Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Is a Useless Controls Problem

securityis.substack.com

Post reply on HN
Print view View original

71–80 of 83 posts

Re: Security Is a Useless Controls Problem

#71

Post by awesome_dude »

treflop wrote: post #36
sharkbot wrote: post #2

I’ve been thinking about this topic thru the lens of moral philosophy lately. A lot of the “big lists of controls” security approaches correspond to duty ethics: following and upholding rules is the path to ethical behaviour. IT applies this control, manages exceptions, tracks compliance, and enforces adherence. Why? It’s the rule. Contrast with consequentialism (the outcome is key) or virtue ethics (exercising and a…

I don't think this is limited to security. I have friends who are very scary drivers but insist on backseat driving and telling you about best driving practices, and coworkers who are insistent on implementing excessive procedures at work but constantly are the ones breaking things. I think following rules gives some people a sense of peace in a chaotic and unpredictable world. And I can't stand them.

Often the reason that they know all of these rules is because they are constantly being bitten/yelled it for breaking them

Speaking as someone who is constantly trying to keep good procedures in the team because of all the footguns I have collected over time

Re: Security Is a Useless Controls Problem

#72

Post by NoPicklez »

Jedd wrote: post #56
commandar wrote: post #22

Earlier quoted context omitted.

>that NIST has killed in competent circles Just because this is my favorite soapbox - anyone that has to deal with passwords should go read NIST SP800-63B: https://pages.nist.gov/800-63-3/sp800-63b.html I was kind of shocked by just how gosh-darned reasonable it is when it came out a couple of years ago. It's my absolute favorite thing to cite during audits. "Are you requiring password resets every 90 days?" "No. We…

Alas, in Australia one of the more popular frameworks in gov agencies is Essential Eight, and they are a few years away from publishing an update with this radical idea.

My understanding is that Essential Eight doesn't require password rotation

Re: Security Is a Useless Controls Problem

#73

Post by NoPicklez »

encomiast wrote: post #16
EE84M3i wrote: post #6

Other than the myriad of problems with passwords that NIST has killed in competent circles, what are some other "useless controls"?

I bumped into controls mandating security scans, when people running the scans don't need to know anything about the results. One example prevented us from serving public data using Google Web Services because the front-end was still offering 3DES among the offered ciphers. This raised alerts because of the possibility of Sweet32 vulnerability, which is completely impractical to exploit with website scale data sizes…

This is often the result of poor risk management or lack of risk management understanding.

Compliance assessments at least the assessments I have worked with, take a risk based approach and allow for risk based decisions/exemptions.

If you have a vulnerability management process which takes what the scanning solution says at face value and therefore your process assumes ALL vulnerabilities are to be patched, then you're setting yourself up for failure.

Re: Security Is a Useless Controls Problem

#74

Post by NoPicklez »

ISO27Auditor wrote: post #65
mozzieman wrote: post #42

For security compliance, it might be "useless" but it is not useless if that compliance enables your company to ship products and earn revenue.

Agreed. As an ISO 27001 auditor I see a growing demand for security compliance certification / attestations (ISO 27001, SOC 2), and it's client driven 95% of the time. So, in the end, it’s often worth it to go ahead and do it. ISO 27001 is more affordable (2k-3k for audit, and additional 1k-3k for external provider to manage everything for you), SOC 2 will set you back at least 10k

100%

Third party cyber risk management is a hot topic in cyber security at the moment. If you want people to buy your solution, you need to be able to demonstrate you have appropriate information security controls. A good way to do that is ISO 27001, all the way up to SOC reports.

Re: Security Is a Useless Controls Problem

#75

Post by Jedd »

NoPicklez wrote: post #72
Jedd wrote: post #56

Earlier quoted context omitted.

Alas, in Australia one of the more popular frameworks in gov agencies is Essential Eight, and they are a few years away from publishing an update with this radical idea.

My understanding is that Essential Eight doesn't require password rotation

If so then I'll be doubly frustrated - I've been assured by our domain experts that this is a requirement of the model.

Did it used to be and was since retracted? I suppose it may be a local or state-based 'implementation augmentation'.

I've trawled just now through the signals directorate site and can find plenty of references to passwords, but nothing specifically covering this.

Re: Security Is a Useless Controls Problem

#76

Post by [deleted] »

NoPicklez wrote: post #74
ISO27Auditor wrote: post #65

Earlier quoted context omitted.

Agreed. As an ISO 27001 auditor I see a growing demand for security compliance certification / attestations (ISO 27001, SOC 2), and it's client driven 95% of the time. So, in the end, it’s often worth it to go ahead and do it. ISO 27001 is more affordable (2k-3k for audit, and additional 1k-3k for external provider to manage everything for you), SOC 2 will set you back at least 10k

100% Third party cyber risk management is a hot topic in cyber security at the moment. If you want people to buy your solution, you need to be able to demonstrate you have appropriate information security controls. A good way to do that is ISO 27001, all the way up to SOC reports.

[deleted]

Re: Security Is a Useless Controls Problem

#77

Post by immibis »

xxpor wrote: post #67
immibis wrote: post #37

Earlier quoted context omitted.

It quickly turns into: what can I get away with, while claiming I performed the duty?

Agreed!

It gets worse than that: it rewards people who try to break the law as much as possible without getting caught, while people who follow it are punished.

That's true of most laws, but the system punishes law breakers to make it better to follow the law overall. When the law is vague and subjective, the people who get the most reward are the ones who are willing to see how far they can push it.

Re: Security Is a Useless Controls Problem

#78

Post by vrighter »

sebazzz wrote: post #68
jiggawatts wrote: post #7

Earlier quoted context omitted.

I work at medium to large government orgs as a consultant and it’s entertaining watching beginners coming in from small private industries using - as you put it - consequentialism and virtue ethics to fight against an enterprise that admits only duty ethics: checklists, approvals, and exemptions. My current favourite one is the mandatory use of Web Application Firewalls (WAFs). They’re digital snake oil sold to organ…

Oh man, web application firewalls and especially Azure Application Gateway are the bane of my existence. Where I work they literally slap an Azure Application Gateway instance on every app service with all rules enabled (even the ones Microsofts recommends not to enable) in block mode directly when provisioning the stuff in Azure. The app is never observed in audit mode. Result is that random stuff in the application…

Well what if they were intelligent and could actually really understand the data and its schema before deciding whether to allow or reject the request... wait... that's just the application itself.

Re: Security Is a Useless Controls Problem

#79

Post by jiggawatts »

vrighter wrote: post #78
sebazzz wrote: post #68

Earlier quoted context omitted.

Oh man, web application firewalls and especially Azure Application Gateway are the bane of my existence. Where I work they literally slap an Azure Application Gateway instance on every app service with all rules enabled (even the ones Microsofts recommends not to enable) in block mode directly when provisioning the stuff in Azure. The app is never observed in audit mode. Result is that random stuff in the application…

Well what if they were intelligent and could actually really understand the data and its schema before deciding whether to allow or reject the request... wait... that's just the application itself.

It all boils down to trust. Management don’t trust the developers to do the right thing because they outsourced development to the lowest bidder. They futilely compensate for this by spending a mere $500/mo for a WAF.

MBA thinking at its finest…

Re: Security Is a Useless Controls Problem

#80

Post by NoPicklez »

danjl wrote: post #12

The vast majority of the security "industry" is about useless compliance, rather than actual security. The chimps have put their fears into large enterprise compliance documents. This teaches the junior security people at enterprise companies that these useless fears are necessary, and they pass them along to their friends. Why? Not just because of chimps and fear, but also $$. There is a ton of money to be made off…

Well one of the big problems is that businesses don't do root cause analysis on incidents and learn what controls failed, or should have been in place that may have prevented the incident.

Additionally, actually testing if the controls works. I work in testing controls and I find a lot of controls might be developed well, but just simply aren't being done due to resource constraints.

Post reply on HN