Security Is a Useless Controls Problem
securityis.substack.com
Security Is a Useless Controls Problem
1–10 of 83 posts
Re: Security Is a Useless Controls Problem
#2I’ve been thinking about this topic thru the lens of moral philosophy lately.
A lot of the “big lists of controls” security approaches correspond to duty ethics: following and upholding rules is the path to ethical behaviour. IT applies this control, manages exceptions, tracks compliance, and enforces adherence. Why? It’s the rule.
Contrast with consequentialism (the outcome is key) or virtue ethics (exercising and aligning with virtuous characteristics), where rule following isn’t the main focus. I’ve been part of (heck, I’ve started) lots of debates about the value of some arbitrary control that seemed out of touch with reality, but framed my perspective on virtues (efficiency, convenience) or outcomes (faster launch, lower overhead). That disconnect in ethical perspectives made most of those discussions a waste of time.
A lot of security debates are specific instances of general ethical situations; threat models instead of trolley problems.
Re: Security Is a Useless Controls Problem
#3I’ve been thinking about this topic thru the lens of moral philosophy lately. A lot of the “big lists of controls” security approaches correspond to duty ethics: following and upholding rules is the path to ethical behaviour. IT applies this control, manages exceptions, tracks compliance, and enforces adherence. Why? It’s the rule. Contrast with consequentialism (the outcome is key) or virtue ethics (exercising and a…
Securities laws are written in terms of duty ethics ("fiduciary duty", "duty of due care", etc). That's all anyone at the top would care about.
Re: Security Is a Useless Controls Problem
#4Security is having a bit of a hay day as everyone fights to build a moat against smart kids and AI. SOC2 and friends are a pain in the ass, but are a moat more than most these days. Security theater? The answer is at least “mostly”, but a moat nonetheless. You can feel the power swinging back into the hands of the customer.
When all software is trivial, the salesman and the customer will reign again. Not that I’m hoping for that day, but that day may be coming.
Re: Security Is a Useless Controls Problem
#5DITE and CSPM are indeed important problems upon which to reflect security-wise.
But, reflecting on XSS: What a shame that we can't evolve our standards, protocols, software, and hardware to fix such issues fundamentally.
Re: Security Is a Useless Controls Problem
#6Other than the myriad of problems with passwords that NIST has killed in competent circles, what are some other "useless controls"?
Re: Security Is a Useless Controls Problem
#7I’ve been thinking about this topic thru the lens of moral philosophy lately. A lot of the “big lists of controls” security approaches correspond to duty ethics: following and upholding rules is the path to ethical behaviour. IT applies this control, manages exceptions, tracks compliance, and enforces adherence. Why? It’s the rule. Contrast with consequentialism (the outcome is key) or virtue ethics (exercising and a…
I work at medium to large government orgs as a consultant and it’s entertaining watching beginners coming in from small private industries using - as you put it - consequentialism and virtue ethics to fight against an enterprise that admits only duty ethics: checklists, approvals, and exemptions.
My current favourite one is the mandatory use of Web Application Firewalls (WAFs). They’re digital snake oil sold to organisations that have had “Must use WAF” on their checklists for two decades and will never take them off that list.
Most WAF I’ve seen or deployed are doing nothing other then burning money to heat the data centre air because they’re generally left them in “audit only mode”, sending logs to a destination accessed by no-one. This is because if a WAF enforces its rules it’ll break most web apps outright, and it’s an expensive exercise to tune them… and maintain this tuning to avoid 403 errors after every software update or new feature. So no-one volunteers for this responsibility which would be a virtuous ethical behaviour in an org where that’s not rewarded.
This means that recently I spun up a tiny web server that costs $200/mo with a $500/mo WAF in front of it that does nothing just so a checkbox can be ticked.
Re: Security Is a Useless Controls Problem
#8I’ve been thinking about this topic thru the lens of moral philosophy lately. A lot of the “big lists of controls” security approaches correspond to duty ethics: following and upholding rules is the path to ethical behaviour. IT applies this control, manages exceptions, tracks compliance, and enforces adherence. Why? It’s the rule. Contrast with consequentialism (the outcome is key) or virtue ethics (exercising and a…
I work at medium to large government orgs as a consultant and it’s entertaining watching beginners coming in from small private industries using - as you put it - consequentialism and virtue ethics to fight against an enterprise that admits only duty ethics: checklists, approvals, and exemptions. My current favourite one is the mandatory use of Web Application Firewalls (WAFs). They’re digital snake oil sold to organ…
can it even be considered a firewall if it's running in an "audit only mode"?
Re: Security Is a Useless Controls Problem
#9This is quite a simplification. There are a lot of useless/dubious controls out there, but the problem is rather the contradiction between security pragmatism and compliance regimes.
####
Government: I need a service.
Contractor: I can provide that.
Government: Does it comply with NIST 123.456?
Contractor: Well not completely, because control XYZ is ackshually useless and doesn't contribute--
Government: hangs up
Re: Security Is a Useless Controls Problem
#10I’ve been thinking about this topic thru the lens of moral philosophy lately. A lot of the “big lists of controls” security approaches correspond to duty ethics: following and upholding rules is the path to ethical behaviour. IT applies this control, manages exceptions, tracks compliance, and enforces adherence. Why? It’s the rule. Contrast with consequentialism (the outcome is key) or virtue ethics (exercising and a…
I work at medium to large government orgs as a consultant and it’s entertaining watching beginners coming in from small private industries using - as you put it - consequentialism and virtue ethics to fight against an enterprise that admits only duty ethics: checklists, approvals, and exemptions. My current favourite one is the mandatory use of Web Application Firewalls (WAFs). They’re digital snake oil sold to organ…
So WAF. Bad? I don’t know enough about it. If it’s just a way to inject custom rules that need to be written and maintained, the value seems low or negative. I had hoped you got a bunch of packages that protected against (or at least detected) common classes of attacks. Or at least gave you tools in order to react to an attack?