Former NSA Honcho Calls Corporate IT Security "Appalling" 174
Nerval's Lobster writes "Former NSA technology boss Prescott Winter has a word for the kind of security he sees even at large, technologically sophisticated companies: Appalling. Companies large enough to afford good security remain vulnerable to hackers, malware and criminals because they tend to throw technological solutions at potential areas of risk rather than focusing on specific and immediate threats, Winter said during his keynote speech Oct. 1 at the Splunk Worldwide User's Conference in Las Vegas. 'As we look at the situation in the security arena we see an awful lot of big companies – Fortune 100-level companies – with, to be perfectly candid, appalling security. They have fundamentally no idea what they're doing,' Winter said, according to a story in U.K. tech-news site Computing. During almost 28 years at the National Security Agency (NSA), Winter established the spy agency's Technology Directorate and served as the agency's first CTO. He also held positions as the NSA's CIO, its deputy chief of Defensive Information Operations and, oddly, as chief of Customer Response. He is currently managing director of Chertoff Group, the strategic management and security consultancy established by Michael Chertoff, secretary of the Dept. of Homeland Security under Pres. George W. Bush and co-author of the USA Patriot Act."
Most offices have normal plate-glass windows, too! (Score:4, Interesting)
All it takes to break in is a hammer and 10 seconds.
Sure, they could put in bullet-proof glass and high-security doors. But those measures are prohibitively expensive for most businesses, and still aren't foolproof.
The same is true with computer security. There are basic precautions businesses should take, like putting all their equipment behind firewalls, for example. That's the equivalent of locking the front door. But security costs money, and makes life more difficult for those with legitimate access. These considerations must be balanced.
Re:No Shit, Sherlock (Score:5, Interesting)
Given that half of Slashdot works in corporate IT I'm sure we're all shocked by this announcement.
Yeah, and we all know who to blame. (looks ominously upward) The irony here is that corporate IT is even more into surveillance and CYA than the former NSA guy is. I mean, the NSA has rules and shit to follow. Management at a company these days is like to be all "Yo, we do whatever we want. You dun like it? Dere's da fuckin' door." (sorry, Jersey accents are really hard to do on slashdot forum posts)
As an experiment I once sent an e-mail out from my last employer containing about 5KB of randomly generated gibberish to an e-mail address setup that had never been used before on a server that didn't have an SMTP server prior to the test balloon. Over the next three days, this previously unused and unloved honeypot got dozens of pings from the corporate network from people trying to login to the SSH, poke at the SMTP server, looking for web services. I sent it from a gmail account specially setup ahead of time, then logged in over a supposedly secure 'ssl' connection.
Similar has happened at 7 out of 10 employers I've worked for. They don't just monitor all your stuff...they actively go out and fuck with it. And the only reason this isn't a problem is because they're so terrifyingly bad at it.
With Windows Backdoored, What's the Point? (Score:5, Interesting)
There's no real cost for coporate security failure (Score:4, Interesting)
Four letters say it all: EULA. You can sell software that bricks a piece of hardware, and the worst you'll have to do is refund the purchase price. Most of the time, all you have to do is issue a credit, so the customer/sucker gives you more money.
Someone breaks into a server farm and steals credit card info and passwords that are stored in a non-encrypted format? Just send out a warning. It's not like you can get sued or anything.
Big defense contractors are leaking classified information like a sieve. It's so bad that the US President had to whine to the Chinese President about cyber spying industrial espionage. Has any defense contractor lost a contract or been fined for these screw ups? Of course not.
Heck, there were images this week from an exposition of Chinese built unmanned aircraft in Beijing, and they had a Predator drone! Not just a look alike, it had the same mounting for the optical sensor pod on the bulging nose, chines, V-tail, etc. It would be completely unsurprised if they stole the plans. Apparently they have the plans for all our major weapons systems. It save then vast effort in R&D, and they can build counter measures that they know will work. If there were any fines or actions against any corporations it was not reported anywhere.
So given that there's no down side to committing corporate software fraud, why is anyone surprised that security is a complete joke.
Re:I can confirm this (Score:5, Interesting)
Re:I can confirm this (Score:5, Interesting)
1) Poor middle management. Many of them are either IT people with poor management skills, or good general managers with no IT skills.
2) Failing talent management. Failure to attract top people, no coaching, poor training, lack of talent recognition (I don't just mean good pay, I mean knowing who your best people are and allocating that talent accordingly), and lack of a decent technical career ladder.
The biggest challenge in IT is not technology, and it hasn't been that in ages. It's management, or rather: figuring out how to do IT well, how to organize it.
Re:I can confirm this (Score:5, Interesting)
In my experience, it's much more rare to find a company that knows about security than to find one that doesn't.
They are actually pretty easy to find.
If they have more than about 500 employees, check if they have an official IT security position. Might be some guy doing other stuff in addition, but he's got to be the official IT security guy.
If they have more than about 1000 employees, check if they have an IT security department with at least one full-time employee.
If they have more than 2000 employees, check if they have a CSO or CISO.
If they have, you just need to verify that it's not an alibi position to satisfy some compliance rules. If they don't have, you already know they got no clue.
Business can always be estimated by checking if they commit to a regular expense on a topic. Occasional security checks mean nothing, they're usually done when someone needs to cover their asses. A permanent financial commitment is the only thing that means something in a business context.