With the release of breach data reports, such as the one from Trustwave SpiderLabs that came out recently and the highly anticipated one from Verizon Business, inevitably comes a wave of data dissection and then disbelief. Security pundits moan at the statistics, such as the one this year that 78% of organizations that Trustwave investigated had no firewalls at all. The report itself takes an incredulous tone as it describes the pervasive use of unencrypted legacy protocols (one highlighted case study described a breach involving an X.25 network), insecure utilities such as telnet and rsh, and more.
Security pros who specialize in this sort of thing may be surprised at how big the problem is, particularly among smaller enterprises, but anyone who has actually tried to implement security in these organizations isn't surprised at all. You can tell by the faces in the audience when one of these talks goes on: it's the difference between "ZOMG!" and "Yup, *sigh*."
It's not that these organizations don't care about security. You'd have to know about security first in order to care about it. The next time you go to a sandwich shop or a gas station, ask the manager about the security in the POS system they're using. It should be an interesting, but very brief, exchange.
Should everyone be able to manage their own security? It's very much out of reach for those below the security poverty line; when you think about it, the level of security management needed for technology today reaches the equivalent of having to rebuild and restock grocery shelves on a weekly basis, or requiring an accountant to know construction, electricity and plumbing for the office. Just reading through the Trustwave report, and all the myriad ways that systems are breached, I can't help but imagine the look on a manager's face if I made it into a checklist and handed it out. Who outside of the clannish IT industry knows how to spell ftp, much less knows that it's insecure? Who would know the better options and be able to implement them? Who has the time to examine and reconfigure computers on a regular basis?
What this indicates to me is that our IT infrastructure -- from the networks to mobile -- is inherently, badly insecure. And we're so far down the road in its widespread implementation that it will be decades before the problem is substantially fixed, even assuming we started today with all software developers and manufacturers. Nobody is going to pay to replace what's running just fine today -- until someone loses a figurative eye.
As technology advances, organizations have to deal with an ever-widening range of technology that they have to try to get secured. Yes, there are still X.25, COBOL, VMS, DOS, NT, SunOS, Sybase, and token ring out there. At the same time, iOS and Android are coming into play, along with "the cloud" and Hadoop and NoSQL and everything else that's new. A CIO needs to know about all these; a CISO has to know how to secure them all -- especially when older systems aren't compatible with updated software. The complexity grows year by year, and the inertia of the legacy environment weighs more heavily on it.
And make no mistake: security is disruptive. It's enormously disruptive. Getting the network architected correctly, every version of software patched and every configuration right, especially after the system has been in use for a while, is as disruptive to the business as migrating to a completely new system or platform. Ask anyone who has tried to manage a security initiative in an enterprise. Even assuming the enterprise wants to do it, it's a major undertaking. All this shows how badly security is designed today; you shouldn't have to keep reconfiguring your systems on a weekly or monthly basis in-flight just to keep the security entropy at bay.
It's an intractable problem, and frankly, it's one that the enterprise shouldn't have to solve. People are trying to work with the equivalent of a pencil, and it's not their fault that their pencils are fragile, complicated, and prone to exploding at inopportune moments. They shouldn't have to know or care why the pencil isn't working; they want a new one without any delay, and without hearing long stories about how the graphite in this type of pencil isn't backwards-compatible with all the erasers in the firm.
So when we read about how bad security is getting, we shouldn't be pointing the finger at the compromised enterprises. We should be pointing it at their IT providers, who really ought to know better; but more fundamentally, we should be pointing it at ourselves. We should stop demanding that the user be responsible for security; those of us who are building this stuff to begin with should fix it ourselves, and build it in to all future technology. Today security is an afterthought, and a bad one at that. As long as it remains separate from the systems it's supposed to protect, instead of being simply an attribute, and as long as it requires users to maintain an abnormal height of awareness as they go about their daily jobs, security is going to continue to be as bad as it is today.
