Imagine you went to an amusement park and saw the rides were being operated unsafely. No seatbelts, no safety protocols, no even making sure passengers were seated first. Do you stay quiet because after all, the teenager running the ride probably didn't invent the safety protocol? Sure, someone might get beheaded, but you don't want to be rude.
> The security treadmill is hard for even the most modern tech companies to stay on
That is nonsense. If you have the resources to track me across the web, hold vast amounts of my private information and profit off of me, you'd best damn invest in basic security practices like SSL and encryption at rest. If you don't have the in-team expertise, bring in a consultant. These aren't Mom & Pop ice cream shops, these are major international companies and banks - stop cheaping out on security to save a few pennies.
Nowhere did the person you're replying to even hint at, suggest or in any way imply this. He/she just said that shaming people into doing whatever the $good_thing_of_the_day is is a case of assuming the ends justifies the means and that's kind of ethically murky.
I don't have a problem with putting a bank on blast for bad security. Security is part of their core value proposition. That's why most people don't hide their savings under their mattress.
If the company didn't want the burden of security, then don't keep secured content. They opted in.
Equifax had one of the worst breaches imaginable. So did Target. Far as I know, no one died. You know, I don't think anyone even got injured. Did some people have to call their bank and dispute charges? Maybe.
Not really a life or death situation was it? I don't think Tesco or Betfair are really life or death either? Sure they should have better security, but is it worth becoming an angry mob about it?
What about people fleeing abusive spouses or other folks who have a very real reason to keep things like their address under wraps? There was a training school that recently leaked the addresses of it's participants - several of whom were undercover police officers. Don't get me started on the OPM breach.
Just because a breach doesn't affect you very much doesn't mean there aren't serious consequences. When every single business has horrendous amounts of information on me, any minor breach becomes a major problem.
She was lucky. I know someone for whom the process took over a year. Because of that he had to wait before he could buy a house - his mortgage wouldn't be approved until all the mess was cleared up.
For you, somebody snatching your CC might mean a hassle due to having to call the bank and dispute the charges. For somebody with little money to spend, it can mean the difference between feeding their family for 3 days and not doing so.
For you, somebody leaking your private messages on a social network might mean some inconvenient messages that have to be explained to a friend. For somebody else, it can mean that suddenly their homosexuality is well-known in a country where that carries the death penalty, and gets them executed.
Software is infrastructure, plain and simple. You don't maintain it, people die. You don't make it safe, people die. It doesn't matter whether you personally see it causing problems for yourself. This "morally righteous fury", as you put it, is absolutely justified.
Developers (and the companies managing them) need to take some goddamn responsibility for the infrastructure they build.
Not all software infrastructure is critical infrastructure. It's like the difference between a company that makes bottom dollar kitchen sink sprayers and washing machine hoses that always leaking and mine railings making a town's water supply undrinkable. Both are water problems. Only one is a big enough problem that people not affected by the problem should care about the problem.
You have to take both likelihood of harm and severity of harm into account. Just because someone somewhere might get hurt using a bottom dollar washing machine hose to transfer dangerous chemicals doesn't mean we should regulate all things related to water the way we regulate waste disposal near rivers and wetlands.
This might be a valid argument if we had a standardized way of classifying critical software vs. non-critical software, that took into account corner cases. We do not.
Instead what happens is that people arbitrarily classify what they consider 'critical' based on gut feelings and rarely considering the situation of people-who-aren't-them, and that the resulting potpourri of judgments produces critical systems where the authors of individual parts thought that it wouldn't be as critical as it ends up being. Then it breaks, and now all hell breaks loose.
In practice, people build critical software systems with off-the-shelf components that really weren't designed to be used for such critical cases. This isn't specific to open-source, either; it happens just as much with proprietary components. There are no certification processes worth a damn, no clear idea of where and why this matters.
And until we get to a point where those processes and standards do exist, there is only one safe assumption to make: all software is critical infrastructure, because you have no idea what it's going to be used for in practice. Hence the 'fury' being justified.
EDIT: Addendum... I've had the critical-systems discussion with many developers. The overwhelming interpretation of "critical" is "I can see a way in which the software can directly kill people". Think drones, airplanes, and so on.
Conversely, almost nobody considers the indirect consequences that might lead to that same outcome (no access to money, no access to healthcare, murderous stalkers, etc.). Let alone serious consequences that don't result in death.
Realistically, barely anybody in the software industry has the first clue as to what constitutes a 'critical' system, or exactly how much damage their software can do. A similar issue exists in the design industry[1].
>Conversely, almost nobody considers the indirect consequences that might lead to that same outcome (no access to money, no access to healthcare, murderous stalkers, etc.). Let alone serious consequences that don't result in death.
That's how things work in every other industry that doesn't specifically build things to operate in hazardous environments. Things are designed to not kill and/or harm in normal use, not to not kill and/or harm people in exceptional circumstances or if grossly misused.
There might be a line to be drawn, for example I don't expect a small shop to adhere to all the last security recommandations.
But a big company handling highly sensitive information at scale? It should be a crime to have a leak caused by a well-known issue. Unfortunately, there was barely any consequence, as far as I know.
Those companies certainly have the means to keep up with security requirements, and it should be mandatory considering their business. Until they act properly, shaming it is.
There are other types of harm people can suffer other than just physical harm. And those other types of harm are no less significant or noteworthy, at least in my opinion.
It very much can be. Look at some of the largest cases of embezzlement/fraud in history where many people's life savings/retirement were completely lost. In the short term, some people commit suicide. In the longer run, they die of poor health because they don't have much money when they're old and sick.
Although I don't know anyone who committed suicide, I do personally know people impacted by what at the time was the largest case of embezzlement in history (back in the 90's). I've seen the impact it has. And I can assure you, shaming a public company is nothing compared to what those people go through. If we had a better hammer to coax the companies to fix these things, I would advocate for it. For now, public shaming is not effective enough an approach.
If, as you suggest, they should be given a pass on data safety, then they should be barred from making promotional statements about data safety. They violate the social contract by making false or misleading claims.
Why should we automatically view shaming in and of itself bad?
How about instead of calling it shaming, simply label it "holding companies accountable"?
Why should "a painful feeling of humiliation or distress caused by the consciousness of wrong or foolish behavior" be something people are prevented from ever feeling? Is it not sometimes merited?
Bad feelings, pain, suffering... if these should be avoided at all cost, what about the people whose private information can be stolen and is then put at risk by bad practices... some which are clung to even in the face of overwhelming evidence presented?
In other words, someone might have to suffer to some degree, if mistakes are acknowledged or if they are not, It's just a matter of whom... should it not be the companies and, to a much lesser extent, (causing some slight embarrassment to) those representing the company and arguing with people providing helpful advice, instead of innocent customers paying a business to secure their information, wealth, livelihoods etc?
Or avoid all shaming, consequences be damned?
It's not hard. It just requires you to give a damn and actually treat it as an important aspect of your process, rather than as an afterthought. And that's where most companies go wrong.
> I think the infosec community could go a long way to helping itself by making easier to use tools, and writing canonical guides for common scenarios.
That I can agree with, and behind the scenes, I've been arguing with infosec people about this for years now. But it's not an excuse not to get your security in order.
If anything, that should be driving more investment from companies into security, to collectively produce more usable mechanisms and documentation... but that doesn't happen.
YES! All companies storing data should continually stay up to date with best practice.
Troy's use of the word "shaming" makes me uneasy, because that's not what he is doing. To shame is to dishonor or make ashamed. He isn't dishonoring anyone by having a conversation with them in a public forum. The companies and their employees are dishonoring themselves when they fail to address complaints and continue to speak out of ignorance.
There is a marked difference between Troy and 45: Troy is speaking directly to these companies. That the conversation occurs in a public forum is of no consequence; the companies willingly entered the forum for that very reason, and there is nothing private about the conversation to be had.
On the other hand, 45 does not shame companies by engaging them directly; he shames them by denouncing them to the public. He has no interest in having a conversation, and so never speaks to them, only about them. This allows him to conveniently sidestep any attempts to refute him, since there was never a debate in the first place.
When I have a bad experience at a business, I post a negative review on Yelp - sometimes with pictures to show how bad it is. What Troy is doing isn't fundamentally different.
>The security treadmill is hard for even the most modern tech companies to stay on. I think the infosec community could go a long way to helping itself by making easier to use tools, and writing canonical guides for common scenarios.
Many of the scenarios he points out are easy to fix and well documented (e.g. not using HTTPS, not storing passwords in plaintext). Although banks are better now, about 7-8 years ago, I often would say that a teenager creating a web site following the Django tutorial would create a more secure site than many financial institutions out there (you know, the kind that limited passwords to 8 characters, or only allowed numbers, and didn't salt their passwords).
If a teenager can find and follow docs to make secure sites, then I don't think it is unreasonable to expect better from people who are paid to do it. And it is reasonable to complain publicly when they don't. Some of these institutions have people's life savings.
If you walked into a bank and saw that they kept all your money behind a glass door with a single pickable lock, and that they don't request your ID when you make a withdrawal, would you complain about someone publicly shaming them?
Absolutely. To expand on your comment, some of his example companies were using practices that were never secure to begin with. What happens in 10 years when they still aren't being secure at all and more information is in the wild because no one held them accountable?
It's best practice for every data-holder to adjust their defenses when any security situation changes, ever, not just Troy's advice.
Anything less is just letting laziness rule.
(Bring Trump's tweets into this is a total non-sequitur. His 'shaming' has nothing to do with the real world, only his moment to moment delusions.)
Agreed on this. Security is too hard to do right and too hard to check. There are no 2 guides or 2 people that agree on the same recommendation.
SSL labs is a perfect example where the top rating is not realistic to obtain.
Security should be everyone's responsibility and working with InfoSec to make your treadmill easier is your responsibility too.
There is a fundamental difference between for instance "Apple stores their password data reversibly hashed in the clear in 2017!" and "Apple won't create backdoored encryption/create jobs in the heartland instead of in China!" One is promoting security by calling attention to an objectively bad security practice to store whenever not necessary (passing to the larger store of the hashed one). If people disagree with it no harm done. People will just roll their eyes if there is no technical merit like if it was that the password allowed o,O, and 0 or emojis in passwords.
The other is an attempt to cudgel and bully for personal gain. Regardless of merit it is an attempt to do harm. Even if he is right in the circumstance it is an inappropriate use of the office. Since if there is actual wrongdoing involved actual action should be taken by departments. Perdue apparently has a food poisoning scandal for instance? Form a team to investigate the issue and call on justice department if it was illegal or congress if it was technically legal or should have been uncovered or enforced way earlier.
Really passwords are a bad security practice to be avoided in my opinion - high grade keys are the way to go. We tried phone and email 2FA and it was inconvenience and another attack vector and the differentiation requires enough volume that a password manager is needed anyway to track everything they may as well use key reserves. We have been trying to avoid it but it is inevitable and right now it is shameful that an empty Amazon EC2 instance is more secure than my bank account.
Intent has a lot to do with it, but to me, I see one as part of business. As another comment said, some of these companies carry enough information to ruin our lives. It makes sense to hold their feet to the fire in a public forum when they put security on the back burner.
>The second thing that troubles me is security "best practices" today may not be best practices tomorrow. Some of his example companies are using practices that were "best" 10 years ago. What happens in another 10 years when Troy's current advice is outdated? More pitchforks?
Security is notoriously hard, and anyone who has ever tried to get into the space understand that. But just because it's hard doesn't mean that you get a pass. It is the duty of the business in question to protect customer data. I believe that it is reasonable to expect a company that has my account and personal information to do everything that it can to protect that data.
You said elsewhere that if a breach occurs, a customer only has to dispute a few charges with their bank. You're right. It is much easier for a customer to dispute fraudulent charges. But why do I need to spend my time filling out forms and cooperating with a minor investigation because a business (through negligence or otherwise) lost something that I trusted them with?
But two things about this trouble me. The first is, have we decided that the ends always justify the means? It seems in other domains public shaming is unacceptable. Troy himself despises Donald Trump, but one of the things most heinous about 45 is his use of Twitter to publicly ridicule and shame companies and individuals. And now Troy is engaging in exactly the same behavior. But it's "OK" this time? What is different?
The second thing that troubles me is security "best practices" today may not be best practices tomorrow. Some of his example companies are using practices that were "best" 10 years ago. What happens in another 10 years when Troy's current advice is outdated? More pitchforks?
The security treadmill is hard for even the most modern tech companies to stay on. I think the infosec community could go a long way to helping itself by making easier to use tools, and writing canonical guides for common scenarios. Setting up HTTPS to get an "A" from SSLLabs is non-trivial. Securing SSH with perfect forward secrecy is near impossible for a mortal. There's no reason it has to be this complicated.
Edit: To the people who couldn't get past the first sentence of my last paragraph. I'm not saying that because the security treadmill is hard the companies get a pass. I'm saying the infosec community has a responsibility to make it easier to stay on it. If the barrier to securing something appropriately was so low you could trip over it, we wouldn't have this many problems.