The 11 Worst Ideas in Security

Now of course it would be easy to slap the hide of NAC, IDS, and DLP technologies, but why kick something when it is down, besides we have Stiennon for that (here)…so I give you the 11 worst ideas in security, presented in far less a grumpy format than Ranum’s 6 dumbest ideas in security (here), and of course I kicked it up to 11…

11. Security Industry and Market Analysts (I am become analyst, the destroyer of markets)

Those bastions of knowledge, defenders of the objective faith, and creators of 2-page, in depth, market analysis reports. They don’t actually analyze security they analyze the security market, they say cool things like “By the end of 2007, 75% of enterprises will be infected with undetected, financially motivated, targeted malware that evaded their traditional perimeter and host defenses.” and come up with amusing names and acronyms, (did you know that NBA – Network Behavior Analysis – was at one time called NADS – Network Anomaly Detection System – you can imagine the fun Gartner could of had with an overview of the NADS market). I spent years as an analyst myself and I loved my time, but I will always regret that analysts never actually test, demo, or even interact with the technology they so confidently and assertively write about.

10. Microsoft CPAV (Central Point Anti-Virus – when turning it up to 11 is 10 too many)

Many of you may not remember that Microsoft used to ship an integrated AV product – CPAV (Central Point Anti Virus) CPAV = total suckage. It was a simpler time, malware consisted of threats like the stoned virus (infect the computer, make it look droopy and display a “your computers stoned” message) and you really didn’t need quality, but you did need something that didn’t completely impact user productivity, suck all the computing resources, and disrupt other services – ah the good old days.

9. The Vulnerability market (what can I get for $.63?)

What happens if you create a market and no one buys? Nothing, but a whole lot of complaining from a whole lot of grumpy researchers about how no one takes security seriously and what a thankless job it is to break someone else’s software and then not be showered with accolades when you present them with the data that their software is broken.

8. Scan and Patch (The never ending hamster wheel of late nights and working weekends)

The security group will scan the environment against a database of known vulnerabilities and then harass, scare and guilt-trip the operations team into actually fixing something – it is also referred to by Philip Roth as the Jewish Mother process. This never-ending, reactionary, ad-hoc, false-positive laden, non-environmentally aware, slow, cumbersome, disruptive, snapshot in time approach equals = effectiveness fail. I have written about this before (here)

7. PKI (Easy to deploy, manage, and administer – oh, wait, whoops, never mind)

Quick Story: When I was with McAfee we acquired PGP, as part of the acquisition the McAfee IT department attempted to roll-put PGP encryption. It was a total fail. It was never properly deployed and the IT folks just gave up and moved on to some other important project, like getting their hands on some cool network sniffers. At the time I thought Wow we own this crap and can’t deploy it, how the hell will the people we sell it to – it would require like a ton of bureaucracy and an army of civil servants to be successful, and this is why the federal government loves PKI.

6. Security Through Obscurity (These are not gur qebvqf lbh are looking for – guess how I cryptoed that)

Frphevgl guebhtu bofphevgl qbrfa’g jbex…crbcyr jvyy nethr gung vs lbh anzr lbhe FFVQ fbzrguvat yvxr AFN Abqr, ab bar jvyy oernx va – OF, be vs lbh pnyy lbh Jvaqbjf obk SerrOFQ, be qvfnoyr inevbhf UGGC cbfg erfcbafrf gung lbh ner fnsr – jebat, lbh’er whfg na vqvbg =)

5. WEP (French encryption – it surrenders in minutes)

What is worse than no security? ineffective security that doesn’t work – WEP is like putting up an aluminum foil door and pretending that no one can break through it – far better to just not have a door and know it – really not a lot more to add.

4. Signature-based AV (Design fail – only works if there is parity between sigs and viruses)

Signature based AV isn’t protecting anyone anymore (here), it certainly wasn’t providing any protection against spyware or some of the nastier threats that have popped up recently. It didn’t stop blaster, or sasser, or slammer, it did nothing to help choicepoint, or the VA or the orgy of disclosure we have all become numb too. It was running happily along, updated and content on my mom’s machine when it turns out her Windows XP box was infected with some pretty nasty bits. The real problem though is the sheer volume of malware that one needs to create a signature against – and wha does one do with a 5 million signature dat file – no wonder every time Symantec runs an application dies

3. The Vulnerability Disclosure Debate (good, bad, good, bad – who gives a crap)

There was a time when I had some passion for htis topic, right or wrong I had an opinion and was looking for responsible disclosure (here). I have come to realize that a. It really doesn’t matter and b. those with malicious intent are far less concerned with silly disclosure debates than those fighting the good fight. The vulnerability disclosure debate is the security’s equivalent of Britney Spears – no matter how bad it gets, you can’t help but be curious.

2. Passwords (2Chr177xh0ff)

Passwords suck (here), they are cumbersome, difficult to manage, prone to attack and require continuous care and feeding – they also aren’t terribly effective, but they are the best we can do with what we have, so remember choose wisely and don’t feel like less than a man simply because you have to use a password manager, everybody needs a little assistance now and again.

1. Security Vendors and the VC’s that love them (The root of all security evil)

The goal of the security industry is not to secure, the goal of the security industry is to make money. I think we all know this conceptually, and even with the best intentions in our capitalistic society we must understand that security companies are motivated by profits. This isn’t necessarily a  bad thing, but it should help to dispel the myth that security companies are smarter than hackers, they aren’t, they are just  smarter than the buyers – from (here)

Mission Accomplished: There is NO Future in Security

According to IBM the Security industry is dead and has no future (here)

“The security business has no future,” Val Rahamani, general manager of IBM ISS and of security and privacy for IBM Global Technology Services. Rahamani said the security industry as it is today is not sustainable, and that IBM is instead going into the “business of creating sustainable business.”

“It’s all about putting security into the context of business operations, she said. “Parasitic threats are only a metaphor for the greater issue — there will always be new threats to business sustainability, ranging from parasites to regulations to insiders to global politics. We cannot achieve true sustainability if we continue to focus on individual threats. We can only achieve true sustainability if we design security and continuity into our processes from the beginning.”

“The traditional security industry is simply not sustainable… We have a historic opportunity to change our mindset from IT security to secure business. We have the technology, services, and expertise available today to create truly sustainable business, even in a world where we assume everyone is infected.”

“The security industry is dead,” Rahamani said. “Long live sustainability.

At first read some of you may be taken aback and look at this as an overly provocative stance along the lines of Bill Gates assertion at a Gartner Symposium over 5 years ago that Microsoft would solve security, or John Thompson’s stance 4 years ago that convergence between security and storage were not only demanded they were needed to evolve the industry, or Art Covello’s prediction last year that the security industry would experience wide-spread and massive consolidation with only large, broad-scoped vendors remaining – with hundreds of security start-ups and more on the way, someone clearly didn’t get the memo.

The reality is that the current reactive, ad-hoc security model isn’t working. Val’s statements reflect a growing awareness and acceptance that a significant part of the security challenge must be addressed through pro-active, insightful, management of the infrastructure, in a way that enables security to support the needs of the business. I have spoken about this in numerous posts

1. Why Should We Spend on Security (here)

“There is a dull hum permeating the industry of late – security is dead some say, others think it to be too costly to maintain, others still believe that what is needed is a change of perspective, perhaps a radical shift in how we approach the problem. What underlies all of these positions is a belief that the status quo is woefully ineffective and the industry is slated for self-destruction or, as a whole, we will succumb to a digital catastrophe that would have been avoided if only we had just…well, just done something different from whatever it is we are doing at the time something bad happens.”

“As we go round and round on the never ending hamster wheels provided as best practice guidelines by security vendors, consultants, and pundits, we find ourselves trapped in an OODA loop that will forever deny us victory against malicious actors because we will never become faster, or more agile than our opponents. But to believe one can win, implies that there is an end that can be obtained, a victory that can be held high as a guiding light for all those trapped in eternal security darkness. We are as secure as we need to be at any given moment, until we are no longer so – when that happens, regardless of what you may believe, is outside of of our control.”

2. Information Security Must Evolve (here)

“Security professionals must have a better understanding of the business they are hired to protect, must posses more soft skills such as communication and cooperation, and must evolve their skill against the dynamic threat environment and the evolving business infrastructure…These soft skills will become increasingly important in the coming decade as security programs mature and become an integral part of business success. More importantly organizations structure becomes critical as enterprises must implement an organizational structure that supports cross-group cooperation and workflow.”

3. RSA Themes: Information Security Evolves (here)

“a general market realization that security is evolving beyond a reactive, ad-hoc activity to an integral part of running a business in today’s world. We are increasingly reliant on technology for every aspect of our lives and business is looking to IT to play a significant role in innovation, whether that is to tap into new revenue streams or to achieve new levels of operational efficiency that also boosts the bottom line.”

“It is encouraging to see organizations begin to embrace security as an integral part of how a successful business functions. But we have a long way to go as we evolve from reactive security programs performed in a silo to security and operations convergence, and a level of operational maturity and agility that allows organizations to leverage IT for innovation.”

4. Security Prediction 2007: The year security becomes irrelevant! (here)

“So does security become irrelevant? well not exactly, but it is the year security goes main stream and becomes just another function performed by an increasingly taxed IT organization. Security will become less and less silo’d and more operationalized. Security and operational convergence will drive more technology convergence as vendors scramble to address multiple constituencies in the operations, security and compliance domains. The bottom line is that information security will begin to mature and evolve”

5. Rational Fear vs. Irrational Security (here)

Security must be agile, we must be able to quickly adapt to changing threats and we have to be careful to balance security of the unknown vs. securing against the known. Zero-days are scary, yet they are relatively infrequent compared to the thousands of known vulnerabilities organizations face annually, we certainly need to adapt to zero-day threats, but we can’t do this at the loss of security against the more frequent but less exotic MSFT or browser vulns. What’s scary is that most organizations, even after years of dealing with vulnerabilities, still have not implemented effective vulnerability management programs (here), (here), and (here)

6. Information Survivability vs. Information Security (here)

Bottom Line: you cannot stop all bad things from happening, this is not the goal of security. The goal of security is to limit the probability of bad things from happening and when they do happen to limit their impact. It really is that simple.