Perimeter
1/25/2013
10:17 AM
Gunnar Peterson
Gunnar Peterson
Commentary
50%
50%

The Three Worst Words In The English Language: Can't We Just?

The road to poor identity and access management architecture is paved with "can't we justs." It's 2013: Find a way

When learning something new, especially a technical something, it's great to hear the words "for example" because you're about to see something more concrete that helps the abstract make more sense.

Conversely, when doing design and development work, it's awful to hear the words "can't we just" because you're about to hear a defense of kicking the can down the road -- more status quo.

"Can't we just" is used to justify all manner of things:

"Can't we just replicate the passwords?"

"Can't we just leave passwords cleartext?"

"Can't we just use one way SSL to solve everything?"

"Can't we just use the same system we have for the last 15 years for our new Cloud?"

"Can't we just use the same system we have for the last 15 years for our new Mobile apps?"

"Can't we just hardcode XYZ?"

What people are really saying when they say "can't we just" is, "Can't we assume tomorrow will look like today?" This may work in some areas of IT (although I am doubtful), but it's flat-out hazardous in security.

The prefix for the majority of suboptimal designs is "can't we just." When you hear that phrase, brace yourself. I am all for being practical, but systems age more like milk than wine. They do not necessarily get better with age, software evolves, and, more importantly, so do attacker's capabilities. To illustrate this latter point, consider Dave Aitel's prediction for 2012 that mobile platforms would fail:

You know what didn't pan out? "Mobile attacks" in commercial attack frameworks. The reasons are a bit non-obvious, but deep down, writing Android exploits is fairly hard. Not because the exploit itself is hard, but because testing your exploit on every phone is a nightmare. There's literally thousands of them, and they're all slightly different. So even if you know your exploit is solid as a rock, it's hard to say that you tested it on whatever strange phone your customer happens to have around.

And of course, iOS is its own hard nut to crack. It's a moving monolithic target, and Apple is highly incentivized by pirates to keep it secure. So if you have something that works in a commercial package, Apple will patch it the next day, and all your hard work is mostly wasted.

Now there are some good reasons why this did not happen; in my view, the fragmentation in mobile is a real issue for developers, testers, and attackers. But it's not a long-term advantage -- it's a delay of game, a speed bump. The point I would like to make here is that you could read those comments as, "Well, it's too hard for attackers. Can't we just live with the same mobile security model in 2013? After all, it was good enough in 2012."

But guess what? It's not a static environment. Attackers don't remain in some little, limited snow-globe world: They learn, and tools get better. What was good enough last year is not good enough this year.

Instead of can't we just kick the can down the road, we should find a way to make improvements in our security architecture.

Gunnar Peterson is a Managing Principal at Arctec Group

Gunnar Peterson (@oneraindrop) works on AppSec - Cloud, Mobile and Identity. He maintains a blog at http://1raindrop.typepad.com. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
gbaggett750
50%
50%
gbaggett750,
User Rank: Apprentice
1/30/2013 | 3:34:37 PM
re: The Three Worst Words In The English Language: Can't We Just?
Can't we just....-á Doesn't always imply kicking the can down the road.-á It is also a cry for help and also may lead to a possible solution so DO NOT just dismiss anything that is said after these three words.-á To do so outright is showing ARROGANCE toward ... (possibly your user).-á-á

Listen to what they have to say and then explain to them why it may not work withing the confines of the subject.-á If you cannot do that then maybe you do not understand well enough yourself to be dismissing his solution outright.-á-á

I have noticed that sometimes in the process of explaining something that-áI develop a better undertanding of the situation and have discovered alternate solutions during the process that may or may not involve the solution that I have previously suggested.

Bleeding edge isn't always the best (although some technologists believe so) because sometimes the inconvenience toward the user needs to be balanced with what that user is doing.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4467
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during the rendering of FRAME elements, which allows remote attackers to spoof the UI via a crafted web site.

CVE-2014-4476
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4477
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4479
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4480
Published: 2015-01-30
Directory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.