Perimeter
1/25/2013
10:17 AM
Gunnar Peterson
Gunnar Peterson
Commentary
Connect Directly
RSS
E-Mail
50%
50%

The Three Worst Words In The English Language: Can't We Just?

The road to poor identity and access management architecture is paved with "can't we justs." It's 2013: Find a way

When learning something new, especially a technical something, it's great to hear the words "for example" because you're about to see something more concrete that helps the abstract make more sense.

Conversely, when doing design and development work, it's awful to hear the words "can't we just" because you're about to hear a defense of kicking the can down the road -- more status quo.

"Can't we just" is used to justify all manner of things:

"Can't we just replicate the passwords?"

"Can't we just leave passwords cleartext?"

"Can't we just use one way SSL to solve everything?"

"Can't we just use the same system we have for the last 15 years for our new Cloud?"

"Can't we just use the same system we have for the last 15 years for our new Mobile apps?"

"Can't we just hardcode XYZ?"

What people are really saying when they say "can't we just" is, "Can't we assume tomorrow will look like today?" This may work in some areas of IT (although I am doubtful), but it's flat-out hazardous in security.

The prefix for the majority of suboptimal designs is "can't we just." When you hear that phrase, brace yourself. I am all for being practical, but systems age more like milk than wine. They do not necessarily get better with age, software evolves, and, more importantly, so do attacker's capabilities. To illustrate this latter point, consider Dave Aitel's prediction for 2012 that mobile platforms would fail:

You know what didn't pan out? "Mobile attacks" in commercial attack frameworks. The reasons are a bit non-obvious, but deep down, writing Android exploits is fairly hard. Not because the exploit itself is hard, but because testing your exploit on every phone is a nightmare. There's literally thousands of them, and they're all slightly different. So even if you know your exploit is solid as a rock, it's hard to say that you tested it on whatever strange phone your customer happens to have around.

And of course, iOS is its own hard nut to crack. It's a moving monolithic target, and Apple is highly incentivized by pirates to keep it secure. So if you have something that works in a commercial package, Apple will patch it the next day, and all your hard work is mostly wasted.

Now there are some good reasons why this did not happen; in my view, the fragmentation in mobile is a real issue for developers, testers, and attackers. But it's not a long-term advantage -- it's a delay of game, a speed bump. The point I would like to make here is that you could read those comments as, "Well, it's too hard for attackers. Can't we just live with the same mobile security model in 2013? After all, it was good enough in 2012."

But guess what? It's not a static environment. Attackers don't remain in some little, limited snow-globe world: They learn, and tools get better. What was good enough last year is not good enough this year.

Instead of can't we just kick the can down the road, we should find a way to make improvements in our security architecture.

Gunnar Peterson is a Managing Principal at Arctec Group

Gunnar Peterson (@oneraindrop) works on AppSec - Cloud, Mobile and Identity. He maintains a blog at http://1raindrop.typepad.com. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
gbaggett750
50%
50%
gbaggett750,
User Rank: Apprentice
1/30/2013 | 3:34:37 PM
re: The Three Worst Words In The English Language: Can't We Just?
Can't we just....-á Doesn't always imply kicking the can down the road.-á It is also a cry for help and also may lead to a possible solution so DO NOT just dismiss anything that is said after these three words.-á To do so outright is showing ARROGANCE toward ... (possibly your user).-á-á

Listen to what they have to say and then explain to them why it may not work withing the confines of the subject.-á If you cannot do that then maybe you do not understand well enough yourself to be dismissing his solution outright.-á-á

I have noticed that sometimes in the process of explaining something that-áI develop a better undertanding of the situation and have discovered alternate solutions during the process that may or may not involve the solution that I have previously suggested.

Bleeding edge isn't always the best (although some technologists believe so) because sometimes the inconvenience toward the user needs to be balanced with what that user is doing.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.