The six dumbest ideas in computer security (2005)

1. Your desktop application shows a list of attachments in the navigation chrome where a message can't display content.

2. When you click on something in that list, Internet Explorer or Firefox seamlessly logs you into the server using Active Directory.

Storing things on a server was also more relevant in the era where space was limited and services like Exchange were famously difficult to scale or customize. If you didn't have good tools to retroactively yank a message out of everyone's inbox when your AV signatures were updated an hour after it arrived, storing it on a server you controlled had a certain practicality.

Your second and third points are spot-on, however, and really hit at a key principle too few security teams appreciate: normalization of deviance. This approach fails badly in the real world where IT security says “don't open attachments from people you don't know” and everyone's manager says “oh, it's totally normal to get passworded ZIP files from the HR services subcontractor. Open it, we have a deadline!”. The real lesson here should be defense in depth so your organization's security isn't jeopardized when one person opens the wrong email.

I don't know; I haven't really seen most of these things in the wild for a long time.

For "#4) Hacking is Cool" the zeitgeist has moved in the exact opposite direction with "white hat", bug bounties, etc. I think that section in particular is a pretty outdated view of things.

"#6) Action is Better Than Inaction" is probably the only one that still broadly applies today, and is actually a special case of "X exists, therefore, therefore we must use it ASAP, and any possible negativities are not our problem and inevitable anyway" attitude that seems the be prevalent among a certain types of people.

We had a user click an email and get phished.

We tried training the users with tools like KnowBe4, banners above the emails that say things like THIS IS AN OUTSIDE EMAIL BE VERY CAREFUL WHEN CLICKING LINKS. Didn't help.

The email was a very generic looking "Kindly view the attached invoice"

The attached invoice was a PDF file

The link went to some suspicious looking domain

The page the link brought up was a shoddy impersonation of a OneDrive login

In just minutes, the users machine was infected, it emailed itself to all of their Outlook contacts...

So this means nothing in this list detected a goddamn thing:

    Next-generation firewall
    AI-powered security
    'MACHINE LEARNING'
    'Prevent lateral spread'
    enterprise defense suite with threat protection and threat detection capabilities designed to identify and stop attacks
    AV software that was advertised to 'Flag malicious phishing emails and scam websites'
    'Defend against ransomware and other online dangers'
    'Block dangerous websites that can steal personal data'
    the cloud-based filtering service that protects your organization against spam, malware, and other email threats

But, we are up to the standards of quite a few acronyms.

It's all a useless shitshow. And plenty of productivity-hurting false flags happen all the time.

However, enumerating badness is hugely valuable in the security industry for two reasons:

1) It’s the backbone of security research, just as physiology and anatomy are to zoology and medicine. With enumeration (observation), we can classify, abstract, find trends, identify risky software and approaches, direct engineering resources, and create broad defenses (yay ASLR).

2) Attackers are lazy, too. I work at a security consulting firm, and routinely see attackers reuse the same TTP across different target companies. Enumerating badness not only offers detection opportunities (perhaps not the best, but higher level detection techniques are often built off understanding the enumeration of badness) but also denies attackers opportunity for reuse. “Impose cost,” as thoughtlords like to say.