Tag Archives: hacking

The Product Versus Skill Pendulum In Security And The Need For Better Solutions

This post was originally published on Forbes

Security used to be easy–a fairly binary condition over whether you are protected or not, whether you are patched or not, or whether the port is accessible to outside IP addresses or not.

And then came complexity: Overlaying different aspects of vulnerabilities. Factoring in application issues, platform bugs, OS patches, network configurations and user access controls has shifted the rather binary situation to an exponential one. As such, we, as security practitioners, learned to use more skills in terms of threat modeling, secure development, honeypots and honeytokens for earlier detections, data-centric decision-making and increased focus on education and training.

We’ve reached a point where products matter less and less. Remember when the first action when getting a new PC was to install an AV on it and try to beat the clock before it got exploited? Now, PCs are pretty much secure out of the box thanks to the native malware detection and mitigation tools that are part of the operating system.

However, when looking at the security industry, we still see a lot of relics of the old-school way of operating. I’m not looking to explore who’s to blame (VCs? Startups? Consumers? Analysts? Your bet is as good as mine), but a lot of security vendors still treat the world in a binary fashion. If you look at marketing claims, for instance, it’s either you have their product, or you are not secure.

This brings me to my main point: A lot of security organizations are already through the pendulum shift. They are much more data- and customer-focused and are prioritizing their risk decisions around this rather than around the binary checklist of products. If that’s the case, where does that leave most industry vendors, especially with products that are not designed around the customer’s actual needs?

As an example, our security organization at Cimpress has been pretty adamant about practicing this customer-focused approach. We make it clear what our needs are and the features/capabilities we’d like to have based on our threat models and current capabilities. However, this leads to several problems.

First, a lot of vendors don’t know how to address that. They have a list of features and their marketing pitch, and that’s it. We’re looking for specific answers–possibly answers that include road map milestones–and are not expecting a single product to address all of our needs. Vendors, on the other hand, find it difficult to adjust their sales process (and pricing) to address customers’ specific needs, leaving frustrated after being told that we’re not using 80% of the product capabilities but would love to pay for the 20% we actually need.

Second, there seems to be a lack of vendors who truly adopt the approach of identifying needs on the customer side and are still adopting the approach of finding novel technical problems and solutions to address them. So, we’re left with niche products that don’t address actual needs but get snazzy marketing backing. We end up pushing the pendulum further into the skills territory, forcing security teams to rely on their own skills and in-house tooling.

To top it off, this increased reliance on skill is deepening the skills gap we already have in the industry. We have an education process that focuses on specific areas of the security field and training and education programs that are often product-focused. Meanwhile, generalists are becoming more rare and expensive as demand for less product-centric and more data/process-centric expertise increases.

What to do? Simple: Enjoy the sound of silence for a moment, especially as a vendor. Don’t incessantly ask what a potential customer’s current challenges are while trying to calculate what part of the answer you can anchor on to and sell your product through. We need to “shift left” that question from sales back to product design and even company inception. We need more smart people listening to what customers say about their needs and, rather than identifying where existing solutions can address them, trying to identify where there are partial or no solutions.

I’ve been fortunate to work with a few VCs and startups that do just that and have the foresight to validate these needs and keep driving their solution to address them or pivot their product so that it truly addresses the core issues.

On the other hand, I get frustrated with vendors who succumb to trying to latch on to a minor detail and blow it out of proportion or, worse, resort to speaking ill of their competition. Statements like, “We see a lot of customers of vendor X come to us after two years, and now, with our product, they are happy,” should be banned from sales discussions and replaced with, “Vendor X? Yes! I hear that their product is really good and addresses a certain set of problems really well. I’d love to know what your threat model and priorities are to better understand whether it is X you should go with or maybe find a different set of solutions.”

And as much as innovative products sometimes need to educate the market (I’ve been there and am actively working with companies like that as well), most times, the reverse is what’s needed: truly understanding what the industry needs right now and providing true minimal viable products (MVPs) that solve these often basic problems. There’s money in solving seemingly simple issues, especially if they have been around for a long time and are considered “the norm” or something that people need to just accept as suboptimal.

An obituary to pentesting?

I just saw a blog post in which Mike Kemp discovers the realities of 2010 (linkedin). (disclaimer – I know Mike and love him as a person, and this is my way of poking at him a bit – no disrespect here, but pretty much the opposite)

Now, go read that post (yes, I know, it’s long, but trust me).
This isn’t new (albeit very honest, direct and true),but here are a couple of comments I have:

  1. Penetration Testing is dead. Overrated, and abused by fancy vulnerability scanning, it died a few years ago. If you are still paying for one – check carefully what you are actually getting…
  2. Automation is king. I actually argue that 80% of what’s sold as a pentest by the major providers can/should be automated. All those scanner monkeys should be fired or forced to step up their game and actually do some work.
  3. Compliance? Really? Do you really want to go there? It’s got nothing to do with security, and if you thought so for a second I want to have what you were on when you did.
  4. Standards. This is where Mike touches on a sensitive topic for me (yes, PTES…). I’d actually challenge Mike to show me how PTES (which he mentions in the post – but you already know that because you read it, right?!) restricts providers by providing the engagement steps – which they should follow. There’s no restriction to scope, and I have personally used PTES in red team engagements. Full scope, no bars held. But still with a standard to follow, and something the client can also keep track of and know what to expect (and demand).
  5. I fully agree on the “pass the wealth” point where you should call in someone else who’s an expert to deal with a specific client request. Done that many times, and have never lost a customer that way.

Last but not least – yes, I do think that most pentesters can be replaced with a script. As they should. I do however have a solid advice to Mike and others who are still valuable professionals that have skills which are not replaceable by automation: demand a proper engagement model. And yes – I’m referring to the PTES again. You’d notice that threat modeling is part of it. Done properly threat modeling achieves multiple goals:

  • Forces the discussion to be around security rather than compliance, price or other factors that have nothing to do with security.
  • Scope goes out the window as threat models focus on the BUSINESS and not the TECHNOLOGY.
  • Enables the organization to test itself against its adversaries (threat actors/communities) rather than against pentesters. Much more rewarding, and correct.
  • Enables the provider (if it can muster to perform a decent threat model with the client) to charge decent rates for its services. You can clearly show how this isn’t some automated software running and spitting out reports, but skills and experience playing. It’s then your responsibility to follow through on it and make sure the final deliverable also looks like that (otherwise you are looking at a very short success rate for trying to adopt only part of this approach).

I actually welcome the hordes of scanner monkeys and tool-jockeys. They make the real professionals look even better. And although professionals don’t often have the marketing/sales power of the big-[number], trust me – they are busy, and doing work that the “big” and “trusted” suppliers can’t even start to put on their canned proposal templates.

Yes, you knew exactly what you were walking into…

I’m writing this in response to a very well put together article written by my friend Dave Lewis on CSO Online: “Are you a legitimate military target?“.
In the article Dave talks about how security researchers, practitioners, and security vendors are suddenly “surprised” to find themselves potentially being under the scrutiny of foreign (and guess what – domestic) governments and militaries.

Dave quotes Mikko Hypponen, F-Secure’s Chief Research officer who keynoted the FIRST conference last week in Berlin, saying “I didn’t sign up for this”.
Well, sorry to take the other side – but you did. We all did. Even those of us who have been in the industry for almost 20 years. We grew up on movies like “War Games“, on the stories such as Cliff Stoll’s “The Cuckoo’s Egg“, and those of us who were pushing the boundaries and practicing security research, also knew that we were playing fast and loose with the law a lot of times (successfully for those of us with a clear record).
Well ,guess what, just like a nuclear physicist becomes a target (legitimate or not) for a foreign nation because they are associated with another nation’s nuclear program, so are we.

Any new piece of information that may allow an advantage in the greater scheme of things is highly sought after by nation states, and if you are not aware of it, well, good luck to you.

I join Dave’s closing comment on the difference between espionage and warfare. We all need to understand though that there are governments and their intelligence services behind both of these. So yes, we all knew very well what we were walking into when we found our first 0-day, vulnerability, or realized that we can bypass controls, processes, hardware, software or whatever it is we hack our way through. This kind of knowledge and skill is a far cry from a new crocheting technique.

p.s. I’ve mentioned the law here, and if you know me you know that one of my advice to any fellow practitioner is usually “get a lawyer”. This isn’t just for fun – law is just as hackable as cheap knockoff Chinese firmware, or a shady Israeli device driver. I highly encourage everyone to at least study your local legislation in relation to computer “stuff”, as well as dabble a bit in the international aspects of it.

Post RSA musings

So it finally happened – I’ve had my first RSA in 9 years.

And what an experience. Suffice to say that I ended that week with no voice, a bad back, and minimally functioning knees, but given the premise of the show I’d peg is as a huge success.

First – having BSides to catch up with friends and colleagues was a perfect beginning to the week (not to mention the weekend in Napa right before – thanks for having me, Tenable!). There still is a huge value that I see in BSides, and BSidesSF specifically. Albeit the great venue (thanks OpenDNS), some more hallway-con was sorely missed. Be it the way the venue is laid out (preventing from more active/vocal discussions from happening other than outside), or the decision to run a dry venue (not even bring your own alcohol), I’d want to see how peer-engagement gets more focus there.

Second – the ability to “hack” RSA from a technical person’s perspective, and yes, I still consider myself somewhat technical, regardless of my ability to don on a suite and behave like a business guy. Which is sort of what hacking RSA is… It was intriguing having interactions with people outside of the echo-chamber (aka infosec) who deal with security and having them take a preconceived notion of me as a sales person. Or with those who gravitated to me as “I needed to talk to someone who is technical” – probably after snooping around a bit and choosing their approach based on existing conversations 😉

Last (and I saved the downer for here) – the show floor. After getting over the sheer size of the convention (no worries – BlackHat has a way to go until it becomes an RSA), I had my expectations adjusted a bit. Walking through the halls, you get into a realization that a lot of the companies showing there (especially the south hall) should probably have no reason to exist. The same regurgitation of “threat intelligence”, “endpoint protection” (i.e. APT, 0day, etc…), and your usual “trust me, I’m an engineer” approaches, were becoming comical to a point where I’d need to keep my gaze pointed far away and ignore the noise while walking around. I truly expected to see some new innovative approaches to security, and companies who would break out of the circle-jerk of security vendors. Unfortunately I didn’t see many, the reason for which I can’t really put my finger on (maybe the cost of entry to RSA?).

Overall, a great experience (and yes – lots of new business too), so yes, I believe my #notatrsa streak has come to an end. Or maybe I’m just getting old 😉

2015-04-21 15.57.44

Yes – you can engage with other evangelists at RSA! (and what seemed like a weird obsession – collect truckloads of branded t-shirts and vendor giveaways).

May the force? May in full force…

Lack of updates here usually means that time constraints are in effect… But apparently all that work is paying off as some of the research we have been working on is starting to get front-and-center stage.
May marks a busy month where I’ll be bouncing around a few places (São Paulo, North Carolina, and locally here in NYC) to talk about it.
Stay tuned for details 😉