10:00 AM
Connect Directly

Internet's Security Woes are Not All Technical

Google engineer Halvar Flake told Black Hat Asia attendees that flaws in organizational structure and market power put enterprises at risk.

BLACK HAT ASIA - Singapore - Technical shortcomings aren't the only flaws in today's Internet. Organizational structure and the balance of market power are also poking holes in an already fragile system.

Google engineer Halvar Flake discussed the actors, incentives, and industry challenges impeding Internet security as part of his keynote "Why We Are Not Building A Defendable Internet" here this week at Black Hat Asia 2017. Protected devices are part of the solution, but there's more to risk management, he said.

Flake began his discussion by describing the way businesses, security vendors, and customers should interact. Ideally, a business' CISO and their team develop security requirements and communicate their needs to the organization. Leaders make requests of vendors to provide products they need.

But in reality, that's not happening today. "This is not how purchasing works in any way, shape, or form," he explained. "The reality is, software vendors and the entire supply side for IT is entirely scale-driven."

The enterprise has little market power in shaping the design of security products they use, he noted. Few companies can give input to software or hardware vendors to influence the design process.

If businesses have little say in product features, CISOs have even less. Security leaders want to buy reliable products for their teams, but there aren't many available. Vendors and cyber insurance companies realize security leaders can't get exactly what they want, so they sell other products and services to fill the gap, he said.

Much of today's security tech exists to protect the CISO, Flake said. Functionality comes second. The biggest risk to the CISO is being perceived as missing a threat to the business. It doesn't matter whether the product performs; it simply has to seem like a reasonable choice. Purchasing security products often relies on marketing and manageability, he admitted.

"Security products may not help all that much, but they look like they could plausibly reduce the risk of the enterprise," Flake explained. "If you've bought a product, and the product fails to stop the risk, at least it's not your fault."

This contributes to the rise of cyber insurance, which offers to mitigate the cost of a breach and ensuing cleanup, he said. Cyber insurance is a new and evolving field. Many companies don't know policies often don't insure loss of reputational risk, user trust, or critical intellectual property.

There are a few ways cyber insurance could change the game for security teams, according to Flake. Insurers may need to acquire new levels of expertise to help differentiate good security products, or offer lower premiums to companies buying legitimately secure products.

That said, there are many cyber insurance factors that could lead to negative outcomes. Evaluating cyber-risk is hard because there is little historical data, he said. Technology changes so quickly that data collected years ago may not accurately predict risk today. Further, risks can be great. If a large breach occurs, "replace all devices" could be a feasible -- and expensive -- outcome.

All of this leads us to a bigger question: How to manage risk until better products come along. Flake notes how security leaders have adopted a defeatist attitude: "'Whatever we do, we'll always have many, many bugs.'"

This isn't actually true, though, he said. The ability to understand the attack surface and implement strong risk management are what sets apart experienced security pros.

One way to do this is to view IT infrastructure like a financial balance sheet, Flake said. As a whole, it provides daily benefits, but each component of the infrastructure has a risk of blowing up and becoming a liability. Installing software means incurring risk on your "balance sheet." Adding code to software is like adding risk to the balance sheet of each customer.

Most organizations don't know how to incentivize security. Employees are quick to add new software features because it will yield praise and promotions, but additional code broadens the attack surface, according to Flake.

Few people offer to reduce privileged code because it doesn't offer the same reward. The truth is, software has so many features and components that cutting code would be beneficial because it decreases the attack surface, he said.

"Too few people understand the equivalence between code and risk, or treat it as such," Flake said. Businesses need to recognize the role of incentive structure and pay to cut code where it's necessary.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
4/1/2017 | 4:41:33 AM
Very nice! Thanks for informative answers
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
3/31/2017 | 3:07:03 PM
Re: Cyber insurance policies
Because cybersecurity, data stewardship, and related matters are such nascent issues for insurers to contend with, don't expect any merger of these considerations with general E&O umbrella policies anytime soon.
User Rank: Strategist
3/31/2017 | 10:11:43 AM
Re: Cyber insurance policies
Cyber, Security, Ethical policies should be tied together.  All it takes is one nasty incident for the company to look for a fall guy; then employees realize they need to careful with what they are doing.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
3/30/2017 | 11:28:51 AM
Cyber insurance policies
> "Many companies don't know policies often don't insure loss of reputational risk, user trust, or critical intellectual property."

There are policies out there that may cover these things, but -- of course -- you have to ask for them.

The real key here is for businesses to imagine all of the possible consequences of something going wrong, do a risk-management assessment, and then ask the broker about coverage accordingly.
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
New 'Mac-A-Mal' Tool Automates Mac Malware Hunting & Analysis
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/14/2018
IoT Product Safety: If It Appears Too Good to Be True, It Probably Is
Pat Osborne, Principal - Executive Consultant at Outhaul Consulting, LLC, & Cybersecurity Advisor for the Security Innovation Center,  3/12/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.