The damage falls on the innocent people the companies were trying to use as resources.
This can be broadly classed as an economic externality, much like how a company can make money dumping poison into the lake but the people who suffer are the ones who drink from it.