Summary: Here’s to the Defenders
I was reading Roger Grimes’ interview with an offensive cybersecurity operator, and one key quote really stood out: I wish we spent as much time defensively as we do offensively. We have these thousands and thousands of people in coordinate teams trying to exploit stuff. But we don’t have any large teams that I know of for defending ourselves. In the real world, armies spend as much time defending as they do preparing for attacks. We are pretty one-sided in the battle right now. As much as I enjoy playing offensive security guy once a year at Defcon, I find defense to be a much more interesting challenge. Unfortunately many in our community don’t consider it as ‘sexy’ as penetration testing or vulnerability research. We need to change that. Most of us started our exploration of technology as hackers. I am fully willing to admit I was fascinated by cracking systems, and engaged in activities as a kid that could land me in jail now. Nothing major – I always assumed it was much easier to catch hackers and phreaks than it really was. I mean seriously, it wouldn’t have been all that hard back then. It turns out no one was looking – who knew? That’s what I get for assessing national computer law enforcement capabilities based on repeated viewings of War Games. But breaking things is, in many ways, far less challenging than protecting them. I am sick and tired of seeing researchers and pen testers on various mailing lists brag about how easy it is to get into their clients’ systems. I suspect the ones who understand the complexity of defending complex environments with limited resources keep their mouths shut. Breakers, with very few exceptions, aren’t accountable. Outside of movies, there are no consequences if they fail. Not yet, at least. No guns to the head as you sit in front of 32 widescreen monitors with 8 keyboards spread out in front of you and a coked- megelomaniac watching you waste part of your 60-second window on a visualization so your code looks good for the cameras. Nope. Builders? Defenders? Our lives are nothing but accountability. We are the firefighters, doctors, cops, and engineers all wrapped into one. Without us who would keep the porn flowing? It is a far more complex challenge, with nowhere near enough disciples. Many of our smartest focus on offensive security for obvious economic reasons. If you are good there is more money, less accountability, and more freedom. Smart defenders, even if they come up with a groundbreaking idea, need time and resources to build it – which often means productizing it and dealing with idiotic investors and bureaucracies. There are far fewer opportunities for smart defenders to perform research leading to practical tools and techniques. The only thing that can change this is money. Sure, I’d love to lead a cultural revolution, but that is more my desire to send people to re-education camps than any inherent belief we will all suddenly focus on defense due to some higher calling. (I’m serious about the camps – I have some awesome ideas). We need some serious investment – and not in academic institutions who often fail to remember sh*t needs to work outside a lab. Breaking and offensive research are important. Doing them well is hard. But defending? That is a challenge. I suspect I will be talking about this at Defcon. But with more beer. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Adrian’s DR Post Why Database Assessment. Rich has another article at Macworld on security for switchers. Rich’s DR post: Security Needs More Designers. Mike’s article at Information Week. Dave Lewis on Disaster Recovery at CSO Online Favorite Securosis Posts Mike Rothman: Using Amazon IAM Roles to Distribute Security Credentials (for Chef). Holy crap. A blog post from an analyst with code and screen shots! OMG… See, some analyst have some kung fu after all. David Mortman: Rich’s first post on security automation. Rich: Continuous Security Monitoring: Classification. This is a good series. Other Securosis Posts The Endpoint Security Buyer’s Guide [New Series]. Living to fight another day…. Another Disclosure Debacle, with a Twist. Using cloud-init and s3cmd to Automatically Download Chef Credentials. Incite 7/10/2013: Selfies. Kudos: Microsoft’s App Store Security Policy. How Not to Handle a Malware Outbreak. RSA Acquires Aveksa. Multitenancy is the Least Interesting Security Property of Cloud Computing. Continuous Security Monitoring: Defining CSM. Calendar Bites Google Security in the Ass. Proactive WebAppSec. Why. Continuous. Security. Monitoring? [New Series]. New Paper: Quick Wins with Website Protection Services. Database Denial of Service: Attacks. OpenStack Security Guide Released. Favorite Outside Posts Mike Rothman: Proving the skeptics wrong. You can only achieve true success when you do things for the right reasons. Seth Godin reminds me that proving someone wrong isn’t one of them. At some point you run out of people to rail against… Adrian Lane: Data Leakage In A Google World. People forget that Google is a powerful tool and often finds data companies did not want exposed. It’s a tool to hack with, and yes, a tool to phish with. Chris Pepper: Solaris patching is broken because Oracle is dumb and irresponsible. David Mortman: Dear Speaker, I Loathe You. Sincerely, Your Event Planner. Funny. Rich: No, Hacker Really Does Mean Hacker. Yep. Get over it. Research Reports and Presentations Quick Wins with Website Protection Services. Email-based Threat Intelligence: To Catch a Phish. Network-based Threat Intelligence: Searching for the Smoking Gun. Understanding and Selecting a Key Management Solution. Building an Early Warning System. Implementing and Managing Patch and Configuration Management. Defending Against Denial of Service (DoS) Attacks. Securing Big Data: Security Recommendations for Hadoop and NoSQL Environments. Tokenization vs. Encryption: Options for Compliance. Pragmatic Key Management for Data Encryption. Top News and Posts Google releases fix to OEMs for Blue Security Android security hole. This is seriously ugly. How the US (probably) spied on European allies’ encrypted faxes. Researcher finds way to commandeer any Facebook account from his mobile phone. Crimelords: Stolen credit cards… keep ‘em. It’s all about banking logins now. DEF CON to Feds. Aeroplan Provides Proactive Customer Alerting A Black Hat,
