<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 8/5/24 04:53, Ralf Senderek wrote:<br>
</div>
<blockquote type="cite"
cite="mid:ea5f728b-bd4d-7556-d163-fc6621cc7ae5@senderek.com">
<pre>I firmly believe that Peter's conclusion [1] is correct:
"COMPLEXITY IS THE ENEMY OF SECURITY"
So we must find practical ways to solve the complexity
problem or at least to tackle it.</pre>
</blockquote>
<p>It seems to me, if I may, that Peter's pdf kind of echos a party
pooping post I think I made here a while back.</p>
<p>Cryptography is kind of over. What has been developed is really
complicated, and deploying it is kinda complicated, but if
deployed carefully, it works really well! The "deployed carefully"
part *is* important: get the cypher mode correct, don't mess up
the initialization vector, don't use default/zero keys, salt your
password hashes, etc. </p>
<p>Yes, tricky, but it can be done. Hire some someones who know
something, give them enough time to do careful work, be worried
enough, but then move on to the hard parts:</p>
<p>1. Know what machines and software you are even running.</p>
<p>2. Don't leave sensitive unencrypted data just sitting on the
internets in a public S3 store. (In the news regularly.)<br>
</p>
<p>3. Don't leave databases of sensitive data just sitting on the
internets without a password. (In the news regularly.)<br>
</p>
<p>4. Don't allow attackers to append to your URLs a ";" followed by
an internal path, and get free access. (In the news a few days
ago.)<br>
</p>
<p>5. Etc.<br>
</p>
<p><br>
</p>
<p>But those things should be *easy*, right?<br>
</p>
<p>No, not if the system is so complex that we can't even do #1.
There are multiple cybersecurity companies out there that seem to
be doing good business just selling services that try to tackle
aspects of #1.</p>
<p>Oh, and once you hire a few (!) companies to help with #1, and
plumb them into your systems…? You have made your too-complex
system, even more complex!</p>
<p>Do companies even know what all other companies they have hired
and given internal access to? Maybe time to start an ESIaaS
(External Service Identification as a Service) company.</p>
<p><br>
</p>
<p>I'm imagining the bold old days of Willie Sutton knocking over
banks and someone needed to explain to banks that it is important
to have a complete roof, walls ALL the way around the building,
doors in all the openings, locks on the doors, and pins in the
hinges. But the banks didn't listen because they already have
"best practices" and they are "idiomatic" in how they follow
"design patterns". Grrrr.<br>
</p>
<p><br>
</p>
<p>-kb, the Kent who does his best to be a party pooper.<br>
</p>
</body>
</html>