Other than the myriad of problems with passwords that NIST has killed in competent circles, what are some other "useless controls"?
in the spirit of this article, can anyone explain why the Linux host-level firewall is a useful control?
Security Is a Useless Controls Problem
11–20 of 83 posts
Re: Security Is a Useless Controls Problem
#12The vast majority of the security "industry" is about useless compliance, rather than actual security. The chimps have put their fears into large enterprise compliance documents. This teaches the junior security people at enterprise companies that these useless fears are necessary, and they pass them along to their friends. Why? Not just because of chimps and fear, but also $$. There is a ton of money to be made off of silly chimps.
Re: Security Is a Useless Controls Problem
#13Other than the myriad of problems with passwords that NIST has killed in competent circles, what are some other "useless controls"?
in the spirit of this article, can anyone explain why the Linux host-level firewall is a useful control?
I think it depends a bit on circumstance, but I think I'd start with "way too much software binds to 0.0.0.0 by default", "way too much software lacks decent authn/z out of the box, possibly has no authn/z out of the box", and "developers are too lazy to change the defaults".
So it ends up on the network, unprotected.
Re: Security Is a Useless Controls Problem
#14This is quite a simplification. There are a lot of useless/dubious controls out there, but the problem is rather the contradiction between security pragmatism and compliance regimes. #### Government: I need a service. Contractor: I can provide that. Government: Does it comply with NIST 123.456? Contractor: Well not completely, because control XYZ is ackshually useless and doesn't contribute-- Government: hangs up
I think it's fine to implement a useless control to get a customer.
Just don't pretend that you're doing it because it is a useful control, pretend that you're doing it because jumping through that hoop gets you that customer, and "we're a smaller fish than the government". Especially with the government (especially if it's the USA…) there are going to be utterly pointless hoops. I can pragmatically smile & jump, … but that doesn't make it useful.
Re: Security Is a Useless Controls Problem
#15Other than the myriad of problems with passwords that NIST has killed in competent circles, what are some other "useless controls"?
in the spirit of this article, can anyone explain why the Linux host-level firewall is a useful control?
There's always an edge case, gotta know the various sec controls to slice the target risk outcome, vs target outcome == specific implementation. Security hires who are challenging employees are the latter types.
Edge case and your answer, in spirit - public-facing server, can't have a HW firewall in-line, can't do ACLs for some reason, can't have EDR on it.... at least put on a Linux host-level FW and hope for the best.
Re: Security Is a Useless Controls Problem
#16Other than the myriad of problems with passwords that NIST has killed in competent circles, what are some other "useless controls"?
I bumped into controls mandating security scans, when people running the scans don't need to know anything about the results. One example prevented us from serving public data using Google Web Services because the front-end was still offering 3DES among the offered ciphers. This raised alerts because of the possibility of Sweet32 vulnerability, which is completely impractical to exploit with website scale data sizes and short-lived sessions (and modern browsers generally don't opt to use 3DES). Still, it was a hard 'no', but nobody could explain the risk beyond the risk of non-compliance and the red 'severe' on the report.
We also had scans report GPL licenses in our dependencies, which for us was a total non-issue, but security dug in, not because of legal risk, but compliance with the scans.
Re: Security Is a Useless Controls Problem
#17Other than the myriad of problems with passwords that NIST has killed in competent circles, what are some other "useless controls"?
I bumped into controls mandating security scans, when people running the scans don't need to know anything about the results. One example prevented us from serving public data using Google Web Services because the front-end was still offering 3DES among the offered ciphers. This raised alerts because of the possibility of Sweet32 vulnerability, which is completely impractical to exploit with website scale data sizes…
"Why do we have to do X? Because we have to do X and have always had to do X" is a human problem coming from lack of expertise and lack of confidence to question authority.
It's a shame, your story isn't unique at all.
Re: Security Is a Useless Controls Problem
#18This is quite a simplification. There are a lot of useless/dubious controls out there, but the problem is rather the contradiction between security pragmatism and compliance regimes. #### Government: I need a service. Contractor: I can provide that. Government: Does it comply with NIST 123.456? Contractor: Well not completely, because control XYZ is ackshually useless and doesn't contribute-- Government: hangs up
I think it's fine to implement a useless control to get a customer. Just don't pretend that you're doing it because it is a useful control, pretend that you're doing it because jumping through that hoop gets you that customer, and "we're a smaller fish than the government". Especially with the government (especially if it's the USA…) there are going to be utterly pointless hoops. I can pragmatically smile & jump, … b…
Exactly. There is absolutely a threshold of money that will get me to implement FIPS. There is no threshold of money that will get me to say it's a good idea that has any value other than getting the (singular) customer that demands FIPS.
Re: Security Is a Useless Controls Problem
#19Earlier quoted context omitted.
I work at medium to large government orgs as a consultant and it’s entertaining watching beginners coming in from small private industries using - as you put it - consequentialism and virtue ethics to fight against an enterprise that admits only duty ethics: checklists, approvals, and exemptions. My current favourite one is the mandatory use of Web Application Firewalls (WAFs). They’re digital snake oil sold to organ…
can it even be considered a firewall if it's running in an "audit only mode"?
(Corporate IT sec answer): it says "firewall" in the name, so yes.
Re: Security Is a Useless Controls Problem
#20[deleted]