Here are examples of Pointing Out What's Wrong:
- Scanning for vulnerabilities.
- Creating exploits.
- Building tools to find vulnerabilities.
- Telling everyone how bad security is.
- Creating detailed descriptions of how to address vulnerabilities (for someone else to do).
- Creating petitions to ask someone else to fix security.
- "Notifying" vendors to fix their security.
- Proving how easy it is to break into something.
- Issuing reports on the latest attack campaigns.
- Issuing reports on all the breaches that happened last year.
- Issuing reports on the malware you found.
- Issuing reports on how many flaws there are in software you scanned.
- Giving out a free tool that requires time and expertise to use that most orgs don't have.
- Performing "incident response," telling the victim exactly who hacked them and how, and then leaving them with a long "to-do" list.
None of this is actually fixing anything. It's simply pointing out to someone else, who bears the brunt of the responsibility, "Hey, there's something bad there, you really should do something about it. Good luck. Oh yeah, here, I got you a shovel."
Now, if you would like to take actual steps to help make things more secure, here are some examples of what you could do:
- Adopt an organization near you. Put in hours of time to make the fixes for them, on their actual systems, that they don't know how to do. Offer to read all their logs for them, on a daily basis, because they don't have anyone who has the time or expertise for that.
- Fix or rewrite vulnerable software. Offer secure, validated components to replace insecure ones.
- Help an organization migrate off their vulnerable OSes and software.
- Do an inventory of an organization's accounts -- user, system, and privileged accounts -- and lead the project to retire all unneeded accounts. Deal with the crabby sysadmins who don't want to give up their rlogin scripts. Field the calls from unhappy users who don't like the new strong password guidelines. Install and do the training and support on two-factor authentication.
- Invent a secure operating system. Better yet, go work for the maker of an existing OS and help make it more secure out of the box.
- Raise money for budget-less security teams to get that firewall you keep telling them they need. Find and hire a good analyst to run it and monitor it for them.
- Help your local school district move its websites off of WordPress.
- Host and run backups for organizations that don't have any.
And if you're just about to say, "But that takes time and effort, and it's not my problem," then at least stop pretending that you really want to help. Because actually fixing security is hard, tedious, thankless work, and it doesn't get you a speaker slot at a conference, because you probably won't be allowed to talk about it. Yes, I know you don't have time to help those organizations secure themselves. Neither do they. Naming, shaming and blaming are the easy parts of security -- and they're more about self-indulgence than altruism. Go do something that really fixes something.
