Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nobody Cares About Security

adatosystems.com

Post reply on HN
Print view View original

51–60 of 93 posts

Re: Nobody Cares About Security

#51

Post by Mountain_Skies »

alphazard wrote: post #32

There are many common software tasks that are just hard to do securely, and there is an incentive to keep it that way. Security is a huge industry mostly filled with people who check boxes and memorize obscure trivia. Consider TLS, the "industry standard" for connecting two processes securely over the network. There is a huge amount of complexity just to accomplish something that should be secure by default. Certific…

>filled with people who check boxes

That's why my switch from software development to application security only lasted four years. It drove me up the wall to find so many vulns and have them ignored because they weren't necessary to fix for the various compliance checklists to be completed. No one cared if systems were actually secured, they just cared that they got their compliance certified so if there ever were a breach, they'd have coverage for their liability. It's also an area where most people in it have little to no actual programming experience so when tools mark potential vulns, programmers can get away with claiming it's a false positive and everyone moves on, even if it's a plain as day case of clear text PII going out over the internet or some ancient injection vuln that no one wants to get their hands dirty fixing.

Re: Nobody Cares About Security

#52

Post by PeterisP »

The author raises two major arguments for why the current low level of care is entirely appropriate -

"the prevailing attitude among business leaders is:

Damage to the company’s reputation SOUNDS bad, but (so the thinking goes) it’s really too amorphous to quantify. Plus, many companies in recent memory were the victims of massive cyber attacks, took a hit to their reputation or stock price, but saw it rebound a week later with no other ill effects. (again, that’s the belief. More on this later)

The fines currently in place appear to be lower than the expected cost to improve the company’s security posture."

But where is the counterargument against that? There is no "more on this" in the article, and if those two things are true, then it would be wrong for companies to start caring more, as it's cheaper/more effective to suffer the not-that-bad-really consequences than bear the substantial effort and expense of trying to prevent them.

Re: Nobody Cares About Security

#53

Post by eadmund »

lofaszvanitt wrote: post #28
y-c-o-m-b wrote: post #20

I've been saying this since at least 2009 when the company I worked for was sending credit card info from card readers across the network in plain text and they dragged their feet to fix it even though they knew we were violating some serious SOX policies. At another company in 2015, I discovered we were sending user credentials for a large hospitals in plain text across the network and need to fix this ASAP. When I…

Until they are fined 10% of yearly revenue. That's why you need a strong government.

An alternate, market-based solution would be insurance companies who impose requirements for insurance. That increases the chances of finding an economic balance between security and productivity. A government regulation applies to everyone, even if it no longer makes sense: an insurance company whose requirements are out-dated will be out-competed by others, while an insurance company whose requirements are insufficient will go out of business.

Re: Nobody Cares About Security

#54

Post by red-iron-pine »

simonw wrote: post #10
vidanay wrote: post #5

Surprisingly few companies (or people) care about paying for good security.

The problem with paying for good security is that it's very difficult for non-security experts to evaluate the genuinely effective ways to do that. Is buying antivirus "paying for good security"? Hiring the first security firm that showed up in a Google search? If you advertise for a security person to join your company, how do you effectively interview candidates?

No F500 tier executive is doing that.

They paid Accenture and Gartner to tell them what to do.

Ditto for having them set up a security organization -- get Accenture to sit a temporary CISO, hire some people, and then fuck off. Hopefully the replacements work!

Mom and Pop shops might use Google, but in 2024 they're usually using whatever the local, oversubscribed MSP is selling.

Re: Nobody Cares About Security

#55

Post by leonadato »

eadmund wrote: post #53
lofaszvanitt wrote: post #28

Earlier quoted context omitted.

Until they are fined 10% of yearly revenue. That's why you need a strong government.

An alternate, market-based solution would be insurance companies who impose requirements for insurance. That increases the chances of finding an economic balance between security and productivity. A government regulation applies to everyone, even if it no longer makes sense: an insurance company whose requirements are out-dated will be out-competed by others, while an insurance company whose requirements are insuffic…

It's interesting that you mention this. It's part of the follow up article coming soon.

Re: Nobody Cares About Security

#56

Post by leonadato »

PeterisP wrote: post #52

The author raises two major arguments for why the current low level of care is entirely appropriate - "the prevailing attitude among business leaders is: Damage to the company’s reputation SOUNDS bad, but (so the thinking goes) it’s really too amorphous to quantify. Plus, many companies in recent memory were the victims of massive cyber attacks, took a hit to their reputation or stock price, but saw it rebound a week…

"more on this" got pushed to the follow-up piece, which is coming soon. Sorry to keep you in suspence. I had to balance people's time to read with the length of the information I was sharing.

Re: Nobody Cares About Security

#57

Post by [deleted] »

alphazard wrote: post #32

There are many common software tasks that are just hard to do securely, and there is an incentive to keep it that way. Security is a huge industry mostly filled with people who check boxes and memorize obscure trivia. Consider TLS, the "industry standard" for connecting two processes securely over the network. There is a huge amount of complexity just to accomplish something that should be secure by default. Certific…

[deleted]

Re: Nobody Cares About Security

#58

Post by leonadato »

closeparen wrote: post #17

Software security is the absence of vulnerabilities, which is a special case of the absence of bugs. People are not interested in security because they are not interested in quality. Even those environments that are supposed to be high security, are in fact buggy, slow and very frustrating to use - revealing that they are almost certainly riddled with vulnerabilities as well. It's implausible that a system could be s…

I don't think this is true. The opposite, really. I think that we continue to present security as a "shift left" ("SHIT left") strategy, dumping the responsibility on devs without any framework for why they should care.

But if we built a culture and practice that low-security code is low-quality code, and made security issues a software defect like any other, it would get handled. Plenty of developers (and leads, and PMs) are fine with shipping low-security code, but would fight to the death if accused of shipping low-quality code.

Re: Nobody Cares About Security

#59

Post by mjevans »

The recent Crowd Strike issue offered great insight into common public perception. Failures of that nature, let alone a real attack, are perceived in the same event class as 'natural disasters' to those who don't understand the problem.

There's also a severe over-reliance on completing a checklist, rather than having an answer for a given class of issue. Asking the correct question is important for receiving a good answer. 'Restores are what people care about.'

Critical vendor failure and ability to operate independently in an isolated recovery mode might be new features added to recently updated checklists.

Re: Nobody Cares About Security

#60

Post by leonadato »

notepad0x90 wrote: post #26

"Nobody (i.e., business leaders)" Glad that was clarified, I was afraid I was "Nobody". What the author is trying to articulate makes me wonder if he considered what security is.The core properties we mean when we say "security" are the CIA triad (confidentiality, integrity and availability). You can't tell me a "business leader" doesn't care about any of those. You have business related information that is vital for…

Those are great points. And what you're saying is why I used the "nobody cares about backups" analogy.

It's NOT that nobody cares about the results of security. It's that those results ("not losing our sales database")are often not presented clearly or coherently enough for the decision makers to recognize the value of the activity ("doing regular backups, paying for offsite storage, etc.")

Post reply on HN