Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/25/2013
10:17 AM
Gunnar Peterson
Gunnar Peterson
Commentary
50%
50%

The Three Worst Words In The English Language: Can't We Just?

The road to poor identity and access management architecture is paved with "can't we justs." It's 2013: Find a way

When learning something new, especially a technical something, it's great to hear the words "for example" because you're about to see something more concrete that helps the abstract make more sense.

Conversely, when doing design and development work, it's awful to hear the words "can't we just" because you're about to hear a defense of kicking the can down the road -- more status quo.

"Can't we just" is used to justify all manner of things:

"Can't we just replicate the passwords?"

"Can't we just leave passwords cleartext?"

"Can't we just use one way SSL to solve everything?"

"Can't we just use the same system we have for the last 15 years for our new Cloud?"

"Can't we just use the same system we have for the last 15 years for our new Mobile apps?"

"Can't we just hardcode XYZ?"

What people are really saying when they say "can't we just" is, "Can't we assume tomorrow will look like today?" This may work in some areas of IT (although I am doubtful), but it's flat-out hazardous in security.

The prefix for the majority of suboptimal designs is "can't we just." When you hear that phrase, brace yourself. I am all for being practical, but systems age more like milk than wine. They do not necessarily get better with age, software evolves, and, more importantly, so do attacker's capabilities. To illustrate this latter point, consider Dave Aitel's prediction for 2012 that mobile platforms would fail:

You know what didn't pan out? "Mobile attacks" in commercial attack frameworks. The reasons are a bit non-obvious, but deep down, writing Android exploits is fairly hard. Not because the exploit itself is hard, but because testing your exploit on every phone is a nightmare. There's literally thousands of them, and they're all slightly different. So even if you know your exploit is solid as a rock, it's hard to say that you tested it on whatever strange phone your customer happens to have around.

And of course, iOS is its own hard nut to crack. It's a moving monolithic target, and Apple is highly incentivized by pirates to keep it secure. So if you have something that works in a commercial package, Apple will patch it the next day, and all your hard work is mostly wasted.

Now there are some good reasons why this did not happen; in my view, the fragmentation in mobile is a real issue for developers, testers, and attackers. But it's not a long-term advantage -- it's a delay of game, a speed bump. The point I would like to make here is that you could read those comments as, "Well, it's too hard for attackers. Can't we just live with the same mobile security model in 2013? After all, it was good enough in 2012."

But guess what? It's not a static environment. Attackers don't remain in some little, limited snow-globe world: They learn, and tools get better. What was good enough last year is not good enough this year.

Instead of can't we just kick the can down the road, we should find a way to make improvements in our security architecture.

Gunnar Peterson is a Managing Principal at Arctec Group

Gunnar Peterson (@oneraindrop) works on AppSec - Cloud, Mobile and Identity. He maintains a blog at http://1raindrop.typepad.com. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
gbaggett750
50%
50%
gbaggett750,
User Rank: Apprentice
1/30/2013 | 3:34:37 PM
re: The Three Worst Words In The English Language: Can't We Just?
Can't we just....- Doesn't always imply kicking the can down the road.- It is also a cry for help and also may lead to a possible solution so DO NOT just dismiss anything that is said after these three words.- To do so outright is showing ARROGANCE toward ... (possibly your user).--

Listen to what they have to say and then explain to them why it may not work withing the confines of the subject.- If you cannot do that then maybe you do not understand well enough yourself to be dismissing his solution outright.--

I have noticed that sometimes in the process of explaining something that-I develop a better undertanding of the situation and have discovered alternate solutions during the process that may or may not involve the solution that I have previously suggested.

Bleeding edge isn't always the best (although some technologists believe so) because sometimes the inconvenience toward the user needs to be balanced with what that user is doing.
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
How to Think Like a Hacker
Dr. Giovanni Vigna, Chief Technology Officer at Lastline,  10/10/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17672
PUBLISHED: 2019-10-17
WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.
CVE-2019-17673
PUBLISHED: 2019-10-17
WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.
CVE-2019-17674
PUBLISHED: 2019-10-17
WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.
CVE-2019-17675
PUBLISHED: 2019-10-17
WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
CVE-2019-17676
PUBLISHED: 2019-10-17
app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI.