Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cybersecurity Is Broken

crankysec.com

Post reply on HN
Print view View original

51–60 of 83 posts

Re: Cybersecurity Is Broken

#51

Post by alephnerd »

ahtihn wrote: post #48
alephnerd wrote: post #25

Earlier quoted context omitted.

Consequences are happening. People just don't see them because this happens well above the IC pay grade and takes some time to percolate down and no one wants to publicly announce you shitcanned 5-10 people in middle management and security leadership because you enter thorny employee litigation territory. That said, I agree with the author about mismatched expectations, though I can safely say that $500k year is VER…

> I don't care that you feel restricted Yeah well, this is why we don't like security engineers. You absolutely should care that the policies you push for are making workers feel restricted. For your job to even exist, engineers must be able to produce just remember that.

There is a middle ground between keeping users (in this case Engineering) happy and an environment secure.

Ideally, Security Ownership should be taken up by the Application/Dev team with an open understanding that heads roll if you messed up ("ownership"), and a security team and platform team exists to help consult and implement security and deployment.

I guess they call philosophy "DevSecOps" or "Shift-Left" in the Gartner world.

That said, a lot of "security" practices are pure BS and security theatre.

Re: Cybersecurity Is Broken

#52

Post by amluto »

> Why the fuck do you need my home address just so I can copy and paste some GIFs? Because you want to sell this data to data brokers, and you know there will be absolutely no negative consequences if you mishandle this data

One might argue that selling or giving away (or even internally abusing) customer data is every bit as bad having it stolen. As far as I’m concerned, selling my address is a data breach and should be treated as such.

(Obviously, as the article notes, data breaches aren’t really taken seriously.)

Re: Cybersecurity Is Broken

#53

Post by alephnerd »

monkburger wrote: post #28
api wrote: post #11

Earlier quoted context omitted.

This, if done right, would also reduce surveillance capitalism by turning huge troves of personal data into liabilities rather than assets.

I wonder if any kind of pro-security legalisation were proposed, how many lobbying firms from big tech (Google, Amazon, etc) would fight it tooth and nail. Kind of reminds me of PHK's criticisms of HTTP2, tho ( https://queue.acm.org/detail.cfm?id=2716278 ), where he makes this point; "The reason HTTP/2.0 does not improve privacy is that the big corporate backers have built their business model on top of the lack of p…

> any kind of pro-security legalisation were proposed

Most of these kinds of policies are done in coordination with companies. Google and Facebook/Meta are actually massive laggards on the lobbying side.

It's companies like Cisco, Microsoft, PANW, ZScaler, Crowdstrike, etc along with some up and coming startups that partake in this. Some of the stuff they propose is good, others is crap.

That said, no one's an idiot. Most of these kinds of legislations and proposals are a direct result of coordination and cooperation between defense buyers, vendors, and ICs.

Re: Cybersecurity Is Broken

#54

Post by [deleted] »

nanocode wrote: post #39
bitwize wrote: post #17

Earlier quoted context omitted.

No. Put C out to pasture -- or just take it behind the barn and shoot it. Entire classes of severe bugs Just Go Away when you switch to a memory-safe language. Not all bugs, obviously, but the vast majority of the low-hanging fruit.

Well if I could shake my magic wand and instantly convert all my (and other) C code to some kind of MemorySafeC code, I would. Unfortunately, there is no such magic wand, and all we can do is to rewrite tens of millions of lines of C code to another language with different tradeoffs and different compatibility. It is, in other words, usually not possible.

[deleted]

Re: Cybersecurity Is Broken

#55

Post by RajT88 »

nanocode wrote: post #37
RajT88 wrote: post #24

Earlier quoted context omitted.

Injection attacks AFAIK have held the top place since forever. It is why people keep buying WAF's.

On the other hand, WAFs are another kind of security theater. They won't stop any determined attacker. Usually you just need to change your payload to make it work. Unless you tweak the rules a lot, to the point where you could encode then in your application as well (for example "user_id" field in the POST data must consist only of decimal numbers)

Counterpoint: Just because they won't stop any determined attacker, doesn't mean they don't have value.

Stopping casual attackers is one talking point, but still not the real value. In my opinion, the real value is making you look less like "low-hanging fruit" to automated scans - throwing a bunch of 403's makes you less likely for a follow-up after an automated scan.

I actually have a side project when I get the time to try and prove it statistically using a honeypot. I would bet the overall volume of attacks is lower with WAF enabled, and inversely correlates with the 403's thrown. Just my 2 cents.

Re: Cybersecurity Is Broken

#56

Post by FreakLegion »

logicprog wrote: post #12
otabdeveloper4 wrote: post #3

"Memory unsafe languages" is maybe one percent of one percent of the problem. As always, nobody actually gives a damn about "security" and uses it as a pretext to push something unrelated. (In this case, Current Year's stupid fad programming language.)

> "Memory unsafe languages" is maybe one percent of one percent of the problem. Multiple distinct large scale software projects have found that 60-70% of severe CVEs are due to memory safety violations[1]. The White House has called for projects to use memory safe languages [2]. The Android Project has seen an incredibly substantial drop in security vulnerabilities concurrent with their rapid shift to using memory sa…

>60-70% of severe CVEs are due to memory safety violations...So your claim that memory unsafe languages are maybe 1% of 1% of the problem is not only completely unsubstantiated, but almost certainly false given all of the available information

Based on your tone and profile you probably aren't interested in better information here, but I'll offer anyway.

The vast majority of cybersecurity attacks, and especially the vast majority of actual incidents, don't involve CVEs. Think recent breaches at Okta, Microsoft, Uber, even SolarWinds a few years ago.

When CVEs do come into play, they're as likely to be logic flaws as anything else. Think Sandworm, Log4Shell, that Apache Struts vulnerability that Equifax didn't patch.

And when memory safety problems do bubble up, well, there are still a bunch of issues that existing memory-safe languages don't actually address. They're real, flawed tools made by real, flawed people, not magic.

So, big picture, memory-safe languages shouldn't be a top-10 priority for very many teams at this point. Maybe someday, though.

Re: Cybersecurity Is Broken

#57

Post by el_duderino_ »

ahtihn wrote: post #48
alephnerd wrote: post #25

Earlier quoted context omitted.

Consequences are happening. People just don't see them because this happens well above the IC pay grade and takes some time to percolate down and no one wants to publicly announce you shitcanned 5-10 people in middle management and security leadership because you enter thorny employee litigation territory. That said, I agree with the author about mismatched expectations, though I can safely say that $500k year is VER…

> I don't care that you feel restricted Yeah well, this is why we don't like security engineers. You absolutely should care that the policies you push for are making workers feel restricted. For your job to even exist, engineers must be able to produce just remember that.

Remember that for an engineers job to continue to exist there is a need to ensure that the product and systems are secure.

Re: Cybersecurity Is Broken

#58

Post by spacebanana7 »

Terr_ wrote: post #10

> You see, cybersecurity is broken because of the lack of consequences. It's really that simple. To put a slightly more explicit phrasing around the blog's message: Consequences fall on the wrong people . The ones screwing up chasing profit are not the ones feeling the pain. The damage falls on the innocent people the companies were trying to use as resources. This can be broadly classed as an economic externality, m…

Data hoarding unfortunately has a massive social positive externality, at least in the perception of many government agencies.

Law enforcement love that gmail addresses can generally be tied back to real people. Tax agencies love that most financial transactions are recorded for several years.

Anyone who reads this comment probably believes these positive externalities are over merited, but it’s formidably difficult to debate the case to a politician.

Re: Cybersecurity Is Broken

#60

Post by Veserv »

alephnerd wrote: post #50
Veserv wrote: post #47

Earlier quoted context omitted.

And still, despite the weakening, hardly anybody passed even the watered down requirements. Large vendors like Microsoft complained that the bidding process was unfair because they were not even allowed to compete just because they could not meet the minimum security requirements. So, the requirements were reduced until the requirements could meet the the abilities of the vendors. For operating systems in the early 2…

Tbh, Common Critera is basically security theatre. I've went thru the process and it's very checkbox driven and not truly design driven. There is a mutual issue of both Procurement being an onerous shitshow and vendors being lazy about validating and ensuring security. I have some thoughts about this but that would basically be a book (or an angry presentation at RSAC, Black Hat, DefCon, and Gartner Federal) Some of…

Were you involved in a Common Criteria certification at EAL5 or higher? Anything below EAL5 is just paperwork.

As stated above, EAL4 is explicitly only intended to certify a system protects against casual and inadvertent attacks. Checkbox security is largely sufficient to meet that standard.

In contrast, it takes actual effort to certify at EAL5 or higher which is why Microsoft and Apple have consistently failed every time they have attempted to do so. Even EAL5 is just the baby steps and at best only comparable to mid-level security like what Multics achieved in the 80s.

You need to target something like the Separation Kernel Protection Profile (SKPP) if you want serious security. That demanded formal specifications, formal proofs of security, and a multi-month NSA penetration test that must fail to find any vulnerabilities. That was the certification process used for the operating system used in the F-22 and F-35, Integrity-178B.

Post reply on HN