Today I was sitting in my office, window open, enjoying the cold front that finally shoved the summer heat out of Phoenix. I had an ice pack on my leg because my achilles tendon has been a little twitchy as I go into the last 8 weeks of marathon training. My wife was going through the mail, walked in, and dropped a nice little form letter from the United States Office or Personnel Management onto my desk.
It’s no secret I’m still an active disaster responder on a federal team. And, as previously mentioned, my data was lost in the OPM hack. However, my previous notification was for the part where they hacked the employment information database. This notification is for the loss of all security investigation records.
Which is cool, because I don’t even have a security clearance.
What was on there? Aside from my SSN, every address I’ve lived at (once going back to childhood, but I think the most recent form was only 7 years), most of my jobs, all my relatives, and (I think) my wife’s SSN. I’m not sure about that because I can’t remember exactly what year I most recently filled out that form, but I’m pretty sure it was after we were married.
Here’s the fun part. The OPM just offered me 3 years of identity theft protection. Three. Years. Which I can only assume means my SSN will expire in that time and I’ll be safe afterwards. And it must mean China wasn’t responsible, because they would go after me as espionage, not identity theft. Right? RIGHT?!?
It’s just another example of the old distract and deceive strategy to placate. No one involved in intelligence or security thinks for half a second that ID theft protection for three years is meaningful when an SSN is lost – never mind when it (and all my personal info) is lost to a foreign intelligence adversary. But it sounds good in the press and distracts the many millions of federal workers who don’t work in security and understand the implications. People who trust the government, their employer.
This isn’t limited to the OPM hack – it’s really a shitty playbook for the security industry overall. Been hacked? Call it “advanced and persistent” and then announce you hired a top-tier incident response firm. It doesn’t matter that you used default admin passwords, it’s all about looking like you take security seriously, when you don’t. Well, didn’t.
Really. Look at all the breach announcements from the past couple of years. Cut and paste.
And then there are our security tools. Various point technologies, each designed to stop one particular type of attack during a particular time window. Some of them really work. But we don’t acknowledge that security is really about stopping adversaries (Gunnar Peterson constantly hammers on this), and then the window for that particular tech closes. This throws the vendors into a spin cycle because, let’s be honest, their entire livelihood is on the line.
Distract. Deceive. Lather. Rinse. Repeat.
Admitting failure is hard. Addressing root causes is hard. Realizing something you built is no longer as valuable as it once was is even harder. Hell, we here at Securosis once spent two years and a couple hundred thousand dollars building something that we had to walk away from because the market shifted. That was cash out of my personal pocket – I get it.
This isn’t a security industry problem, it’s basic human behavior. I don’t have an issue with someone covering their ass, but when you deceive and distract to protect yourself, and put others at greater risk?
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Rich wrote an article at TidBITS on the million dollar iOS exploit.
- Rich quoted at Wired on using AI to stop malware.
Favorite Securosis Posts
- Rich: Incite 11/4/2015 – The Taper. I’m training for my first marathon right now. Well, second time training, because I got stomach flu the week of my planned first and had to miss it. My entire life right now is focused on starting my taper on December 6th.
Other Securosis Posts
- CSA Guidance V4 content on GitHub.
- DevOps’ed To Death.
- Why I design for one cloud at a time.
- Million Dollar iOS Exploit? Maybe.
- Get Your Marshmallows.
- Summary: Edumacation.
Favorite Outside Posts
- Rich: Fast, flexible and free, Linux is taking over the online world. But there is growing unease about security weaknesses. A big WaPo piece on the security state of Linux? I sh*t you not. This is an important article that highlights some of the fundamental tensions at the heart of information security.
- Adrian: How Carders Use eBay as Virtual ATM. A very clever way to launder money through PayPal. This shouldn’t work – the various merchants should match the Zip code of the recipient to the Zip code associated with the credit card. Gas stations and automated kiosks ask for Zip codes for this reason. But I guess some merchants aren’t checking.
Research Reports and Presentations
- Pragmatic Security for Cloud and Hybrid Networks.
- EMV Migration and the Changing Payments Landscape.
- Network-based Threat Detection.
- Applied Threat Intelligence.
- Endpoint Defense: Essential Practices.
- Cracking the Confusion: Encryption and Tokenization for Data Centers, Servers, and Applications.
- Security and Privacy on the Encrypted Network.
- Monitoring the Hybrid Cloud: Evolving to the CloudSOC.
- Security Best Practices for Amazon Web Services.
- Securing Enterprise Applications.
Top News and Posts
- If the UK government collects browsing data, one day it will be public. How long until you need to register to use the Internet like they do in cybercafes in China? What an astoundingly bad idea.
- Pentagon Farmed Out Its Coding to Russia. That’s cool. Maybe they outsourced by identity protection to Russia because China supposedly hacked it, and we can let those two fight it out.
- Chinese Mobile Ad Library Backdoored to Spy on iOS Devices.
- Xen Patches ‘Worst’-Ever Virtual Machine Escape Vulnerability. I wonder which cloud providers this affects?
- Mozilla Embraces Private Browsing with Tracking Protection in Firefox 42. Safari? Chrome? Not-IE-but-can’t-remember-the-name?
Blog Comment of the Week
This week’s best comment goes to Guillaume Ross, in response to Why I design for one cloud at a time.
It’s weird. Companies that never thought twice about getting locked into Windows as a platform, now super concerned to have code calling S3!