Interesting: Summary: Here’s to the Defenders
From Securosis Highlights:
I was reading Roger Grimes’ interview with an offensive cybersecurity operator, and one key quote really stood out:
I wish we spent as much time defensively as we do offensively. We have these thousands and thousands of people in coordinate teams trying to exploit stuff. But we don’t have any large teams that I know of for defending ourselves. In the real world, armies spend as much time defending as they do preparing for attacks. We are pretty one-sided in the battle right now.
As much as I enjoy playing offensive security guy once a year at Defcon, I find defense to be a much more interesting challenge. Unfortunately many in our community don’t consider it as ‘sexy’ as penetration testing or vulnerability research. We need to change that.
Most of us started our exploration of technology as hackers. I am fully willing to admit I was fascinated by cracking systems, and engaged in activities as a kid that could land me in jail now. Nothing major – I always assumed it was much easier to catch hackers and phreaks than it really was. I mean seriously, it wouldn’t have been all that hard back then. It turns out no one was looking – who knew? That’s what I get for assessing national computer law enforcement capabilities based on repeated viewings of War Games.
But breaking things is, in many ways, far less challenging than protecting them. I am sick and tired of seeing researchers and pen testers on various mailing lists brag about how easy it is to get into their clients’ systems. I suspect the ones who understand the complexity of defending complex environments with limited resources keep their mouths shut. Breakers, with very few exceptions, aren’t accountable. Outside of movies, there are no consequences if they fail. Not yet, at least. No guns to the head as you sit in front of 32 widescreen monitors with 8 keyboards spread out in front of you and a coked- megelomaniac watching you waste part of your 60-second window on a visualization so your code looks good for the cameras. Nope.
Builders? Defenders? Our lives are nothing but accountability. We are the firefighters, doctors, cops, and engineers all wrapped into one. Without us who would keep the porn flowing? It is a far more complex challenge, with nowhere near enough disciples.
Many of our smartest focus on offensive security for obvious economic reasons. If you are good there is more money, less accountability, and more freedom. Smart defenders, even if they come up with a groundbreaking idea, need time and resources to build it – which often means productizing it and dealing with idiotic investors and bureaucracies. There are far fewer opportunities for smart defenders to perform research leading to practical tools and techniques.
The only thing that can change this is money. Sure, I’d love to lead a cultural revolution, but that is more my desire to send people to re-education camps than any inherent belief we will all suddenly focus on defense due to some higher calling. (I’m serious about the camps – I have some awesome ideas). We need some serious investment – and not in academic institutions who often fail to remember sh*t needs to work outside a lab.
Breaking and offensive research are important. Doing them well is hard. But defending? That is a challenge.
I suspect I will be talking about this at Defcon. But with more beer.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
Adrian’s DR Post Why Database Assessment.
Rich has another article at Macworld on security for switchers.
Rich’s DR post: Security Needs More Designers.
Mike’s article at Information Week.
Dave Lewis on Disaster Recovery at CSO Online
Favorite Securosis Posts
Mike Rothman: Using Amazon IAM Roles to Distribute Security Credentials (for Chef). Holy crap. A blog post from an analyst with code and screen shots! OMG… See, some analyst have some kung fu after all.
David Mortman: Rich’s first post on security automation.
Rich: Continuous Security Monitoring: Classification. This is a good series.
Other Securosis Posts
Using
cloud-initands3cmdto Automatically Download Chef Credentials.Multitenancy is the Least Interesting Security Property of Cloud Computing.
Favorite Outside Posts
Mike Rothman: Proving the skeptics wrong. You can only achieve true success when you do things for the right reasons. Seth Godin reminds me that proving someone wrong isn’t one of them. At some point you run out of people to rail against…
Adrian Lane: Data Leakage In A Google World. People forget that Google is a powerful tool and often finds data companies did not want exposed. It’s a tool to hack with, and yes, a tool to phish with.
Chris Pepper: Solaris patching is broken because Oracle is dumb and irresponsible.
David Mortman: Dear Speaker, I Loathe You. Sincerely, Your Event Planner. Funny.
Rich: No, Hacker Really Does Mean Hacker. Yep. Get over it.
Research Reports and Presentations
Network-based Threat Intelligence: Searching for the Smoking Gun.
Implementing and Managing Patch and Configuration Management.
Securing Big Data: Security Recommendations for Hadoop and NoSQL Environments.
Top News and Posts
Google releases fix to OEMs for Blue Security Android security hole. This is seriously ugly.
How the US (probably) spied on European allies’ encrypted faxes.
Researcher finds way to commandeer any Facebook account from his mobile phone.
Crimelords: Stolen credit cards… keep ‘em. It’s all about banking logins now.
Judge Orders U.S. to Release Aaron Swartz’s Secret Service File
Blog Comment of the Week
This week’s best comment goes to Dwayne, in response to Incite 7/10/2013: Selfies.
I’m very interested in Adrian’s item under “No firewall for you” as I have heard a number of organizations discussing this. I really want to hear some post-facto analysis from companies who go this route, to find out what differences (positive and negative) they experience.
Along those lines, I have been in conversation with a couple of companies who want to get rid of antivirus because they feel it isn’t adding value (at least in the data center). Unfortunately, they both have to answer to PCI which explicitly requires AV so that is a bit of a problem.
In general, I think the more we can streamline the number of countermeasures and controls we have to manage, the better. But it is definitely a “look before you leap” problem.
BTW – I’m with you on the selfies – definitely fascinating. My daughter told me about “duck face” selfies, which are apparently a sub-class of the normal selfie. You can find a lot of them on Flickr, too.
- Rich (0) Comments Subscribe to our daily email digest
via Securosis Highlights https://securosis.com/blog/summary-heres-to-the-defenders