Schneier on Security

Clive Robinson • February 25, 2011 8:46 AM

I’ll be honest and say “so what”…

In reality what did HBGary do that hundreds if not thousands of other companies have not do or are currently doing. Likewise politicos and many others.

The simple answer is they took a risk and “they got caught”.

Think of any “brand led” organisation where it is driven by the “marketing” people. Marketing is in general an amoral activity where telling “white lies” is the norm.

As I have found out when working for companies with good morals that get taken over by companies with “marketing morals” as their key ethic you are expected to “shape up or ship out” and “shape up” means “do whatever brings the bacon home” with the hidden understatment of “don’t get caught or well disown you, and add to your pain”.

More importantly however is how HBGary were caught…

Effectivly they believed that the FUD they were selling was just that and did not take precautions, against the FUD actually comming home to roost. Even worse they did not make alowance for “deniability” their internal email system signed each email thus when they made claim that the messages where not genuine the Verisign Cert and who purchased it were pointed out.

At the end of the day the HBGary mob have been hung up by their own arrogance.

But I very very seriously doubt they are a single “rotten apple” the barrel is full of them wrapped in pork fat.

Clive Robinson • February 26, 2011 5:05 AM

@ John,

“Bruce is rather tardy in reporting – guess he was waiting for the sort of pro-HBGary”puff piece” to be written that he could link to.”

It could be more to do with RSA last week which is where that HBGary “self promoting” poster trying to make themselves out to be “poor little victims” was photographed.

Also as Bruce has said before this blog is a security site note a news site.

Unlike many other blogs Bruce tends to wait until there is sufficient security related content that can be thoughtfully analysed befor posting.

If you look at the way the HBGary mess has been swinging backwards and forwards (and will more than likely continue to do so) you will see there is a lot more “dirt” and “consternation” yet to surface with possible legal activity.

But to be honest HBGary made the usual PR blunder thay made statments not made on actuality but on what they thought the press had and thus they portrayed themselves to be victims thinking it would put them in the best light.

They would have been better off acknowledging the problem and saying it was under investigation and leaving it at that.

A lesson that many PR prols should learn is not to play from the “little miss muffet” playbook. If you spill your curds and whey then don’t turn around and blub at the “horrible” spider to get sympathy, it’s the behaviour of imature people (ie children) not the behaviour of responsable and mature adults.

But you “reap what you sow” as HBGary are finding out and as they say “people who throw stones, should not live in glass houses” and with most popular OS’s your system is more like a goldfish bowl than a fortress irespective of what you do to bolster it up.

Clive Robinson • February 26, 2011 10:45 AM

@ Noname,

I guess you have a reason to be anonymous.

When you say,

“Laws and punishments need to be harsh enough to actual deter the crime.”

It has been known for well over a two centuries that “harsh punishment” in no way deters crime and a study of history shows it activly encourage it (which is one reason why we have so many feudal cultures stuck in the middle ages or earlier and also why religious texts more modern than the old testiment effectivly forbid “eye for an eye”).

I could give you a load of weblink refrences but you can go and look them up yourself (not that you are likley to but google “bentham panopticon utilitarianism”).

In a more modern society it can quickly be seen that those who recomend harsh punishment generaly have a vested interest (profit / power) or are the sort of person who scores higher than average on sociopath testing or not particularly high on SATS.

Nearly all studies that have investigated the roots of crime show that ensuring a good “social/emotional education” in those under 3years of age will prevent a lot of crime. Also the cost of the early years education costs less than ~1/8,000 of dealing with the consiquences of not providing the early years education.

So if you do the math on the number of criminals (ie those that have been convicted) in the US and the population you will actually see that if even only 50% of the children benifit from the early years eduction the direct cost of the education to the US taxpayer will be just a small fraction of the cost of the current prison system.

However this is not “politicaly” on message as the benifit will take 15-20years to come on stream.

There are other ways that will bring significant savings sooner such as seperating first and repeat offenders into different institutions and offering sensible education policy etc in the first offenders institutions. This seperation and education has been found to encorage socio emotional development as well as employability in something like 80% of first time offenders and reduce repeate offending (it also stops “criminal education” whereby experianced criminals teach first offenders how to be more violent more effective criminals).

But again this is “politicaly” not on message.

Have a look at the money flow around the US prison system to see who realy benifits and you will quickly find it is noot the ordinary taxpayer.

But there are other reasons for not “tit for tatting” or “defence by offence”. When you do “eye for an eye” you get into a mind set of “use your brawn not your brains” and collateral damage is often high and leads to the “might is right” mentality of the “school bully”.

I could go one at great length but look at it this way the Afghan War is likley to go on another 40-80years and achieve little or nothing except a huge budget deficit year on year. In the mean while the Afghan War has actually increased the opiate drugs flow into the US and a whole load of other things that can be directly shown to harm the average US taxpayer so double whamy. Again follow the money and see who gains the power and profit by the Afghan war to see why it still continues.

The way to deal with cyber crime (and that’s what it is not war) is to,

1, Treat “cracking” as what it is which is crime not war.
2, Use LEA’s not Armed forces to deal with it.
3, Develop better international LE relations.
4, Reduce “short term” / “next quater figures” thinking.
5, Start using more secure operating systems.
6, Start using more secure applications
7, Minimise OS/App functionality.

And a whole load of other quite minor changes that will pay big dividends for little or no real cost.

However when it comes to ICT (both development and deployment) the two most important changes should be,

1, Treat security as a quality issue, (ie build in from day 0 not bolt on after in use).
2, All techs need business qualifications.

Clive Robinson • February 26, 2011 1:02 PM

@ Jim,

“Once convicted in the USA, always convicted”

I know it used to be bad pre-9/11 but I guess it’s got worse. I made my mind up not to vist the US for business or pleasure ever again when I flew in a few days after they started taking fingerprints of the inbound passengers.

Does it not occur to people in the US with the ability to change things that not giving convicted criminals a choice in continuing in crime or becoming a useful citizen might actually increase violent crime especialy with “three strikes and out” type rules?

Having been the recipient of violent crime I’ll be one of the first to put my hand up to saying that things have to change. But without giving people choice you can only expect things to get worse not better or is their something I’ve missed?

With regards business qualifications for techs it’s a question of being an “ignored outsider” -V- “a tolerated insider”.

The man that cuts the cheques at the end of the day “speaks business” not “tech” such people have a very very very limited tolerance of what they consider to be “techno babble”. When it comes to listening to “Sales & Marketing” speaking his language and “ICT Sec” speaking what sounds like nonsense which way do you think he’s going to vote?

A current example of this is “cloud computing” with “mobile computing” have a look at the vendors sales pitches and “business presentations” and ask yourself why such high risk technology is gaining such traction even when the techs can say fairly accurately and simply as “It cannot be secure with current technology”?

With regards,

“what we need more of is street level thinkers who can think beyond… ”

I’m with you all the way on that, but they need to be listened to not just heard, and that means sad to say speaking the language the man speaks, because the man won’t learn any other language as he’s to busy.

Clive Robinson • February 26, 2011 9:00 PM

@ BF Skinner,

“It’s cause he’s got more than one”

For my ears it is true, and it is also true both of them went a little pink on reading the complement.

I’m after all “British” and as I’m sure you know we do embarrassed fairly colourfully at the merest hint of a complement.

Clive Robinson • March 2, 2011 3:27 PM

@ Shane,

“So you’re not coming off as bitter, simply correct This is pure neuroscience, it’s simply telling u what many of us suspected all along.”

And so dies an eternal optomist 😉

Clive Robinson • March 7, 2011 1:40 PM

@ Nick P,

“The Clives”

That sounds to much like a skin condition and I’ve just started itching “enough already” [noise of vigorous scratching to stage left]

In the same vein as your comments,

The trouble with some feedback loops is they disapear within themselves never to be seen again as the whirl tighter and tighter in ever decreasing circles beyond their own event horizon… Sometimes I feel like Zaphod Beebolbrox, in that there are parts of my mind closed of for very deliberate but unknown reasons…

But back to reality sorry as far as I can tell my brain is just an ordinary bucket of grey white and pink goo with bits hanging out in the appropriat places just like everybody elses.

However a rumour has it a very large cat at some point must have crossed my path or scratched me. Because not only am I curious to the point of being terminal (I’ll tell you about making an instant duck pond one day) I also appear to have atleast nine lives (I’ think I’m on number seven currently).