Perimeter
1/25/2013
10:17 AM
Gunnar Peterson
Gunnar Peterson
Commentary
50%
50%

The Three Worst Words In The English Language: Can't We Just?

The road to poor identity and access management architecture is paved with "can't we justs." It's 2013: Find a way

When learning something new, especially a technical something, it's great to hear the words "for example" because you're about to see something more concrete that helps the abstract make more sense.

Conversely, when doing design and development work, it's awful to hear the words "can't we just" because you're about to hear a defense of kicking the can down the road -- more status quo.

"Can't we just" is used to justify all manner of things:

"Can't we just replicate the passwords?"

"Can't we just leave passwords cleartext?"

"Can't we just use one way SSL to solve everything?"

"Can't we just use the same system we have for the last 15 years for our new Cloud?"

"Can't we just use the same system we have for the last 15 years for our new Mobile apps?"

"Can't we just hardcode XYZ?"

What people are really saying when they say "can't we just" is, "Can't we assume tomorrow will look like today?" This may work in some areas of IT (although I am doubtful), but it's flat-out hazardous in security.

The prefix for the majority of suboptimal designs is "can't we just." When you hear that phrase, brace yourself. I am all for being practical, but systems age more like milk than wine. They do not necessarily get better with age, software evolves, and, more importantly, so do attacker's capabilities. To illustrate this latter point, consider Dave Aitel's prediction for 2012 that mobile platforms would fail:

You know what didn't pan out? "Mobile attacks" in commercial attack frameworks. The reasons are a bit non-obvious, but deep down, writing Android exploits is fairly hard. Not because the exploit itself is hard, but because testing your exploit on every phone is a nightmare. There's literally thousands of them, and they're all slightly different. So even if you know your exploit is solid as a rock, it's hard to say that you tested it on whatever strange phone your customer happens to have around.

And of course, iOS is its own hard nut to crack. It's a moving monolithic target, and Apple is highly incentivized by pirates to keep it secure. So if you have something that works in a commercial package, Apple will patch it the next day, and all your hard work is mostly wasted.

Now there are some good reasons why this did not happen; in my view, the fragmentation in mobile is a real issue for developers, testers, and attackers. But it's not a long-term advantage -- it's a delay of game, a speed bump. The point I would like to make here is that you could read those comments as, "Well, it's too hard for attackers. Can't we just live with the same mobile security model in 2013? After all, it was good enough in 2012."

But guess what? It's not a static environment. Attackers don't remain in some little, limited snow-globe world: They learn, and tools get better. What was good enough last year is not good enough this year.

Instead of can't we just kick the can down the road, we should find a way to make improvements in our security architecture.

Gunnar Peterson is a Managing Principal at Arctec Group

Gunnar Peterson (@oneraindrop) works on AppSec - Cloud, Mobile and Identity. He maintains a blog at http://1raindrop.typepad.com. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
gbaggett750
50%
50%
gbaggett750,
User Rank: Apprentice
1/30/2013 | 3:34:37 PM
re: The Three Worst Words In The English Language: Can't We Just?
Can't we just....-á Doesn't always imply kicking the can down the road.-á It is also a cry for help and also may lead to a possible solution so DO NOT just dismiss anything that is said after these three words.-á To do so outright is showing ARROGANCE toward ... (possibly your user).-á-á

Listen to what they have to say and then explain to them why it may not work withing the confines of the subject.-á If you cannot do that then maybe you do not understand well enough yourself to be dismissing his solution outright.-á-á

I have noticed that sometimes in the process of explaining something that-áI develop a better undertanding of the situation and have discovered alternate solutions during the process that may or may not involve the solution that I have previously suggested.

Bleeding edge isn't always the best (although some technologists believe so) because sometimes the inconvenience toward the user needs to be balanced with what that user is doing.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

CVE-2014-8090
Published: 2014-11-21
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...

CVE-2014-8469
Published: 2014-11-21
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?