There is no black and white “this will fix it” in cybersecurity. It is a continual arms race. Arguing “X will stop cybercrime” is so naive it hurts.
Cybersecurity Is Broken
21–30 of 83 posts
Re: Cybersecurity Is Broken
#22Earlier quoted context omitted.
Memory safe languages are nearly irrelevant. Last time I looked, freaking injection attacks still held the top place among vulnerabilities. Even companies that take testing seriously rarely test for security problems. This needs to change.
Injection attacks holding a top place means the adoption of memory-safe languages is working.
No. Injection attacks have held the top place for literally decades. They are kindergarten level: validate your inputs. Lazy or incompetent developers still fail to do so.
Re: Cybersecurity Is Broken
#23Earlier quoted context omitted.
I'm fascinated by C. I agree that using almost anything else automatically eliminates entire classes of bugs and vulnerabilities, but it's so much _fun_ to be close to the machine and avoid those bugs and vulnerabilities myself. Judging by the fact that even some greenfield projects are still written in C, I'm not alone.
I am as much of a rust shill as you'll ever meet, but I agree that there is something beautiful and alluring and simple and engaging about C that few other languages match. It's basically an advanced macro assembler for an abstract machine, so there's all of the allure of using 6502 or 68000 assembly language but with none of the portability problems, and a vast ecosystem of libraries and amazing books to back it up.
I've enjoyed writing a few projects in x86-64 assembly as well, for what it's worth. Even though I'm sure that any C compiler would generate better assembly than my handwritten one. Flat assembler is great, by the way.
Re: Cybersecurity Is Broken
#24"Memory unsafe languages" is maybe one percent of one percent of the problem. As always, nobody actually gives a damn about "security" and uses it as a pretext to push something unrelated. (In this case, Current Year's stupid fad programming language.)
Memory safe languages are nearly irrelevant. Last time I looked, freaking injection attacks still held the top place among vulnerabilities. Even companies that take testing seriously rarely test for security problems. This needs to change.
Injection attacks AFAIK have held the top place since forever.
It is why people keep buying WAF's.
Re: Cybersecurity Is Broken
#25> You see, cybersecurity is broken because of the lack of consequences. It's really that simple. To put a slightly more explicit phrasing around the blog's message: Consequences fall on the wrong people . The ones screwing up chasing profit are not the ones feeling the pain. The damage falls on the innocent people the companies were trying to use as resources. This can be broadly classed as an economic externality, m…
Consequences are happening.
People just don't see them because this happens well above the IC pay grade and takes some time to percolate down and no one wants to publicly announce you shitcanned 5-10 people in middle management and security leadership because you enter thorny employee litigation territory.
That said, I agree with the author about mismatched expectations, though I can safely say that $500k year is VERY HIGH for a CISO. I know CISOs for publicly listed F500s who earn around 200-300k at most after 15-20 YoE.
The bigger issue is CISOs, VP Security, and Security ICs are not enabled institutionally.
If I'm honest, most security engineers suck. 90% are crappy IT Admins or Compliance Monkeys who did CISSP and maybe worked for PWC or an MDR for 1-2 years and don't know the difference between NFTables and NTFS. Most CISOs and VP Sec are former security engineers in turn.
Security Engineering NEEDS Security Minded Engineers. Now that development teams own Platform Management and Deployment, they should also be enabled to own Security, and a Security Team of 10x Engineers with a Security background should help with implementation and guidance internally. At least this is the model I've seen in tech forward public companies (some of whom HNers wouldn't even realize are tech first).
I also agree with Scarlett that data protection laws are critical and need to be enforced. That said, it's not enough (wouldn't protect against a vulnerability disclosure or misconfigured ACLs), and several Security ICs I trust recognize that as well. That said, the tone of the author and a couple well intentioned security minded engineers can impact this larger effort. You trap more flies with honey as they say.
A security minded engineer cannot present this kind of an article to their non-technical leadership, as it opens multiple questions about liability, ownership, and potential incompetence.
> Absolutely no amount of gentle pleas disguised as executive orders from the White House urging people to use memory-safe languages will solve the problem. CISA, despite all the phenomenal work they do, can't charge people who mishandle data with negligence; critical infrastructure involved or not
Amen to that! There's a reason why pushing for cybersecurity insurance might be a good push - hurting the bottom line is a good forcing function for change.
----------
Also, Engineers need to stop being shitty to QA and Platform Engineers.
Treat QA, IT, and DevOps as a first class citizen.
I don't give a rat's ass that you like using Mosh or xyz project on GitHub (not trying to pick on Mosh).
I don't care that you feel restricted by having to use MacOS laptops and SSHing into a CoLo protected behind ZPA when you'd rather use ArchLinux on your work laptop.
Every bug, misconfiguration, or non-standard platform deployment needs to be treated as a potential security liability.
Sure it might slow down the deployment of your "yet another wrapper around an LLM SaaS" but there absolutely needs to validation.
Re: Cybersecurity Is Broken
#26> You see, cybersecurity is broken because of the lack of consequences. It's really that simple. To put a slightly more explicit phrasing around the blog's message: Consequences fall on the wrong people . The ones screwing up chasing profit are not the ones feeling the pain. The damage falls on the innocent people the companies were trying to use as resources. This can be broadly classed as an economic externality, m…
Nassim Taleb was right again.
Re: Cybersecurity Is Broken
#27It'd be interesting if you basically made it illegal to both process and store user-data. If you want to process a user's information you need to go through that user's storage API and then you need to persist your data back through that API. Since everything is co-located in the cloud I don't think latency would be a huge deal. Users would get a choice of storage vendors - total visibility into who and what is doing the reading/writing and can delete/revoke access at any time.
Re: Cybersecurity Is Broken
#28This is a great summary of the economic problems perpetuating lax cybersecurity and the real political reasons we continue to suffer. The answer is clear, and there is precedent in other similar fields: we need data protection laws with teeth.
This, if done right, would also reduce surveillance capitalism by turning huge troves of personal data into liabilities rather than assets.
I wonder if any kind of pro-security legalisation were proposed, how many lobbying firms from big tech (Google, Amazon, etc) would fight it tooth and nail.
Kind of reminds me of PHK's criticisms of HTTP2, tho (https://queue.acm.org/detail.cfm?id=2716278 ), where he makes this point;
"The reason HTTP/2.0 does not improve privacy is that the big corporate backers have built their business model on top of the lack of privacy"
Re: Cybersecurity Is Broken
#29I think this is the wrong way to think about personal data. You're better off just living your life like everything is hacked and out there and take precautions to deal with that.
Otherwise you place your destiny in the hands of others. And your also expecting a 100% success rate against data being stolen. We're only human, eventually someone will screw up no matter how much punishment there is.
Re: Cybersecurity Is Broken
#30Fixing cybersecurity with laws is the same as fixing drug trafficking with laws