Risk
3/30/2017
10:00 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Internet's Security Woes are Not All Technical

Google engineer Halvar Flake told Black Hat Asia attendees that flaws in organizational structure and market power put enterprises at risk.

BLACK HAT ASIA - Singapore - Technical shortcomings aren't the only flaws in today's Internet. Organizational structure and the balance of market power are also poking holes in an already fragile system.

Google engineer Halvar Flake discussed the actors, incentives, and industry challenges impeding Internet security as part of his keynote "Why We Are Not Building A Defendable Internet" here this week at Black Hat Asia 2017. Protected devices are part of the solution, but there's more to risk management, he said.

Flake began his discussion by describing the way businesses, security vendors, and customers should interact. Ideally, a business' CISO and their team develop security requirements and communicate their needs to the organization. Leaders make requests of vendors to provide products they need.

But in reality, that's not happening today. "This is not how purchasing works in any way, shape, or form," he explained. "The reality is, software vendors and the entire supply side for IT is entirely scale-driven."

The enterprise has little market power in shaping the design of security products they use, he noted. Few companies can give input to software or hardware vendors to influence the design process.

If businesses have little say in product features, CISOs have even less. Security leaders want to buy reliable products for their teams, but there aren't many available. Vendors and cyber insurance companies realize security leaders can't get exactly what they want, so they sell other products and services to fill the gap, he said.

Much of today's security tech exists to protect the CISO, Flake said. Functionality comes second. The biggest risk to the CISO is being perceived as missing a threat to the business. It doesn't matter whether the product performs; it simply has to seem like a reasonable choice. Purchasing security products often relies on marketing and manageability, he admitted.

"Security products may not help all that much, but they look like they could plausibly reduce the risk of the enterprise," Flake explained. "If you've bought a product, and the product fails to stop the risk, at least it's not your fault."

This contributes to the rise of cyber insurance, which offers to mitigate the cost of a breach and ensuing cleanup, he said. Cyber insurance is a new and evolving field. Many companies don't know policies often don't insure loss of reputational risk, user trust, or critical intellectual property.

There are a few ways cyber insurance could change the game for security teams, according to Flake. Insurers may need to acquire new levels of expertise to help differentiate good security products, or offer lower premiums to companies buying legitimately secure products.

That said, there are many cyber insurance factors that could lead to negative outcomes. Evaluating cyber-risk is hard because there is little historical data, he said. Technology changes so quickly that data collected years ago may not accurately predict risk today. Further, risks can be great. If a large breach occurs, "replace all devices" could be a feasible -- and expensive -- outcome.

All of this leads us to a bigger question: How to manage risk until better products come along. Flake notes how security leaders have adopted a defeatist attitude: "'Whatever we do, we'll always have many, many bugs.'"

This isn't actually true, though, he said. The ability to understand the attack surface and implement strong risk management are what sets apart experienced security pros.

One way to do this is to view IT infrastructure like a financial balance sheet, Flake said. As a whole, it provides daily benefits, but each component of the infrastructure has a risk of blowing up and becoming a liability. Installing software means incurring risk on your "balance sheet." Adding code to software is like adding risk to the balance sheet of each customer.

Most organizations don't know how to incentivize security. Employees are quick to add new software features because it will yield praise and promotions, but additional code broadens the attack surface, according to Flake.

Few people offer to reduce privileged code because it doesn't offer the same reward. The truth is, software has so many features and components that cutting code would be beneficial because it decreases the attack surface, he said.

"Too few people understand the equivalence between code and risk, or treat it as such," Flake said. Businesses need to recognize the role of incentive structure and pay to cut code where it's necessary.

Related Content:

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance & Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Shantaram
50%
50%
Shantaram,
User Rank: Ninja
4/1/2017 | 4:41:33 AM
Re: 192.168.0.1
Very nice! Thanks for informative answers
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
3/31/2017 | 3:07:03 PM
Re: Cyber insurance policies
Because cybersecurity, data stewardship, and related matters are such nascent issues for insurers to contend with, don't expect any merger of these considerations with general E&O umbrella policies anytime soon.
jenshadus
50%
50%
jenshadus,
User Rank: Strategist
3/31/2017 | 10:11:43 AM
Re: Cyber insurance policies
Cyber, Security, Ethical policies should be tied together.  All it takes is one nasty incident for the company to look for a fall guy; then employees realize they need to careful with what they are doing.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
3/30/2017 | 11:28:51 AM
Cyber insurance policies
> "Many companies don't know policies often don't insure loss of reputational risk, user trust, or critical intellectual property."

There are policies out there that may cover these things, but -- of course -- you have to ask for them.

The real key here is for businesses to imagine all of the possible consequences of something going wrong, do a risk-management assessment, and then ask the broker about coverage accordingly.
5 Reasons the Cybersecurity Labor Shortfall Won't End Soon
Steve Morgan, Founder & CEO, Cybersecurity Ventures,  12/11/2017
BlueBorne Attack Highlights Flaws in Linux, IoT Security
Kelly Sheridan, Associate Editor, Dark Reading,  12/14/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.