I was reading Roger Grimes’ interview with an offensive cybersecurity operator, and one key quote really stood out:
I wish we spent as much time defensively as we do offensively. We have these thousands and thousands of people in coordinate teams trying to exploit stuff. But we don’t have any large teams that I know of for defending ourselves. In the real world, armies spend as much time defending as they do preparing for attacks. We are pretty one-sided in the battle right now.
As much as I enjoy playing offensive security guy once a year at Defcon, I find defense to be a much more interesting challenge. Unfortunately many in our community don’t consider it as ‘sexy’ as penetration testing or vulnerability research. We need to change that.
Most of us started our exploration of technology as hackers. I am fully willing to admit I was fascinated by cracking systems, and engaged in activities as a kid that could land me in jail now. Nothing major – I always assumed it was much easier to catch hackers and phreaks than it really was. I mean seriously, it wouldn’t have been all that hard back then. It turns out no one was looking – who knew? That’s what I get for assessing national computer law enforcement capabilities based on repeated viewings of War Games.
But breaking things is, in many ways, far less challenging than protecting them. I am sick and tired of seeing researchers and pen testers on various mailing lists brag about how easy it is to get into their clients’ systems. I suspect the ones who understand the complexity of defending complex environments with limited resources keep their mouths shut. Breakers, with very few exceptions, aren’t accountable. Outside of movies, there are no consequences if they fail. Not yet, at least. No guns to the head as you sit in front of 32 widescreen monitors with 8 keyboards spread out in front of you and a coked- megelomaniac watching you waste part of your 60-second window on a visualization so your code looks good for the cameras. Nope.
Builders? Defenders? Our lives are nothing but accountability. We are the firefighters, doctors, cops, and engineers all wrapped into one. Without us who would keep the porn flowing? It is a far more complex challenge, with nowhere near enough disciples.
Many of our smartest focus on offensive security for obvious economic reasons. If you are good there is more money, less accountability, and more freedom. Smart defenders, even if they come up with a groundbreaking idea, need time and resources to build it – which often means productizing it and dealing with idiotic investors and bureaucracies. There are far fewer opportunities for smart defenders to perform research leading to practical tools and techniques.
The only thing that can change this is money. Sure, I’d love to lead a cultural revolution, but that is more my desire to send people to re-education camps than any inherent belief we will all suddenly focus on defense due to some higher calling. (I’m serious about the camps – I have some awesome ideas). We need some serious investment – and not in academic institutions who often fail to remember sh*t needs to work outside a lab.
Breaking and offensive research are important. Doing them well is hard. But defending? That is a challenge.
I suspect I will be talking about this at Defcon. But with more beer.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Adrian’s DR Post Why Database Assessment.
- Rich has another article at Macworld on security for switchers.
- Rich’s DR post: Security Needs More Designers.
- Mike’s article at Information Week.
- Dave Lewis on Disaster Recovery at CSO Online
Favorite Securosis Posts
- Mike Rothman: Using Amazon IAM Roles to Distribute Security Credentials (for Chef). Holy crap. A blog post from an analyst with code and screen shots! OMG… See, some analyst have some kung fu after all.
- David Mortman: Rich’s first post on security automation.
- Rich: Continuous Security Monitoring: Classification. This is a good series.
Other Securosis Posts
- The Endpoint Security Buyer’s Guide [New Series].
- Living to fight another day….
- Another Disclosure Debacle, with a Twist.
- Using
cloud-init
ands3cmd
to Automatically Download Chef Credentials.- Incite 7/10/2013: Selfies.
- Kudos: Microsoft’s App Store Security Policy.
- How Not to Handle a Malware Outbreak.
- RSA Acquires Aveksa.
- Multitenancy is the Least Interesting Security Property of Cloud Computing.
- Continuous Security Monitoring: Defining CSM.
- Calendar Bites Google Security in the Ass.
- Proactive WebAppSec.
- Why. Continuous. Security. Monitoring? [New Series].
- New Paper: Quick Wins with Website Protection Services.
- Database Denial of Service: Attacks.
- OpenStack Security Guide Released.
Favorite Outside Posts
- Mike Rothman: Proving the skeptics wrong. You can only achieve true success when you do things for the right reasons. Seth Godin reminds me that proving someone wrong isn’t one of them. At some point you run out of people to rail against…
- Adrian Lane: Data Leakage In A Google World. People forget that Google is a powerful tool and often finds data companies did not want exposed. It’s a tool to hack with, and yes, a tool to phish with.
- Chris Pepper: Solaris patching is broken because Oracle is dumb and irresponsible.
- David Mortman: Dear Speaker, I Loathe You. Sincerely, Your Event Planner. Funny.
- Rich: No, Hacker Really Does Mean Hacker. Yep. Get over it.
Research Reports and Presentations
- Quick Wins with Website Protection Services.
- Email-based Threat Intelligence: To Catch a Phish.
- Network-based Threat Intelligence: Searching for the Smoking Gun.
- Understanding and Selecting a Key Management Solution.
- Building an Early Warning System.
- Implementing and Managing Patch and Configuration Management.
- Defending Against Denial of Service (DoS) Attacks.
- Securing Big Data: Security Recommendations for Hadoop and NoSQL Environments.
- Tokenization vs. Encryption: Options for Compliance.
- Pragmatic Key Management for Data Encryption.
Top News and Posts
- Google releases fix to OEMs for Blue Security Android security hole. This is seriously ugly.
- How the US (probably) spied on European allies’ encrypted faxes.
- Researcher finds way to commandeer any Facebook account from his mobile phone.
- Crimelords: Stolen credit cards… keep ‘em. It’s all about banking logins now.
- DEF CON to Feds.
- Aeroplan Provides Proactive Customer Alerting
- A Black Hat, DefCon and B-Sides survival guide
- Vermont and North Dakota Amend Breach-Notice Laws
- Judge Orders U.S. to Release Aaron Swartz’s Secret Service File
- Multi-platform Java RAT targeting government agencies
Blog Comment of the Week
This week’s best comment goes to Dwayne, in response to Incite 7/10/2013: Selfies.
I’m very interested in Adrian’s item under “No firewall for you” as I have heard a number of organizations discussing this. I really want to hear some post-facto analysis from companies who go this route, to find out what differences (positive and negative) they experience.
Along those lines, I have been in conversation with a couple of companies who want to get rid of antivirus because they feel it isn’t adding value (at least in the data center). Unfortunately, they both have to answer to PCI which explicitly requires AV so that is a bit of a problem.
In general, I think the more we can streamline the number of countermeasures and controls we have to manage, the better. But it is definitely a “look before you leap” problem.
BTW – I’m with you on the selfies – definitely fascinating. My daughter told me about “duck face” selfies, which are apparently a sub-class of the normal selfie. You can find a lot of them on Flickr, too.
Reader interactions
2 Replies to “Summary: Here’s to the Defenders”
I agree with your sentiments but disagree on the numbers. In my experience defenders out number offensive security types by a vast number. That’s the main reason why most enterprises contract that out to consultants.
As best I can tell a lot of defenders boil down to being security device administrators. Their knowlege is also very vendor specific, ie Checkpoint, Microsoft. Increasingly defenders don’t place a high enough prioity on scripting and *nix skills.
Both defenders and OSec folks are way too Tactically oriented with under developed Strategic thinking skills.
0x
Bravo! I’ve been complaining about over the past year or so. However, I don’t see the attitude (or problem) changing anytime soon for exactly the reasons you outline.
Putting money to the side (which is also something that won’t change anytime soon for most organizations) the lack of accountability is very appealing to many people. Why be judged on your inevitable failures when you can instead be judged on your inevitable successes… and be paid better for it to boot?