Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Is a Useless Controls Problem

securityis.substack.com

Post reply on HN
Print view View original

41–50 of 83 posts

Re: Security Is a Useless Controls Problem

#41

Post by lmm »

dataflow wrote: post #38
lmm wrote: post #34

Earlier quoted context omitted.

Maybe, if the attacker didn't bother to hack into the WAF itself (generally a softer target than whatever's behind it) and if you bothered keeping or understanding the logs (extremely unlikely to be a good use of resources).

You don't need to understand the logs at the time you gather them for this, you just need to keep them long enough to cover the breach, and to be able to understand them after the fact. Hardly seems like an obvious waste to me, and well worth $500/mo.

> you just need to keep them long enough to cover the breach, and to be able to understand them after the fact

And avoid leaking customer information/passwords/etc. through them until then, which is the hard part.

Re: Security Is a Useless Controls Problem

#43

Post by hathawsh »

commandar wrote: post #22
EE84M3i wrote: post #6

Other than the myriad of problems with passwords that NIST has killed in competent circles, what are some other "useless controls"?

>that NIST has killed in competent circles Just because this is my favorite soapbox - anyone that has to deal with passwords should go read NIST SP800-63B: https://pages.nist.gov/800-63-3/sp800-63b.html I was kind of shocked by just how gosh-darned reasonable it is when it came out a couple of years ago. It's my absolute favorite thing to cite during audits. "Are you requiring password resets every 90 days?" "No. We…

I've done the same thing, with the same results. These guidelines are impressive. 1Password created an excellent summary:

https://blog.1password.com/nist-password-guidelines-update/

Re: Security Is a Useless Controls Problem

#44

Post by ozim »

lll-o-lll wrote: post #10
jiggawatts wrote: post #7

Earlier quoted context omitted.

I work at medium to large government orgs as a consultant and it’s entertaining watching beginners coming in from small private industries using - as you put it - consequentialism and virtue ethics to fight against an enterprise that admits only duty ethics: checklists, approvals, and exemptions. My current favourite one is the mandatory use of Web Application Firewalls (WAFs). They’re digital snake oil sold to organ…

So WAF. Bad? I don’t know enough about it. If it’s just a way to inject custom rules that need to be written and maintained, the value seems low or negative. I had hoped you got a bunch of packages that protected against (or at least detected) common classes of attacks. Or at least gave you tools in order to react to an attack?

Just slapping WAF in front of your services without configuring and maintaining rules is bad.

Without someone dedicated for maintenance of WAF it is just a waste. Where not many companies want to pay for someone babysitting WAF and it can be full time job if there is enough changes on layers behind.

Re: Security Is a Useless Controls Problem

#45

Post by not2b »

pphysch wrote: post #9

This is quite a simplification. There are a lot of useless/dubious controls out there, but the problem is rather the contradiction between security pragmatism and compliance regimes. #### Government: I need a service. Contractor: I can provide that. Government: Does it comply with NIST 123.456? Contractor: Well not completely, because control XYZ is ackshually useless and doesn't contribute-- Government: hangs up

Note, though, that "the government" (NIST to be specific) says that requiring passwords to be changed every 90 days is counterproductive and shouldn't be done, yet many corporations (including my employer) still mandate it. Corporate bureaucracy can be as backward and counterproductive as government bureaucracy.

Re: Security Is a Useless Controls Problem

#47

Post by UltraSane »

If money was no object I would just hire continuous pen testers to test your infra and every time they are able to do something they shouldn't be able to then fix how they did it and then repeat endlessly. I think it is analogous to immersing a tire in water and looking for bubbles to find leaks and then patching them.

Re: Security Is a Useless Controls Problem

#48

Post by CSSer »

treflop wrote: post #36
sharkbot wrote: post #2

I’ve been thinking about this topic thru the lens of moral philosophy lately. A lot of the “big lists of controls” security approaches correspond to duty ethics: following and upholding rules is the path to ethical behaviour. IT applies this control, manages exceptions, tracks compliance, and enforces adherence. Why? It’s the rule. Contrast with consequentialism (the outcome is key) or virtue ethics (exercising and a…

I don't think this is limited to security. I have friends who are very scary drivers but insist on backseat driving and telling you about best driving practices, and coworkers who are insistent on implementing excessive procedures at work but constantly are the ones breaking things. I think following rules gives some people a sense of peace in a chaotic and unpredictable world. And I can't stand them.

Do you mean the rules or the people? I don’t mean to sound facetious.

Re: Security Is a Useless Controls Problem

#49

Post by [deleted] »

TeMPOraL wrote: post #26
mmsc wrote: post #17

Earlier quoted context omitted.

"Why do we have to do X? Because we have to do X and have always had to do X" is a human problem coming from lack of expertise and lack of confidence to question authority. It's a shame, your story isn't unique at all.

Not just lack of expertise and confidence, but also lack of trust, and possibly also a real overhead of running a large org. Like, IT sec does not trust employees. This burns absurd amount of money day in, day out, due to broadly applied security policies that interfere with work. Like, there's a lot of talk about how almost no one has any business having local admin rights on their work machine. You let people have…

[deleted]

Re: Security Is a Useless Controls Problem

#50

Post by SAI_Peregrinus »

JoshTriplett wrote: post #18
deathanatos wrote: post #14

Earlier quoted context omitted.

I think it's fine to implement a useless control to get a customer. Just don't pretend that you're doing it because it is a useful control, pretend that you're doing it because jumping through that hoop gets you that customer, and "we're a smaller fish than the government". Especially with the government (especially if it's the USA…) there are going to be utterly pointless hoops. I can pragmatically smile & jump, … b…

Exactly. There is absolutely a threshold of money that will get me to implement FIPS. There is no threshold of money that will get me to say it's a good idea that has any value other than getting the (singular) customer that demands FIPS.

The core idea of FIPS doesn't seem terrible at first glance: a validation program to ensure known attacks are protected against.

The obvious issue is that known attacks have progressed significantly faster than FIPS has been updated, so in practice it doesn't defend against actual attackers. Compliance-based security pretty much always falls into this trap, and often is even worse because compliance with the standard is considered the maximum that can be done instead of the minimum that must be done. FIPS' fatal flaw is that in many cases it mandates a maximum security level that is now outdated.

It's a lot like building or electrical codes: if they're treated as the minimum as intended things stay safe, but if they're just barely complied with then buildings tend to fall down and/or catch fire.

Post reply on HN