Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Is a Useless Controls Problem

securityis.substack.com

Post reply on HN
Print view View original

61–70 of 83 posts

Re: Security Is a Useless Controls Problem

#61

Post by colek42 »

I've been thinking about this a lot. First, the author should replace security with compliance. Currently they are two different things. There is a huge divide between compliance teams and developers, they speak completely different languages. I'm writing an entire series about it. I do think we can fix the problem, but it is going to be a lot more work than it was to get development and operations on the same page.

https://productgovernance.substack.com/publish/posts/detail/...

Re: Security Is a Useless Controls Problem

#62

Post by foobarchu »

TeMPOraL wrote: post #26
mmsc wrote: post #17

Earlier quoted context omitted.

"Why do we have to do X? Because we have to do X and have always had to do X" is a human problem coming from lack of expertise and lack of confidence to question authority. It's a shame, your story isn't unique at all.

Not just lack of expertise and confidence, but also lack of trust, and possibly also a real overhead of running a large org. Like, IT sec does not trust employees. This burns absurd amount of money day in, day out, due to broadly applied security policies that interfere with work. Like, there's a lot of talk about how almost no one has any business having local admin rights on their work machine. You let people have…

Another of my favorite examples is companies going "everyone needs cyber security training" and applying a single test to their entire global staff with no "test out" option. I watched a former employer with a few hundred thousand employees in the US alone mandate a multi-hour course on the most basic things, which could have been negated with some short knowledge surveys.

The same employer also mandated a multi-hour ethics guidelines course yearly that was 90% oriented towards corporate salespeople, and once demanded everyone take what I believe was a 16 hour training set on their particular cloud computing offerings. That one just have cost them millions in wasted hours.

Re: Security Is a Useless Controls Problem

#63

Post by MattPalmer1086 »

too_pricey wrote: post #52

I wrote this! I'm excited to see this get attention here. I'll be responding to folks' comments where I feel like I have something to add, but please let me know if you have any questions or feedback!

There's certainly a lot of cargo cult security controls out there. One of the big issues is simply that it is very hard to change established practices. It takes a lot of effort, and senior people who are not security experts have to sign off on the "risk" of not doing what all their peers are doing.

There is one word I would change in your post title. Security has a useless controls problem, not security is a useless controls problem.

Re: Security Is a Useless Controls Problem

#64

Post by DyslexicAtheist »

sharkbot wrote: post #2

I’ve been thinking about this topic thru the lens of moral philosophy lately. A lot of the “big lists of controls” security approaches correspond to duty ethics: following and upholding rules is the path to ethical behaviour. IT applies this control, manages exceptions, tracks compliance, and enforces adherence. Why? It’s the rule. Contrast with consequentialism (the outcome is key) or virtue ethics (exercising and a…

I recall a grugq podcast several months back in which they compared it to a "chastity pledge", wish I had the exact episode.

Re: Security Is a Useless Controls Problem

#65

Post by ISO27Auditor »

mozzieman wrote: post #42

For security compliance, it might be "useless" but it is not useless if that compliance enables your company to ship products and earn revenue.

Agreed. As an ISO 27001 auditor I see a growing demand for security compliance certification / attestations (ISO 27001, SOC 2), and it's client driven 95% of the time. So, in the end, it’s often worth it to go ahead and do it.

ISO 27001 is more affordable (2k-3k for audit, and additional 1k-3k for external provider to manage everything for you), SOC 2 will set you back at least 10k

Re: Security Is a Useless Controls Problem

#66

Post by [deleted] »

CSSer wrote: post #48
treflop wrote: post #36

Earlier quoted context omitted.

I don't think this is limited to security. I have friends who are very scary drivers but insist on backseat driving and telling you about best driving practices, and coworkers who are insistent on implementing excessive procedures at work but constantly are the ones breaking things. I think following rules gives some people a sense of peace in a chaotic and unpredictable world. And I can't stand them.

Do you mean the rules or the people? I don’t mean to sound facetious.

[deleted]

Re: Security Is a Useless Controls Problem

#67

Post by xxpor »

immibis wrote: post #37
xxpor wrote: post #3

Earlier quoted context omitted.

Securities laws are written in terms of duty ethics ("fiduciary duty", "duty of due care", etc). That's all anyone at the top would care about.

It quickly turns into: what can I get away with, while claiming I performed the duty?

Agreed!

Re: Security Is a Useless Controls Problem

#68

Post by sebazzz »

jiggawatts wrote: post #7
sharkbot wrote: post #2

I’ve been thinking about this topic thru the lens of moral philosophy lately. A lot of the “big lists of controls” security approaches correspond to duty ethics: following and upholding rules is the path to ethical behaviour. IT applies this control, manages exceptions, tracks compliance, and enforces adherence. Why? It’s the rule. Contrast with consequentialism (the outcome is key) or virtue ethics (exercising and a…

I work at medium to large government orgs as a consultant and it’s entertaining watching beginners coming in from small private industries using - as you put it - consequentialism and virtue ethics to fight against an enterprise that admits only duty ethics: checklists, approvals, and exemptions. My current favourite one is the mandatory use of Web Application Firewalls (WAFs). They’re digital snake oil sold to organ…

Oh man, web application firewalls and especially Azure Application Gateway are the bane of my existence. Where I work they literally slap an Azure Application Gateway instance on every app service with all rules enabled (even the ones Microsofts recommends not to enable) in block mode directly when provisioning the stuff in Azure. The app is never observed in audit mode.

Result is that random stuff in the application does not work for any user, or only for some users, because some obscure rule in Azure Application Gateway triggers. Especially the SQL injection rule of Azure Application Gateway seems to misfire very often. A true pain to debug, then a true pain for the process to get the particular rule disabled.

And then not even to start about the monthly costs. Often Azure Application Gateway itself is more expensive than the App Service + SQL Database + Blob Storage + opt. App Insights. I really think someone in the company got offered a private island from Microsoft for putting Azure Application Gateway as a mandatory piece in the infrastructure of every app.

Yes, our most of our security has been outsourced to cheap workers in developing countries like India, which are of course rated on maintaining the standard and not rated on thinking and understanding what you want and putting things in context, and probably also work 60-70 hours per week during ungodly times so you can hardly blame them. It is truly the process that is broken.

Re: Security Is a Useless Controls Problem

#69

Post by sebazzz »

goalieca wrote: post #35
danjl wrote: post #12

The vast majority of the security "industry" is about useless compliance, rather than actual security. The chimps have put their fears into large enterprise compliance documents. This teaches the junior security people at enterprise companies that these useless fears are necessary, and they pass them along to their friends. Why? Not just because of chimps and fear, but also $$. There is a ton of money to be made off…

I’m an engineer who now works security. Very few of us come from an engineering background. Most lack the technical skill to do much than apply controls and run tooling. Some try to do design work but imagine a junior dev with 2-3 years experience trying to write a service. Those of us who are architects and coders don’t often get to do it anymore because we’re not working on single projects or solutions.. so we beco…

> I’m an engineer who now works security. Very few of us come from an engineering background. Most lack the technical skill to do much than apply controls and run tooling.

I think you probably hit the nail on the head there. Often the people in Infosec I work with are not interested into putting things in context, thinking into the actual impact of a control not being met. Instead, just a bunch of controls are thrown out without any regard to the actual security.

Now I have to say, most of our security has been outsourced to cheap workers in developing countries like India, which are of course rated on maintaining the standard and not rated on thinking and understanding what you want, and probably also work 60-70 hours per week during ungodly times so you can hardly blame them.

Re: Security Is a Useless Controls Problem

#70

Post by treflop »

CSSer wrote: post #48
treflop wrote: post #36

Earlier quoted context omitted.

I don't think this is limited to security. I have friends who are very scary drivers but insist on backseat driving and telling you about best driving practices, and coworkers who are insistent on implementing excessive procedures at work but constantly are the ones breaking things. I think following rules gives some people a sense of peace in a chaotic and unpredictable world. And I can't stand them.

Do you mean the rules or the people? I don’t mean to sound facetious.

A little of both. I understand getting a warm fuzzy feeling that you did the right things, but if you don't achieve your goal, what's the point?

But let me clarify -- OP mentioned a contrast between consequentialism and virtual ethics and I think you can be "too much" consequentialism too. I'm wouldn't call myself a rule follower but I also follow rules 99% of the time too. It does create a sense of order and and predictability and I value that.

There is a right balance where you do follow rules but you also know when to break them. What I can't really stand are rigid people -- diehard rule followers or diehard "no one can tell me what to do." I find working with rigid people hard because you have to work around their "buttons."

Post reply on HN